Aalborg University's personal data policy for employees

When you apply for a position at AAU, are employed or previously employed, AAU processes your personal data. You can read more below about how we process your personal data in different situations.

Contact AAU's Data Protection Officer (DPO)Read here if you need to see your rights or want to view your complaint opportunities

Aalborg University's personal data policy for employees

When you apply for a position at AAU, are employed or previously employed, AAU processes your personal data. You can read more below about how we process your personal data in different situations.

Contact AAU's Data Protection Officer (DPO)Read here if you need to see your rights or want to view your complaint opportunities

Processing of your personal data under recruitment, and as a current or former employee

Recruitment and appointment

Why we process your personal data

When you send your application to a vacant position at AAU, we process your personal data for administration, processing of your application and completion of the recruitment process.

If you are subsequently employed, we process your personal data in order to administratively establish the terms of your employment, for onboarding purposes, and during the course of your employment. We process this information in order to be able to fulfil our obligations in relation to your employment.

We process this information about you

Name, CPR.nr., private e-mail, private telephone number, information from your application and your CV about current and previous employment, education, grades, competencies and statements, driver's license, information about salary and tax and salary account number, affiliation to one or more institutions, any information about diagnoses and health, your trade union affiliation, criminal record, child certificate and security clearances.

We have received the information from you when you submitted your application for the position and when you filled out Aalborg University's information form prior to your employment.

We process the personal data on the basis of the following legislation: The General Data Protection Regulation art. 6 (1) (b) art. 9(2)(b), sections 8, 11 and 12 of the Danish Data Protection Act as well as joint collective agreements and organisational agreements between the Ministry of Finance and the trade unions, Executive Order no. 375 of 8 April 2025 on the job structure for academic staff at universities and Executive Order no. 242 of 13 March 2012 on the employment of academic staff at universities and Circular no. 9930 of 16 November 2021 on the job structure of the Bachelor of Engineering and the Export Engineering programme.

How we store your personal data

We store your personal data securely and confidentially in accordance with applicable information security rules. Only employees who have a work-related need have access to process the personal data.

In addition to storing personal data on local servers at AAU, we use suppliers of IT systems such as Microsoft and KMD WorkZone for general processing of personal data. We have entered into data processing agreements with the suppliers. This means, among other things, that the suppliers are subject to instructions from AAU, confidentiality and compliance with the data protection rules and other relevant legislation.

Especially in connection with recruitment and employment, we use the recruitment system Grade Varbi, KMD WorkZone, SLS, HR payroll, Statens HR.

For how long do we process and store your personal data

In connection with recruitment, we process your personal data for as long as the recruitment case is ongoing and subsequently we store it for 3 years after the applicant has applied for the position for the sake of documentation and any complaints. If you are hired, the storage period follows the other processes described in this section.

We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

Archiving your personal data under the Danish Archives Act means that AAU, as a government authority, in some cases may be obliged to file and/or submit the information to the Danish National Archives. When the information is submitted to the Danish National Archives, the rules of the Danish Archives Act apply, and among other conditions, permission from the Danish Data Protection Agency is required for the disclosure of personal data.

We disclose your information in these cases and to these recipients

We disclose this information to the following recipients:

The Ministry of Higher Education and Science: Name and information about education
Other public authorities: name, nationality, trade union
Statistics Denmark in relation to researcher recruitment statistics: Position, gender, year of birth, citizenship, whether you have a PhD. or doctorate and why, whether you have been employed at the university before. If recruitment from abroad is also disclosed, information about the country from which it is based.
Trade union organisation and union representative: In the case of salary negotiations for new employment, we disclose your name, contact information, application, CV, diploma, publication list and teaching portfolio to the union representative.
Assessment committees (internal and external): name, e-mail, information on training, publications, course certificates, grades, occupations, duties, affiliation with one or more institutions.

When employing academic staff, we in some cases transfer information to external members of assessment committees, who may reside in countries both within and outside the EU. The transfer of personal data to recipients residing outside the EU takes place on the basis of GDPR art. 45 (1) or art. 49(1)(d)

The purpose of the disclosure to the Ministry of Higher Education and Science is to comply with our obligations to report data regarding recruitment.

The purpose of the disclosure to the trade union and the union representative is to ensure that the union representative has the necessary information to be able to perform his or her duties as a union representative.

The purpose of the disclosure to the assessment committee is for the assessment committee to make a professional assessment of your qualifications in relation to the position (assessment).

We may lawfully disclose your personal data (or parts of your personal data) to specific recipients for purposes that are not incompatible with the original purposes and in accordance with applicable law. In some cases, we may be required by other public authorities to disclose personal data about you in accordance with sector-specific legislation (GDPR art. 6(1)(e)) for the use of statistics, surveys, political work, access to documents and other societal tasks that are imposed on us.

For more information

If you have questions about how AAU processes your personal data in connection with recruitment and employment, you can contact HR here: Contact HR - Aalborg University

Security clearance and risk assessments in connection with employment

Why we process your personal data

AAU is obliged to carry out security approvals and risk assessments of selected personnel who are to be part of or are part of AAU's security organisation, carry out special tasks within research security, work with defence technology research, conduct research in relevant subject areas or according to requirements from external partners and authorities, such as industry, the Danish Defence Intelligence Service (DDIS) or the Danish Security and Intelligence Service (PET). In this connection, we process personal data about you.

The purpose of the security approvals and risk assessments is to ensure that the university's research is conducted in accordance with export control rules, sanctions and with due regard to the URIS guidelines.

We process this information about you

PET Security Approvals: Name, civil registration number, e-mail, job title, desired level of classification, work description and project name
DDIS security clearance: Name, civil registration number, duration of approval and security level.
Security assessment for hiring: Name, citizenship, previous/current places of employment, previous/current educational institutions, professional qualifications, publication history.

We have received the information directly from you in connection with employment and security clearance.

We process the personal data on the basis of the following legislation:

PET Security Approvals: The General Data Protection Regulation art. 6 (1) (c) art. 10, Safety Circular CIR1H no. 10338 of 17/12/2014
DDIS Security Approvals: The General Data Protection Regulation art. 6 (1) (c) art. 10, Defence Command Provision (FKOBST) 358-1.
Risk assessments in connection with employment: The General Data Protection Regulation art. 6(1)(c), Export controls and sanctions (including the Dual-Use Regulation) and the URIS Guidelines.

How we store your personal data

We store your personal data securely and confidentially in accordance with applicable information security rules. Only employees who have a work-related need have access to process the personal data.

In particular, in connection with security clearances and risk assessments in connection with employment, we use information from the recruitment process and the systems used in this connection, see [henvis til rekrutteringsafsnit].

For how long do we process and store your personal data

A PET Security Clearance is valid for 10 years, after which a new approval can be requested. When approval has ended, the case is archived.

An DDIS Security Clearance is valid for 5 years, after which a new approval can be requested. When approval has ended, the case is archived.

Risk assessment in connection with employment: The personal data is processed for as long as the case is active and then stored for 5 years.

We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

In the case of PET security clearance, the following is disclosed to the Danish Security and Intelligence Service: Name, CPR number, e-mail, job title.
In the case of DDIS security clearance, the following is disclosed to the Danish Defence Intelligence Service: Name, CPR number, e-mail, job title.
In connection with risk assessments in connection with employment, information is in some cases disclosed to PET for the purpose of sparring related to personal safety: Name, nationality, previous/current places of employment, previous/current educational institutions, professional qualifications, publication history, intended duties in the position.

The purpose of the disclosure is: Recommendation for security accreditation with the relevant national safety authority in respect of security authorisations. Advice from relevant intelligence services to ensure compliance with the rules on export control and sanctions (including the Dual-Use Regulation) and the URIS guidelines with regard to risk assessments.

For more information

If you have any questions about how AAU processes your personal data in connection with security clearances and risk assessments in connection with employment, you can contact us here: Safety in Research - Aalborg University

Onboarding of international employees and work and residence permits

Why we process your personal data

In order to onboard international employees and administratively process residence and work permits, we process personal data.

