Translate.Navigation.SkipToMain

Privacy Policy

.
This Privacy Policy explains how N.G.P Tobacco ApS processes personal data in connection with reports submitted through the whistleblower scheme.
Reference is also made to the Whistleblower Policy of N.G.P Tobacco ApS, which outlines who may submit reports, who may be reported, and in which situations.
Below is a detailed description of the personal data processing that takes place, as well as the rights you have if you are reported through the whistleblower scheme, and the rights you have if you use the scheme to submit a report about another person.
This policy concerns only the handling and investigation of reports submitted to the whistleblower scheme.

Data Controller

The legal entity responsible for the processing of your personal data is:
N.G.P Tobacco ApS
Industriparken 35,
9610 Haverslev,
Denmark
CVR no: 41201908
CVRP no: 1025610810
Phone: +45 70 90 92 00
E-mail: info@ngptobacco.dk

Processing of Personal Data

N.G.P Tobacco ApS’ processing of personal data is described in Appendix 1.
The appendix outlines:
  • The purpose for which N.G.P Tobacco ApS processes personal data
  • The categories of personal data processed
  • The sources from which personal data is collected
  • The legal basis for processing
  • The recipients of personal data
  • The data retention periods

Transfer of Personal Data to Countries or International Organisations Outside the EU/EEA (“Third Countries”)

If the processing of personal data involves transfers to third countries—for example, when using a hosting provider located outside the EU/EEA—N.G.P Tobacco ApS will ensure that such transfers are always lawful, including compliance with the GDPR requirements for ensuring an adequate level of protection for the transferred data.

Data Subject Rights

The GDPR grants data subjects a number of rights, particularly as set out in Articles 13–18 and Article 21.
Data subjects have the right to request access to, rectification of, or in special cases deletion of their personal data.
Data subjects may, in certain cases, object to the processing of their personal data and request restriction of processing.
If the processing is based on consent, the data subject has the right to withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
There may be conditions or limitations associated with these rights. It is therefore not guaranteed that a data subject will be entitled to full access or deletion of all personal data. This depends on the specific circumstances of the processing. For example, it will not be possible to delete personal data that is necessary to fulfil the purposes of N.G.P Tobacco ApS’ processing activities, or where deletion would conflict with legal obligations.
Data subjects may exercise their rights by sending an e-mail to Arthur Emil Nielsen, arthur@ngptobacco.dk.
Complaints may also be submitted to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby.

Appendix 1 - Privacy Policy for the whistleblower scheme

Purpose

The purposes of N.G.P Tobacco ApS’ processing of personal data are:
The handling and investigation of reports to the whistleblower scheme concerning the person being reported, and
The handling and investigation of reports to the whistleblower scheme concerning the reporting person.
Below, the personal data processing related to
  1. the person being reported
  2. the reporting person is described in more detail.

1. Handling and Investigation of Reports Concerning the Person Being Reported

Categories of Personal Data.
N.G.P Tobacco ApS may process the following categories of personal data:
  • Name
  • Postal address
  • Telephone number
  • E-mail addresses
  • Position and workplace
  • Salary information
  • Personnel documents
  • Education
  • Sickness absence
  • Criminal matters
  • Other information contained in the report
Additionally, the following special categories of personal data may be processed—generally not before 17 December 2023 unless a lawful basis exists:
  • Racial or ethnic origin
  • Political opinions
  • Religious beliefs
  • Philosophical beliefs
  • Health data
  • Sexual life or sexual orientation
  • Trade union membership
  • Personal identification number

Sources

N.G.P Tobacco ApS may collect information from the following sources—corresponding to individuals entitled to use the whistleblower scheme:
  • Current employees
  • Former employees

Legal Basis

Until 17 December 2023, the legal basis is Article 6(1)(f) of the GDPR, and for criminal matters, Section 8(3), second paragraph of the Danish Data Protection Act. Special category data will generally not be processed before this date unless a lawful basis exists under GDPR Article 9(2)(a), (b), (e), (f) or (g).
From 17 December 2023, processing may take place under Section 22 of the Danish Whistleblower Protection Act.

Recipients

N.G.P Tobacco ApS may share personal data with:
  • Deloitte Statsautoriseret Revisionspartnerselskab
  • EQS Group A/S
  • IT providers
  • External advisors
  • The Police
  • Public authorities

Retention

Personal data relating to an employee is retained for documentation purposes during employment and for 5 years after termination pursuant to Section 4(1) of the Danish Limitation Act, unless circumstances justify longer retention (e.g., pending litigation).
Personal data relating to customers or other third parties is retained for 3 years pursuant to Section 3(1) of the Danish Limitation Act, unless longer retention is required (e.g., pending litigation).

2. Handling and Investigation of Reports Concerning the Reporting Person

This purpose does not include the processing of the reported information itself (see above). If there is suspicion of a knowingly false report, this purpose also includes investigating the reporting person.

Categories of Personal Data

N.G.P Tobacco ApS may process:
  • Name
  • Postal address
  • Telephone number
  • E-mail addresses
  • Position and workplace
  • Salary information
  • Personnel documents
  • Education
  • Sickness absence
  • Criminal matters
  • Other information included in the report
  • Additional information from the sources listed under “Sources” above in cases involving suspected knowingly false reporting
Sensitive data will generally not be processed before 17 December 2023; any reports submitted before this date containing sensitive data will be deleted. After 17 December 2023, sensitive data will also generally not be processed unless the reporting person voluntarily includes such information about themselves. Information concerning legal offences may be processed if there is suspicion of knowingly false reporting.

Sources

N.G.P Tobacco ApS may collect data from the same sources listed under section 1 above.

Legal Basis

The same legal bases apply as those listed under section 1.

Recipients

The same recipients apply as those listed under section 1.

Retention

Personal data relating to an employee is retained during employment and for 5 years after termination, unless circumstances justify longer retention (e.g., pending litigation).