Privacy Policy
Below you can read more about how Aarhus Letbane I/S (hereafter “Aarhus Letbane”) processes your personal data.
We kindly ask you to read the privacy policy before submitting your personal data to Aarhus Letbane.
1. Data controller and contact details
The data controller for the processing of your personal data is:
Aarhus Letbane I/S
CVR no. 34704724
Thomas Koppels Gade 311
8000 Aarhus C
Denmark
E-mail: info@aarhusletbane.dk
2. If you visit our website
The following section describes our processing of personal data about visitors to www.letbanen.dk.
2.1 Cookies
We use cookies on our website to, among other things, ensure that the website functions properly and to prevent abuse and downtime. You can read more about our use of cookies in the cookie banner, which is displayed on the front page when you visit our website for the first time.
You can always change your cookie settings by clicking on the small red cookie icon in the lower left corner of the website.
2.2 Registration for the courses Pas på, på Letbanen, infrastructure training, etc.
Types of personal data
When you register for our courses, we process your personal data. We may collect, process and store the following types of personal data about you:
- Your name, e-mail address, telephone number and address
- What company/organisation you are affiliated with
- Your payment details
- E-card or a photo of your ID card and passport photo (only for applications for course credit)
The purposes of the processing
Your personal data will be processed for the following purposes:
- Completion of registration and payment, including sending of order confirmation and invoice
- Administration of registrations and issuing of ID cards
- Statistics and analysis
Legal basis for processing
We process your personal data on the following basis:
- Legal obligation: The processing of your payment details and information about your purchases is necessary for compliance with bookkeeping and VAT legislation. In addition, we conduct and administer the courses on the basis of requirements from the Danish Civil Aviation and Railway Authority (Article 6 (1) (c) of the Danish Data Protection Act).
- Contractual obligations: We process your personal data in order to fulfil the course or training agreement that you have entered into with Aarhus Letbane, including to be able to issue ID cards and handle order confirmation (Article 6 (1) (b) of the General Data Protection Regulation).
2.3 Reporting of security incidents, dangerous situations, etc. via website form
Types of personal data
When reports are submitted via our website, e.g. about undesirable conditions on or around the light rail system, near misses or accidents, we may process the following types of personal data about the reporter:
- Name, e-mail address, telephone number and employee number, if relevant
- The date of report submission
- Other information you provide in connection with your report. We encourage you not to provide us with sensitive personal data unless it is strictly necessary for the processing of your communication.
In addition, in some cases, personal data may be processed about other persons that appear in the report, such as images and other reported information.
The purposes of the processing
Your personal data will be processed for the following purposes:
- Recording and handling of reported incidents
- Improvement of safety on the light rail system
- Statistics and analysis
Legal basis for processing
We process your personal data on the following basis:
- Exercise of official authority: Recording and handling of reported matters falls under the exercise of official authority (Article 6 (1) (e) of the General Data Protection Regulation).
3. If you communicate with us
Types of personal data
When you write to our info address or communicate with us in other contexts, we process the following types of personal data about you:
- Name, e-mail address and telephone number
- What your correspondence concerns
- The date of your correspondence
- Other information you provide in connection with your correspondence. We encourage you not to provide us with sensitive personal data or your CPR number unless it is strictly necessary for the processing of your correspondence. If you send sensitive information or your CPR number via e-mail, the information should be sent in a highly encrypted form.
The purposes of the processing
Your personal data will be processed for the following purposes:
- Handling your correspondence
- Observance of any rights
- General communication
- Statistics and analysis
Legal basis for processing
We process your personal data on the basis below depending on the nature of your correspondence.
- Exercise of official authority: We may process your personal data because the handling of correspondence about Aarhus Letbane falls under the exercise of official authority (Article 6 (1) (e) of the General Data Protection Regulation).
- Contractual obligations: If your correspondence concerns (potentially) entering into a contract, we process your personal data in order to implement measures prior to the contract (Article 6 (1) (b) of the General Data Protection Regulation).
