Datenschutz

Information on processing of personal data

1 Introduction

This document sets out how HPNow ApS (“HPNow”, “we”, “us”) collects and processes personal data about external persons as part of the operation of our business and the activities described in Section 3. 

2 Data Controller 

HPNow is the data controller in respect of the processing activities described in this Privacy Notice unless otherwise mentioned below in Section 3.

If you have any questions regarding our processing of your personal data, please contact us here: 

HPNow ApS
CVR-no.: 37258822
Sydmarken 32F
2860 Søborg
E-mail: rafr@hpnow.eu

3 Processing activities

3.1 Sale and delivery of products and services

When you order goods or services from us, we process personal information about you for the purpose of delivering your order and to manage the customer relationship.

3.1.1 Categories of personal information

• Name

• Business contact information (Business address, telephone number and email address)

• Information on correspondence and trading history, including invoices and similar information

3.1.2 Legal basis for the processing 

If you interact with HPNow as the owner of a personally owned business, the legal basis for our processing is: 

• Conclusion of a contract with you or performance of a contract, which you have concluded. This legal basis is set out in Article 6(1), para. (b), of GDPR. 

• Compliance with legal obligations, primarily the Danish bookkeeping and tax legislation. This legal basis is set out in Article 6(1), para. (c) of GDPR.

• Article 6(1), para (f) of GDPR, as the processing is necessary for HPNow to pursue its legitimate interest in providing proper customer service and developing its business.

Otherwise, the legal basis for our processing is Article 6(1), para (f) of GDPR, as the the processing is necessary for HPNow to pursue its legitimate interest in ensuring efficient and proper operations of the business, including handling of orders and provision of customer service.

3.1.3 Recipients of personal data

Information may be disclosed to logistics companies transporting goods to the agreed delivery address. Furthermore, data is made available to our IT suppliers (data processors), who store the data for us and process the data in accordance with our instructions.

3.1.4 Retention 

We retain the information for as long as we have an active customer relationship with you or the company, you represent and for five years from the end of the year, where the customer relationship ended. We consider our customer relationship to be active as long as you or the company you represent have active equipment delivered by us or if we for other reasons have had interactions with you within the past year.

3.2 Operations of website and profiles on social media

In order to provide website visitors with relevant, secure and well-functioning website, and to help us make our pages and postings on social media more relevant, we process personal information about visitors to our website and our pages on social media (LinkedIn, Instagram and Facebook).

When you visit our profiles on LinkedIn and Facebook, the provider of the respective platforms collects personal information about you. This information is made available to us as anonymized statistical information. As far as this processing is concerned, we are joint controllers with the provider of the respective platforms. Further information is available on LinkedIn Pages Joint Controller Addendum, Instagram and Facebook.

3.2.1 Categories of personal data

• Electronic identification data (IP address, mac-addresses and other information identifying the user and/or the device used for browsing)

• Information on device type, operating system and browser used

• Information on preferences indicated by the user (e.g., language or location preferences)

• Search history

• Information on how the user moves around on our website and social media pages, including links the user clicks on and sub-pages visited.

The data is collected through the use of cookies and other tracking technologies, including tracking technologies provided by LinkedIn.

For further information on the information collected by LinkedIn and Meta (Facebook), please see LinkedIn Privacy Policy and Meta Privacy Policy – How Meta collects and uses user data.

3.2.2 Legal basis for the processing 

The legal basis is article 6(1), para. (f), of the GDPR, as the processing is necessary to pursue our legitimate interest in providing a relevant, secure and well-functioning website, and our legitimate interests in understanding the interests for our social media pages and postings. 

3.2.3 Recipients of personal data 

As mentioned above, we are joint controllers with LinkedIn and Meta (Facebook) in relation to the information they collect to provide us with statistics for visits to our sites and interactions with our postings.

Furthermore, data is shared with our IT suppliers (data processors), who store the data for us and process the data in accordance with our instructions.

3.2.4 Retention 

The retention period depends on the specific cookie. Please refer to our cookie policy for further information, including information on the purpose of each specific cookie, as well as information on how long the information is retained.

For information about retention of the information collected by LinkedIn and Meta (Facebook), please refer to LinkedIn Privacy Policy and Meta Privacy Policy – How Meta collects and uses user data.

