Founded in 1967 THE UNION FOR IT-PROFESSIONALS FREE FOR STUDENTS IT COMMUNITY EMPLOYMENT CONTRACT SUPPORT LEGAL ADVICE NETWORK FOR IT PROFESSIONALS COURSES AND PROFESSIONAL DEVELOPMENT YOUR VOICE IN THE IT INDUSTRY SUPPORT WHEN YOU NEED IT

Terms and conditions

Privacy policy

1. Background

In connection with our work at PROSA (hereinafter "PROSA," "we," "us"), we process a range of personal data about you. Personal data refers to information that identifies or can identify physical individuals.

Our data protection policy concerns our processing of personal data when we act as data controllers, including the handling of our members' memberships, labor law cases, and our marketing activities.

Below, we describe our collection and processing of personal data. The privacy policy is intended to help you understand what personal data we collect, why we collect it, the types of collections we undertake, what we use the information for, and how long we retain it. The privacy policy also contains a range of other information. For instance, you can read about your rights when we process personal data about you and the options you have to complain about our processing; see more under Rights.

1.1 Data controller

PROSA is the data controller for the processing of the personal data we have received. You are welcome to contact us if you have any questions or comments regarding our privacy policy.

PROSA, The Union of IT Professionals
Vester Farimagsgade 37A
1606 Copenhagen V

CVR No.: 39628228

Email: gdpr@prosa.dk

Phone: 33364141

1.2 Data protection officer

You are welcome to contact our Data Protection Officer (DPO), ComplyCloud, if you have any questions about how PROSA processes your personal data.

ComplyCloud ApS
Attn: Martin Folke Vasehus
Borgergade 24B, 3rd floor
1300 Copenhagen K

Email: dpo@complycloud.com, attn: PROSA's DPO

2. Roles

As a data subject (i.e., a person about whom we process data), you may have one or more roles within PROSA. They are described below.

2.1 Members

2.1.1 Types of personal data processed

We may process the following types of personal data about you when you are a member:

  • Name

  • CPR number

  • Email

  • Address

  • Phone number

  • Membership date

  • Membership type

  • Payment information

  • Local branch

  • Membership history

  • Employment status (unemployed, employed, self-employed, retired, or student)

  • Job title

  • Place of employment

  • Salary information when participating in PROSA's salary statistics

  • Education

2.1.2 Where do we obtain your data from

We obtain the information from you.

The local branch is assigned based on your place of employment.

2.1.3 Purpose of processing

We collect and process personal data for the following purposes:

  1. Creation of your membership. The following general personal data is processed for this purpose: Name, email, address, phone number, membership date, membership type.

  2. Ongoing administration of your membership. The following general personal data is processed for this purpose: Local branch, membership history, and payment information.

  3. PROSA's salary statistics and the PROSA panel. The following information is processed: salary information, contact information, responses, employment information.

  4. Contacting members with the aim of ensuring that PROSA can provide the best possible services, retaining members, informing them about PROSA's membership services and benefits, as well as providing information about membership changes.

2.1.4 Legal basis for processing

2.1.4.1 Creation of your membership

Our basis for processing your general personal data for this purpose is our agreement with you to become a member¹. In relation to sensitive personal data, it is processed based on our legitimate activity as an association².

2.1.4.2 Ongoing administration of your membership

Primarily, our basis for processing your general personal data is our legitimate interest in managing our members³. Regarding your membership in PROSA, our basis for processing your data is our agreement with you that you wish to become a member of PROSA⁴.

2.1.4.3 Contacting members after resignation to ensure PROSA can deliver the best possible services and support in the future

Our basis for processing these general personal data is our legitimate interest in improving our services and support, i.e., following up on the reasons for resigning from PROSA and ensuring that PROSA's members are satisfied with us as an association going forward⁵.

2.1.4.4 Survey submission of PROSA's salary statistics

Our legal basis for processing these ordinary personal data is our legitimate interest in assisting PROSA's members in their employment relationships.

2.1.4.5 Panel submission to the PROSA Panel

Our legal basis for processing these ordinary personal data is the member's consent to share their responses with PROSA.

2.1.5 Storage, transfer, and deletion of your personal data

We disclose personal data to SKAT to ensure you receive tax deductions for your membership fee⁶.

Additionally, we disclose personal data to Nets in connection with the creation of payment service agreements.

