Privatlivspolitik / Privacy Policy
1. Purpose and Scope
1.1 Information about the processing of personal data
This Privacy Policy is established by BeGreen A/S, Company reg. no.: 43692836. Your data security is important to us, and we therefore take great care to ensure that your personal data is handled responsibly. Below you can read how BeGreen A/S (hereinafter “BeGreen”, “we”, “us” or “our “) process personal data about you when we act as data controller. You can also read about your rights in relation to our processing.
1.2 BeGreen’s role as a data controller
In connection with the operation of our business, we process a range of personal data.
We do this in order to provide you with the best possible service. We mainly collect and process general (non-sensitive) personal data.
If you have any questions regarding this privacy policy or our processing of your personal data, please contact BeGreen here:
BeGreen A/S
Constantin Hansens Gade 25, 1799 København V,
CVR: 43692836
Contact person: Lise Kilsgaard
E-mail: [email protected]
2. What personal data do we collect and for what purpose
2.1 General
We can process personal data about you in several different situations. Read more about our processing below.
2.2 Visitors to our website and users of our online services
When you visit our website (https://begreen.dk/) or use our other online platforms, we may process information about your IP address as well as information about your computer, device, and browser.
We also process personal data that you provide to us in connection with your use of the website or our online services, for example when you use our online contact form, including your name, email address, product interest, and other information you provide to us.
We process information about your visit (e.g., information about how you access our websites, how you navigate around them, which pages you visit, content you view, your searches, advertisements you have seen, etc.). Personal data is collected through cookies, log files and other technologies.
We process your personal data to enable us to make relevant products deliveries, and services (“Services”) available to you and to improve your experience of our websites, online-services, and the Services we offer. We also use the personal data to show you content on our and other websites based on your activities and preferences and to limit the number of times you see the same content.
Our legal basis for processing is our legitimate interest in making our website (and online services) available to you cf. Article 6(1)(f) of the General Data Protection Regulation. Our basis for processing may also be based on your consent cf. Article 6(1)(a) of the General Data Protection Regulation and Section 3 of the Danish Executive Order on Cookies.
We store personal data collected in connection with your visit to our website in in accordance with our cookie policy. After this, the personal data will be deleted. For information about storage of personal data collected in connection with cookies, please refer to our cookie policy on our website.
2.3 Business partners and/or suppliers to the data controller
When you are a business partner, supplier, or a contact person of a business partner/supplier, we process personal data about you such as name, phone number and email address as well as publicly available information and other information you provide to us.
We process personal data for the purpose of contract management, receiving goods and services from our suppliers and business partners, and where appropriate to fulfil agreements with our landowners.
Our legal basis for processing is the agreement with you/the company you represent cf. Article 6(1)(b) of the General Data Protection Regulation or our legitimate interests in managing the relationship with you/the company you represent as a business partner/supplier cf. Article 6(1)(f) of the General Data Protection Regulation.
We store personal data about business partners and/or suppliers for as long as it is necessary in accordance with the agreement. After the end of the collaboration, the personal data is generally stored in accordance with the Danish Bookkeeping Act for a subsequent period of five (5) years from the end of the financial year to which any accounting material relates.
2.4 Integrity Due Diligence
When you are a business partner (landowners), counterparty, or a contact person of a counterparty/business partner, we process personal data about you such as name, ownership details, board members, senior management information, and other relevant data you provide to us or that we obtain from publicly available sources.
We process personal data for the purpose of conducting initial integrity screenings, managing risk through understanding our business relationships, and implementing risk mitigating measures as part of our Integrity Due Diligence (IDD) process. This helps us prevent illegal or unethical practices, including corruption, human rights violations, money laundering, and environmental crimes.
Our legal basis for the processing is our compliance with the laws and regulations to which our parent company, Equinor, is subject in connection with Anti-Money Laundering (AML), cf. Article 6(1)(c) of the General Data Protection Regulation, as well as our own legitimate interest in preventing illegal or unethical practices, cf. Article 6(1)(f) of the General Data Protection Regulation.
We store personal data, including all IDD records, for as long as necessary in accordance with the aforementioned AML obligations to which our parent company Equinor is subject. The storage period is divided into the following IDD categories:
- Business relationship expired: Personal data is stored for a period of ten (10) years.
- Business relationship exempted: Personal data is stored for a period of ten (10) years.
- IDD Aborted: Personal data is stored for a period of three (3) years from the last IDD
activity. - IDD rejected: Personal data is stored for a period of three (3) years from the last IDD
activity.
2.5 Recipients of communications
When you receive communication materials from us, including newsletters and information notices we process personal data about your name, email address, and
your interest in news, typically targeted to neighbors, landowners, municipalities, or
other stakeholders.
We also process information about your interacting with the content we send to you (including, for example, whether you have opened an email from us, whether the email has been read and which links you have opened), and any other information you provide to us.
We process your personal data to send you information about our company, projects, our sites (solar parks), relevant neighbor information and to manage your subscription preferences.
