Logo

Privacy policy

1. Introduction

1.1 The data controller

Velliv, Pension & Livsforsikring A/S ("Velliv", "we", "our", "us") is a financial undertaking licensed by the Danish Financial Supervisory Authority to conduct business under the categories of life insurance and pension. We are registered as a public limited company in Denmark under company registration (CVR) number 24260577.

Our contact details are:
Address: Lautrupvang 10, 2750 Ballerup
Telephone: +45 70 33 99 99
Email: contact@velliv.dk

Contact form: Contact Velliv

Read here about secure communication

As a life insurance and pension company, we process personal data as a natural part of our business. This means that we are data controllers in our processing of personal data about you as a customer, as a visitor to our website and as a visitor to our company pages on social media.

1.2 The Data Protection Officer

We have appointed a Data Protection Officer (“DPO”), as our core business activities are inextricably linked to the extensive processing of personal data, including sensitive personal data (in form of health information) about our customers.

Velliv has appointed Bech-Bruun as our Data Protection Officer (“DPO”). For any questions regarding Velliv’s data protection, you can contact Bech-Bruun at:

Bech-Bruun Advokatpartnerselskab
CVR nr.: 3853 8071
Gdanskgade 18
2150 Nordhavn
Telephone number: 72 27 30 02

You can contact our Data Protection Officer here.

1.3 Structure of the privacy policy

We have divided our privacy policy into a number of sections which together fulfil our disclosure obligations under Articles 13 and 14 of the General Data Protection Regulation (GDPR).

In the specific provisions section, you can read about our specific processing activities.

In the general provisions section, you can read about the recipients of personal data, your rights and the complaint guide.

1.4 Categories of personal data

To give you an overview of the personal data processed about you, we have prepared a table that presents the categories of personal data that we typically process during your time as a customer at Velliv. The table is therefore not exhaustive, but gives you an overview. It is also not certain that all the personal data listed will be processed, or that it will happen at the same time during your engagement with Velliv.

Categories of personal data

Examples

  • Identifying information
    • Date of birth
    • Agreement number
    • Customer number
    • Case ID
    • Job title
    • Marital status
    • Passport number
    • Driving licence number
  • Civil registration number
    • Civil registration (CPR) number
    • Foreign civil registration number
  • Customer identification and verification data
    • PEP (politically exposed person) status
    • Investigations under the Danish Anti-Money Laundering Act (hvidvaskloven)
    • Investigations under international sanctions rules
  • Behavioural data
    • IP address
    • Log information
    • Photos and video recordings (investigation of possible fraud)
    • Leasure time activities
    • Recording of eye and facial movements when you volunteer to participate in a test of, for example, a new campaign text. The data is not used to identify you.
  • Contact details
    • Email address
    • Address
    • Telephone
  • Financial information
    • Tax information
    • Account number
    • Credit card information
    • Pay information
    • Tax information
    • Savings
    • Debt
  • Insurance and pension information
    • Amount at risk and choice of cover
    • Contributions
    • Reserves and balance
    • Expected disbursement
    • Bonus amount
    • Employee group
    • Pension contributions
    • Pension contribution rates
    • The cover under your insurance policies
    • Return
    • Investment
  • Potential criminal offences
    • Material showing undue insurance disbursements (e.g. due to insurance fraud) or supporting a reasonable suspicion thereof.
    • Material on criminal offences that may emerge from a review of international sanctions lists.
  • Health information
    • Health declaration
    • Health record
    • Information on sickness absence
    • Medical opinion
    • Disease status
    • Claims information
    • Information on occupational injury
  • Trade union membership
    • Collective agreement

2. Specific provisions

2.1 Velliv's insurance and pension schemes


Velliv's insurance and pension schemes
Purpose of processing We process your personal data to administer your insurance and/or pension scheme. Your insurance and pension scheme is set up either as an employer scheme or as an individual scheme. This processing activity includes all the processes that are a natural part of the customer relationship between you and Velliv, including in connection with the provision of offers, advice, claim forms and disbursements.
Categories of personal data
  • Contact details
  • Identifying information
  • Civil registration number
  • Financial information
  • Insurance and pension information
  • Health information
  • Trade union membership
Legal basis for processing

The legal basis for Velliv's processing of general personal data is Article 6(1)(b) of the GDPR on processing necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract.

The legal basis for Velliv's processing of general personal data in connection with the provision of advisory services is Article 6(1)(f) of the GDPR on processing necessary for Velliv to pursue a legitimate interest. The legitimate interest is to ensure that Velliv offers you advice on your insurance and/or pension scheme.

You have the right to object to our interests by writing to us with a description of your own concerns. See section 3.2 about your rights.

The legal basis for Velliv's processing of sensitive personal data is Article 9(2)(f) of the GDPR on processing necessary for the establishment, exercise or defence of legal claims under your scheme (contract).

The processing of your personal data is a requirement for the conclusion of the agreement on your scheme. In other words, we cannot offer you the scheme without this information.

The legal basis for Velliv's processing of trade union membership specifically is section 12 of the Danish Data Protection Act (databeskyttelsesloven) and Article 9(2)(b) of the GDPR on processing necessary for the purposes of complying with the specific rights you have under any collective agreement in terms of the pricing of your scheme.

