1. Introduction

We process your personal data in connection with a delivery we are to make to you. Therefore, we have adopted this privacy policy (the “Privacy Policy”), which describes how we process your personal data.
The Privacy Policy has been prepared with reference to the rules in the General Data Protection Regulation (Regulation on the protection of natural persons in connection with the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (the “GDPR”) and the Danish Data Protection Act (Act No. 502 of 23/05/2018 with any subsequent amendments) (the “Data Protection Act”).

2. Information about the Data Controller

The data controller for the processing of personal data under this Privacy Policy is:
RTC Transport A/S, Abildager 8-14 2605 Brøndby, CVR number: 29445125 (hereinafter “RTC”, “we” and “us”).
We are the data controller when we process your personal data. This also applies in cases where we process the personal data together with our partners.

If you have any questions about our processing of personal data, you can contact our GDPR-team, by email at [email protected]

3. Processing Activities

3.1 Website Visitors

When you visit our website www.rtctransport.dk, we use cookies to optimise the website and its functionality, thereby making your visit as easy as possible for you. We collect personal data via the web analytics tool Google Analytics.
You can delete cookies from your computer at any time, depending on your browser.
When personal data is collected via our website, we ensure that it is always done with your explicit consent, so that you are informed about exactly what data is being collected and why.

3.1.1 Purpose

We use the personal data for statistics and behaviour patterns on our website to continuously improve the customer experience and the website’s performance.
The purpose of processing personal data is that it is in our interest to provide you with the best visit experience on our website.

3.1.2 Legal Basis

We collect and process personal data based on your consent, cf. Article 6(1)(a) of the GDPR.

3.2 Purchase of Services (delivery, installation, etc.)

When you purchase one or more of our services, we process a range of your personal data.

3.2.1 Types of Personal Data

We process the following personal data:

• Name
• Address
• Email address
• Telephone number

In certain cases, we also process:

•  Your voice
• Health information

3.2.2 Purpose

The purpose of processing your personal data is to be able to deliver the services you have ordered and otherwise fulfil our agreement with you, including to be able to manage your rights, e.g. in relation to a complaint.

3.2.3 Legal Basis

Processing of the aforementioned personal data is based on several different legal bases:

• Consent to processing (Article 6(1)(a)): the data subject has given consent to the processing of their personal data for one or more specific purposes.
• Legitimate interests (Article 6(1)(f)): processing is necessary for the data controller or a third party to pursue a legitimate interest.

3.3 Other Processing

3.3.1 Recording of Conversations

When we record the conversation with you, we process a range of your personal data. We process the following personal data:

• Name
• Order number
• Your voice

In certain cases, we also process:

• Your address
• Health information

3.3.2 Purpose

We have an interest in using the recording for quality assurance and documentation purposes.
Quality assurance means, for example, that the conversations are listened to together with our employees to ensure that correct answers are given, that we comply with our agreements, and that you receive the level of service we aim to provide.
Documentation purposes mean, for example, that the purpose of the recording is to be able to document or clarify doubts about agreements or conversations with us.

3.3.3 Legal Basis

Recording of the conversation is based on Article 6(1)(f) of the GDPR, i.e. we may record the conversation and process the personal data that appears in the specific conversation and recording. We have a legitimate interest in ensuring that our employees give correct answers and ensure that our customers have a good customer experience. In addition, we also have a legitimate interest in being able to resolve disputes and similar in connection documentation purposes.

3.3.4 Deletion

We store the conversations securely and in accordance with the data protection rules on processing security.
We automatically delete the recordings after 1 month. If a recording is involved in a specific complaint case or a warranty case, the conversation is only deleted when this or these case(s) or event(s) are finally concluded in accordance with the limitation rules, cf. Article 6(1)(f) of the GDPR.

4. Storage

Unless otherwise stated in the description of the specific processing activities above or in the table in this section, we only store your personal data as long as it is necessary to fulfil the purpose for which it was collected. This means that every time we collect your personal data, we assess how long your data should be stored.

5. Collection

We collect your personal data in three ways:

• Information we collect when you visit our website.
• Information you provide to us, e.g. when you purchase one of our services through our customer service.
• Information we may receive about you from third parties when you purchase one of our services, e.g. through one of our partners.

You can read more about the collection and our further processing above in section 3 ‘Processing Activities’.

6. Disclosure

6.1 Partners

We use partners in various situations, e.g. to support our business. When we use partners, we may need to share your personal data with them. Our use of partners is typically to support our business, e.g. in connection with the delivery of our services and products, administration, billing, development, etc.

When we share your personal data with our partners, we ensure the necessary guarantees and security measures. We do this by making a so-called data processing agreement with them. If our partner is located outside the EU/EEA, we make an agreement that complies with the EU-approved standards for the transfer of personal data.

