Management of personal data

As you are studying at DTU, DTU processes a range of data about you. Under Articles 13 and 14 of the General Data Protection Regulation (GDPR),1) DTU must inform you about the data DTU has or receives about you—from you or from anyone else.

Types of data and purposes

DTU collects and processes data about you that is relevant to your application for admission and/or studies. DTU’s legal basis for processing this data is Article 6(1)(b), (c) and (e) of the General Data Protection Regulation. This relates to the following personal data:

  • Name
  • Address
  • Civil registration (CPR) number
  • Nationality
  • Admission qualifications
  • Exam results
  • Applications for exemptions including documentation
  • SU (State Educational Grant)
  • Photo
  • Attachments included in your application for admission
  • Registration of the data relevant to your studies is necessary in order to administer your enrolment as a student at DTU.

DTU treats your data confidentially. All employees who have access to your personal data are bound by confidentiality. Most of the data that DTU processes about you is necessary, as it is needed in relation to your application for admission and/or your studies and DTU’s operations.

The purpose of processing your personal data will primarily be to manage your application for admission and/or your studies, including your exam results. Another purpose is to ensure the proper fulfilment of DTU’s obligations in relation to you as a student, as well as the fulfilment of obligations in accordance with legislation. In addition, there are necessary records in DTU’s systems, etc., about you as a student at DTU.

DTU records data about your use of IT, the Internet and email in order to ensure that DTU fulfils its obligations for processing security, and may take care of other legitimate interests under the terms of Article 6(1)(b), (c) and (e) of the General Data Protection Regulation. Finally, DTU processes other relevant data linked to your studies at DTU.

Accordingly, DTU will collect, register, keep, and use data about you. This may be data that you have provided to DTU in connection with your application for admission, or during your studies. However, it may also be data that DTU receives or obtains from other parties, including public authorities, when this is necessary or relevant in relation to your studies at DTU.

Your data may also be included in statistical material in aggregated form and in such a way that data concerning individuals cannot be isolated and connected with named persons.

Disclosure of your personal data
Generally, data relating to you will not be disclosed to any third party. DTU will, however, disclose data about you to the extent that DTU is obliged to do so. This may, for example, concern disclosure of data to other public authorities where DTU is committed to doing so. Examples of other public authorities are: The State Education Grant and Loan Scheme in Denmark (SU), the Danish Ministry of Higher Education and Science, Statistics Denmark, the Danish National Archives, the police, etc.

There may also be disclosure of data in connection with audits, etc., including the external audit of DTU. Finally, data may be disclosed to DTU’s partners, for example Polyteknisk Forening (PF) and in connection with partnership programmes and surveys. It will always be made clear if your data is being disclosed to third parties.

Your rights

Under the General Data Protection Regulation, you have a number of rights in relation to our registration and processing of data about you. Please contact us if you wish to exercise these rights.

Right of access
You have a right of access to the data that DTU processes about you. If DTU has registered incorrect data, you also have the right to have the data rectified. In addition, you have the right to object to the processing, and in certain cases you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transfer that personal data from one data controller to another without hindrance.

In exceptional cases where DTU processes information about you based on your consent, you have the right to withdraw your consent.

Right to erasure

In certain cases, you may have the right to have data about you erased prior to the date of DTU’s normal general erasure. Data relating to you will be erased or archived when there is no longer a legitimate and work-related need for keeping it with a view to complying with the above-mentioned obligations or duties, or when DTU otherwise no longer has the authority to keep the data. Data is transferred continuously to the Danish National Archives pursuant to the rules of the Danish Archives Act (Arkivloven) and the National Archives’ provisions in relation thereto.

Data controller

DTU has responsibility as a ‘data controller’, and DTU is therefore responsible for complying with the Danish Act on Processing of Personal Data (Persondataloven) and the General Data Protection Regulation.

The controller is thus Technical University of Denmark, Anker Engelunds Vej 1, DK-2800 Kgs. Lyngby, Denmark.

Contact

DTU has appointed a data protection officer who can be contacted at dpo@dtu.dk

Complaints

You have the right to file a complaint with the Danish Data Protection Agency, which is the regulator.

1) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. Article 14(1) states that the (data) controller must provide the data subject with certain information where personal data is not collected from the data subject.