Processing of personal data in Topdanmark

In Topdanmark , we want our customers to always trust us. When you supply us personal data, we know that it is our responsibility to protect it. Therefore, we have IT systems, procedures and controls which ensure that we comply with the General Data Protection Regulation (GDPR) and the Data Protection Act, and that your personal data is processed and stored in a way that respects your privacy.  

Topdanmark does not sell personal data.

What data is collected? 

We only collect  personal data, which is necessary for our processing and we process the personal data in compliance with current legislation.The categories of personal data collected depends on the purpose of the processing. In Topdanmark , we process the following types of personal data:

  • Contact information and identifiers 
  • CPR numbers/Civil Registration Numbers  
  • Policy information 
  • Claims information 
  • Payment information 
  •  Health Information 
  • Financial Information 
  • Trade union membership Information 
  • Information on criminal offence 
  • Information for investigations 
  • Operation data from IOT (Internet of Things) solutions such as e.g. water damage sensors, fertiliser sensors or fire alarms. 

We only register personal data if it is necessary. When processing your insurance, claim or buying shares, it can be necessary to collect data on the following categories of persons: 

  • Policyholder and insured 

  • Beneficiaries 

  • Next-of-kin 

  • Claimant  

  • Counterparty 

  • Guardians 

  • Mortgagees 

  • Advisers (bank, lawyer, accountant) 

  • Therapists (doctor, psychologist, physiotherapist, etc.) 

  • Shareholders 

  • Real owners. 

Where and how do we collect the data? 

We collect personal data  from you and from third parties such as your former insurance company, your doctor and  Topdanmark
collaboration partners (for example: Coop, Varelotteriet, suppliers of fertiliser sensors and Leakbot etc.) 

We collect data about you e.g. via cookies, telephone calls or chats with you. We receive data if you follow us on Facebook oractively write comments or in other ways communicate with us. We also collect information from your replies, when you participate in surveys or answer questionnaires. 

Furthermore, we collect data from public and private registers such as the CPR register, CVR register, trade unions, the Register of Motor Vehicles, BBR, DFIM, credit reporting agencies and telephone book information.

Facebook 

When using Facebook, Facebook installs a cookie on your computer, telephone or tablet, which collects data about you. The data is collected if you share, comment or like a post. Both Facebook and Topdanmark are responsible for this data collection. Facebook is the data controller, when your personal data is used for marketing and advertising on Facebook.  Topdanmark is the data controller, when we receive statistics regarding Facebook users, which we then apply to target our marketing.  

Facebook’s policy for processing personal data is available at: 

https://www.facebook.com/policy.php

The purpose of processing your data 

We  use  your data when processing your insurances and claims, give you advice and keep you up to date on the products we, and our collaboration partners, can offer within insurance and banking. Furthermore, we use the data when processing complaints and lawsuits, as well as for making surveys and analyses to continuously improve our advice, service and technical solutions. If you have an IOT solution (Internet of Things), we will make use of the data to assess whether the data can be used to prevent damages. 

Data collected from public and private registers are used for 

  • Updating addresses  
  • Ensuring your entitlement to discounts via your trade union membership 
  • Collecting information on your property and motor vehicle 
  • Verifying that you are not reported at a credit agency 
  • Verify the accuracy of the received information.

If you are a shareholder, the purpose of processing your data is to update the register of shareholders and manage your transactions. 

Recording of telephone calls 

When you call us, we sometimes ask permission to record the call for us to continuously improve and ensure the highest standards for our service and products. We do this by evaluating the calls by listening to them and analysing them based on an automated transcription. 

We record the call and subsequently process it with your consent, which you give in the telephone menu cf. Article 6, paragraph 1(a) of the General Data Protection Regulation (consent).

You can always withdraw your consent by writing to us at persondata@topdanmark.dk. By using the same email address, you can also request erasure and object to Topdanmark’s processing of your personal data. 

A limited circle of our employees has access to the recordings. We erase or anonymise recordings after 6 months and transcriptions after 18 months. 

The recording of your call can also be used as documentation, if you want it to. If within 6 months, your call becomes part of a complaint, dispute or other form of casework, including disclosure and inspection or limitation, the recording can be stored as long as necessary for solving the specific case in accordance with the rules of statute of limitations. 

We save our chat conversations 

If you use our chat service on the website for subscriptions, damages or police questions, we process the information that you enter. If you chat with us without being logged in, any personal information in the chat will be anonymised after 1 hour, so that the conversation can no longer be attributed to you. If you chat with us after you have logged in to Mit Topdanmark, we may save the chat on your case. The chat conversations are used to enhance the user experience and clarify the chatbot's answers.

We save  data on your use of our website 

When you log on to Mit Topdanmark, we identify you. Data on your use of the website is processed confidentially and in the same way as all  customer data.  

When you use our website, we use cookies to save  data on your use of our site. We use the data to make it easier for you to use our website as well as to improve our website.  

Read more about Cookies

The legal basis for Topdanmark’s processing of your data 

The legal basis for  processing your data is the financial regulations (The Financial Business Act etc.) and other relevant legislation including: 

  • The Danish Anti-Money Laundering Act 
  • The Danish Tax Control Act 
  • The Danish Bookkeeping Act 
  • The Danish Credit Agreements Act 
  • The Danish Payments Act 
  • The Danish Data Protection Act  

Topdanmarkalso process your data, if you have entered or are considering entering a contract with us or you have given your consent. cf. the General Data Protection Regulation, article 6, paragraph 1, see paras (a) and (b), or if any other rules for processing according to the General Data Protection Regulation, article 6 or article 9 apply. We only process personal data, which is adequate, relevant and limited to what is necessary in relation to the purpose of the processing.  