4. If you visit our physical locations, e.g. as a passenger or guest at our service centre
When you use light rail trains, are on a light rail platform, or are in the areas immediately around the platforms and tracks, you may be recorded on video. In addition, you may be recorded if you visit our service centre and other locations.
CCTV monitoring is carried out as follows:
- Passenger compartment monitoring
- Track monitoring from front-mounted cameras on trains
- Rear-view mirror monitoring mounted on trains
- Platform monitoring
- Monitoring at our service centre and other locations
In addition, we process your personal data if you have been given an electronic access card.
Types of personal data
We may process the following types of personal data about you:
- Photo and video material
- Digital footprints, including information about where and when you have used access cards (if you have been given an access card)
The purposes of the processing
Your personal data will be processed for the following purposes:
- To ensure and maintain safety on and around the light rail system, as well as at our office facilities and other buildings
- To prevent and solve crime
- To give you access to our office facilities and other buildings
- To manage your visit with us
Legal basis for processing
We process your personal data on the following basis:
- Exercise of official authority: We may process your personal data because it falls under the exercise of office authority, i.e. to establish and maintain security at and around Aarhus Letbane’s premises for passengers, employees and business partners (Article 6 (1) (e) of the General Data Protection Regulation). Information about criminal offences collected via CCTV monitoring is also processed on the basis of our legitimate interests in preventing and investigating criminal offences (Section 8 (3) of the Danish Data Protection Act).
In the event of criminal acts or suspicion of such acts, recordings from CCTV monitoring, etc. may be disclosed to the police. Aarhus Letbane’s CCTV monitoring is recorded in the Danish police camera register. Data may also be disclosed if required in accordance with the law.
We have put up signs in accordance with the law on CCTV monitoring at the entrance to areas subject to CCTV monitoring.
5. If you apply for a job at Aarhus Letbane
If you apply for a job at Aarhus Letbane, we process your personal data in connection with the recruitment process.
We recommend that your application does not include your CPR number or other sensitive personal data, such as personal data revealing racial or ethnic background, religion, trade union membership, sexuality or health information.
Types of personal data
Aarhus Letbane may collect, process and store the following types of personal data about you:
- Contact details such as name, e-mail address and telephone number
- Information contained in the application, CV and any attachments
- Relevant information that is publicly available on the internet and social media, including information about previous employment, activities, skills, performance and general appearance
- Results of personality tests, if you complete any
- References from previous and/or current employers that you have provided in your application or that you have consented to us contacting
- Health information if the position you have applied for places special demands on health conditions
- Other information you provide to us in connection with the recruitment process
Purpose of the processing
Your personal data is included in our evaluation of whether you will be offered a position at Aarhus Letbane.
Legal basis for processing
Aarhus Letbane processes your personal data on one or more of the following grounds:
- Contractual obligations: We process your personal data in order to implement measures prior to entering into a potential contract (Article 6 (1) (b) of the General Data Protection Regulation).
- Consent: If we obtain references from previous and/or current employers that you have not provided as references in your application, we will ask for your consent (Article 6 (1) (a) of the General Data Protection Regulation). If, in exceptional circumstances, the position you have applied for places special requirements on health conditions, we will – after a specific assessment – ask for your explicit consent prior to the processing of such personal data (Article 6 (1) (a) and Article 9 (2) (a) of the General Data Protection Regulation).
6. If you are a contact person with a supplier, business partner, etc.
If you cooperate with Aarhus Letbane in your professional capacity, including as an owner of a sole proprietorship or as a contact person with one of our suppliers or other business partners, you can read more about our processing of your personal data here.
Types of personal data
Aarhus Letbane may collect, process and store the following types of personal data about you:
- Name, company and job title
- Your work-related contact details, such as e-mail address, telephone number and address
- Contractual information such as invoices, contracts and other agreements between your company (or your employer) and Aarhus Letbane
- Other information included in our correspondence
We may receive the above information directly from you (primarily through e-mails and other correspondence with you) or from your employer. We process your data if your company or the company you are employed by enters into an agreement with Aarhus Letbane, if you have shown interest in our services, for example by sharing your contact information with us, or in connection with other cooperation.