The legal basis for Velliv's processing of civil registration numbers is section 11(2)(i) of the Data Protection Act, which allows private undertakings to process civil registration numbers where this follows from the law. According to section 43b of the Danish Financial Business Act (lov om finansiel virksomhed) (with effect from 1 January 2024, section 69 of the Danish Insurance Business Act (i lov om forsikringsvirksomhed)), financial undertakings may process civil registration numbers for the purpose of necessary unique identification in relation to existing customer relationships in the performance of administrative and advisory tasks.

The legal basis for Velliv's processing of civil registration numbers in connection with the provision of offers when establishing a new customer relationship is section 11(2)(iv) of the Data Protection Act, which allows private undertakings to process civil registration numbers when the conditions of section 7 of the Data Protection Act are met, including when the processing is subject to Article 9(2)(f) of the GDPR on legal claims.

Sources

  • Your employer
  • Insurance intermediaries, including banks
  • Any former pension and insurance companies
  • Your general practitioner, hospitals, specialist doctors and other practitioners, such as psychologists, physiotherapists and chiropractors.
  • The PensionsInfo Association
  • The Danish Centre of Health & Insurance (Health & Insurance)
Storage period

We store your personal data for the entire duration of the scheme and until ten years after the last disbursement has been made, see section 29 of the Danish Insurance Contracts Act (forsikringsaftaleloven) and section 8 of the Danish Limitation Act (forældelsesloven), which deal with legal claims arising from an insurance contract.

In the event that no agreement is entered into after you have provided us with your personal data, we will store your personal data for up to six months after clarifying whether an agreement can be reached. The storage period in these cases is determined by our legitimate interest in being able to prove the course of action in the event of complaints about the non-conclusion of an agreement, see Article 6(1)(f) of the GDPR on legitimate interests and Article 9(2)(f) on legal claims. We must be able to state the reasons why the agreement was not entered into, and we follow general practice in this area by storing the data for six months, without thereby overriding your fundamental freedoms.

2.2 If you are connected to one of our customers' pension schemes - e.g. beneficiaries

If you are connected to one of our customers' pension schemes - e.g. beneficiaries
Purpose of processing We process your personal data to administer any claim you may have in relation to our customer's insurance and/or pension. In addition, we process your personal data in order to be able to handle your inquiry as a representative or guardian of our customer.
Categories of personal data
  • Contact details
  • Identifying information
  • Financial information
  • Civil registration number
 Legal basis for processing   

The legal basis for Velliv's processing of your general personal data is Article 6(1)(f) of the GDPR on processing necessary for Velliv to pursue a legitimate interest. The legitimate interest is to protect our legal position and to be able to administer our customer's scheme. You have the right to object to our interests by writing to us with a description of your own concerns. See section 3.2 about your rights.

The legal basis for Velliv's processing of civil registration numbers in connection with the administration of any claim you may have is section 11(2)(iv) of the Data Protection Act, which allows private undertakings to process civil registration numbers when the conditions of section 7 of the Data Protection Act are met, including when the processing is subject to Article 9(2)(f) of the GDPR on legal claims.

 Sources
  • You
  • Other claimants

Storage period

We store your personal data for the entire duration of our customer's scheme and until ten years after the last disbursement has been made, see section 29 of the Insurance Contracts Act and sections 3 and 8 of the Limitation Act, which deal with the lapse of claims and legal claims arising from an insurance contract.

2.3 Statutory suitability test for investments

Statutory suitability test for investments
Purpose of processing When providing advice on an insurance-based investment product, we are required to perform a suitability test under the Executive Order on Insurance Distributors (bekendtgørelsen om forsikringsdistributører). For this purpose, we collect information about your knowledge of and experience with investments, and ask about your financial situation, including your ability to bear a loss, your investment goals, and your risk appetite. This is an integral part of our advice and enables us to recommend the insurance-based investment products that are right for you. The results of the suitability test are presented to our pension advisers, so that you will also receive personalised advice based on your answers. The activity is included in the profiling concept of the GDPR, but you obviously have the right to human involvement on our part
Categories of personal data
  • Contact details
  • Identifying information (selected)
  • Financial information
Legal basis for processing The legal basis for Velliv's processing of general personal data is Article 6(1)(c) of the GDPR on processing necessary for compliance with a legal obligation to which Velliv is subject under section 37 of the Executive Order on Insurance Distributors concerning suitability tests in connection with the distribution of insurance-based investment products.
Sources Your answers in the suitability test
Storage period We store your personal data according to the same principles as stated under section 2.1 on insurance and pension schemes.