We process this information about you

Onboarding of international employees: Name, Cpr.nr., address, date of commencement, length of employment, job title, approval of the data subject's professional qualifications as a researcher, information on research obligations, information on foreign social security, marital status, including date of marriage and spouse's birthday, information on the data subject's private affairs such as finances, residence, job search, tax matters, own or family members' health information, if advice is required in relation to for treatment options, school offers, etc. when moving to Denmark.
Work and residence permits: Name, private address, telephone number, email address, birthday, job title, education/copy of diplomas, nationality, copy of registered passport, registered marital status and children, letter of employment, salary income.

We have received the information from you when you submitted your application for the position and when you filled out Aalborg University's information form prior to your employment.

In addition, we receive information from you via email when we apply for a personal tax number.

When applying for residence and work permits, we also receive information and documents from you via e-mail when we initiate the application for a residence and work permit.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6 (1) (b) and art. 9 (2) (b), the Danish Data Protection Act sections 11 and 12, and residence and work permits: Act no. 1009 of 2 September 2024 on the Danish Aliens Act.

How we store your personal data

We store your personal data securely and confidentially in accordance with applicable information security regulations. Only employees who have a work-related need have access to process the personal data.

In connection with an application for a residence and work permit (OAT), you apply online via secure application forms at the Danish Agency for International Recruitment and Integration (SIRI).

In connection with personal tax numbers and researcher taxation for employed researchers, an application must be submitted to the Danish Tax Agency.

How long do we store your personal data?

We process your personal data for as long as you are employed, and after that we store the data for 30 years for documentation purposes.

We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

Onboarding of international employees:

The Danish Tax Agency: Name, cpr.nr., address, date of commencement, length of employment, job title, approval of the data subject's professional qualifications as a researcher, information on research obligation, information on foreign social security, marital status, e-mail and telephone number. We attach a copy of passport, residence and work permit, and marriage certificate

Residence and work permit:

The Danish Agency for International Recruitment and Integration (SIRI): Name, private address, telephone number, email, birthday, job title, education, nationality, copy of reg. Pas, reg. Marital status and children, civil registration number if there is one, copy of diplomas, letter of employment, salary income.

The purpose of the transfer to SIRI is to obtain the necessary residence and work permit (OAT) for the new employee to be able to carry out legal work at AAU.

The purpose of the disclosure to The Danish Tax Agency is to obtain a Danish personal tax number for employees, guests and/or interns who are to receive salary or grants from AAU who stay in Denmark for less than 90 days and thus cannot be issued a CPR number. Salary payments cannot be made without a personal tax number.

For more information

If you have any questions about how AAU processes your personal data in connection with the onboarding of international employees, work permits and residence permits, you can contact HR here: Contact HR - Aalborg University

Maternity, leave, sick leave and absence for family reasons

Why we process your personal data

In order to process your request for/registration of and ensure your access to take maternity, leave, sick leave and absence for family reasons, we need to process your personal data.

We process this information about you

Maternity leave: information about the employee + about the father/co-mother and the child; registration of secondary persons made by the employee by notification to determine the duration of leave and determine the right to leave, the child's birthday to determine the duration of leave and the right to care days, name, periods of absence, documentation from the adoption authority, documentation of the number of weeks of leave remaining when applying for deferred leave, the child's date of birth, employment rate, information about employment in the last 4 months, health information in the form of documentation of pregnancy, e.g. a pregnancy certificate. We receive the information directly from you when you submit one of the following digital forms: “Notification of pregnancy leave, maternity leave and parental leave”, "Notification of paternity and parental leave", "Notification of adoption, partner and parental leave".

Leave: name, cpr.nr. and address. We receive the information from you when you inform us of your request for leave from your position.

Sick leave: name, cpr.nr., private address, telephone number, private e-mail, date of sick leave, periods of absence and expected duration of absence, health information in the form of diagnosis. We receive the information directly from you when you report sick to your department and your sick leave is registered in Statens HR, at sickness absence interviews and any statements from your doctor.

Absence for family reasons: name, cpr.nr., period of absence/hours, employment rate, information on employment in the last 4 months (employment requirements), health information on secondary persons, documentation of the absence, cf. section 8 of the agreement on leave of absence for family reasons, application for leave of absence pursuant to sections 118 and 119 of the Social Services Act and documentation of payment from the municipality of residence, cf. section 87 of the Children's Act. We receive the information directly from you when you inform us of the absence and we receive the grant.

We process the personal data on the basis of the following legislation:

Maternity leave: The General Data Protection Regulation art. 6 (1) (c) art. 9(2)(b), the Danish Data Protection Act section 12, Circular of 5 July 2024 on the Joint Agreement between the Ministry of Finance and Public Employees' Organisations – The State Area section 14. Circular of 11 April 2025 on the collective agreement for academics in the state section 18(6). Circular no. 9375 of 29 April 2019 on agreement on leave of absence for family reasons, section 6 of the Maternity Act. Act no. 114 of 29 January 2025 on the right to leave and unemployment benefits in connection with maternity/paternity leave section 26. Act no. 155 of 11 February 2025 on social services (hereinafter referred to as the Social Services Act) section 119. Act no. 282 of 17 March 2025 of the Children's Act, (hereinafter referred to as the Children's Act) Section 87. Section 118 of the Danish Social Services Act. The Act on Equal Treatment of Men and Women with Regard to Employment, etc., the Act on Active Social Policy and various other laws.
Sick leave: General Data Protection Regulation art. 6 (1) (b) and art. 9(2)(b). Sections 7(2), 11(1) and 12 of the Danish Data Protection Act.
Absence for family reasons: General Data Protection Regulation art. 6 (1) (b) and art. 9(2)(f). Act no. 915 of 23 June 2024 on employees' right to absence from work for special family reasons.

How we store your personal data

Especially in connection with maternity/paternity leave, leave, sick leave and absence for family reasons, we use Statens HR, Outlook, Digital Post, Qlikview, Virk.dk, Statens Refusion, Interact, KMD WorkZone, SLS and HR payroll.

For how long do we process and store your personal data

We process your personal data for as long as you are employed, and after that we store the data for 30 years for documentation purposes.

We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

Regarding maternity/paternity leave, the following is passed on to Udbetaling Danmark to ensure your access to maternity/paternity benefits and maternity/paternity reimbursement to AAU: Name, cpr.nr., period of absence, employment rate, information about employment in the last 4 months (employment requirements), time of birth of the child, parental relationship.

Regarding sickness absence, the following is disclosed to the employee's municipality of residence: Name, CPR number, address, first and last day of sickness, employment rate, hours of absence,
type of reimbursement (sickness benefit reimbursement, resource development benefit, section 56-agreement, flex job, new employee)

In the event of absence for family reasons, the following is disclosed:

To the employee's municipality of residence: Name and information about absence.
To Udbetaling Danmark: Name, cpr.nr., address, the child's first and last sick day, employment rate, information about employment in the last 4 months (employment requirements), hours of absence.

The purpose of the disclosure in connection with maternity leave is that AAU can obtain reimbursement from the state in the form of maternity benefits.

The purpose of the disclosure in the event of sickness absence is to ensure that AAU can obtain reimbursement from the state in the event of illness, including illness due to pregnancy discomfort. This is done in the form of sickness benefit reimbursement/maternity benefits, cf. Executive Order no. 97 of 29 January 2025 on the Act on Sickness Benefits section 54, and maternity/paternity benefit reimbursement, cf. Executive Order no. 114 of 29 January 2025 on the right to leave and benefits in connection with maternity leave (hereinafter referred to as the Maternity Act) section 6, as well as compliance with our legal obligations.

The purpose of disclosure in the event of absence for family reasons is to give the employee the rights in connection with the absence of relatives that the employee is entitled to according to organisation agreements or legislation. We may lawfully disclose your personal data (or parts of your personal data) to specific recipients for purposes that are not incompatible with the original purposes and in accordance with applicable law. In some cases, we may be required by other public authorities to disclose personal data about you in accordance with sector-specific legislation (GDPR art. 6(1)(e)) for the use of statistics, surveys, political work, access to documents and other societal tasks that are imposed on us.

For more information

If you have questions about how AAU processes your personal data in connection with maternity, leave of absence, or sick leave, you can contact HR here: Contact HR - Aalborg University

Holidays

Why we process your personal data

The purpose of processing your personal data is to be able to ensure your right to take holiday and administratively execute holiday.

We process this information about you

Name, CPR.nr., job title, employee number and holiday earned by previous employer as well as current accrued holiday. We have received the information from you.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6(1)(c). Sections 11 and 12 of the Danish Data Protection Act, and Act no. 152 of 20 February 2024 on holiday (the Holiday Act) and circular no. 9298 of 17 May 2024 on holiday agreements.

