Privacy Policy

Danish UNICEF Foundation Privacy Policy

1 General
1.1 This Privacy Policy (hereafter “policy”) applies to the information you provide to us and/or that we collect about you, either as part of a contributor or voluntary relationship, a (potential) employment relationship or as a user of our services, including on various digital platforms. In the policy, you can read more about what information we collect, how we handle the information, and how long we keep information about you. You should read the policy and contact us if there is information in the policy that you cannot accept. On www.unicef.dk, you will be able to find the current version of the policy at any time.

2 Data controller
2.1 The data protection organization for processing your personal data is:

Danish UNICEF Foundation
Rentemestervej 62
2400 Copenhagen NV
Tlf. +45 35 27 38 00
unicef@unicef.dk
CVR no. 42824534

2.2 The overall legal framework for our processing of personal data is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC and related regulation. Further to this is the law that may be adopted based on legislation proposed on 25 October 2017 regarding additional provisions for the protection of individuals relative to the processing of personal data and the free exchange of such data.

2.3 All questions relating to this policy, the processing of your information and questions about compliance with the policy should be addressed to us in the first instance at the above address. Your inquiry will be passed on to the relevant focal point for the General Data Protection Regulation as well as this Personal Data Policy.

3 Definitions

3.1 The following are definitions of some of the most important concepts:

Personal data	Any information about an identified or identifiable natural person. That is, any information that can directly or indirectly, alone or in combination, identify a particular natural person.
Data controller	The natural or legal person, public authority, institution or other body that decides, alone or together with others, for what purposes and by what means personal data may be processed.
Data processor	The natural or legal person, public authority, institution or other body processing personal data on behalf of the data responder.
Treatment	Any activity or series of activities involving the use of personal data, such as collection, registration, systematization, modification of, search, juxtaposition, entrustment or disclosure to persons, authorities, companies, etc. outside the organization.
Special categories of Personal Data	Information on racial or ethnic origin, political, religious or philosophical beliefs or trade union affiliations, genetic data, health information or information about a natural person’s sexual relations or sexual orientation, as well as information in the form of biometric data, provided that biometric data are processed for the purpose of uniquely identifying a natural person (sensitive information).
General Data Protection Regulation	Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals regarding the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC and related regulation.
Data Protection Act	The law that may be adopted based on the proposal for a law on additional provisions for the protection of individuals with regard to the processing of personal data and on the free movement of such data (Data Protection Act) tabled on 25 October 2017.

4 For the purpose of processing your personal data
4.1 Depending on whether you are a contributor, a job applicant or a volunteer with us, or perhaps simply a user of our website, we are obliged to process your personal data to such an extent that we can provide you with the services you demand and that we can partly meet the obligations we have as a charitable foundation. This applies both when handling your possible contributions – unless you choose to contribute anonymously – your possible purchases of services or goods with us, and/or when we need to manage your any subscriptions with us. It may also be by your use of our webshop or in connection with our marketing to you. It can also be if you apply for a job through our recruitment system or are in an existing employment relationship. When we collect personal data about you, we inform you of the purpose of processing your personal data.

5 The personal data we process about you
5.1 We collect this information directly from you:

5.1.1 Depending on whether you are a customer, job applicant or contributor, e.g., Monthly Donor with us, we collect the following common personal data from you: Name, address, zip code, city, mobile number, email address, (registration and account number for fixed contributors and members). Depending on your relationship with us, we collect information about your CPR number, for example if you need a deduction for contributions, as we have a reporting obligation to the tax authorities, or if you are a volunteer in UNICEF Denmark and we need a criminal/child certificate. Criminal and child records are always obtained with your consent.

5.1.2 We purchase the following ordinary personal data for the purpose of asking for contributions: Name, address, zip code, city, phone number.

5.1.3 In addition, we collect information when you register for an event or order a presentation or lecture.

5.1.4 When registering or participating in, for example, petitions, competitions, as well as when buying tickets, information about name, address, zip code, telephone number and e-mail is typically collected. This information is obtained for competitions, sales of tickets, etc. Registration is made with the aim of influencing decision-makers with the collected signatures, being able to handle individual players’ participation in competitions and lotteries, payment of the game and payment of winnings.

5.1.5 As a rule, we do not collect any specific categories of personal data (sensitive information) about you, but in cases where we need it, for example in connection with an employment or at a voluntary event, e.g. children’s and criminal records.

