Version: April 2025
In connection with renting out homes to local tenants, the DIS Foundation and DIS Stockholm AB (DIS) will, as central data controller, collect and process personal data regarding tenants in Denmark.
1. Categories of personal data and purposes
We collect and process the following types of personal data:
Non-sensitive categories of personal data: contact and ID information, application information and essays, educational information, financial information, housing preferences and details, and case information and bias reporting information (only if applicable).
If relevant to the housing allocation process, personal data regarding serious allergies or food restrictions may be processed with the consent of the data subject.
Personal data is processed for the following purposes:
- In efforts to fulfill DIS's mission, including the commitment to DIS's values and diversity and respect
- To support the best possible relationships between DIS students and tenants
- To fulfill the agreement between DIS and residents
- For statistical and research-related purposes
- To comply with applicable personal data regulations and other legitimate interests, e.g.:
- Documentation requirements
- Compliance with fundamental principles and legal grounds for processing personal data
- Establishing, maintaining and testing technical and organizational security measures
- Investigation and reporting of suspected cases of violation of personal data regulations
- Processing of any inquiries and complaints from registered persons and others
- Processing of any inspections and inquiries from supervisory authorities
- Handling of any disputes between registered persons and third parties
2. Sources
Personal data is collected from tenants in virtually all cases mentioned in this privacy policy. Exceptions are details from internal case notes and bias reporting information, which is processed if relevant, and which in such case may originate directly from the tenant, DIS students, or representatives of DIS.
3. Legal basis for the collection and processing of personal data
The legal basis for collecting and processing contact and ID information, financial information, and educational information:
- Based on GDPR Article 6(1)(b), processing is necessary for the performance of a contract to which the data subject has entered or in order to take steps at the data subject's request prior to entering into a contract
When DIS collects personal data directly from tenants in order to enter into a contract, tenants are obliged to provide information. DIS and tenants would not be able to enter into an agreement without this information.
The legal basis for collecting and processing tenant contact information, application information and essays, housing preferences and details, and case information and bias reporting information (only where applicable) is the following:
- Based on GDPR Article 6(1)(f), processing is necessary for the purposes of the legitimate interests pursued by the controller.
DIS collects personal data directly from tenants for the legitimate purposes of recruiting tenants through newsletters, ensuring a safe living environment, ensuring the best possible housing allocation for both local tenants and DIS students, and fulfilling service requests. Tenants are obliged to provide the information to DIS, but have the right to object that their legitimate interests as individuals outweigh DIS's legitimate interests as an organization. Tenants have the same obligations and rights regarding internal case and bias reporting information, if applicable. In such cases, DIS pursues its legitimate interests. DIS is to keep an internal record when necessary to maintain quality and consistency of service and to best pursue the fulfillment of the agreement with the residents and the DIS students with whom they live and the DIS mission in all its parts.
To make this claim, tenants must contact DIS' Data Protection Officer ( dataprotectionofficer@dis.dk ) and explain in detail which legitimate interest they are objecting to and why their interest outweighs DIS's in the specific case. Tenants can directly object to the processing of newsletters by clicking unsubscribe.
The legal basis for collecting and processing tenants' information about serious allergies and food restrictions is the following:
- Based on GDPR Article 6(1)(a), processing of personal data based on the consent of the data subject for one or more specific purposes
When DIS collects this type of personal data directly from tenants, the information is provided voluntarily. Tenants are not obligated to provide this information to DIS. This sensitive personal data is only processed when tenants themselves share it.
4. Disclosure of personal data to other data controllers
Relevant personal data will be disclosed to and shared with the following recipients:
- Cleaning and maintenance companies affiliated with DIS housing.
- Your local municipality, if they want to know
- The other local residents at your residence
The legal basis for disclosing tenants' contact information to cleaning and maintenance companies, as well as information about room availability to other local residents at your residence, is the following:
- Based on GDPR Article 6(1)(f), processing is necessary for compliance with a legal obligation to which the controller is subject
The legal basis for informing the local municipality about tenants' contact information is the following:
- Based on GDPR Article 6(1)(c), processing is necessary for compliance with a legal obligation to which the controller is subject.
5. Transfer of personal data to data processors
DIS transfers personal data to IT suppliers who process and/or store personal data on behalf of DIS.
DIS transfers contact, ID and financial information to a housing company that processes rent payments and other administrative tasks on behalf of DIS.
DIS transfers contact and ID information to the DIS app, on which residents record their own interactions.
6. International transfers of personal data to recipients (data controllers as well as processors) in countries outside the EU/EEA
We transfer personal data to the following recipients in countries outside the EU/EEA:
Transfer of personal data to a third country or an international organizationRecipient category:
IT suppliers, incl. Mailchimp, Sendgrid, StarRez, Pathify, Papertrail, Freshservice, Pixlee
Country: United States
☒ EU standard contracts – for data processors
EU standard contractual transfer basis means that DIS and the other organization(s) have accepted additional contractual language from the EU that protects the legal rights that Tenant has as a data subject, even if Tenant's personal data is shared outside the EU. Tenant has the right to obtain a copy of these clauses, which can be requested by contacting dataprotectionofficer@dis.dk.
7. Retention period
DIS stores personal data for as long as necessary to fulfil the above purposes. Personal data of applicants who do not become residents is deleted annually. Applicants on the waiting list are contacted several times a year for consent to continued storage and all personal data about them is deleted, if not annually. Financial information is stored for the mandatory period based on relevant legislation and all personal data about residents is deleted in the following year after moving out of DIS housing.
8. Tenant's rights
Under the terms of the applicable personal data legislation, you have the following rights:
- Right to request access to personal data
- Right to correction of personal data
- Right to have personal data deleted
- Right to restriction of processing of personal data
- Right to data portability
- Right to object to the processing of personal data
Tenants also have the right to lodge a complaint with the supervisory authority, such as the Danish Data Protection Authority. The Danish Data Protection Authority's website www.datatilsynet.dk provides guidance on how to lodge a complaint.
9. Contact
Host partners can contact DIS if they have questions about the protection of their personal data or if they wish to assert their legal rights.
Contact information for data controller:
DIS Foundation – Danish Institute for Study Abroad
Vestergade 7
DK-1456 Copenhagen K.
Organization number in Denmark: DK13058946
Telephone: +45 33 11 01 44
DIS Stockholm AB
Melodislingan 21
115 51 Stockholm
Organization number in Sweden: 559021-1206
Contact information for DIS's Data Protection Officer:
Mail: dataprotectionofficer@dis.dk
Telephone: +45 33 76 54 36