How we store your personal data

Especially in connection with holidays, we use State HR.

For how long do we process and store your personal data

The information is stored throughout the employment, and for resigned employees, the information is then stored for 30 years from the time of resignation, after which we archive the documents containing your personal data.

We disclose your information in these cases and to these recipients

For more information

If you have any questions about how AAU processes your personal data in connection with taking holiday, you can contact HR here: Contact HR - Aalborg University

Salary negotiations, payment, additional and overtime work

Why we process your personal data

In order to be able to plan and conduct salary negotiations at AAU, pay your salary and administer, settle and make payments in connection with additional and overtime work, we process your personal data.

We process this information about you

Salary negotiations: Name, CPR.nr., information about education, employment, employment rate, work tasks, title of employment, salary, affiliation to one or more institutions at AAU, system user information (AAU-ID) and trade union affiliation.

Salary payment: Name, CPR.nr., address, TIN number, bank details, email, salary, pension, employment rate, net holiday pay, holiday year.

Overtime and additional work: Name, CPR.nr, working hours for the part that relates to overtime or additional work, the nature of the task and AAU email. In connection with the inspection, the place of employment, degree of employment, type of position, contractual affiliation are also checked.

In connection with annual salary negotiations, we receive the information from SLS, ID gateway, MDS database, IDM (rights/access to the system). In connection with overtime and additional work, we receive the information from you in connection with your employment and via a timesheet from you.

We process the personal data on the basis of the following legislation: General Data Protection Regulation 6 (1) (b) and art. 9(2)(b). The Danish Data Protection Act sections 11 and 12, applicable collective agreements, Circular no. 9168 of 28 February 2022 on framework agreement on new salary systems, Circular no. 9759 of 25 September 2024 on union representatives in the state etc., Circular no. 9418 of 4 July 2013 of collegiate bodies of the state, Act no. 152 of 20 February 2024 on holiday and Circular no. 9551 of 5 July 2021 on the state's working time rules.

How we store your personal data

Especially in connection with administration of overtime and additional work, we use paper forms, SLS, HR payroll and email system/Outlook.

For how long do we process and store your personal data

We disclose your information in these cases and to these recipients

In connection with salary payments, we disclose the following information to these recipients:

The Danish Agency for Economic and Financial Management through the State Payroll Solution: Name, CPR.nr., address, TIN number, bank details, email, employment rate.
The Danish Tax Agency: Name, CPR.nr., address, TIN number, e-mail, salary information, pension information.
Statens administration: Name and employment rate, cpr.nr., information on salary, pension.
Holiday account: Name, CPR.nr., net holiday pay, holiday year.
Pension funds and banks: Name, CPR.nr., amount.

The disclosure of your information is necessary in order for us to be able to pay your salary or because we are required by law to disclose the information in question.

For more information

If you have questions about how AAU processes your personal data in connection with salary negotiations, salary payments and additional and overtime work, you can contact HR here: Contact HR - Aalborg University

Internal courses and meetings

Why we process your personal data

In connection with the organisation of internal courses and meetings, we process your personal data for the planning and execution of the course/meeting in order to ensure your participation and involvement. If you are a manager or responsible for handling invoices, we also process your personal data in order to be able to register your employee/colleague.

We process this information about you

Name, work email, telephone number, employee ID, position/title, place of employment.

We process the personal data on the basis of the following legislation: The General Data Protection Regulation art. 6(1)(e), Sections 5 and 12 of the Bookkeeping Act, and Section 2 of the University Act.

When ordering meeting catering: Information about catering considerations. We have received the information directly from you. We process the personal data on the basis of the following legislation: The General Data Protection Regulation art. 6 (1) (a) and art. 9(2)(a).

How we store your personal data

Especially in connection with internal courses, we use the supplier Plan2learn, with whom we have a data processing agreement.

For how long do we process and store your personal data

We process your personal data for as long as you are employed, and as long the information is necessary for us to fulfil our purposes. Hereafter we delete your personal data.

Information in Plan2Learn is stored as long as you are employed.

Meeting requests exist in Microsoft Outlook as long as an employee is employed. After this, the account will be deleted. The storage period for participant lists follows the description under invoices under "Administration regarding finance, accounting, purchasing, financial controls and analysis" in this personal data policy.

We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

In connection with meeting catering, we disclose your personal data to AAU's canteen providers Jespers Torvekøkken and Cheval Blanc Kantiner: Names and any catering considerations.

In some cases, external course instructors need to receive information about you in order to prepare for the course. In this connection, information about you may be disclosed.

Participant lists with names and email are available in Outlook for all meeting participants, i.e. also for participants outside AAU.

For more information

If you have questions about how AAU processes your personal data in connection with internal courses and meetings, you can contact HR here: Contact HR - Aalborg University

Access to access systems at CAS, premises, car rental and mileage requisition

Why we process your personal data

In order to be able to issue your AAU access card and manage your access to AAU's buildings and premises, register in Webbook and Symmetry, to give you access to use AAU’s cars for employees and make a mileage request, it is necessary that we process your personal data.

We process this information about you

Setting up for the Symmetry access system: Employee number, name, birthday, date of employment and, if applicable, termination date.
Creating a user in the webbook: Username, password, work email, name, company, work phone number, right to book.
AAU car used by employees: Name, driver’s licence number, which car is authorised to be used.
Fixed mileage requisition: Name, driver's license number. and which cars you are allowed to use.
AAU card: Employee number, name, birthday, portrait photo, date of employment and, if applicable, date of termination.

We have received the information directly from you in connection with your employment.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6(1)(b) and section 12 of the Danish Data Protection Act.

How we store your personal data

Especially in connection with these work processes, we use Symmetry and Webbook.

For how long do we process and store your personal data

Setting up for the Symmetry access system: During the entire employment and until 6 months after the end of the employment period.

Webbook: 5 years after you have been created.

Car usage: 1 year after a mileage requisition has been created.

Fixed mileage requisition: 1 year after the creation of a mileage requisition for a single requisition, and for a fixed requisition when the employment at AAU ends.

AAU card: During the period of employment. 60 days after termination of employment, your AAU account will be closed.

We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

For more information

If you have questions about how AAU processes your personal data in connection with access to access systems, premises, car rental and transport requisition, you can contact Campus Service here: Campus Service - Aalborg Universitet

Research support and administration

Why we process your personal data

In order to provide administrative support for AAU's research and collaboration with the outside world, it is necessary for us to process your personal data in connection with funding advice, project management, legal advice, advice on research security, drafting and negotiating agreements in connection with research collaboration and data protection, handling applications and approvals to the Research Ethics Committee, administrative handling of PhD students' educational programmes, support for mission-driven research that AAU participates in or leads, process mapping and optimisation of administrative processes.

We process this information about you in these cases

Support of funding applications and project management: Name, title, email, phone number, place of employment. In some cases, also date and place of birth, nationality, gender, number of children, salary, timesheets, research experience, experience with funding, competences, publication lists and research interests.
Funding-related courses, seminars and events: Name, email, workplace. In some cases, title, phone number, educational information, citizenship.
Preparation of impact assessments: Name, CPR.nr., work email, work phone number, department affiliation, title/position.
Art. 30 processes: Name, CPR.nr., work email, work phone number, department affiliation, title/position.
Legal advice and advice on research security: Name, title, workplace and department, work email and telephone number, previous education, previous employment, ethnic origin in connection with risk assessments/screenings, information in the CV about membership of a religious or political association, publication information, address, CV, application, subject area, family relations, external partners, advice may include assessments related to violations of legislation (export control, the Public Administration Act, economic irregularities).
Conclusion of contracts: Name, work email, work phone number, private phone number.
Research Ethics Committee: name, title, work telephone no. and e-mail, department/department.

We have received the information directly from you, your colleague or manager.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6 (1) (e) and art. 9(2) (g). Sections 2(2) and (3) of the University Act, and the General Data Protection Regulation art. 26 (1), art. 28 (3), art. 30 (1) and (2), art. 35 (1) and art. 46 (2).

For advice related to risk assessments in the area of safety:

PET Security Approvals: The General Data Protection Regulation art. 6 (1) (c) and art. 10. Safety Circular CIR1H no. 10338 of 17/12/2014.
Advice on risk assessments of employment: The rules on export controls and sanctions (including the Dual-Use Regulation) and the URIS guidelines.