We may also disclose personal data to external partners if you provide separate consent for this⁷.

Disclosure of personal data to Min A-kasse occurs to manage your membership, including reporting to SKAT for tax deductions on your membership fee, based on your separate consent.

We retain your personal data as long as you are a member of PROSA. Data is generally deleted 13 months after resignation. However, we retain your payment information for 5 years from the time of payment due to accounting laws⁸.

2.2 Individuals using our legal advice services

2.2.1 Types of personal data processed

We process the following types of personal data:

  • Basic data for members (see 2.1 Members)

  • Health information and details about other social and private circumstances.

2.2.2 Where we obtain your data from

We obtain the information from you and from the organizations you have authorized us to collect information from.

2.2.3 Purpose of processing

We collect and process personal data for the purpose of providing legal advice.

We only record, store, and process information about you to offer advice and manage your case. The information is not used for any other purposes and is not shared with anyone other than external partners, and only when necessary to provide advice and manage your case. Disclosure of information only occurs with your consent.

2.2.4 Legal basis for processing

Our basis for collecting and processing your general and sensitive personal data (contact information and health information) is the agreement you enter when you use our legal advisory services⁹.

To the extent that it is necessary to disclose your general and sensitive data to external partners as part of our advisory services, such disclosure will only occur based on this agreement¹⁰.

External partners include lawyers, PROSA's psychological counseling scheme with Joblife A/S, and the Employment Guarantee Fund for bankruptcy cases.

2.2.5 Storage, transfer, and deletion of your personal data

We process your data for five years from the conclusion of your case, after which it will be deleted. The data is kept as long as it is necessary to protect PROSA's legitimate interests¹¹.

For occupational injury cases, we retain your data for 10 years, after which it will be deleted¹².

2.3 Main board and committee members

2.3.1 What personal data is processed

When you are a member of PROSA's main board, a local branch member, or a committee member in PROSA, we may collect the following categories of personal data about you:

  • Name

  • Address

  • Email

  • Telephone number

  • CPR number

  • Bank account information

  • Place of employment

  • Employment status (unemployed, employed, retired, self-employed, or student)

  • Photos, as well as video and audio recordings

  • Type of board position (e.g., chairperson, employee representative)

  • Date of joining the board

  • Date of leaving the board or local branch, and any reason for departure

  • Meeting minutes, board reports, annual reports, general meeting minutes, delegate meeting minutes, etc.

  • Certain other information that is necessary and permitted according to applicable law. For example, this may include documents required by national legislation.

  • Information you otherwise choose to provide to us

2.3.2 Where we obtain your data from

The information we process about you is obtained from you, the board, the local branch, or one of PROSA's committees.

2.3.3 Purpose of the processing

We collect and process your personal data for the following purposes:

  1. To register you as a main board, local branch, or committee member.

  2. To provide secretariat support for the main board, local branches, and committees, as well as to fulfill various reporting or disclosure obligations related to the operation of PROSA.

  3. To prepare minutes of board, local branch, and committee meetings, as well as general meeting minutes, annual reports, and board reports.

  4. To protect PROSA (operations, security, recovery, and documentation).

  5. We may process and publish photos, videos, and audio recordings of you, for example, to introduce main board, local branch, and committee members at the delegate assembly and in other contexts.

  6. For archival purposes to document the history of the board's or local branch's work.

2.3.4 Legal basis for the processing

Our basis for processing depends on the type of information processed and the purpose.

2.3.4.1 Registration as a main board, local branch, or committee member

We process your standard personal data based on an agreement with you regarding your participation in the main board, local branch, or a PROSA committee.¹³

We process and share identification information with banks to fulfill obligations under anti-money laundering laws¹⁴.

2.3.4.2 Secretarial support for the main board and committees, and fulfillment of reporting or disclosure obligations related to PROSA preperations

We process your standard personal data based on our legitimate interest in organizing a main board, local branch, or committee¹⁵.

Processing your data for travel reimbursement is based on tax law requirements¹⁶.

For other reimbursements, we process your data to comply with accounting regulations.¹⁷

2.3.4.3 Preparation of minutes

We prepare minutes of board and committee meetings, delegate assemblies, general meetings, annual reports, and board reports based on PROSA's bylaws¹⁸.