Moreover, Topdanmark process your data when necessary to pursue legitimate interests. This could be preventive action against abuse and loss, to strengthen our IT security, and for direct marketing etc. 

Categories of recipients 

As a financial institution, we are subject to a strict duty of confidentiality according to the Financial Business Act. Therefore, your data is processed confidentially, and we only disclose your personal data if you have given your consent, or if we have a legitimate interest by law.

Topdanmark discloses data to the following recipients:

  • Persons related to an insurance or pension scheme e.g. policyholder, next-of-kin, claimant, beneficiaries and counterparties 

  • Other insurance companies 

  • Mortgagees 

  • Public authorities (police, tax authorities, municipal authorities etc.) 

  • Repairers e.g. skilled workers 

  • Lawyers 

  • Banks 

  • Doctors and other therapists 

  • Collaboration partners 

  • Data processors 

For how long is the data stored? 
Topdanmark is obliged to erase personal data when no longer relevant. This means that we on an on-going basis erase data for which we no longer have a reasoned purpose,  a legal obligation to store, or can be met by a claim.

Topdanmark rules of erasure is based on the absolute limitation period in the Danish limitation act and the storage requirements in the bookkeeping act.  

The standard rules of erasure for Topdanmark are as follows:

Data security 

Your security is important to us. Therefore, we have taken both technical and organisational  measures to protect the data we receive. This means that we have: 

  • Work-induced access at all locations 
  • Encryption of data transmissions and storage 
  • Virus scanners on servers 
  • Restore and back-up of all servers 
  • IT systems with access control based on user ID and personal passwords that must be a minimum of eight characters 
  • VDI, VPN with two-factor authentication and encryption for remote workstations and other mobile units
  • Procedures and policies for processing and communicating personal data 
  • E-learning for all employees 
  • Employees certified in data protection. 

Profiling and automated rulings 

In Topdanmark , we use  profiling and data modelling to provide you the right insurances, fix prices, reveal fraud and risk of fraud/money laundering, assess the probability of breaches, assess assets and for marketing purposes.  

We are also working on automating some of the decisions rulings we make. This means that a robot will make the decisions on whether a claim is covered by the insurance, or if we can make an insurance quote. If a decision making  is automated, you will be informed hereof in the specific ruling.  

In Topdanmark , we have adopted ethical principles for the use of artificial intelligence. You can read the principles here: 

> Topdanmark principper for brug af kunstig intelligens (In Danish only)

Secure email 
Nearly all emails to and from Topdanmark are encrypted by TLS (Transport Layer Security), thus the e-mail is protected during transport. We also encrypt emails, thus we can send and receive emails containing sensitive personal information.

If you want to send emails encrypted with certificate to Topdanmark, please send your emails to sikkermail@topdanmark.dk, after downloading the certificate at: https://service.nemid.nu/dk-da/support/soeg_certifikat/. 

Læs mere om sikker e-mail her (Danish)

e-Boks

You can also write to us via your e-boks. All you need to do is log in to your e-boks, choose “Skriv ny post” and choose “Topdanmark” as the recipient.

Læs mere om e-Boks’ håndtering af sikker kommunikation her (in Danish only)

Processing by data processors

Topdanmark may choose to  use  data processors, including suppliers of software, hosting, security and storage. Therefore, your data can be disclosed to data processors.  

All data processors are subject to written authorisation and control to ensure that your personal data is solely used for the specific purpose for which the data was collected.  

Topdanmark has chosen to outsource some services to countries outside the EU/EEA; this includes IT technical development and support. When doing so, we ensure your rights by using the EU Commission’s standard contract, binding corporate rules or the so-called “Privacy Shield” approved by the EU Commission.   

We have written contracts with all data processors, and we perform on-going audits to ensure that they comply with our instructions on secure processing. As a part of the instructions, we require the data processors to treat your data  confidential and take the appropriate technical and organisational measures to prevent your data, unforeseen or illegally, from being destroyed, lost, impaired, abused, divulged to any unauthorised persons, or in any other way processed in contravention of the General Data Protection Regulation. 

Your rights 

At any time, you can exercise your rights – however, with certain statutory exemptions 

  • You have the right to obtain confirmation as to whether or not Topdanmark is processing your personal data, and where that is the case, access to the personal data and information regarding our processing. 
  • You have the right to object to the collection and processing of your data, including for automated individual rulings 
  • You can require that we correct or erase data. However, we only erase your data, when you are no longer a customer – and only when no claim can be made against us for any previous claims and insurances. 
  • You can get information into how an automated decision is made and the logic involved and you have the right to a manual processing of any automated assessment 
  • You have the right to receive your personal data in a machine-readable format as well as have the personal data transmitted to another data controller (data portability) 
  • When you have given your consent, you can always contact us to learn to what extent. At any time, you can revoke your consent. Subsequently, we will cease to process your data, unless we can continue the processing on a different legal basis.  

Complaints 

If you are dissatisfied with how Topdanmark is processing your data, you can send your complaint to us at databeskyttelsesraadgiver@topdanmark.dk. You can also send a complaint to Datatilsynet (The Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, Tlf. 33 19 32 00, mail dt@datatilsynet.dk, website: www.datatilsynet.dk.

Contact Topdanmark

Topdanmark A/S and Topdanmark Forsikring A/S, Borupvang 4, 2750 Ballerup are data controllers.
If you have any questions regarding the processing of personal data, or if you want to exercise your rights, please contact us at www.topdanmark.dk, or call us at 44 68 33 11. You can also contact our Data Protection Advisor at databeskyttelsesraadgiver@topdanmark.dk or by phone at 44 74 40 28.