How we store your personal data

For how long do we process and store your personal data

Support of funding applications and project management: In the period until a decision has been made regarding the application and then for 5 years after the application or final payment, however, some information follows the administration of finances [insert link].
Funding-related courses, seminars and events: Until the end of the year and then for 5 years.
Impact assessments and art. 30 processes: The data is processed and stored for as long as the research project is active and research data is stored. After this the assessment will be archived pursuant to the Danish Archives Act.
Legal advice and advice on research security: The information is processed throughout the grant period/agreement period and is stored for 20 years thereafter.
Research Ethics Committee: The information is processed during the case processing, and for 3 years after the rejection or research activity period expires.

We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data

We disclose your information in these cases and to these recipients

Support of funding applications and project management: Granting bodies and any external consultants associated with or the project's consortium: name, title, e-mail, telephone number, place of work. The disclosure takes place to ensure cooperation and receipt of the grant.
Funding-related courses, seminars and events: External consultants, partners, speakers in connection with the event, etc., name, e-mail and workplace may be disclosed. The disclosure is done to ensure your participation.
Impact assessments and art. 30: In certain cases, AAU is obliged to disclose the following information to the DPO and/or the Danish Data Protection Agency: Name, work email, work phone number, department affiliation, title, position.
In order to provide legal advice, enter into contracts and advise on research security:
- In the event of violations or audits, information is disclosed to the DPO, auditor, police or other relevant authorities where required.
- General personal data is disclosed to business partners in connection with the conclusion of contracts and correspondence both within and outside the EU (cf. General Data Protection Regulation art. 45 (1) or art. 49(1)(b), (c) or (d), depending on the type of transfer).

For more information

If you have any questions about how AAU processes your personal data in connection with research funding, you can contact Research Services here: https://www.forskningsservice.aau.dk/

Administrative support for innovation, entrepreneurship and commercialisation at AAU

Why we process your personal data

In order to provide support for the commercial exploitation of the results of AAU's research, it is necessary for us to process your personal data. This happens, for example, in the event that you are the inventor/originator of an invention or software that is reported to AAU, or if you are in contact with Research Innovation because you are applying for funding for the commercial maturation of your technology or intend to found a start-up based on your non-patentable research results.

We process this information about you

In connection with the commercialisation of inventions or software to which you have contributed, we process your name, job title, place of employment, work email, nationality and, if applicable, private address and private email address.

If you are in contact with AAU with a view to commercialising your non-patentable research results or in connection with an application for funding for the commercial maturation of your technology, we process your name and the contact data, usually e-mail address and telephone number, that you provide yourself.

In some cases, image and video material is also processed with you for the visibility of your technology.

We have received the information from you in connection with your reporting of inventions or software, when filing a patent application with you as an inventor/co-inventor or when you contact Research Innovation for support of commercial opportunities for non-patentable research results.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6(1)(e). Section 11 of the Data Protection Act, and Section 2(3) of the University Act. The Act on Inventions at Public Research Institutions sections 1, 10,12 (1) and 14. Sections 8 (4) and 20 of the Patents Act.

How we store your personal data

For case management, we use Inteum, with whom we have entered into a data processing agreement.

For how long do we process and store your personal data

We process your personal data for as long as the commercialisation activity is ongoing, and then we store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

In connection with novelty screening of the invention to which you have contributed, we disclose the information about your name and contact details to the patent agency you have provided on the notification form. When filing a patent application with you as an inventor/co-inventor, we disclose your name and the address you have provided to the patent authorities (in Denmark, the Danish Patent and Trademark Office), usually via a patent agency. If the patent application is active after 18 months, all information about the patent application, including the patent application, names of the inventors and the addresses they have provided to AAU will be published. If the patent application is still active after 30 months, the information is disclosed via the patent agency to national patent offices in all the countries where a patent is sought.

In connection with the commercialisation of the research results to which you have contributed, the information you have provided about your name, address and contact details may be disclosed to collaborators, other universities, patent agencies, companies, foundations and/or public authorities both within and outside the EU in connection with patent applications, licence transfers and case processing/communication in this connection. The basis for transfer is the General Data Protection Regulation art. 45 (1) or art. Article 49 (1)(e). The purpose of the disclosure is to inform the parties involved about who has produced the research results that are sought to be commercialised and, in the case of patenting, to comply with the requirements of the patent authorities.

For more information

If you have any questions about how AAU processes your personal data in connection with innovation, entrepreneurship and commercialisation, you can contact AAU Innovation here: aauinnovation@adm.aau.dk

Research Registration and Dissemination (AUB)

Why we process your personal data

In order to provide administrative support for AAU's research and dissemination of it, it is necessary for us to process your personal data in connection with research registration and dissemination, as well as personal and user registration in Pure, as well as to carry out VBN analyses.

We process this information about you

Name, work email, work telephone number, place of employment, gender, profile photo, job title, employee number, AAU-ID, job type (VIP, TAP, etc.), list of publications.

We have received the information from HR in connection with your employment.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6(1)(e) and sections 11 and 12 of the Danish Data Protection Act.

How we store your personal data

In addition, we use Pure API, Scival and ORCID, with which AAU has entered into data processing agreements with.

For how long do we process and store your personal data

We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

Your personal profile is published on vbn.aau.dk. The purpose of this is to make visible and disseminate research carried out at and in collaboration with AAU.

For more information

If you have any questions about how AAU processes your personal data in connection with research registration and dissemination, you can contact Aalborg University Library (AUB) at Aalborg University Library in Aalborg, Esbjerg, and Copenhagen - Aalborg University

Administration regarding finance, accounting, purchasing, financial controls and analysis

Why we process your personal data

Travel expenses and control: Registration, administration and payment of travel compensation when you have travelled in connection with your work for AAU, as well as control and auditing.
Tenders and procurement: When you participate in one of AAU's tenders or purchases.
Registration of plant and equipment: The purpose of processing your personal data is to register and manage employees' use and storage of equipment at AAU.
Controlling and project finances: For the creation of projects in the project system, financial reporting to the grantor and in partner accounts as well as time registration.
Local salary control: When AAU conducts local salary control.
Creditors and debtors: Processing and/or issuing invoices.
Budgeting and bookkeeping in connection with the operation of AAU.
Analysis Reports to external authorities and analyses for internal use.

We process this information about you

Name, CPR.nr., address, work telephone number, work email, employee number, private address and e-mail and in addition, specifically:
Travel expenses: gender, date of birth, driver's license, registration number on the car used, affiliation with one or more institutions, passport number, work permit.
Controlling and project finances: date of birth, photo ID, education, course certificates, statements, employment, assignment, salary, taxation info, pension, account number, nationality, information about absence and illness, registration number on a car.
Local salary control: Information on salary, information on pension, information on absence and illness, employee number.
Creditors and debtors: Date of birth, account number, registration number of car, employee number, Health information that may have been added to the invoice as text by the supplier.
Budgeting and bookkeeping: Information about salary, information about pension, information about absence, illness, information about intended education, field of study, employee number.
Analysis Information on salary, information on pension, information on absence and illness, employee number.

We have received the information from HR, which has been obtained directly from you.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6 (1) (c) and art. 9(2) (b). Sections 11 and 10(1) of the Danish Data Protection Act (analysis and statistics).

The Executive Order on the State Accounting System, the taxation laws, the Executive Order on the Act on Universities (the University Act), the Executive Order on Grants, Accounting and Auditing, etc. at the Universities, the Ministry of Finance's Budget Guidance, the Executive Order on Public Procurement Act, the Public Tender Act, the Ministry of Finance's Budget Guide Circular on the Business Travel Agreement. Executive Order on Mandatory Digital Reporting to Statistics Denmark, UFM Reporting Instructions.

How we store your personal data

Especially in connection with these tasks within finance, accounting, tendering/purchasing and controlling, we use Oracle ERP, VAX 360 and WBM (MySupply), with which AAU has entered into a data processing agreement with.