The purposes of the processing
Your personal data may be processed for the following purposes:
- Administration of our professional cooperation, including fulfilment of agreements, ongoing correspondence and planning
- Statistics and analysis
Legal basis for processing
Aarhus Letbane primarily processes your personal data on one or more of the following grounds:
- Contractual obligations: In certain cases, the processing of your personal data is necessary for the fulfilment of a contract to which you are a party or for which you represent a party (Article 6 (1) (b) of the General Data Protection Regulation).
- Exercise of official authority: We may process your personal data because it falls under the exercise of official authority, i.e. to administer the day-to-day operation of Aarhus Letbane, including exercising our rights and obligations under the agreements, etc. that we have entered into with our business partners (Article 6 (1) (e) of the General Data Protection Regulation).
7. If you visit our social media profiles
If you visit Aarhus Letbane’s social media profiles and pages, you can read more about our processing of your personal data in this section.
Aarhus Letbane and the social media providers are the joint data controllers for the processing of personal data collected in connection with your visit to Aarhus Letbane’s social media profile or page on the social media in question.
We have profiles or pages on the following social media:
- Facebook (Meta Platforms Ireland Ltd.)
- Instagram (Meta Platforms Ireland Ltd.)
- YouTube (Google LLC)
- LinkedIn (LinkedIn Ireland Unlimited Company)
Types of personal data
When you visit or interact with our social media profiles, Aarhus Letbane and the social media provider in question may collect, process and store the following types of personal data about you:
- Information available on your profile, including your name, gender, marital status, workplace, interests and your city
- Whether you “like” or have submitted other responses to our profile
- Comments you leave on our posts, including in connection with competitions
- That you have visited our profile
The purposes of the processing
We process your personal data for the following purposes:
- Improving our products and services, including our social media profiles and pages
- Statistics and analysis
- To be able to communicate with you if you comment on a post, leave a review or send us a message
The social media providers process your personal data for the following purposes, among others:
- To improve their advertising system
- To provide Aarhus Letbane with statistics that social media providers compile, among other things, on the basis of your visit to our profiles and pages
- Advertising and customising the activities on the page
Legal basis for processing
The processing of your personal data is based on the following grounds:
- Legitimate interests: We base the processing of your personal data on our legitimate interests in being able to communicate with and market ourselves to you on our social media profiles, as well as our legitimate interest in improving our services (Article 6 (1) (f) of the General Data Protection Regulation).
The social media providers base the processing of your personal data on their legitimate interests, including their interest in improving their advertising system and providing statistics to Aarhus Letbane, which the social media provider prepares, for example, on the basis of your visit to our profile or page on the social media in question. In addition, social media providers have a legitimate interest in providing an innovative, individually tailored, secure and profitable service (Article 6 (1) (f) of the General Data Protection Regulation).
- Consent: The social media providers process certain of your personal data in accordance with your consent, which you can withdraw at any time via your privacy settings on the social media in question (Article 6 (1) (a) of the General Data Protection Regulation).
Who do social media providers share your personal data with?
The social media providers may, among other things, share your personal data with the following categories of recipients:
- Other units in the corporate group of which the social media provider is part
- Externally with business partners who provide analysis and survey services
- Advertisers
- Other people who visit our profile or social media page (to the extent your information is publicly available)
- Researchers and other academics
You can find more information about who the social media providers share your personal data with in each provider’s privacy policy.
The social media providers may transfer your personal data to recipients outside the EU/EEA in accordance with applicable data protection legislation. You can read more in the privacy policies of each provider.
You can read more about who Aarhus Letbane shares your personal data with in the section Disclosure to other data controllers and transfer to data processors below.