2.4 Statutory requirements under insurance and financial legislation

Statutory requirements under insurance and financial legislation
Purpose of processing As a financial undertaking and insurance company, we are subject to several obligations under the law which apply to the processing of your personal data. This applies, for example, to our duty to document certain matters, as well as statutory reporting to public authorities.
Categories of personal data
  • Identifying information
  • Financial information
  • Insurance and pension information
Legal basis for processing

The legal basis for Velliv's processing of your general personal data is Article 6(1)(c) of the GDPR on processing necessary for compliance with a legal obligation to which Velliv is subject under the Financial Business Act (with effect from 1 January 2024, the Insurance Business Act), the Insurance Contracts Act, the Danish Nationalbank Act (nationalbankloven), the Danish Bookkeeping Act (bogføringsloven), the Executive Order on Business Plans, Recovery Plans, Financing Plans and Individual Capital Adequacy Requirements for Insurance Companies (bekendtgørelse om driftsplaner, planer for genoprettelse, finansieringsplaner og individuelt solvensbehov for forsikringsselskaber), the Executive Order on Index-Linked Old-Age Insurance in Insurance Companies (bekendtgørelse om pristalsreguleret alderdomsforsikring i forsikringsselskaber), the Act on Udbetaling Danmark (lov om Udbetaling Danmark), etc.

The legal basis for Velliv's processing of civil registration numbers is section 11(2)(i) of the Data Protection Act, which allows private undertakings to process civil registration numbers where this follows from the law (mentioned above).
Sources Public authorities, including municipalities, the Danish Tax Agency, courts and other authorities and agencies.
Storage period We store your personal data for as long as we are legally obliged to do so under relevant legislation. Most regulations apply to our current operating liabilities, which thus automatically follow our storage period for the individual, see the insurance and pension section. In other areas, there may be very specific deadlines for parts of the material processed, e.g. current year + 5 years for accounting records, see section 12 of the Bookkeeping Act.

2.5 Prevention of money laundering and compliance with sanctions lists

Prevention of money laundering and compliance with sanctions lists
Purpose of processing As a financial undertaking and insurance company, we are subject to several obligations under the law which apply to the processing of your personal data. This applies, for example, to our duty to document certain matters, as well as statutory reporting to public authorities.
Categories of personal data
  • Identifying information
  • Customer identification and verification data
  • Potential criminal offences​
Legal basis for processing

The legal basis for Velliv's processing of your general personal data is Article 6(1)(c) of the GDPR on processing necessary for compliance with a legal obligation to which Velliv is subject under the sanctions lists and Part 3 of the Anti-Money Laundering Act, including section 11 on CDD procedures, section 18 on politically exposed persons. As the processing is required by law, we can only offer you the scheme if you provide these personal data.

The legal basis for Velliv's processing of civil registration numbers is section 11(2)(i) of the Data Protection Act, which allows private undertakings to process civil registration numbers where this follows from the law, see section 11(i) of the Anti-Money Laundering Act.

The legal basis for Velliv's processing, where applicable, of criminal offences is section 8(3) of the Data Protection Act, which allows private undertakings to process information on criminal offences based on a balancing of interests.

The legal basis for Velliv's processing in relation to due diligence processes, where we collect information about, among other things, ownership of our business partners, is Article 6(1)(f) of the GDPR on processing necessary for Velliv to pursue a legitimate interest. The legitimate interest is to protect Velliv's legal position. You have the right to object to our interests by writing to us with a description of your own concerns. See section 3.2 about your rights.
Sources
Storage period Your personal data will be stored for five years after the termination of your scheme or after completion of the last recorded single transaction, unless otherwise provided for by other legislation or in connection with beneficiary nominations in accordance with section 30(2) of the Anti-Money Laundering Act

2.6 Disputes and verification of suspected or attempted undue disbursements

 

Disputes and verification of suspected or attempted undue disbursements
Purpose of processing

If a dispute arises about your scheme, if we suspect an undue disbursement (for example, insurance fraud or attempted insurance fraud), or we need to investigate certain matters as part of our general checks, we may process your personal data to secure our legal position. The processing activity thus includes complaints handling, checks, appeal board proceedings and legal proceedings.

In relation to insurance fraud investigations, we collect current and historical information from publicly available sources and open social media profiles and make observations in accordance with legislation and the trade association Insurance & Pension Denmark's 'Insurance Fraud Code'. You can read more on our website: https://www.velliv.dk/dk/privat/om-os/forsikringssvindel

Finally, we process your personal data as a claimant – e.g. as a beneficiary – if you are a party to a dispute in relation to our customer's scheme
Categories of personal data
  • Contact details
  • Identifying information
  • Financial information
  • Insurance and pension information
  • Behavioural data
  • Health information
  • Potential criminal offences
Legal basis for processing

The legal basis for Velliv's processing of your general personal data is Article 6(1)(f) of the GDPR on processing necessary for Velliv to pursue a legitimate interest. The legitimate interest is to protect our legal position and to assess whether you are entitled to receive benefits from Velliv and whether your scheme can be maintained. You have the right to object to our interests by writing to us with a description of your own concerns. See section 3.2 about your rights.

The legal basis for Velliv's processing of your sensitive personal data is Article 9(2)(f) of the GDPR on processing necessary for the establishment, exercise or defence of legal claims under your scheme.

The legal basis for Velliv's processing of civil registration numbers is section 11(2)(iv) of the Data Protection Act, which allows private undertakings to process civil registration numbers when the conditions of section 7 of the Data Protection Act are met, including when the processing is subject to Article 9(2)(f) of the GDPR on legal claims.