2.3.4.4 Protection of PROSA (operations, security, recovery, and documentation)

We process your standard personal data based on our legitimate interest in ensuring adequate security for the organization's history.¹⁹

2.3.4.5 We may process and publish photos, videos, and audio recordings of you, for example, in connection with presenting board and committee members

If we take a photo or video of you related to your role in PROSA, for instance, at the delegate assembly, the nature and purpose of the image determine the legal basis for processing. We will always consider how you are portrayed and the context in which the image is used. If the purpose of the image aligns with our statutory objectives, we process the image based on our legitimate interest in promoting PROSA's policies and messages.²⁰

However, if the image is used for a different purpose or focuses on one or more specific individuals, we will obtain your consent to use the image.²¹

In some cases, we may share photos or video material of you with others, such as the media. If the purpose of sharing aligns with our statutory objectives of promoting PROSA's policies, we do so based on our legitimate interest in disseminating PROSA's messages.²² If the purpose of sharing differs or our legal basis is contractual, we will establish this basis prior to sharing (GDPR Article 9(2)(d) and Article 6(1)(b)).²³

2.3.4.6 Archival purposes to document the history of the board's work

We store minutes, annual reports, etc., based on our legitimate interest in documenting our history.²⁴

2.3.5 Storage, transfer, and deletion of your personal data

We may share your information to the extent necessary for the administration of your work on the board, local branches, or committees in PROSA.

We provide identification information to auditing firms for the purpose of signing the annual financial statement. Additionally, PROSA may share your information for registration in the Central Business Register, where necessary.

We store and process your personal data for as long as you are a member of the main board, local branches, or committees in PROSA.

When you leave the main board, local branch, or a committee, we retain the information collected during your board or committee term for up to 13 months after your departure, to support the operation of the secretariat serving the main board and committees.

Information about you that appears in meeting minutes, general meeting minutes, annual reports, board reports, as well as the date of joining and leaving the board and any reason for leaving, will then be stored for archival purposes.

2.4 Job applicants

2.4.1 What personal data is processed

When you apply for a position at PROSA, we may process the following personal data about you.

We may process the information that you attach to your email or upload via JobIndex's Quickapply service, to which you have given separate consent:

  • Your CV and motivation letter

  • First and last name

  • Physical address

  • (Mobile) phone number

  • Email address

  • Nationality

  • Educational background

  • Degree certificate

  • Previous employment and current position

  • Video (presentation video)

  • Your preferences regarding geography and field of expertise, if you are an unsolicited job applicant

  • Any other information you choose to provide us with

  • A child protection certificate, if relevant

Additionally, we may process the following personal data about you:

  • Publicly available information: We may search for publicly available information, such as from social media, through public searches.

  • References: We may obtain references from previous employers or other relevant third parties. References are obtained with your consent if you are the candidate we proceed with for the position. Our reference collection will typically include the following information:

    • Your name, including information that you have applied for a position at PROSA

    • The position you applied for and the reference's perspective on your suitability for that role

    • The position you held with the previous employer and how you performed in it

    • Your relationship with colleagues/employees

    • Other details the reference person finds important in this context

2.4.2 Where we obtain your data from

Generally, we receive your personal data directly from you. If we use external recruitment consultants during the recruitment process, we may receive personal data about you from an external recruitment consultant. With your agreement, we may also obtain information about you from previous employers or other relevant third parties as part of reference collection.

2.4.3 Purpose of the processing

We process your information for the following purposes:

  1. To find the most suitable candidate for a position at PROSA.

  2. To ensure we have the relevant information to respond to inquiries from job applicants seeking feedback on their applications.

  3. To document the recruitment process in case of objections from applicants who have been declined.

2.4.4 Legal basis for processing

Legal basis for processing under Purpose 1:

  • We collect and process your general personal data based on your request to be considered for a position at PROSA and our legitimate interest in filling a position with the best-suited candidate.²⁵

  • We collect and process general personal data you have published on social media based on our legitimate interest in understanding you as a candidate²⁶ or, in the case of sensitive personal data, based on your publication of it.²⁷

  • We obtain references from your former employers or other relevant third parties with your consent, based on our legitimate interest in selecting the right candidate, including disclosing that you have applied for a position with us to relevant third parties.²⁸

Legal basis for processing under Purpose 2:

  • We retain your personal data after the recruitment process based on our legitimate interest in having relevant information to respond to any request from you for feedback on your application.²⁹

Legal basis for processing under Purpose 3:

  • We retain your personal data after the recruitment process based on our legitimate interest³⁰ in documenting the recruitment process in case of objections from applicants who were declined.