For how long do we process and store your personal data

Travel expenses and control: In Oracle ERP for 20 years from the end of the financial year to which the information relates and in WorkZone for 5 years after the current financial year
Tenders and procurement: For the entire duration of the contract, however, a minimum of 3 years from the date of award of the contract, cf. the Public Procurement Act.
Registration of plant and equipment: Throughout the employment and thereafter for 5 years after the current financial year.
Controlling and project finances: In Oracle ERP for 20 years from the end of the financial year to which the information relates and in WorkZone for 5 years after the current financial year.
Local salary control: During the control period and thereafter 3 years from the end of the period.
Creditors and debtors: In Oracle ERP for 20 years from the end of the financial year to which the information relates and in WorkZone for 5 years after the current financial year.
Budgeting and bookkeeping: Current year and thereafter for 5 years after the current financial year for budgeting and for bookkeeping in Oracle ERP for 20 years from the end of the financial year to which the information relates, and in WorkZone for 5 years after the current financial year.
Analysis During the assignment period and thereafter for 30 years.

We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

In all cases, personal data is disclosed to Deloitte for institutional audit purposes and in addition, specifically:

Travel expenses and control: CWT as a supplier for booking travel, banks and Wordline for foreign card payments, Mobilepay.
Creditors and debtors: The Danish Tax Agency for tax reporting and banks for payment.
Budgeting and bookkeeping: External partners and grantors, banks and Wordline for card payments, Mobilepay.
Analysis Mandatory reporting to Statistics Denmark, the Ministry of Education and Science and the Ministry of Children and Education.

For more information

If you have any questions about how AAU processes your personal data in connection with administration regarding finances, accounting, purchasing, financial controls and analysis, you can contact the Finance Department here: Contact information for the Economics Department at Aalborg University (AAU) - Aalborg University

Access to IT systems, support and other technical support of workflows

Why we process your personal data

In order to give you access to AAU's systems and support, you must have a user profile. In connection with this we process your personal data. We may also process your personal data in connection with system development and maintenance for the purpose of ensuring that AAU's systems continue to be sufficiently updated and protected.

We process this information about you

Access and technical support when using AAU's systems and equipment: Depending on the system to be accessed, the following system-relevant IDs are processed: AAUID, employee number, IP address and StatHR ID. In addition, the following information is processed in connection with identity and rights management: name, CPR.nr., department, work email, work telephone number, place of employment, possibly private e-mail and private telephone number.

Supportproces: In connection with technical support, the above information is processed to the extent that it is relevant. In addition, logging information may be processed, and if your inquiry contains sensitive personal data, we also process this.

System development and maintenance: As a general rule, we do not process your personal data in connection with system development and maintenance. To the extent that it is necessary to use personal data to ensure the correct functionality of systems, we process information about you. The type of information depends on the specific system that is being developed, tested or maintained.

We have received the information from you in connection with your employment and/or inquiry. AAUID, work telephone no. and employee number are assigned by AAU.

We process the personal data on the basis of the following legislation: General Data Protection Regulation. 6(1) (b) art. 9(2) (b) and art. 32, Sections 11 and 12 of the Data Protection Act, and Section 2 of the University Act.

How we store your personal data

In addition to storing personal data on local servers at AAU, we use suppliers of IT systems such as Microsoft, KMD WorkZone for general processing of personal data. We have entered into data processing agreements with the suppliers. This means, among other things, that the suppliers are subject to instructions from AAU, confidentiality and compliance with the data protection rules and other relevant legislation.

Especially in connection with identity and rights management, we use IDM (IdentityIQ), AD and Entra ID. In connection with user data in AAU's LMS (Moodle), we use data from STADS and Modulbasen. In connection with the support process, we use ServiceNow, with whom AAU has entered into a data processing agreement with.

For how long do we process and store your personal data

We process your personal data for as long as you are employed, and then we store the data for 5 years after the last active affiliation in order to ensure consistency in usernames. Information in IDM, AD and Entra ID will typically be stored for a maximum period of 3 months after your affiliation with AAU ends. Course information in Moodle is stored for 6 years, after which it is deleted. Support cases are retained for 5 years plus the current year.

We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

Identity management: In order to ensure access to systems offered at AAU, including support, it may in some cases be necessary to disclose your information about login, name, work email and username to system suppliers. This may involve system suppliers outside the EU in accordance with the General Data Protection Regulation. 45 (1) or art. 46(2) (c).

For more information

If you have any questions about how AAU processes your personal data in connection with system access and support, you can contact ITS Support here: support@its.aau.dk

Monitoring of IT equipment and monitoring of public areas

Why we process your personal data

Security operation: In order to provide necessary IT security at AAU, we monitor the use of IT equipment and software offered, and in this connection we collect and process personal data about you.

Network monitoring: For IT security purposes, AAU conducts network monitoring using AAU networks. In order to be able to identify users based on network traffic information, e.g. in connection with the investigation of cases of violation of AAU's terms of use of networks, we collect and process personal data about you.

CCTV: For security purposes, AAU has established CCTV surveillance at AAU's locations. If you are at AAU's locations, you may be covered by the CCTV surveillance and in connection with this we collect and process personal data about you.

We process this information about you

CCTV: TV recordings on which you may appear and the information that can be recognized from it, including characteristics and any health information, if this is clearly stated in the recording.

Security operation: Name and email address, IP addresses, usernames, location information (at city level based on IP addresses). Actions taken on AAU computers, e.g. used software and visited websites.

Network monitoring: Name and email address, IP and MAC address, location information at building level or room level when networks at AAU are used.

We have received the information from you in connection with your employment at AAU and when you are in AAU's areas that are under CCTV surveillance. We also receive information when you use IT equipment assigned to you in connection with your employment, as well as information from network equipment when you use AAU's network.

We process the personal data on the basis of the following legislation: The General Data Protection Regulation art. 6 (1) (e) art. 9 (2) (g) art. 32, section 2d of the Television Surveillance Act, and section 2(1) of the University Act.

How we store your personal data

We store your personal data securely and confidentially in accordance with applicable information security regulations. Only employees who have a work-related need have access to the personal data.

In particular, in connection with the storage of log information, we store the information in Sentinel and Splunk.

For how long do we process and store your personal data

CCTV: We store the TV recordings for 30 days, after which they are deleted.

Security Operation and Network Monitoring: We keep log information for up to 13 months, after which it is deleted.

In the event of an investigation of a case, we may be required to store the information for a longer period of time. We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

In the event of an investigation of an offence, the information may be disclosed to the police or to other relevant authorities.

For more information

If you have questions about how AAU processes your personal data in connection with CCTV, you can contact Campus Service here: Campus Service - Aalborg Universitet

If you have questions about how AAU processes your personal data in connection with monitoring, you can contact ITS Security here: ciso@aau.dk

Rector's availability fee and recommendations and appointments

Why we process your personal data

In order to be able to serve as secretariat for committees at AAU, administer the rector's availability fee, which is intended to support activities, major initiatives and strategic initiatives that have to do with AAU's activities, as well as process recommendations and appointments to boards, councils, committees, foundations etc., which in some cases are submitted via “Danske Universiteter”, it is necessary for us to be able to process your personal data.

We process this information about you

Rector's availability sum: Name, phone number, e-mail and, in some cases, address.
Secretariat service for committees: Name, e-mail, position, place of employment, scientific publications and in some cases also phone number, previous positions, department affiliation, CPR.nr. and private address.
Nominations and appointments: Information in the CVs of the nominees is processed, i.e. name, e-mail, phone number., title, address, date of birth and publications, any previous employments and other information you may provide in your CV.

We have received the information that we process in connection with the administration of the rector's disposable sum from you when you applied for a grant.

We have received the data that we process in connection with secretariat services for committees by virtue of your employment at the university.

We have received the information that we process in connection with nominations and appointments from you, either directly or via a dean's or department's secretariat.

We process the personal data on the basis of the following legislation:

Rector's availability sum: General Data Protection Regulation art. 6(1) (e) and Sections 2 and 21 of the Universities Act.
Nominations and appointments: General Data Protection Regulation art. 6(1) (e) and section 35 of the University Act.
Administrative support: General Data Protection Regulation art. 6(1) (e), section 11 of the Data Protection Act and section 2 of the University Act, as well as special rules for the committees.

How we store your personal data

Especially in connection with secretariat services, we use the e-agenda system First Agenda and the plagiarism system Ithenticate.

For how long do we process and store your personal data

Secretariat service for committees: 5-8 years, depending on the type of committee, from the time of appointment to the committee in question.