The legal basis for Velliv's processing of criminal data is the second sentence of section 8(3) of the Data Protection Act on processing that may take place if necessary for the purpose of safeguarding a legitimate interest and this interest clearly overrides the interests of the data subject. We follow the rules of the Executive Order on Investigations by Insurance Companies (bekendtgørelse om undersøgelser foretaget af forsikringsselskaber) to ensure the right balance between our interests and yours.
Sources
  • Your employer
  • Your general practitioner, specialist doctor, hospital/private clinic, psychologist, psychiatrist, psychotherapist, chiropractor, physiotherapist or other practitioners, including alternative practitioners
  • Public authorities, including municipalities, the Danish Tax Agency, the Insurance Complaints Board, courts and other dispute resolution bodies.
  • Public sources, including social media – both current and historical information
  • Private detectives
Storage period  We store your personal data for the entire duration of the scheme and until ten years after the last disbursement has been made, see section 29 of the Insurance Contracts Act and section 8 of the Limitation Act, which deal with legal claims arising from an insurance contract. If a judgment is delivered after the termination of the scheme, the time limit for erasure is ten years from the date of the judgment, if this date is later than ten years after the last transaction, see section 5(3) of the Limitation Act on the limitation of claims established by judgment. 

2.7 Cooperation with Tryg

Cooperation with Tryg 
Purpose of processing

Velliv has entered into cooperation with Tryg Forsikring A/S ("Tryg"). The cooperation means that Velliv and Tryg are joint data controllers in relation to:

  • Tryg's provision of Velliv's life and pension products in Denmark.
  • Velliv's booking of meetings with private customers in Denmark for Tryg.
  • Velliv's provision of Tryg's health insurance and welfare products in Denmark.

Tryg and Velliv are both responsible for ensuring that the storage and exchange of customer data are in accordance with the legislation in force from time to time. This implies, among other things, that each party must ensure that there is a valid processing basis for the processing of personal data, including disclosure, carried out in the course of the activities covered by the joint data controller agreement.

You will find information about Velliv's processing of personal data in the other sections of this Privacy Policy. If you would like more information about Tryg's processing of personal data, you can read more here: Tryg's Data Protection Policy.

Feel free to contact us here, if you need further information about the joint data controller agreement.
Categories of personal data

As stated in the parties' privacy or data protection policies.
Legal basis for processing The processing of personal data in the parties' cooperation is governed by a joint data controller agreement, which follows the GDPR article on joint data controllers.

Each party's processing basis in respect of the services concerned follows from the descriptions in the parties' privacy or data protection policies.

2.8 Velliv and the Danish Centre of Health & Insurance

 Velliv and the Danish Centre of Health & Insurance
Purpose of processing

The Danish Centre of Health & Insurance (Health & Insurance) is an independent association registered in Denmark under business registration (CVR) number 76836310.

Health & Insurance is an advisory knowledge centre for health issues and advises insurance companies and pension funds with the aim of making insurance available to as many people as possible. Velliv is a member of Health & Insurance and uses their advice in connection with the conclusion of insurance and pension agreements.

  • Health & Insurance is an independent data controller for a number of processing activities, including:

    Advice to members (including Velliv)
  • Maintaining of health register
  • Preparation of statistics of significant public importance

When you fill in a health declaration at Velliv, Velliv will, with your consent, pass on the information to Health & Insurance. Consent is required by law under Part 9 of the Financial Business Act on disclosure of confidential information (with effect from 1 January 2024, the Insurance Business Act).

In addition, Velliv will (on behalf of Health & Insurance) obtain your consent to Health & Insurance's processing of your personal data when providing advice to Velliv.


Read more about Health & Insurance's personal data processing here.
Categories of personal data
  • Identifying information
  • Contact details
  • Health information
Legal basis for processing

The legal basis for Velliv's processing of your personal data is the same as described above under section 2.1 on insurance and pension schemes, i.e. as part of the conclusion of an agreement and for the purpose of establishing the legal claims that may arise in connection with your scheme. Velliv's receipt of advice from Health & Insurance on Velliv's legal position thus falls within the scope of this legal basis.

The legal basis for Health & Insurance's processing of your personal data for the purpose of advising Velliv is your consent, see Article 6(1)(a) and Article 9(2)(a) of the GDPR on consent. Our entering into an agreement with you is thus subject to you giving this consent.

The legal basis for Health & Insurance's other processing of your personal data follows from Health & Insurance's data protection policy.
Sources As stated by Health & Insurance in their data protection policy.
Storage As stated by Health & Insurance in their data protection policy.

2.9 Velliv and Velliv Foreningen

Velliv and Velliv Foreningen  
Purpose of processing

Velliv is owned by Velliv Foreningen F.M.B.A (the "Association"), which is registered as an association under business registration (CVR) number 36741422.

The object of the Association is to own Velliv and safeguard the interests of the members in the form of member democracy and payment of members' bonuses. In addition, the Association provides support for non-profit activities in the field of mental health.