We will only send you communications by email if you have signed up for this via our website.
Our legal basis for sending newsletters and other communications to you is your consent pursuant to Article 6(1)(a) of the General Data Protection Regulation, which you have consented to under the Danish Marketing Practices Act.
If you withdraw your consent to receive our newsletter and other communications, you will not receive any further material from us.
We store personal data about you as recipients of our communications as long as the contact is active, and you have not withdrawn your consent. If you withdraw your consent, documentation of the original consent will be stored for two years from the date of withdrawal in accordance with the guidelines and requirements of the Danish Consumer Ombudsman. Our legal basis for processing this documentation is our legal obligation under Article 6(1)(c) of the General Data Protection Regulation.
2.6 Analytics tools
We also use personal data about you to show you content on our and other sites based on your activities and preferences, to limit the number of times you see the same content, and to measure the effectiveness of our content and marketing. For this purpose, we use Fathom Analytics.
Our legal basis for processing is our legitimate interests in targeting and improving our marketing efforts towards website visitors cf. Article 6(1)(f) of the General Data Protection Regulation.
2.7 Visitors on our social media
When you visit our LinkedIn profile, we may process personal data about you that you have made available on our social media, your reactions to our posts, your sharing thereof and comments to our posts.
Together with LinkedIn we are joint data controllers for the collection that takes place on our company profiles. This means that LinkedIn also process personal data from our company profiles for their own purposes for which we have no control or responsibility.
Similarly, personal data may be transferred to countries outside the EU/EEA. It is our understanding that this is done lawfully under the EU-U.S. Data Privacy Framework (DPF).
When using LinkedIn, we have also entered into a joint data responsibility agreement that clarifies the division of roles and responsibilities between the parties. The agreement can be read here.
Our legal basis for processing is our legitimate interests in making content available and marketing our offers and services through social media in accordance with Article 6(1)(f) of the General Data Protection Regulation.
We store personal data collected on social media for up to three (3) years after publication.
2.8 Visitors to the data controller’s office(s)
When you visit one of our offices, we process personal data about your name, company name and title if necessary and any other information you choose to provide to us.
We process this personal data for security reasons. The legal basis for processing is our
legitimate interests in preventing crime cf. Article 6(1)(f) of the General Data Protection Regulation.
Our visitor records are stored securely and are only reviewed if there is a specific need to do so, for example in the event of a security breach. These records are reviewed only by persons who have a work-related need to do so.
2.9 Video surveillance at our sites (solar parks)
We have installed video surveillance at our sites (solar parks). Areas monitored by video surveillance are identified in accordance with Section 3(1) of the Danish Television Surveillance Act. All recordings are stored securely and only played, if necessary, for example in the event of a security breach or vandalism. Recordings are available only to persons who have a work-related need to see them. Recordings are typically overwritten automatically after a short period of time, unless a problem is identified that requires investigation, such as theft.
We store personal data collected in connection with TV surveillance for up to thirty (30)
days in accordance with Section 4c (4) of the Danish TV surveillance Act.
If storage of recordings is necessary for our processing of a specific dispute, it may be necessary to store the recordings for longer than thirty (30) days. In this case, these recordings are stored in accordance with Section 4c (5) of the Danish TV Surveillance Act.
We use Article 6(1)(f) of the General Data Protection Regulation as the legal basis for processing, as it is necessary for us to process this information as part of the security measures, we implement in order to protect our business, including for the purpose of supervision and to prevent burglaries, loss and unauthorised access and for the purpose of providing documentation in personnel files.
2.10 Participants in our Partner Events
When you register and participate in partner events organized by us, typically involving municipalities, neighbors, or other relevant individuals who have been part of a project, we process personal data about your name, email address and any other information you choose to provide to us.
We process this personal data for the purpose of managing the event and for security reasons, as well as to be able to send you relevant material.
Our legal basis for processing is our legitimate interests in holding partner events and keeping our partners informed about ongoing or completed projects, cf. Article 6(1)(f) of the General Data Protection Regulation, or your consent cf. Article 6(1)(a) of the General Data Protection Regulation and Section 10 of the Danish Marketing Practices Act.
2.11 Other general purposes of processing
We may enrich the personal data described above with information from other sources. This can be publicly available information – including information that we get from commonly available sources.
Personal information that we have collected for the purposes described above may also
be processed by us for the purposes of complying with laws and regulations which we
are subject to in the course of operating our business or in order to comply with various
reporting or disclosure obligations under applicable laws and regulations cf. Article
6(1)(c) of the General Data Protection Regulation.
If we sell all or part of our business or sell or transfer our assets or is otherwise involved in a merger or transfer of all or a substantial part of our business, we may transfer your personal data to the party or parties involved in the transfer as part of the transaction where we are permitted to by law cf. Article 6(1)(c) of the General Data Protection Regulation.
Finally, we may process your personal data to enforce or defend our or third parties’ legal rights or legitimate interests, where necessary, objectively, and proportionally cf. Article 6(1)(c) of the General Data Protection Regulation.