Rector's availability sum: The case is processed in the current year, and case files are stored for 5 years after the end of the financial year.

Nominations and appointments: 15 years after the date of the decision/appointment/award or similar.

We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

Secretariat services for committees, etc.: Meeting materials are shared with contributors and attendees. In addition, the minutes are open and can be found on AAU's website or intranet, where meeting participants appear with their name and title.

Nominations and appointments: Information in the CVs of the nominees is processed; Name, e-mail, phone number, title, address, date of birth and publications, previous employments, etc. are disclosed to the organisations that handle the case and serve the boards, councils, committees, boards, foundations to which they are recommended or appointed, as well as to “Danske Universiteter”, which in some cases act as a liaison.

The purpose of the disclosure is, with regard to secretariat services, to ensure openness about the processing of cases in committees, etc., when we are obliged to do so, and regarding recommendations, to ensure that you are recommended to the appointing authority or organisation.

For more information

If you have questions about how AAU processes your personal data in connection with administration regarding secretariat services for committees, etc., the Rector's availability sum, as well as recommendations and appointments, you can contact the Rector's Office here: The Rector's Office at Aalborg University - Aalborg University

Sideline occupation

Why we process your personal data

We process your personal data for registration and administration regarding your sideline employment.

We process this information about you

Name, CPR.nr., job title, AAU e-mail, place of employment, information about sideline employment; type, description of tasks, client/employer/domicile and website, number of hours per week and period of sideline employment.

We have received the information from you in connection with the employment and via a completed form or email about sideline employment – annual reporting or advance notification.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6(1) (b) and Sections 11(1) and 12 of the Danish Data Protection Act.

How we store your personal data

In particular, in connection with the completion of digital forms for advance notification and annual reporting of sideline employment, we use InterACT.

For how long do we process and store your personal data

We disclose your information in these cases and to these recipients

For more information

If you have questions about how AAU processes your personal data in connection with your sideline employment, you can contact HR here: Contact HR - Aalborg University

Anniversary

Why we process your personal data

During your employment, your seniority is registered, and in connection with this and your anniversary (including registration on the anniversary list and payment of anniversary bonus or gift), we process your personal data for registration and administration.

We process this information about you

Name, CPR.nr., address, title, date of birth, period of employment, salary number, staff category and date of anniversary.

We receive the information from you when filling out the information form prior to your employment. In addition, we receive information as a result of your employment. We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6(1) (c), Section 11 of the Data Protection Act, Circular No. 15/4 2011 on Anniversary Bonuses for State Employees, Executive Order No. 764 of 19 June 2024 on Grants and Auditing etc. at universities Section 23, and Act No. 42 of 13 January 2023 on the Assessment of Income Tax to the State (Tax Assessment Act) and applicable collective agreements.

How we store your personal data

Especially in connection with anniversaries, we use SLS, HR payroll and Statens HR.

For how long do we process and store your personal data

Anniversary lists are kept for 5 years for auditing purposes. Physical lists are stored for 1 year after an anniversary has been held. Information about seniority and anniversary is stored throughout the employment, and for resigned employees, the information is then stored for 30 years from the date of resignation, and then we archive the documents containing your personal data.

We disclose your information in these cases and to these recipients

In connection with the purchase and delivery of a gift, information about your name and address is disclosed to the supplier of the gift to ensure correct delivery.

For more information

If you have any questions about how AAU processes your personal data in connection with anniversaries, you can contact HR here: Contact HR - Aalborg University

DRAM (flex job, etc.) as well as senior schemes and senior bonus

Why we process your personal data

If you are in a flex job, applying for a flex job or are otherwise covered by the DRAM scheme, or if you are covered by senior schemes and senior bonus, we process your personal data for the purposes of applying, registering and administering the schemes.

We process this information about you

DRAM: Name, CPR.nr., address, grant from municipality, period/employment rate, degree of efficiency/period, unemployment benefit rate and choice of tax card, information on employment, information on work tasks, information on choice of tax card, information on pension, nationality, wage statistics information in accordance with employment scheme (reimbursement part).

Senior schemes and senior bonus: Name, date of birth, information about the employee's employment conditions such as position, seniority, date of resignation, employment rate and salary, Place of employment, number of senior days, reduction in hours or new job title. Trade union membership.

We have received the information from you and your municipality of residence/job centre. We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6(1) (b) and Sections 8(1), 11 and 12 of the Data Protection Act, Circular No. 25022 of 14 June 1997 on jobs on special terms, Act No. 280 of 1 March 2024 on active employment efforts, Circular of 14 December 2012 on pension conditions from employees in flex jobs in the state, etc., Act No. 97 of 29 January 2025 on sickness benefits and Circular No. 9938 of 5 November 2024 on agreements on senior schemes and Circular No. 10119 of 16 December 2024 on the agreement on senior bonus and senior days.

How we store your personal data

Especially in connection with DRAM, we use Vitas, Statens HR, SLS, HR-løn and KMD WorkZone.

For how long do we process and store your personal data

The information is stored throughout the employment and for resigned employees, the information is then stored for 30 years from the date of resignation, after which we archive the documents containing your personal data.

We disclose your information in these cases and to these recipients

We disclose the following information to said recipients:

Municipality of residence: cpr.nr., name, salary information, hours, period.
State administration (reimbursement from the state): cpr.nr., name, salary information, hours, period.
Trade union and union representatives: name, salary information, period, type of agreement, place of employment, job title, number of senior days, reduction in hours.

The purpose of the transfer to the municipality of residence is that it is necessary in order to be able to receive and maintain a licence from the municipality. The purpose of the disclosure to the State Administration is that it is necessary for AAU to receive relevant reimbursement in connection with the employment. The purpose of the transfer to the trade union and union representatives is that it is necessary in order to get approval for a grant in connection with company internships and wage subsidies as well as in salary negotiations in connection with employment in a flex job.

For more information

If you have questions about how AAU processes your personal data in connection with DRAM, senior schemes and senior bonuses, you can contact HR here: Contact HR - Aalborg University

Communication: Content on social media, websites, AAU Update and speeches

Why we process your personal data

For close-ups and certain types of content, we obtain your consent to publish it on AAU's social media. In this you can read specifically how we process your personal data. In general, we process - with your explicit consent - your personal data for information and marketing material about AAU on AAU's accounts on social media, on AAU's websites, information campaigns online and offline for AAU, advertisements for and articles about AAU in prints, posters, brochures/printed matter and digital media formats, as well as profiling, campaign and advertising films for TV and on online platforms.

In addition, in some cases, we process your personal data in speeches, on AAU Update and on AAU's website and content on AAU's social media channels for information and communication about activities and conditions at AAU.

We process this information about you

Name, title, field of work, publications, debate contributions, research areas, photo/video on which you appear and personal narratives that you provide.

We have received the information directly from you or someone you have asked to assist you.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6(1) (e) and Section 2 of the University Act (speeches, situational pictures on websites, etc.)

For close-ups and certain types of content, we process your personal data on the basis of the General Data Protection Regulation art. 6(1) (a) and/or Art. 9(2) (a).

How we store your personal data

For how long do we process and store your personal data

We process your personal data in connection with the preparation of the content for the media, and after the publication of a post, the data is deleted at AAU, while the post remains on AAU's social media channels.

Speeches are stored for 3 years and then archived.

We store your personal data for as long as it is necessary in relation to the purpose. We will then delete or anonymise your personal data.

We disclose your information in these cases and to these recipients

When we publish material containing your personal data on AAU's social media accounts, including Facebook, Youtube, Instagram and X, these social media are often domiciled for their operations within the EU, where the personal data is generally stored, but also subsidiaries and/or parent companies outside the EU, especially in the USA. This means that when your personal data is published on social media, the data may be transferred to a country outside the EU that does not provide the same level of data protection as within the EU. We obtain your consent for the publication of photos and videos in which you appear clearly.

In connection with speeches and content on websites, your personal data is published so that it is available to anyone who may hear the speech or access the website, AAU update, etc.

For more information

If you have questions about how AAU processes your personal data in connection with content on social media, websites and speeches, you can contact AAU Communication and Public Affairs here: Contact - Aalborg University

Workplace accidents

Why we process your personal data

In the event that you are involved in a workplace accident, we process your personal data for administrative case processing and handling of the workplace accident.