5.1.6 We do not collect information about children and adolescents under the age of 18 as part of our fundraising. In case it happens by mistake (for example, if the child is a user of a mobile phone registered by an adult), we delete the information as soon as we become aware of it. When we store information about children, e.g. through Rights schools, it happens with consent or out of a legitimate interest, depending on the type of information.

5.2 We collect this personal data from others about you:

5.2.1 In some cases, it is necessary for us to collect personal data about you from others. For example, personal data from previous employers in relation to reference or obtaining criminal and child certificates. Criminal and child records are always obtained with the consent of you.

6 Cookies
6.1 Our website uses “cookies” to manage logins and to collect web statistics. A cookie is a small text file that is sent from our server to your browser and stored on your computer’s hard drive or mobile device. Cookies mean that you can use the website more efficiently and more easily.

You can read our cookie policy on our website: https://www.unicef.dk/cookies

7 How we process your personal data
7.1 Specifically, we use your personal data for several different purposes depending on whether you are a contributor, job applicant, customer or volunteer with us, or whether you are simply a user of our website.

7.1.1 If you are a customer of ours, we use your personal data to:

To make the functionalities of our website, including in our webshop, available to you
Send order confirmations and items to you
Answer any questions you may and comply with your requests
Be able to fulfill your orders in the webshop
Be able to manage the customer relationship with you
Be able to send you marketing materials if this is also in accordance with the marketing law in force at any time
Compile statistics for internal use

7.1.2 If you are a job applicant with us, we use your personal data to:

Be able to make an informed assessment of you
Be able to contact you
Be able to contact references if needed

7.1.3 If you are a contributor with us, we use your personal data to:

Manage your deposits
Be able to send you necessary information about the use of your contributions
For Danish residents, be able to report your contribution to the SKAT Tax administration so that your contribution will appear on your tax return
For Danish residents, be able to contact you with marketing materials, e.g. via digital channels, postal and telemarketing
Comply with requirements in the Danish Bookkeeping Act
Compile statistics for internal use

7.1.4 If you are a volunteer with us, we use your personal data to:

Manage your relationship between you and UNICEF Denmark
Be able to contact relatives if the need arises
Obtain your child and criminal records. Criminal and child records are always obtained with your consent.

7.1.5 If you are a solely a user of our website, we use your personal data to:

Be able to make the functionalities of our website available to you
Compile statistics about your whereabouts on our website
Optimize our website’s interior design/li>
Could contact you with marketing
Compile statistics for internal use

7.1.6 If you are contacted to become a contributor or support our work for children, we use your personal data to:

Be able to contact you
Be able to send receipts for registration to support our work
Be able to register if we can contact you in the future if you do not want to support our work
Compile statistics for internal use

7.1.7 If you are a monthly donor, and only relevant for Danish residence, we use your personal data to:

Get feedback on how your contribution has helped children, our campaigns, and UNICEF’s work
Give you more opportunities to support us in other ways
Manage our records to avoid duplicates
Maintain personal contact with you as a Monthly Doner
Comply with requirements of the Danish Bookkeeping Act
Compile statistics for internal use

7.1.8 If you make a donation through the website, online banking, mobilepay or SMS, we use your personal data to:

Get feedback on how your contribution has helped children, our campaigns, and UNICEF’s work
For Danish Residents, give you more opportunities to support us in other ways
Manage our records to avoid duplicates
Comply with requirements of the Danish Bookkeeping Act
Compile statistics for internal use

7.1.9 If you have written UNICEF into your will, shown an interest in doing so, or simply want information, we use your personal data to:

Monitor the right to the will
Stay in touch with you, even if you’re interested
Target our campaigns
Compile statistics for internal use

7.1.10 If you are a contact person or partner, e.g. blogger, ‘influencer’, ambassador, foundation, rights school or companies, with UNICEF Denmark, we use your personal information to:

Manage the relationship between you, your organization and UNICEF Denmark
Compile statistics for internal use

7.1.11 If you subscribe to our newsletter, we will use your personal information to:

Send our newsletter to you
Compile statistics for internal use

7.1.12 If you apply for a job or internship, we use your personal data to:

Identify who you are
Make the recruitment process easy and simple
Improve future recruitment processes
Obtain children’s and criminal records. Criminal and child records are always obtained with the consent of you

8 Why are we allowed to process information about you (processing basis)?

8.1 When you make a contribution to us, buy an item in our webshop or enter into any other form of agreement with us, we process your ordinary personal data for that particular purpose. We may also process your ordinary personal data if, for example, you have a request or similar that precedes your decision to enter into an agreement with us. The legal basis for processing your personal data is Article 6(1)(b) of the General Data Protection Regulation, as the processing of your data is necessary for us to fulfil our agreement with you or for us to handle inquiries and the like prior to your possible conclusion of an agreement with us.