8. How long do we keep your personal data?
Your personal data will be deleted when we no longer need to process it for one or more of the above purposes. However, the data may be processed and stored longer in anonymised form or if we are required to do so by law.
Accounting materials, including personal data, which we are obliged to keep in accordance with Section 12 of the Danish Bookkeeping Act, will be erased no earlier than 5 years after the end of the financial year to which the data relates, including training and course enrolments.
Specific information on CCTV monitoring
Recordings from CCTV monitoring made for crime prevention purposes will be erased or anonymised no later than 30 days after the recording, unless it is necessary for Aarhus Letbane to store the recordings for the purpose of handling a specific dispute, e.g. in connection with investigating a criminal offence.
However, we may process your personal data for a longer period in anonymised form.
Specific information on job applications
If you are offered a position at Aarhus Letbane, your application and additional relevant personal data collected in connection with the recruitment process will be stored in your personnel file with us.
If you are not offered a position, we will keep your application and any additional personal data collected in connection with the recruitment procedure for a period of 6 months after our rejection, unless you have consented to the further retention of such personal data.
You can withdraw any consent you may have given as part of our recruitment process at any time. Withdrawing your consent will have an effect on future processing of your personal data, but does not affect the lawfulness of any processing based on your consent before the withdrawal. If you wish to withdraw your consent, please contact us as indicated below.
Specific information for social media
Any correspondence you send to us that is not publicly posted is stored for up to 2 years. However, we may store your data for a longer period in anonymised form.
We encourage you to delete comments, likes and other interactions you have left on our profile if you no longer wish them to appear on our pages. Aarhus Letbane does not delete such publicly available interactions.
Please refer to the privacy policy of the relevant social media provider for information on how long they retain your personal data.
9. Disclosure to other data controllers and transfer to data processors
In order to fulfil the above purposes, we may grant access to your personal data to a third party that, on the basis of a contractual relationship with Aarhus Letbane, provides relevant services. For instance, this may include IT providers, e-mail providers and providers of IT solutions. Such service providers will only process personal data as set out in our instructions in accordance with data processing agreements we have entered into with them.
Under certain circumstances and in accordance with the law, it may be necessary to disclose your personal data to:
- The Danish police
- Lawyers
- Auditors
- Courts
- Public authorities
If your personal data is transferred to data processors or data controllers established in countries outside the EU/EEA that do not have an adequate level of protection, such transfer will be based on the EU Commission’s standard contracts or another lawful basis for transfer in accordance with Chapter V of the General Data Protection Regulation. If you have any questions or want to know more about specific transfers, including the basis for transfer, you are always welcome to contact us. You are also entitled to receive a copy of the basis for transfer.
10. Your rights
- You have the right to access the personal data that we process about you
- You have the right to object to our collection and further processing of your personal data
- You have the right to rectification and erasure of your personal data, subject to certain statutory exceptions
- You have the right to request that we restrict the processing of your personal data
- In certain circumstances, you may also request a copy of your personal data, as well as the transmission of the personal data you have provided to us to another data controller (data portability)
- You can withdraw any consent you may have given at any time. We will then erase your personal data unless we can continue the processing on another basis.
Links to other websites, etc.
Our website may contain links to other websites or to integrated websites. We are not responsible for the content of other companies’ websites or for their practices in relation to the processing of personal data. When you visit other websites, you are encouraged to read the privacy policy of those websites.
12. Questions and complaints
If you have any questions about this privacy policy or if you wish to complain about our processing of your personal data, you can always contact Aarhus Letbane as specified below.
Aarhus Letbane I/S
CVR no. 34704724
Thomas Koppels Gade 311
8000 Aarhus C
Denmark
E-mail: info@aarhusletbane.dk
If your complaint is not resolved by us and you want to pursue the matter, you can complain to the Danish Data Protection Agency:
The Danish Data Protection Agency
Carl Jacobsens Vej 35
2500 Valby
Denmark
www.datatilsynet.dk/borger/klage
E-mail: dt@datatilsynet.dk
Telephone: +45 33 19 32 00