As a Velliv customer, you automatically become a member of Velliv Foreningen, which is the independent data controller for the processing of your personal data in connection with your membership. Therefore, Velliv also discloses certain personal data about you to the Association. This includes, for example, information about your customer relationship with Velliv, your name, your contact details, your civil registration number (CPR) and information about your eligible members' bonus, including the basis and amount of bonus.

Your membership of the Association is free. However, you may resign your membership in the Association at any time and waive any members' bonus by contacting the Association directly. Read more about it here. The Association's website for members.
Categories of personal data
  • Contact details
  • Financial information (bonus basis)
  • Civil registration number
Legal basis for processing

The legal basis for Velliv's disclosure of your general personal data to the Association is based on Article 6(1)(f) of the GDPR on the legitimate interests pursued by the Association. The legitimate interests pursued by the Association include customary activities such as membership administration, communication, conducting elections and effecting bonus payments, as well as your interests in benefiting from your rights as a member.

The legal basis for Velliv's disclosure of your civil registration number (CPR) is based on section 11(2)(iii) of the Data Protection Act, as the disclosure is considered to be a natural part of normal customer administration within the financial sector when the disclosure, as in this case, is of vital importance to the Association. This is because the Association needs to be able to uniquely identify you in connection with election procedures, member communication via e-Boks, payment of bonuses via your NemKonto account and the reporting of bonus payments to the tax authorities.

Read more about how the Association processes your personal data, including about the statutory basis for the operation of the Association and your rights in relation to the processing of data, on the Association's website via this link: The Association's privacy policy.
Sources As stated by Velliv Foreningen in their privacy policy.
Storage  As stated by Velliv Foreningen in their privacy policy.

2.10 Velliv and healthcare professionals

Velliv and healthcare professionals
Purpose of processing When setting up a pension and insurance scheme with Velliv, you will be presented with a health declaration. In order to collect relevant information from healthcare professionals (e.g. general practitioners, private hospitals, etc.), the healthcare professional must obtain your consent to their disclosure of your health information to us. Our entering into an agreement with you is subject to you giving this consent.

 
Categories of personal data
  • Identifying information
  • Contact details
  • Health information
Legal basis for processing  The legal basis for the healthcare professionals' disclosure of your health information follows from section 43(1) of the Health Act on patient consent to the healthcare professional's disclosure of health information to private undertakings (Velliv). The consent is valid for one year at a time.

2.11 Statistics and analyses

 Statistics and analyses
Purpose of processing

We process your personal data when we compile statistics and prepare analyses, including internal surveys and analyses, product development, actuarial calculations and cost-benefit analyses.

All information related to our use of cookies is not described here, but in our cookie policy. See also section 2.19 on the use of our website.
Categories of personal data
  • Identifying information (selected)
  • Contact details (selected)
  • Financial information
  • Insurance and pension information
  • Behavioural data
Legal basis for processing The legal basis for Velliv's processing of your personal data is Article 6(1)(f) of the GDPR on processing necessary for Velliv to pursue a legitimate interest, as we as a company have a legitimate interest in developing our products. We secure the balancing of interests by using depersonalised personal data where possible.
Sources
  • Public sources
  • Our internal systems
Storage period  We store statistics and/or analyses in depersonalised form.

2.12 Satisfaction surveys and feedback

Satisfaction surveys and feedback
Purpose of processing We would like to conduct occasional satisfaction surveys and receive other relevant feedback. For this purpose, we use your personal data to ask for your participation in a survey and process your answers. Surveys are usually conducted by means of questionnaires, customer satisfaction surveys or market research. Any survey will be used solely to improve our service and will not be published using personal data.
Categories of personal data
  • Identifying information
  • Contact details
  • Your answers
Legal basis for processing

The legal basis for Velliv's processing of your personal data in order to ask for your participation in a given survey is Article 6(1)(f) of the GDPR on a legitimate interest. The legitimate interest is that we pursue general customer-oriented activities to improve our services without disregarding your essential interests. You have the right to object to our interests by writing to us with a description of your own concerns. See section 3.2 about your rights.

The legal basis for Velliv's processing of your personal data for the purpose of conducting a survey is Article 6(1)(a) of the GDPR on consent. You have the right to withdraw your consent at any time by contacting us. Withdrawal of consent will apply to future processing. If you do not wish to participate, this will have no adverse consequences for or impact on your scheme with us.

 
Sources
  • Questionnaire answers
  • Business partners
Storage period  Information from our surveys is stored for up to five years. We store the results in depersonalised form where possible and have a long storage period to be able to measure our performance and service levels over time.