7. Consent

If we have wholly or partly based the processing of your personal data on consent, you have the right to withdraw this consent at any time. You can use the contact details in section 2 for this purpose.
If you choose to withdraw your consent, it does not affect the legality of our processing of your personal data based on your previously given consent up to the time of withdrawal. If you withdraw your consent, it therefore only takes effect from that time.

8. Your Rights

You have a number of rights under the GDPR and the Data Protection Act.
If you contact us to gain insight into your data or otherwise exercise your rights, we need to ensure that it is the correct person who has contacted us. We will therefore confirm your identity in a relevant way before giving you access to your data.

8.1 Right of Access

You have the right to have confirmed whether personal data about you is being processed and to receive a printout or a copy of the personal data, cf. Article 15 of the GDPR. If we have recorded a telephone conversation with you, you can request to receive an audio recording.
In addition, you have the right to receive the following information:

• The purposes of the processing and information about the affected categories of personal data, including where the personal data originates from if it is not collected from you.
• The recipients or categories of recipients to whom the personal data is or will be disclosed, particularly recipients in third countries or international organisations.
• If possible, the intended period for which personal data will be stored, or if this is not possible, the criteria used to determine this period.
• The right to lodge a complaint with a supervisory authority, including the Danish Data Protection Agency or the Danish Business Authority.
• You also have the right to receive information about necessary guarantees if we have transferred personal data to third countries.

8.2 Data Portability

You have the right under Article 20 of the GDPR to receive personal data about yourself, which you have provided to us, in a structured, commonly used, and machine-readable format.
Access to data portability only includes data you have provided yourself and will only cover processing that is carried out automatically and based on consent or a contract with you.

8.3 Right to Rectification

You have the right under Article 16 of the GDPR to have incorrect personal data about yourself rectified by us without undue delay.
Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed. This right supplements our own fundamental obligation to continuously ensure that only correct and up-to-date data is processed, cf. Article 5 of the GDPR.
The right to rectification only concerns objective personal data and not subjective assessments.

8.4 Right to be Forgotten

You have the right under Article 17 of the GDPR in certain cases to have personal data about yourself registered with us deleted.
You can, among other things, request deletion if personal data is no longer necessary to fulfil the purposes for which it was collected, if your legitimate interests in objecting to the processing outweigh our legitimate interests in retaining personal data, or if personal data has been processed unlawfully.
You cannot request deletion if the processing is necessary to comply with a legal obligation or to establish, exercise, or defend legal claims, cf. Article 17(3)(b) and (e) of the GDPR.

transferred to other data controllers or data processors, we must notify these data controllers or data processors that you have requested to have your personal data deleted, cf. Article 19 of the GDPR.

8.5 Right to Object and Right Not to be Subject to Automated Decisions

You have the right to object to the processing of your personal data if the processing is based on Article 6(1)(e) (performance of tasks in the public interest) or (f) (legitimate interests) of the GDPR or on automated processing, including profiling, cf. Articles 21 and 22 of the GDPR.
If you object, we may no longer process the personal data in question unless we can demonstrate compelling legitimate grounds for the processing that override your interests, or if the processing is necessary to establish, exercise, or defend legal claims.
This right does not apply if the processing is necessary for the conclusion or performance of a contract between you and us, if the processing is authorised by law, or if the processing is based on your explicit consent.

8.6 Right to Restriction of Processing Activities

You have the right under Article 18 of the GDPR to have the processing of personal data restricted if:

• The accuracy of the personal data is contested by you, but only for the period during which we have had the opportunity to determine whether the personal data is accurate,
• The processing is unlawful, and you oppose the deletion of personal data and instead request that its use be restricted,
• We no longer need the personal data for the processing, but it is necessary for the establishment, exercise, or defence of legal claims, and
• You have objected to the processing under Article 21(1) of the GDPR, but only for the period during which it is being determined whether our legitimate interests override your legitimate interests.

It follows from Article 21(2) of the GDPR that if processing has been restricted, such personal data, apart from storage, may still be processed, among other things, if you consent to it, or if the processing is necessary to establish, exercise, or defend legal claims.

8.7 You Can Complain to the Danish Data Protection Agency

You have the right to lodge a complaint with the Danish Data Protection Agency if you are dissatisfied with the way we process your personal data.
Danish Data Protection Agency
Carl Jacobsens Vej 35
2500 Valby
Telephone: +45 33 19 32 00
[email protected]
www.datatilsynet.dk

9. Changes

We continuously review the Privacy Policy and update it if there are changes in our processing of personal data.
Any changes will be published here.