We may store the information for a longer period if this is required in order to comply with a legal obligation or to establish, exercise or defend a legal claim.

3.3 Suppliers and other business partners

We process personal information about (contact persons at) our suppliers and business partners in order to be able to manage our business relationship with them.

3.3.1 Categories of personal data

• Name 

• Business email address

• Business telephone number

• Business address

• Information on the specific relationship, including information on historic purchases and other agreements.

3.3.2 Legal basis for the processing 

If you interact with HPNow as a private person or as the owner of a personally owned business, the legal basis of our processing of non-sensitive personal data is 

• Conclusion of a contract with you or performance of a contract, which you have concluded. This legal basis is set out in Article 6(1), para. (b), of the GDPR

• Compliance with legal obligations, primarily the Danish bookkeeping and tax legislation. This legal basis is set out in Article 6(1), para. (c) of GDPR.

• Article 6(1), para (f) of GDPR, as the processing is necessary for HPNow to pursue its legitimate interest in managing our business, including relationships with suppliers and business partners.

Otherwise, the legal basis of our processing is Article 6(1), para. (f), of the GDPR, as the processing is necessary for us to pursue our legitimate interest in managing our business and business relationships.

3.3.3 Recipients of personal data

Data is shared with our IT suppliers (data processors), who store the data for us and process the data in accordance with our instructions.

3.3.4 Retention 

We retain the information throughout the duration of the business relationship and for five years from the end of the year of the latest interaction.
We may store the information for a longer period if this is required to comply with a legal obligation or to establish, exercise or defend a legal claim.

3.4 Recruitment

We process personal data about job candidates for positions with us in order to identify the candidate we assess as the best fit for the position in question.

3.4.1 Categories of personal information

• Name

• Contact information

• Information on educational background, including diplomas

• Information on current and prior occupation, including appraisals and other statements from prior employers

• Information on specific competencies, e.g. languages spoken, certifications, etc.

• Results from tests taken during the recruitment (personality and skills tests)

• Information available on the publicly available parts of your profiles on social media

• References that you allow us to contact

• Any other information provided by you

For certain positions, we may also require a copy of your criminal record (straffeattest).

Except for references, we will obtain the information directly from you or from publicly available sources.

3.4.2 Legal basis for the processing 

The legal bases of our processing of non-sensitive personal data are: 

• Your consent where this is required, for example to obtain information from references you allow us to contact. This legal basis is set out in Article 6(1), para. (a), of the GDPR.

• Conclusion of a contract with you or performance of a contract, which you have concluded. This legal basis is set out in Article 6(1), para. (b), of the GDPR.

• Article 6(1)(f) of the General Data Protection Regulation, as the processing is necessary for us to pursue our legitimate interest in selecting the candidate, we assess to be the best fit for the position in question.

3.4.3 Recipients of personal data 

We may disclose your personal data to professional advisors supporting us in the recruitment process, e.g., external recruiters and law firms. 

Furthermore, data is made available to our IT suppliers (data processors), who store the data for us and process the data in accordance with our instructions.

3.4.4 Retention 

Where the recruitment process leads to the candidate being employed by HPNow, the information is transferred to the personnel file and stored in accordance with the retention rules described in the privacy notice for current and prior employees.

For other candidates, the information is deleted within 6 months from the end of the month, where the relevant recruitment process was concluded, unless we ask for the candidates consent to keep the information for longer, in which case we store the information in accordance with the consent provided by the candidate.

Unsolicited applications are stored for 12 months from the end of the month, they are received, unless we ask for the candidates consent to keep the information for longer, in which case we store the information in accordance with the consent provided by the candidate.

We may store the information for a longer period if this is required to comply with a legal obligation or to establish, exercise or defend a legal claim.

3.5 General business administration

In order to handle queries and other interactions with other persons than the categories covered in sections 3.1 –3.4 above, we process personal data about such other persons.

3.5.1 Categories of personal data

• Name 

• Email address

• Telephone number

• Address

• The reason for HPNow to interact with the person (e.g., a query from the person) and any information relevant to this interaction such as communication between the parties.

3.5.2 Legal basis for the processing 

The legal basis of our processing of non-sensitive personal data depends on the specific reason for the interaction and may be: 

• Conclusion of a contract with you or performance of a contract, which you have concluded. This legal basis is set out in Article 6(1), para. (b), of the GDPR. 