We process this information about you

Name, CPR.nr., work email, phone number, employment conditions, health information, information about the accident and sick leave as a result of the accident.

We have received the information from you in connection with your report of the work accident.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6 (1) (c) and Art. 9(2) (b), Section 11 of the Data Protection Act, as well as Executive Order No. 799/22 on Notification of Occupational Accidents, etc. to the Danish Working Environment Authority and Executive Order No. 941/22 on Notification of Accidents under the Workers' Compensation Act.

How we store your personal data

For how long do we process and store your personal data

We process your personal data for as long as the case is ongoing and then we store the data for as long as it is necessary for the purpose of any reassessments or when acknowledging late effects of the occupational injury later in life.

We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

We disclose the following information to the Danish Labour Market Insurance and the Danish Agency for Higher Education and Science: Name, CPR.nr., e-mail, phone no. employment conditions, information about the accident, health information and information about sick leave as a result of the accident. The purpose of the disclosure is to report the occupational accident.

For more information

If you have questions about how AAU processes your personal data in connection with workplace accidents, you can contact Campus Service, Working Environment and Emergency Preparedness here: Working Environment and Emergency Preparedness - Aalborg University

The whistleblower scheme

Why we process your personal data

The purpose of the Whistleblower Scheme is to ensure a safe environment for employees and other persons associated with AAU to express themselves about critical conditions at AAU. In this way, AAU complies with the obligations imposed on the university, cf. Act no. 1436 of 29 June 2021 on the protection of whistleblowers.

We process this information about you

If you're a reporter of an incident: The information that you may provide about yourself in the review. You can remain anonymous. Read more here: https://www.en.aau.dk/about-aau/contact/whistleblower-scheme

If you are affected by an incident: If matters for which you are responsible are processed in connection with a report, then the type of personal data processed depends on the type of report.

We receive the information from the whistleblower. In connection with the investigation of the report, we generally use the information registered in our systems about the incident. In addition, we may obtain new information.

We process the personal data on the basis of the following legislation: Section 22 of the Whistleblower Act, according to which the processing of personal data covered by Article 6(1) (c), 9(2) (b) and (10) of the General Data Protection Regulation may take place if it is necessary to process a specific report received in a whistleblower scheme established under the Whistleblower Act. In addition, the General Data Protection Regulation and the Data Protection Act apply to other processing of personal data in relation to the whistleblower scheme.

How we store your personal data

We use the system WhistleB to process personal data for the whistleblower scheme. We have a data processing agreement with BechBruun, who provides the system.

For how long do we process and store your personal data

We process your personal data for as long as the case is ongoing. The case will be deleted from WhistleB at the end of the case.

If BechBruun assesses that the report is covered by the whistleblower scheme, it is investigated and a report is written which AAU receives. We store the report in WorkZone for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

The information is disclosed to Bech-Bruun, which processes the reports on AAU's behalf, and Bech-Bruun advises if necessary. All the information reported in the system is disclosed by the whistleblower. In addition, information that emerges from the further processing of the case and investigation may be disclosed.

Finally, the information may be disclosed to the police or relevant authorities if this is required as a result of the report. The information that is relevant to the situation is disclosed.

For more information

If you have questions about how AAU processes your personal data in connection with the whistleblower scheme, you can contact HR here: Contact HR - Aalborg University

Cases concerning The Danish Committee on Research Misconduct

Why we process your personal data

If you are a respondent in a case that is being processed by AAU's Practice Committee, or are otherwise involved in the case, we are obliged to refer the case to the Danish Committee on Research Misconduct if there is suspicion of scientific misconduct. We process your personal data in connection with our case processing and the transfer.

We process this information about you

If you are a reviewer: Name, address, email address and telephone number.
If you are a respondent: Name, work email, CPR.nr., title, position, place of employment, scientific products, statement on breach of good scientific practice or decision on scientific misconduct and any decision on sanction.
If you are a member of the practice committee, the following information about you will be disclosed: The names, titles and places of employment of the members of the committee are stated in the material sent to the committee for the purpose of informing the committee.

We have either received the information when we received the notification to the practice committee, or by virtue of your employment at AAU if you are part of the practice committee.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6(1) (c), sections 4 and 10(3) of the Danish Act on Research Misconduct, and section 11(1) of the Danish Data Protection Act.

How we store your personal data

Especially in connection with the assessment of the case, we use the plagiarism tool Ihenticate.

For how long do we process and store your personal data

We process your personal data while the case is pending, and then we store the data for 5 years in order to ensure the respondent's ability to request access to the case and to ensure uniform case processing.

We store your personal data for as long as it is necessary in relation to the purpose. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data

We disclose your information in these cases and to these recipients

When you are sent to the Danish Committee on Research Misconduct, which is served by the secretariat of the Danish Agency for Higher Education and Science, we will disclose the following information about you to them:

If you are a reviewer: Name, address, email address and telephone number.
If you are a respondent: Name, e-mail address, civil registration number, title, type of employment, place of employment and the scientific product that is the focal point of the case.
If you are a member of the practice committee, the following information about you will be disclosed: The names, titles and places of employment of the members of the committee are stated in the material sent to the committee for the purpose of informing the committee.

The purpose of the disclosure is to comply with the university's obligation to refer the case to the Board if there is a reasonable suspicion that the case has been covered by the Committee's competence, cf. section 10(3) of the Act on Research Misconduct.

For more information

If you have any questions about how AAU processes your personal data in connection with the Committee on Research Misconduct, you can contact the Rector's Office here: The Rector's Office at Aalborg University - Aalborg University

Dismissal and other disciplinary proceedings

Why we process your personal data

We process your personal data so that we can make use of the labour law options to sanction an employee through the use of reprimands, warnings, dismissal or expulsion. This may be justified by the institution's circumstances or the employee's own circumstances.

In addition, the information is used in connection with budgeting and staff planning.

We process this information about you

Name, CPR.nr., private address, information about employment conditions such as position and seniority. Personal circumstances such as absence, qualifications, performance and behaviour. Position of trust as health and safety representative. Member of the Board of Directors. Membership of a trade union, Disability, fertility treatment, pregnancy or maternity/paternity leave, Personal circumstances such as state of health, Positions of trust as union representative, deputy union representative, member of works council and deputy member of works council. Member of the municipal council. Criminal information depending on the specific case; fraud, violence, traffic offences, etc. In some situations, the information is obtained from the Director of Public Prosecutions.

We have received the information from you, public authorities, others associated with your workplace, etc.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6 (1) (e) and Art. 9(2) (g), section 8(1) and (2), Section 11(1) and Section 12(1) of the Danish Data Protection Act.

How we store your personal data

In connection with the above, we use the Danish Government HR, Digital Post and Qlikview.

For how long do we process and store your personal data

The information is stored throughout the employment and for resigned employees, the information is then stored for 30 years from the time of resignation, and then we archive the documents containing your personal data.

We disclose your information in these cases and to these recipients

The Regional Labour Market Council: Name, cpr.nr., date of birth, position, address, municipality of residence, date of termination and date of resignation.
Union representatives: The name of the employee and that the person in question has been summoned to a handover meeting. In the event of dismissals due to the institution's circumstances, the reasons must also be stated.
Law firm: all information in the specific case.
The Danish Agency for Employees and Competence: all information in the specific case.
The employee's professional organisation: The trade union is always informed of name, address, date of birth and sanction.
If you accept an outplacement programme in the event of dismissal, your personal data will be disclosed to the company with which AAU has entered into an agreement on the outplacement programme.

The purpose of the disclosure is:

The Regional Labour Market Councils

Disclosure takes place if the dismissals are covered by the Act on Notice, etc. in connection with large-scale dismissals. That is, in order to comply with a legal obligation.
Legal basis: Legal obligation, cf. the General Data Protection Regulation art. 6 (c) and section 12 of the Danish Data Protection Act in order to comply with the data controller's legal obligation.

Union representatives

Legal basis: We are obliged to do so, cf. industrial arbitration FV 2017.0150. The legal basis is a legal obligation, cf. the General Data Protection Regulation art. 6 (1) (c) art. 9(2) (b) and Section 12 of the Danish Data Protection Act.

External law firms, such as Kammeradvokaten.

Disclosure takes place if we need legal advice in a case.
Legal basis: The General Data Protection Regulation art. 6(1) (e) and Art. 9(2) (g).