8.2 We can also process your ordinary personal data because we have a legitimate interest in processing the information about you, cf. Article 6(1)(f) of the Personal Data Regulation, unless your right to obtain protection for your own ordinary personal data takes precedence over our legitimate interest in processing your data.

8.3 We have a legitimate interest in processing your personal data (your name and email address) for marketing purposes. Our legitimate interest thus consists in knowing your preferences so that we can better adapt our information to you and ultimately offer news and services that meet your needs and desires. It is also with reference to legitimate interest that we compile various statistics on the number of purchases, contributions, use of the website, etc.

8.4 In certain cases, we are also legally obliged to process personal data about you, in accordance with Article 10(1) of the Directive. Article 6(1) (c) of the Personal Data Regulation. For example, it may be for documentation of transaction tracks and the like under the rules of the Danish Bookkeeping Act. Among other things, we must store accounting material for five years from the end of the financial year to which the accounting material relates. For Danish residents only, it may also be in connection with reports to the tax authorities, so you can get a deduction for your contribution to us. Reports to the tax authorities must be made with an indication of CPR-nr., cf. The Danish Tax Control Act, and it is therefore the basis for our processing of information about your Social Security number.

8.5 As a charitable foundation, we are allowed, in accordance with Section 8A of the Danish Tax Assessment Act, to contact persons for the purpose of collecting money for the purpose of the foundation, cf. The Danish Collection Act Chapter 1011. 1(2). Paragraphs 8 and 11(3).

8.6 If you are not a contributor or volunteer with us, but for example simply a user of our website, we need – to a limited extent – to be able to manage the information that you provide yourself for use in e.g. cookie handling. Read more in our cookie policy on our website. In some cases, we can detect which IP addresses have visited our website. An IP address can be a personal data, and if we process your IP address, it will be done on the same basis as described above.

9 Sharing your personal data
9.1 We may share your personal data with the suppliers and business partners who assist us, for example, in the execution of your fixed contribution agreement, your order, program collaboration or who assist us with our IT operations, hosting, etc. This means that we can share your information with, for example, our service providers, recruitment partners and NETS.

9.2 We can also share your information with our parent organization to the extent that this is legal.

9.3 In addition to the above, we share your information to the extent that we are obliged to do so, e.g. as a result of reporting requirements to public authorities such as tax authorities.

10 Sharing your information with recipients outside the EU/EEA
10.1 We, our suppliers and partners generally only process your personal information within EU/ EEA. In cases where personal data is processed outside the EU/ EEA (in “third countries”), either a decision by the EU Commission is taken that the third country concerned ensures an adequate level of protection for the processing of personal data or other appropriate safeguards under the GDPR, for example in the form of standard contractual clauses, binding company internal rules or Privacy Shield (a security mechanism for transfers to the US), to ensure that your rights are protected. If you want a copy of the protection measures, we have taken or information about where these were made available, it can be obtained by contacting us using the contact information listed above.

10.2 You can obtain information at any time, or possibly a copy of, the necessary guarantees that form the basis for the transfer of Personal Data to recipients outside the EU/EEA or, if exceptions are used as mentioned in Article 49 of the General Data Protection Regulation, what exceptions are used for any transfer.

11 Storage and deletion of your personal data
We store your personal data in accordance with the following rules:

11.1 If you are a contributor with us, we will retain your personal data during the time you are affiliated with our organization and up to five years after the current year from your last donation in accordance with the Danish Bookkeeping Act. Personal data on bank reg.nr. and account number will be deleted 13 months after your Payment Service Agreement has been terminated with NETS, cf. The Payment Service Act 2009, which requires UNICEF Denmark to be able to document that an agreement has been concluded up to 13 months after the end of the contractual relationship.

11.2 If you are a job applicant with us, we will store your personal data for up to 12 months from your latest application date, so we can go back into the applications if a new employee stops within the probationary period. Criminal and child records are deleted as soon as the contents are checked.

11.3 If you are a volunteer with us, we will store your personal data during the time you are affiliated with our organization. If you are a volunteer in connection with fundraisers, we will store your information for up to 2 years after collection in order to re-enlist you to participate in a fundraiser. If you are a volunteer in other areas, e.g. in our local associations, we will store your information for up to 6 months from your announcement.