• Article 6(1), para. (f), of the GDPR, as the processing is necessary for a proper and professional handling of queries and other interactions with stakeholders and others, with whom we may be interacting.

3.5.3 Recipients of personal data 

Depending on the reason for the interaction, we may disclose information to other third parties where necessary for proper handling of the matter. This could include insurance companies, external advisors or public authorities as appropriate.

Furthermore, data is made available to our IT suppliers (data processors), who store the data for us and process the data in accordance with our instructions.

3.5.4 Retention 

If the relationship involves financial transactions, we will retain the information for five years from the end of the year of the latest transaction.

For other situations, we will retain the information for three years from the end of the year of the latest interaction.

We may store the information for a longer period if this is required to comply with a legal obligation or to establish, exercise or defend a legal claim.

4 Transfer of personal data to countries outside the EU/EEA

We are using Microsoft Office products at HPNow. Furthermore, as described in section 3.2, we are joint controllers with LinkedIn and Meta. Thus, personal data about you may be transferred to Microsoft, LinkedIn and Meta in USA. All three organisations are covered by the EU-US Data Privacy Framework. 

If we transfer personal data to countries outside the EU/EEA in other situations, we will take all necessary steps to ensure that your personal data will be subject to a level of protection essentially equivalent to the level of protection within the EU/EEA, typically through the use of the EU Standard Contractual Clauses, unless the recipient is located in a country recognised by the EU Commission as having an adequate level of protection of personal data, or where the transfer is subject to one of the derogations for specific situations in Article 49 of GDPR. 

Where EU Standard Contractual Clauses are used as the basis for the transfer, you can obtain a copy of these by contacting us, using the contact information in section 2.

5 Your rights 

When we process personal data about you, you have the following rights: 

• Withdrawal of consent: Where the processing is based on your consent, pursuant to Article 6(1), para. (a) or Article 9(2), para. (a) of GDPR, you have the right to withdraw your consent at any time. You may do so by contacting us, using the contact information in section 2. Please note that withdrawal of consent will not affect the lawfulness of any processing carried out prior to the point in time of withdrawal.

• Access: You have the right to receive a confirmation as to whether we process personal data about you. If we do, you also have the right to receive a copy of the data we process about you along with other information about the processing. 

• Rectification: You have the right to have incorrect or incomplete personal data about you rectified or completed. 

• Erasure: In special circumstances, you have the right to have personal data about you erased, before the time for our ordinary erasure. 

• Restriction: In certain cases, you have the right to restriction of processing of your personal data. If the right applies, we may then only process the data – except for retention – with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another person or for reasons of important public interest. 

• Data portability: In certain cases, you have the right to receive a copy of the personal data you have provided in a structured commonly used and machine-readable format.

• Object to the processing: Where the processing is based on article 6(1), para. (f), of the GDPR (our legitimate interest), you have the right to object to the processing at any time on grounds relating to your particular situation. In particular, you have an unconditional right to object to the processing of your personal data for the purposes of direct marketing.

If you wish to exercise your rights, please contact us at the email address provided in section 2. 

Please be aware that certain conditions and/or restrictions may apply for some of the rights; it depends on the specific circumstances relating to the processing activities. Therefore, we might not be obliged or able to fulfil your request. 

Your request will be processed in accordance with the legislation in force at the given time. To the extent necessary, we will contact you and ask for additional information required to handle your request correctly. 

If you would like to learn more about your rights, please visit the website of the Danish Data Protection Agency, www.datatilsynet.dk 

6 Making a complaint

Further to the rights described above, you always have the right to file a complaint with the relevant supervisory authority, if you believe that our processing of personal data is infringing your rights.

In Denmark, the relevant supervisory authority is the Danish Data Protection Agency, Carl Jacobsens Vej 35, DK-2500 Valby. A complaint may be filed by email to dt@datatilsynet.dk or through the website of the Danish Data Protection Agency www.datatilsynet.dk.

We do, however, recommend that you contact us before filing a complaint with the Danish Data Protection Agency. Our contact information can be found in section 2. 

7 Updating our privacy policy

HPNow may update this privacy policy on an ongoing basis when this is necessary to provide a fair description of our processing of personal data. 

In the event of material changes to our processing of your personal data already in our possession, you will be notified directly of the update (e.g. by email). 

This privacy policy was last updated in June 2024.