The Danish Agency for Employees and Competences

Disclosure is made with a view to the agency safeguarding the university's interests in connection with a negotiation of a dismissal case.
Legal basis: The General Data Protection Regulation art. 6(1) (e) and art. 9(2) (g).

Professional organisation

Disclosure takes place on the basis of the joint agreements.
Legal basis: Legal obligations, cf. the General Data Protection Regulation art. 6 (1) (c) and Art. 9(2) (b) and Section 12 of the Danish Data Protection Act.

For more information

If you have questions about how AAU processes your personal data in connection with dismissal and other disciplinary cases, you can contact HR here: Contact HR - Aalborg University

Termination of employment - Resignation

Why we process your personal data

In order to manage your resignation, we process your personal data.

We process this information about you

Name, CPR.nr., address, resignation date, position, affiliation at AAU.

We have received the information directly from you in connection with your employment and your employment relationship in general. from you or they are already in our systems.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6(1) (b) and art. 9(2) (b) of the Danish Data Protection Act.

How we store your personal data

In connection with resignation, in addition to the above, we use the State HR, HR-Payroll, SLS and Qlikview.

For how long do we process and store your personal data

We disclose your information in these cases and to these recipients

For more information

If you have any questions about how AAU processes your personal data in connection with your resignation, you can contact HR here: Contact HR - Aalborg University

Data analysis

Why we process your personal data

At AAU, we analyse our data and business procedures, prepare statistics and analysis reports with a view to optimising our processes, conduct internal and external audits, develop the university's offer of education, research and administration, or respond to inquiries from the authorities about the university's activities.

In addition, we are obliged to provide certain data for the use of statistics to Statistics Denmark.

We process this information about you

The personal data that we may have collected about you in connection with other workflows described in this privacy policy may be used for data analysis, but not information about criminal offences. We pseudonymise your personal data to the extent possible so that you cannot be directly identified from the analysis.

We have received the information from AAU's various departments in connection with the activities listed in the other sections of the policy.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6 (1) (e) and art. 9(2) (g) and Section 2 of the University Act and Section 6(1) of the Act on Statistics Denmark.

How we store your personal data

Especially in connection with data analysis, we use PowerBI and QlikView.

For how long do we process and store your personal data

We will store your personal data for as long as it is necessary in relation to the purpose of the analysis. We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

We are obliged, upon request, to provide certain data for the use of statistics to Statistics Denmark in accordance with section 6 of Statutory Order 2018-05-30 no. 610 on Statistics Denmark.

For more information

If you have questions about how AAU processes your personal data in connection with data analysis, you can contact HR here: Contact HR - Aalborg University

Processing of access to documents with files in which your personal data is included

Why we process your personal data

As a government institution, we are subject to the Public Access to Information Act, the Public Administration Act and the Environmental Information Act and are therefore obliged to process, make decisions and hand over case files in accordance with the rules herein on access to documents. In some cases – depending on the content of the request and the rules in the area – this may mean that we are required to provide documents in which your personal data appears.

We process this information about you

The personal data that we may have collected about you in connection with other workflows described in this personal data policy may be processed in cases of access to documents, depending on the specific request. In connection with the delivery of documents, we pseudonymise your personal data to the extent possible according to the rules on access to documents, so that you cannot be directly identified from the documents provided. If you have requested access to documents, we will process the personal data we may have received from you.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6(1) (c) and Art. 9(2) (g), sections 8 and 11 of the Danish Data Protection Act and section 9 of the Danish Public Administration Act, section 7 of the Danish Public Access to Information Act and section 2 of the Environmental Information Act.

How we store your personal data

For how long do we process and store your personal data

We store your information for as long as the case is being processed and for 5 years after the decision has been made. We then archive your personal data (in accordance with the Danish Archives Act).

We disclose your information in these cases and to these recipients

If the decision on access to documents requires that one or more documents in which your personal data appears must be disclosed, these will be handed over to the person who has requested access to the documents. To the extent possible under the rules on access to documents, we pseudonymise your personal data so that you cannot be directly identified from the documents provided.

If you have requested access to documents and we assess that another authority is competent to make a decision on access to documents, the request, including your personal data, will be forwarded to the appropriate authority.

For more information

If you have questions about how AAU processes your personal data in connection with access to documents cases, you can contact the Rector's Office here: rektorsekretariatet@adm.aau.dk

Lending of rooms for events outside regular teaching

Why we process your personal data

When you wish to use AAU's premises for events outside of regular teaching and enter into an agreement with AAU, we process your personal data for administrative purposes.

We process this information about you

Name, private phone number, private email address, workplace/department/organization and EAN number. In the event that you borrow premises in connection with events held by an association or interest organisation, we also process this information, which may reflect your political or trade union interest.

We have received the information from you in connection with your employment and enquiry about premises loans.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6(1) (e) art. 9(2) (g) and section 2 of the University Act.

How we store your personal data

Especially in connection with security services at AAU's locations, AAU uses the security company G4S. In this connection, G4S may process your personal data on behalf of AAU. A data processing agreement has been entered into with G4S.

For how long do we process and store your personal data

We will store your personal data for 1 year after the event. In the case of events for a fee, the description is followed under 'Administration regarding finance, accounting, purchasing, financial controls and analysis' in this personal data policy.

We then delete, anonymise or archive (in accordance with the Danish Archives Act) your personal data.

We disclose your information in these cases and to these recipients

For more information

If you have any questions about how AAU processes your personal data in connection with the lending of rooms for events outside of regular teaching, you can contact Campus Service here: Campus Service - Aalborg Universitet

Processing of breaches and possible breaches of personal data security

Why we process your personal data

As a government institution, we have a duty to deal with breaches and suspected breaches of personal data security. This implies for instance identifying which personal data may have been or has been compromised, how a breach may have been or has occurred, and which systems or processes may have been or have been affected, as well as to notify the Danish Data Protection Agency and any affected persons where necessary depending on the risk in the specific case.

We process this information about you

The personal data that we may have collected about you in connection with other workflows described in this personal data policy may be processed in connection with the processing of personal data breaches, depending on the specific incident. Only employees who have a work-related need process the personal data.

We have received the information in connection with the notification of the security breach. Where the information is specifically received from depends on the type of security breach.

We process the personal data on the basis of the following legislation: General Data Protection Regulation art. 6(1) (c) and Art. 9(2) (g) and Art. 33.

How we store your personal data

Especially in connection with handling security incidents, we use ServiceNow.

For how long do we process and store your personal data

We store the case with your personal data for as long as the case is being processed and for 5 years thereafter. We then archive your personal data (in accordance with the Danish Archives Act).

We disclose your information in these cases and to these recipients

In cases where Aalborg University is not the data controller in connection with reported breaches of personal data security, all necessary information, including personal data, is disclosed to the data controller. Only information that is necessary for the data controller to handle the case is disclosed. This is necessary for the correct data controller to handle the breach.

For more information

If you have any questions about how AAU processes your personal data in connection with data analysis, you can contact us here: dpo@aau.dk

Aalborg University's personal data policy for employees

Aalborg University's personal data policy for employees

Processing of your personal data under recruitment, and as a current or former employee

Recruitment and appointment

Security clearance and risk assessments in connection with employment

Onboarding of international employees and work and residence permits

Maternity, leave, sick leave and absence for family reasons

Holidays

Salary negotiations, payment, additional and overtime work

Internal courses and meetings

Access to access systems at CAS, premises, car rental and mileage requisition

Research support and administration

Administrative support for innovation, entrepreneurship and commercialisation at AAU

Research Registration and Dissemination (AUB)

Administration regarding finance, accounting, purchasing, financial controls and analysis

Access to IT systems, support and other technical support of workflows

Monitoring of IT equipment and monitoring of public areas

Rector's availability fee and recommendations and appointments

Sideline occupation

Anniversary

DRAM (flex job, etc.) as well as senior schemes and senior bonus

Communication: Content on social media, websites, AAU Update and speeches

Workplace accidents

The whistleblower scheme

Cases concerning The Danish Committee on Research Misconduct

Dismissal and other disciplinary proceedings

Termination of employment - Resignation

Data analysis

Processing of access to documents with files in which your personal data is included

Lending of rooms for events outside regular teaching

Processing of breaches and possible breaches of personal data security

Canteens

Other webpages

Contact

Contact

About AAU

Shortcuts

Service