2.13 Velliv's tests and panels

Velliv's tests and panels
Purpose of processing We would like to conduct user tests and collect other relevant feedback from you as a customer about Velliv. We use your personal data to ask if you would like to participate in a test and if you would like to participate in one of Velliv's panels. In that case, your personal data will be processed in order to process test answers and to administer your participation in the panel – including inviting you to new tests in relation to the panel. The tests usually take the form of questionnaires. Some tests involve video recording of you and sometimes recording of your facial and eye movements, but only with your knowledge. All tests are voluntary and will be used solely to develop and improve our products and services. Your personal data will not be published.
Categories of personal data
  • Identifying information
  • Contact details
  • Insurance information
  • Your answers
  • Behavioural data – If relevant, biometric data, but not used to identify you
Legal basis for processing

The legal basis for Velliv's processing of your personal data in order to ask for your participation in Velliv's test and panel, administering your participation in Velliv's test and panel and conducting a test is Article 6(1)(f) of the GDPR on a legitimate interest. The legitimate interest is that we pursue general customer-oriented activities to improve our services without disregarding your essential interests. You have the right to object to our interests by writing to us with a description of your own concerns. See section 3.2 about your rights

The legal basis for Velliv's processing of your personal data for the purpose of conducting video-recorded interviews where your facial and eye movements are recorded is Article 6(1)(a) of the GDPR on consent. You have the right to withdraw your consent at any time by contacting us. Withdrawal of consent will apply to future processing. If you do not wish to participate, this will have no adverse consequences for or impact on your scheme with us.

The legal basis for Velliv's processing of civil registration numbers is section 11(2)(ii) of the Data Protection Act, which allows private undertakings to process civil registration numbers where consent has been obtained from the data subject.

 
Sources
  • Questionnaire answers
  • Business partners
Storage period We process your personal data for as long as you are a panellist. Your test answers are depersonalised within 90 days of receipt. If you are not a panellist but have participated in a test, the information about your participation will be erased at the same time as the test answers are depersonalised. If you receive a gift, your data will be stored for five years.

2.14 Marketing

 Marketing
Purpose of processing We process your personal data for marketing purposes. This includes sending newsletters, emails and text messages about Velliv's services and news about customer advantages, events, competitions and about the activities and focus areas of Velliv Foreningen, in addition to information about our partners' services. If you have agreed to receive marketing material or newsletters from Velliv, we use your personal data for compilation purposes and so that we can target our marketing and communication specifically to you. The targeting is based on segmentation. Velliv will use segmentation to improve the content and relevance of our direct marketing and thus increase the impact.
Categories of personal data
  • Identifying information
  • Contact details
  • Behavioural data
  • Financial information
  • Insurance and pension information
  • Civil registration number
Legal basis for processing

The legal basis for Velliv's processing of your personal data with regard to the targeting of marketing material is Article 6(1)(f) of the GDPR on processing necessary for Velliv to pursue a legitimate interest. The legitimate interest is that we pursue our interest in targeting the marketing material we send to you without disregarding your interests. It is essential to us that:

  • you have an interest in receiving marketing material that is relevant to you
  • the processing is relatively straightforward
  • there is no profiling or pooling of data from different external sources and/or platforms, e.g. social media
  • you as a customer have given voluntary consent
  • you were informed of an easy way to opt-out of this processing when you gave your consent.

You have the right to object to our interests. Contact us about this – see section 1.1 on how to contact Velliv. See section 3.2 about your rights.

The legal basis for Velliv's processing of your personal data for the purpose of contacting you with marketing material is Article 6(1)(a) of the GDPR on consent.

You have the right to withdraw your consent at any time by contacting us. Withdrawal of consent will apply to future processing.

If you do not wish to give your consent, this will have no adverse consequences for or impact on your existing scheme with us.

The legal basis for Velliv's processing of your personal data for the purpose of documenting that our direct marketing to you was in accordance with the marketing rules is Article 6(1)(c) of the GDPR on processing necessary for compliance with a legal obligation to which Velliv is subject under the Danish Marketing Practices Act (markedsføringsloven).


The legal basis for Velliv's processing of civil registration numbers is section 11(2)(ii) of the Data Protection Act, which allows private undertakings to process civil registration numbers where consent has been obtained from the data subject.

 
Sources
  • Business partners
  • The Central Office of Civil Registration (CPR), the Central Business Register (CVR)
Storage period  We process your personal data for marketing purposes for as long as it is relevant, but never longer than three years after termination of the agreement with you. If you have consented to marketing, we will process the data until the time of your withdrawal of consent. However, we retain the information that enables Velliv to ensure documentation in accordance with the rules of the Marketing Practices Act for up to two years from the time we last contacted you with direct marketing. 

2.15 Recording and transcription of telephone conversations and online meetings

Recording and transcription of telephone conversations and online meetings
Purpose of processing We process your personal data to ensure the quality of our case administration.
Categories of personal data
  • Identifying information (selected)
  • Content of the conversation
Legal basis for processing

For quality assurance purposes, the legal basis for Velliv's processing of your personal data is Article 6(1)(a) and Article 9(2)(a) of the General Data Protection Regulation regarding consent. You will be presented with the consent – either by phone at the start of the conversation or before the recording of the online meeting is initiated.
You have the right to withdraw your consent at any time by contacting us. Withdrawal of consent will apply to future processing.
If you do not wish to participate, this will have no adverse consequences for or impact on any offers from us or your existing scheme(s) with us.
Sources
  • You
Storage We store your recordings for three months for the purpose of quality assurance.