2.4.5 Storage, transfer, and deletion of your personal data

If you apply for an advertised vacancy at PROSA, we will retain your application, CV, and any other information you provided for up to 3 months after the position has been filled.

If you are hired, your application and any additional information provided will be retained for up to 13 months after your employment ends. Upon receiving an employment offer, you will receive information on how we handle your personal data in PROSA's employee privacy policy.

2.5 Individuals covered by PROSA's collective agreements in the public sector

2.5.1 Types of personal data processed

If you are covered by PROSA's agreements in the public sector, we may process the following types of personal data about you:

  • Contracts

  • Salary information

  • Union representative advisory cases

  • Warnings

  • Significant position changes

  • Dismissals/terminations

2.5.2 Sources of your data

We collect your information from you, your union representative, and your employer.

2.5.3 Purpose of the processing

We use historical data to ensure equal pay for equal work and to ensure that employees receive appropriate compensation. It is often essential to understand the reasons for specific pay supplements, for instance.

This information is also used to safeguard PROSA's interests and fulfill its obligations as a contracting party.

2.5.4 Legal basis for processing

We retain data to serve PROSA's legitimate interest.³¹

2.5.5 Storage, transfer, and deletion of your personal data

We retain data for 5 years.

2.6 PROSAbladet

2.6.1 Types of personal data processed

If you are a source for PROSAbladet, we may process the following types of personal data about you:

  • Contact information

If you are a subscriber to PROSAbladet, we may process the following types of personal data about you:

  • Name

  • Email address

2.6.2 Sources of your data

2.6.2.1 Sources (for articles)

We collect information from you, public sources, or people who know you.

If we obtain your information from others who know you, we will contact you directly.

2.6.2.2 Subscribers

We collect information directly from you.

2.6.3 Purpose of the processing

2.6.3.1 Sources

We retain your contact information to be able to use you as a source for PROSAbladet if needed.

2.6.3.2 Subscribers

We retain your contact information to be able to use you as a source for PROSAbladet if needed.

2.6.4 Legal basis for processing

We retain data based on your membership.³²

2.6.5 Storage, transfer, and deletion of your personal data

You may request to stop receiving the physical copy of PROSAbladet at any time.

Data deletion occurs 13 months after membership termination.

3 Cookies on prosa.dk

When you visit prosa.dk, your computer may automatically receive one or more cookies (small, harmless data files).

You are not required to accept these cookies, and you can always set your internet browser to reject them. However, please note that some parts of prosa.dk may not function as intended if cookies are disabled.

Here is how we use these cookies:

3.1 For your possible login to prosa.dk and when you register for events

When you log in or register for events, the information you enter in your membership profile is recorded.

3.2 For surveys and polls you choose to participate in

We do not use cookies to target content or display ads for third parties.

We do not share this information with third parties unless you have been informed of this in advance, and only with your consent.

4 Your rights

As a data subject, you have several rights under the General Data Protection Regulation (GDPR). If you wish to exercise these rights, please contact us.

Your rights include the following:

  • Right to withdraw consent: You can withdraw your consent at any time by emailing us (see our contact details above). Withdrawal of your consent will not have any negative consequences but may mean that we cannot fulfill specific requests from you going forward. Withdrawal does not affect the legality of processing based on consent before its withdrawal, nor does it affect any processing conducted on another legal basis.

  • Right of access: You have the right to access the personal data we process about you.

  • Right to rectification: You have the right to have incorrect personal data corrected and incomplete personal data completed.

  • Right to erasure (right to be forgotten): In certain cases, you have the right to have your personal data erased before the time when we would normally delete your data.

  • Right to restriction of processing: In specific situations, you have the right to have the processing of your personal data restricted.

  • Right to object: In some cases, you have the right to object to our processing of your personal data. You always have the right to object if the processing is for direct marketing purposes.

  • Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, without human intervention, unless the decision is necessary for your employment with us, legally required, or based on your explicit consent.

  • Right to data portability: In certain cases, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transfer this data from one data controller to another.