11.4 If you are a customer of ours, we will store your personal data for up to five years after the current year from your last purchase in accordance with the Danish Bookkeeping Act.

11.5 If you have committed a will, we will keep your information for life. If you have received information about succession rights, your personal data will be stored for 24 months.

11.6 If we have purchased personal data and contacted you with a view to becoming a monthly donor, we will store your information indefinitely. In the case that you have requested to receive marketing material or be contacted by UNICEF Denmark in the first place, so that we can take your wish into account, otherwise we will delete your data after 24 months.

12 Your rights
12.1 Insight – You have the right to gain access to the personal data that we process about you. By writing to us on unicef@unicef.dk you can request access to the personal data that we have registered about you, including the purposes for which the information was collected. We will comply with your insight request as soon as possible.

12.2 Rectification and deletion – You have the right to request correction, additional processing, deletion or blocking of the personal data we process about you. We will comply with your request as soon as possible to the extent necessary. If we cannot comply with your request, we will contact you.

12.3 Limitation of processing – In exceptional circumstances based on Article 18(1), you have the right to have your personal data processed restricted. Please contact us if you would like to restrict the processing of your personal data.

12.4 Data portability – You have the right to receive your personal data (data relating to yourself only, which you have provided to us) in a structured, commonly used and machine-readable format (data portability). Please contact us if you want to take advantage of the data portability option.

12.5 Right of opposition – You have the right to ask us not to process your personal data in cases where the processing is based on Article 6(1)(e) (task in the public interest or public authority) or Article 6(1)(f) (legitimate interest). This policy indicates the extent to which we process your information for such purposes. You can exercise the right of objection at any time by contacting us.

12.6 Withdrawal of consent – If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Your withdrawal does not affect the legality of the processing carried out before you withdrew your consent. Please contact us if you wish to revoke your consent.

12.7 There may be conditions or restrictions attached to the exercise of the above rights. Therefore, you may not be entitled to data portability in the specific case, for example – it depends on the specific circumstances of the treatment activity in question.

13 Possible consequences of not providing personal data
If you are obliged to provide information about yourself to us, it will appear where we collect the information. In some cases, it will be statutory or a requirement under a contract within the meaning of Article 10(1) of Directive 2001/18/EC. The General Data Protection Regulation Article 13(2)(e).

If you do not want to provide the personal data that we request, it may have the consequence that we cannot provide you with the services you demand, complete your orders, register as a contributor, report your contributions to the the tax authorities.

14 Use of automatic decisions / profiling
14.1 We apply automatic decisions as part of our direct marketing. This means that we use the ordinary personal data that we collect about you to create a profile of you. The logic behind this is as follows: We use existing data about our user to create a profile on Facebook, Google or other marketing platforms – a so-called indirect profile, as we cannot track the user’s activity other than that we can advertise content targeted to the user. We can import and export data to and from Facebook in the form of name, email, phone number and profile ID. However, we can only get profile ID at so-called fundraisers, where users collect money for UNICEF Denmark on Facebook on their own initiative. It is also the case that engagement (likes, comments, shares, videoviews, sign-ups) from users is tracked internally by Facebook and gives the advertiser (us) a better opportunity to target our content to them.

15 Security
15.1 In the organization, our processing of personal data is subject to our IT and security policy. Our IT and Security Policy also contains rules for carrying out risk assessment and impact assessment of existing as well as new or changed processing activities. We have implemented internal rules and procedures for maintaining appropriate security from the time we collect personal data up to deletion, and we only entrust our processing of personal data to data processors who maintain an equivalent appropriate level of security.

16 Complain to regulator
16.1 If you are dissatisfied with our processing of your personal data, we would always like to hear from you. You can also complain to the Danish Data Protection Agency:

Data Protection Agency, Borgergade 28, 5th floor, 1300 Copenhagen K., phone +45 3319 3200, e-mail: dt@datatilsynet.dk

17 Updating this policy
17.1 UNICEF Denmark is committed to complying with the basic principles of the protection of personal data and data protection. We therefore regularly review this policy to keep it up to date and in accordance with applicable principles and legislation. This policy is subject to change without notice. Significant policy changes will be posted on our website along with an updated version of the policy.

17.2 Any changes we may make to this policy in the future will be published on this page and may be notified to you by email.

The privacy policy was last updated on 24/05/2018