2.16 Other contact

Other contact 
Purpose of processing When you communicate with us using our contact form or by email or telephone, we process your personal data in order to respond to or otherwise accommodate your enquiry.
Categories of personal data
  • Contact details
  • Identifying information (selected)
  • Content of the inquiry
Legal basis for processing

The legal basis for Velliv's processing of your personal data is Article 6(1)(f) of the GDPR on processing necessary for Velliv to pursue a legitimate interest without disregarding your rights, as we only process what is necessary to respond to your enquiry.

 

If you contact Velliv as an existing customer, or wish to become a customer, the enquiry will be subject to section 2.1 on insurance and pension schemes.
Sources Your enquiry
Storage period  We store correspondence for up to six months after last contact.

If you are a customer of Velliv and your enquiry concerns your customer relationship, the same storage period as in section 2.1 on insurance and pension schemes applies.

2.17 Social media

Social media
Purpose of processing

We use social media to promote our brand and products, and to communicate with various stakeholders. We do so on the terms provided by the social media concerned and according to our own guidelines, which you can read about here.

Velliv and the social media are considered joint data controllers, and you should be aware that the social media process information about you independently. You can find the joint data protection agreement with the social media which we use here:

You can read the social media privacy policy here:
Categories of personal data
  • Identifying information (selected)
  • Social media statistics and analysis reports
Legal basis for processing The legal basis for Velliv's processing of your personal data is Article 6(1)(f) of the GDPR on processing necessary for Velliv to pursue a legitimate interest without disregarding your interests because your participation on social media is voluntary for you on the terms applicable on the social media.
Sources Our social media profile
Storage  We store social media data for up to three years, continually deleting or depersonalising reports etc. that no longer need to be stored.  

2.18 Video surveillance at Velliv's domicile

Video surveillance
Purpose of processing

Video surveillance is in operation at several points at Velliv's building, Lautrupvang 10,

2750 Ballerup, to document who has and has had access to the building.
Categories of personal data
  • Identifying information (selected)
  • Potential criminal offences
  • Behavioural data – the information that may appear in the video recordings
Legal basis for processing The legal basis for Velliv's processing of your personal data is Article 6(1)(f) of the GDPR on processing necessary for Velliv to pursue a legitimate interest. The legitimate interest is crime prevention and detection. You have the right to object to our interests by writing to us with a description of your own concerns. See section 3.2 about your rights. The legal basis for Velliv's processing of criminal offence data is the second sentence of section 8(3) of the Data Protection Act on processing that may take place if necessary for the purpose of safeguarding a legitimate interest and this interest clearly overrides the interests of the data subject.
Sources You
Storage  As a general rule, we store the video recordings for 30 days, except in the case where we have established an incident that requires a longer retention period.

2.19 Use of our websites and emails

 Use of our websites and emails
Purpose of processing

When you use our websites, we collect personal data about your use. For this we use "cookies" which remember your preferences for the use of the website and for statistical purposes.

In order to show you videos from youtube.com on our website, a cookie from google.com is embedded for Google's marketing purposes if you have given your consent. See also section 2.17 about social media.

To better target our messages, we collect your click behaviour in our emails. If you do not want us to carry out this processing, you can easily opt out by writing to us at velliv.dk/contact. See also section 2.14 about marketing.

If you contact us via email, website or apps – see section 2.16 Other contact

 
Categories of personal data
  • Behavioural data
Legal basis for processing

The legal basis for Velliv's processing of your personal data is Article 6(1)(f) of the GDPR on processing necessary for Velliv to pursue a legitimate interest. The legitimate interest is to optimise our websites by using necessary cookies. As far as collecting your click behaviour in emails is concerned, our interest is that you receive relevant messages. You have the right to object to our interests by writing to us with a description of your own concerns. See section 3.2 about your rights.

The legal basis for Velliv with regard to processing necessary to collect information about your preferred settings and choices on the website and to keep statistics is Article 6(1)(a) of the GDPR on consent that you give during your visit to the website, including your acceptance of cookies.

You have the right to withdraw your consent at any time by using our consent solution on our website.

See more about marketing here.

See more about cookies here.
Sources You
Storage It varies how long a particular cookie is stored on your devices and browsers. A cookie's lifespan is calculated on the basis of your last visit to the website. Once the cookie's lifespan expires, it is automatically deleted. Read more about the lifespan of cookies in our cookie policy.

2.20 Velliv’s events

 Velliv’s events
Purpose of processing

We process your personal data in order to organise the event you have registered for and to keep in touch with you before, during and after the event. These include webinars and physical events such as speaking engagements and inspirational seminars.

We also process your personal data in order to send you invitations to certain events. Furthermore, we process your personal data in order to provide lists of participants and name badges to participants at Velliv's physical events. We do not share any contact information about you in connection with webinars.

In addition, we can send you satisfaction surveys – see section 2.12. Furthermore, we process your health information if you inform us about allergens and the like when participating in a physical event with catering.

 
Categories of personal data
  • Identifying information
  • Contact details
  • Health information – if catering is included in the event and we need to be aware of allergens. Information about allergens will not be stored after the event.
Legal basis for processing

The legal basis for Velliv's processing of your personal data is Article 6(1)(b) of the GDPR on processing necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract. Furthermore, the legal basis for the processing is Article 6(1)(f) of the GDPR on processing necessary for Velliv to pursue a legitimate interest. The legitimate interest is to ensure that Velliv can invite to events, manage events, and offer participants at Velliv's physical events transparency as to who is attending and allow participants to create professional networks.