3. Disclosure of personal data
We may disclose your personal data to other suppliers and/or service providers in the ordinary course of our business as well as to our group affiliates.
We may also disclose your personal data to a public authority and external advisors such as auditors and lawyers in situations where we are specifically obliged to disclose your personal data pursuant to legislation and notification obligations to which we are subject. If there is a need to report a matter to the police as a result of e.g., TV surveillance or a phone call, we may disclose your personal data to the police.
It may for example be necessary to disclose personal data to the following recipients:
Public authorities, entities performing public tasks or acting at the direction of public authorities, to the extent and for purposes which follows from provisions of law, e.g., tax authorities, business authorities, courts of justice, permitting authorities, public regulators or inspections, the police, as well as transmission or distribution system operators, etc.
Equinor ASA group, financing entities, including potential financing entities, advisors, etc., where personal data is shared depending on the circumstances, in particular, for administrative purposes and the purposes of internal reporting, due diligence, etc.
Entities supporting us in our business processes and operations, and our partners, e.g., service providers in the area of IT, asset and/or facility management providers, accounting and bookkeeping, property protection, auditing and controlling, banks, postal and courier companies, entities from Equinor ASA group, suppliers, business partners, etc.
We try to limit the disclosure of personally identifiable information and thus the disclosure of information that can be attributed to you personally.
We may also disclose your personal data to data processors. Our data processors only process your personal data for our purposes and under our instructions.
4. Transfer of personal data to countries outside of EU/EEA
In connection with our processing of your personal data, we may transfer your personal data to countries outside the EU/EEA (third countries).
Your personal data may be transferred to countries where the European Commission has determined that the level of data protection is equivalent to that in the EU/EEA (secure third countries).
We may also transfer your personal data to unsecure third countries. The transfer of your personal data to unsecure third countries will be based on transfer basis, e.g. the Standard Contractual Clauses (“SCC”) developed by the European Commission specifically designed to ensure an adequate level of protection or for companies established in the United States as a result of the US company’s adherence to the EUU.S. Data Privacy Framework (“DPF”).
We assess the adequacy of the transfer basis and adopt additional measures if necessary to ensure an adequate level of protection for the transfer.
You can read more about the transfer of personal data to countries outside the EU/EEA on the European Commission’s website. You can also find an overview of US companies registered with the DPF here: https://www.dataprivacyframework.gov/s/participant-search .
If you would like further information about our transfer of personal data to countries
outside the EU/EEA, please contact us.
5. Storage, data integrity and security
When your personal data is no longer needed, we will ensure that it is deleted in a secure manner. It is our policy to protect personal data by taking adequate technical and organisational security measures.
We have implemented security measures to ensure data protection for all personal data that we process. We conduct regular internal follow-ups on the adequacy of and compliance with policies and measures.
6. Your rights
6.1 General
As a data subject, you have certain rights under the General Data Protection
Regulation. If you want to exercise your rights, please contact us.
You may – unconditionally and at any time – withdraw your consent. You can do so by
sending us an email. Withdrawal of your consent will not have any negative impact. However, this may mean that we cannot meet specific requests from you in the future. Withdrawal of your consent will not affect the lawfulness of the processing based on consent before it is withdrawn. Furthermore, it will not affect any processing carried out on another lawful basis.
You can also – unconditionally and at any time – object to our processing when it is based on our legitimate interests.
6.2 Your rights
Your rights also include the following:
(a) Right of access: You have a right to access personal data, we process about you.
(b) Right to rectification: You have the right to obtain rectification of any inaccurate
and incomplete personal data about you.
(c) Right to erasure (right to be forgotten): In exceptional cases, you have the right to
obtain erasure of information about you before the time when we would normally
delete your personal data.
(d) Right to restriction of processing: In certain situations, you have the right to restrict the processing of your personal data. If you have the right to restrict the processing of your personal data, we may only process personal data in the future – apart from storage – with your consent, or for the establishment, exercise of defence of legal claims, or to protect an individual or important public interests.
(e) Right to object: In certain situations, you have the right to object to our processing of your personal data, and always if the processing is for direct marketing purposes.
(f) Right to data portability: In certain situations, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to have those personal data transferred from one data controller to another.
(g) Right to lodge a complaint: You can lodge a complaint at any time with the Danish Data Protection Authority about our processing of personal data. See more at www.datatilsynet.dk, where you can also find further information on your rights as a data subject.
6. General Provisions and Subsidiaries
7.1 General Provisions
This Policy applies in addition to the provisions of any applicable law and any regulations.
In case of conflict between this document and any compulsory law or regulation and any BeGreen Directives in the Management System, firstly the provisions of laws and regulations shall apply and secondly the BeGreen Directives shall apply.
This Policy shall be reviewed once a year by BeGreen’s Compliance Officer, or when material changes occur in order to ensure that it is updated, valid and in accordance with current legislation and the principles for processing of personal data.
We will publish new versions of the policy on our website.
