Privacy Policy for B. G. Montage ApS

1. Purpose of this Privacy Policy

This privacy policy describes how B. G. Montage ApS collects, processes, and protects your personal data. Our goal is to ensure transparency and inform you about your rights regarding the processing of your data, in order to maintain trust and comply with applicable data protection legislation.

2. Data Controller

We are the data controller for the processing of personal data concerning our customers and business partners. Our company is not required to appoint an external DPO, as we do not carry out systematic or large-scale monitoring of individuals, do not process special categories of personal data on a large scale, and are not a public authority. However, we comply with GDPR requirements by implementing appropriate security measures and data protection procedures.

If you have questions about how your personal data is processed, you can contact us at [email protected]. Our data processor processes personal data on behalf of the data controller, following agreed instructions, as defined in Article 4(8) of the GDPR.

Data Controller:
Birger Glud Jensen
Email: [email protected]
Phone: +45 4040 9017

Data Processor:
Pernille Jensen
Email: [email protected]
Phone: +45 2240 6203

3. Processing Activities

• Employee Data:
  Data: Name, address, CPR number, contact details, salary information, identification data, courses.
  Purpose: To manage recruitment and employment, payroll, and legal compliance.
  Legal Basis: Performance of employment contract (GDPR Article 6(1)(b)) and legal obligations (GDPR Article 6(1)(c)).
• Customer Data:
  Data: Name, address, contact details, payment and billing information, project description, project data, contract details.
  Purpose: Communication regarding tenders, preparation, planning, and execution of construction work for private and corporate clients, as well as invoicing.
  Legal Basis: Necessary for contract performance (GDPR Article 6(1)(b)) and legal obligations (GDPR Article 6(1)(c)).

• Cookies and Website Tracking:
  Data: Information about your device, IP address, browser settings, and how you interact with our website (e.g. clicks, page views, and interactions). When you submit information via our contact form, it is received in a secure customer database system. Information may be shared with analytics and marketing partners such as Google and Meta and is stored only as long as necessary. You can change your cookie settings or withdraw consent at any time via our website.
  Purpose: To improve user experience and analyze website traffic. Cookies are used to ensure website functionality.
  Legal Basis: Executive Order on Cookies §3, cf. GDPR Article 6(1)(f) (legitimate interest in maintaining website functionality and security), and §4, cf. GDPR Article 6(1)(a) (consent).

• CCTV Monitoring on Company Premises:
  Data: Video recordings of individuals on monitored premises.
  Purpose: CCTV is used to ensure the safety of employees, customers, and visitors, and to prevent or document criminal activity such as theft or vandalism. Recordings are stored for a limited period, typically 30 days, unless longer retention is necessary. Access is restricted to authorized personnel.
  Legal Basis: GDPR Article 6(1)(f).
• Marketing and Customer Communication:
  Data: Name, email, phone number, photos of projects, project descriptions (anonymized if consent is not given).
  Purpose: Use of customer projects as references, marketing materials, and offers.
  Legal Basis: Consent (GDPR Article 6(1)(a)).

4. Information We Collect

We collect the following categories of data related to the above activities:

• Name, address, phone number, and email.
• Project data such as drawings, descriptions, and documentation.
• Billing information including payment data and history.
• Video footage from CCTV on company premises.
• Technical data from website visits (IP address, cookies, browser data).

5. Retention and Deletion

• Tenders and project documentation: Stored for at least 5 years under Building Regulations BR18 and AB18.
• Financial data: Stored for 5 years under the Danish Bookkeeping Act.
• CCTV recordings: Stored for a maximum of 30 days unless linked to a criminal investigation.
• Cookies: Retained according to our cookie policy, typically between 6 and 24 months.

6. Disclosure of Personal Data

• Data: May include name, address, contact details, financial information, and other relevant data depending on the recipient.
• Purpose: To meet legal obligations such as reporting to tax authorities, using necessary IT and operational service providers, and ensuring compliance with applicable laws and regulations.
• Legal Basis: GDPR Article 6(1)(c) (legal obligation) and Article 6(1)(f) (legitimate interest in efficient operations).

7. Data Security

• Data: All personal data we store and process, including ordinary and potentially sensitive data.
• Purpose: To protect data from unauthorized access, loss, or alteration; to comply with GDPR’s security requirements; and to minimize the risk of data breaches while ensuring lawful processing.
• Legal Basis: GDPR Article 32 (security of processing), Article 6 (lawful processing of ordinary personal data), and Article 9 (sensitive data).

8. Withdrawal of Consent

• Data: Personal data previously processed based on consent, e.g. for communication or marketing purposes.
• Purpose: To allow data subjects to withdraw consent and stop further processing of their data, ensuring transparency and respect for individual rights.
• Legal Basis: GDPR Article 7(3) (right to withdraw consent).

9. Your Rights

Under GDPR, you have the following rights:
– Right of access (Article 15): You may request access to the data we hold about you.
– Right to rectification (Article 16): You may have inaccurate information corrected.
– Right to erasure (Article 17): You may request deletion of your data unless we are legally required to retain it.
– Right to restriction (Article 18): You may request restricted processing in certain cases.
– Right to data portability (Article 20): You may receive your data in a structured, commonly used, and machine-readable format.
– Right to object (Article 21): You may object to processing based on legitimate interests or direct marketing.

10. Complaints to the Danish Data Protection Agency

To exercise your rights, contact us at [email protected].
If you believe that we process your data in violation of applicable law, you have the right to lodge a complaint with the Danish Data Protection Agency:

Website: www.datatilsynet.dk
Address: Carl Jacobsens Vej 35, 2500 Valby
Phone: +45 33 19 32 00