You have the right to object to our interests by writing to us with a description of your own concerns. See section 3.2 about your rights.

The legal basis for Velliv's processing of sensitive personal data – your allergens – is Article 9(2)(f) of the GDPR on processing necessary to protect you against loss and damage due to an allergic reaction.
Sources You
Storage  We store your personal data as long as necessary to fulfil the purpose for which the data is processed.

2.21 B2B – If you are the contact person with a company that has contact and perhaps an agreement with Velliv.

 B2B – If you are the contact person with a company that has contact and perhaps an agreement with Velliv.
Purpose of processing We process your personal data in order to manage the contact with the company you are employed by. The processing of your personal data may be included in the management of the agreement entered into with Velliv. It may also be used as part of costumer relations – i.e. in relation to the company you are employed by.
Categories of personal data
  • Identifying information
  • Contact details
  • Behavioural data
Legal basis for processing The legal basis for Velliv's processing of your personal data is Article 6(1)(f) of the GDPR on processing necessary for Velliv to pursue a legitimate interest. The legitimate interest is to ensure Velliv's right to set up and run our own business as we choose. In addition, the legitimate interest is to secure Velliv's legal position. You have the right to object to our interests by writing to us with a description of your own concerns. See section 3.2 about your rights.

Sources
  • You
  • The company you are employed by
Storage We store your personal data as long as necessary to fulfil the purpose for which the data is processed.

 

3. General provisions

 

3.1 Recipients of personal data

For many of our processing activities, we use data processors who assist us with IT or other services. When we use data processors, we always conclude a data processing agreement, setting out the nature of the processing, the purposes, the type of personal data, the categories of data subjects and the period.

We disclose personal data to Velliv Foreningen as described in section 2.9.

After your death, we may disclose your personal data to persons connected to your Velliv scheme, such as your beneficiary. See section 2.2.

We disclose personal data to authorities and other third parties (e.g. the Danish FSA, the Danish Tax Agency, lawyers, auditors, the police or the Special Crime Unit) when we are required to do so under the law or in order to safeguard our interests in a legal dispute.

The legal basis for disclosure of general personal data will typically be Article 6(1)(c) of the GDPR on processing necessary for compliance with a legal obligation. For sensitive personal data, the legal basis will typically be Article 9(2)(f) of the GDPR on processing necessary for the establishment, exercise or defence of legal claims. Alternatively, the legal basis can be Article 9(2)(g) of the GDPR on processing necessary for reasons of substantial public interest, on the basis of Union or Member State law. It depends on the situation, and you will be informed unless confidentiality is required. Under Part 9 of the Financial Business Act (disclosure/use of confidential information) (with effect from 1 January 2024, the Insurance Business Act), we obtain your consent to disclosure/use where we are required to do so.

In connection with IT operations, including hosting, development and support, we may in certain cases disclose personal data to companies established in a country outside the EU/EEA. When Velliv discloses your personal data to third parties outside the EU and EEA, we ensure that your personal data and data protection rights are adequately protected by ensuring either:

  • that the European Commission has decided on the adequacy of the level of protection
  • that standard contracts approved by the European Commission or the Data Protection Agency are being used
  • that complementary measures are being implemented for those third countries where the legislation of the country concerned so requires.

For further information about Velliv's disclosure of your personal data to third countries, please write to our Data Protection Officer here.

Velliv will inform each recipient to whom your personal data has been disclosed of any rectification or erasure of the personal data or restriction of processing carried out, unless this proves impossible or involves disproportionate effort. The legal basis for this disclosure is Article 19 of the GDPR.

 

3.2 Your rights

Under the GDPR, you have various rights in relation to our processing of information about you.

If you wish to exercise your rights, please contact your adviser by email or phone, or write to our Data Protection Officer here. We handle access requests via indsigt@velliv.dk.

  • Right of access to personal data: You have the right to access the personal data we process about you, including receiving a copy.
  • Right to rectification: You have the right to have inaccurate information about you rectified.
  • Right to erasure: In particular situations, you have the right to have your personal data erased before our storage period expires.
  • Right to restriction of processing: In certain cases, you have the right to obtain restriction of processing of your personal data. If you have the right to obtain restriction of processing, we may in future only process data – except for storage – with your consent or for the purpose of establishing, exercising or defending legal claims or for the purpose of protecting the rights of another person or for reasons of important public interest.
  • Right to object: In certain circumstances, you have the right to object to our processing of your personal data. You may also object to our processing of your data for direct marketing purposes.
  • Right to data portability: You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format and the right to have personal data transmitted from Velliv to another controller without hindrance.

We will respond within 30 days.

You can read more about your rights in the Danish Data Protection Agency's guide to the rights of data subjects available here.

3.3 Complaints procedure

You have the right to lodge a complaint with the Danish Data Protection Agency if you are unhappy with the way we process your personal data. We always encourage you to contact us beforehand. You can find information about the Danish Data Protection Agency's complaints procedure here.