  • Right to file a complaint: You can file a complaint with the Danish Data Protection Agency (Datatilsynet) regarding our processing of personal data.

For more information, visit www.datatilsynet.dk, where you can also find additional information about your rights as a data subject.

The contact details for Datatilsynet are as follows:

Carl Jacobsens Vej 35
2500 Valby

Tel.: +45 3319 3200

Email: dt@datatilsynet.dk

You can exercise your rights by contacting us at:

gdpr@prosa.dk

5 Changes and updates

PROSA reserves the right to update and amend this privacy policy on an ongoing basis.

If we change the policy, we will update the date below in this section.

In the event of significant changes, we will notify you via a visible notice on our website, email, or other communication channels.

Footnotes

¹ Article 6(1)(b) of the General Data Protection Regulation (GDPR)

² Article 9(2)(d) of the General Data Protection Regulation (GDPR), in conjunction with Article 6(1)(f) of the General Data Protection Regulation (GDPR)

³ Article 6(1)(f) of the General Data Protection Regulation (GDPR)

⁴ Article 6(1)(b) of the General Data Protection Regulation (GDPR)

⁵ Article 6(1)(f) of the General Data Protection Regulation (GDPR)

⁶ Article 9(2)(f) of the General Data Protection Regulation (GDPR), in conjunction with Section 7(1) of the Danish Data Protection Act, and Section 11(1)(4) of the Danish Data Protection Act

⁷ Article 6(1)(a) of the General Data Protection Regulation (GDPR)

⁸ Article 6(1)(c) of the General Data Protection Regulation (GDPR)

⁹ Article 6(1)(b) and Article 9(2)(b) of the General Data Protection Regulation (GDPR), in conjunction with Article 6(1)(b) of the General Data Protection Regulation (GDPR)

¹⁰ Article 6(1)(b) and Article 9(2)(b) of the General Data Protection Regulation (GDPR)

¹¹ Article 6(1)(f) (General Data) and Article 9(1)(f) (Special Categories of Data) of the General Data Protection Regulation (GDPR)

¹² The Absolute Limitation Period in Section 3(3)(1) of the Danish Limitation Act

¹³ Article 6(1)(b) of the General Data Protection Regulation (GDPR)

¹⁴ The Anti-Money Laundering Act, Article 6(1)(a) of the General Data Protection Regulation (GDPR) in conjunction with Article 6(1)(c) of the GDPR, and Section 11(2)(1) of the Danish Data Protection Act

¹⁵ Article 6(1)(f) of the General Data Protection Regulation (GDPR)

¹⁶ Article 6(1)(c) of the General Data Protection Regulation (GDPR)

¹⁷ Article 6(1)(c) of the General Data Protection Regulation (GDPR)

¹⁸ Article 6(1)(c) of the General Data Protection Regulation (GDPR)

¹⁹ Article 6(1)(f) of the General Data Protection Regulation (GDPR)

²⁰ Article 6(1)(f) of the General Data Protection Regulation (GDPR)

²¹ Article 6(1)(a) of the General Data Protection Regulation (GDPR) and Article 9(2)(a) of the GDPR in conjunction with Article 6(1)(a) of the GDPR

²² Article 6(1)(f) of the General Data Protection Regulation (GDPR)

²³ Article 6(1)(f) of the General Data Protection Regulation (GDPR)

²⁴ Article 9(2)(j) of the General Data Protection Regulation (GDPR) in conjunction with Article 6(1)(e) of the GDPR, and Section 44 et seq. of the Archives Act

²⁵ Article 6(1)(f) of the General Data Protection Regulation (GDPR)

²⁶ Article 6(1)(f) of the General Data Protection Regulation (GDPR)

²⁷ Article 9(2)(e) of the General Data Protection Regulation (GDPR)

²⁸ Article 6(1)(f) of the General Data Protection Regulation (GDPR)

²⁹ Article 6(1)(f) of the General Data Protection Regulation (GDPR)

³⁰ Article 6(1)(c) and (f), and Article 10 of the General Data Protection Regulation (GDPR), as well as Section 8(3) of the Data Protection Act, and Article 9(2)(f) of the GDPR in conjunction with Article 6(1)(c) and the Child Protection Certificate Act.

³¹ Article 6(1)(f) of the General Data Protection Regulation (GDPR)

³² Article 6(1)(b) of the General Data Protection Regulation (GDPR)