Cabicon’s Personal Data Protection Policy

The purpose of Cabicon’s personal data policy is to explain how we collect, process, and protect personal information. This policy establishes rules on the processing of personal data with the aim of protecting individual rights and in accordance with data protection legislation.

To deliver our services to customers, we collect a range of personal information, and therefore we consider ourselves data controllers, which means we are obliged to protect the confidentiality, integrity, and availability of our customers’, employees’, suppliers’, and partners’ information, including personal information.

Types of Information We Collect

We gather information about our employees, suppliers, customers, and partners. We have compiled a register in accordance with the EU General Data Protection Regulation (GDPR) and guidance from the Data Protection Authority. The register contains all processing activities for which we are responsible.

At cabicon.com, we collect personally identifiable information as well as aggregated information.
We only collect personally identifiable information from users who provide it to us voluntarily and willingly, by registering on our website. The information is collected in connection with the customer’s desire to order a product, sign up for a newsletter, or subscribe. The information is always collected directly from you and with your knowledge.

In addition, aggregated, non-personal information is continuously collected while you visit our website. The collection of this information is done via cookies, as explained below. This may include the number of visits to the website, which pages are visited, the type of web browser, etc. We also automatically collect information about you.

We automatically collect information about how you use our websites and mobile applications, which areas of our websites you visit, and information about your computer or mobile device, including your IP address, device ID, physical location, browser and operating system type, and referring URLs. This information is necessary to be able to deliver personalized and location-based content and analyze web traffic, solve problems, prevent fraud, and improve our services. We may combine this information with information on your account to prevent fraud.

Purpose and Legality of Our Processing of Personal Data

Personal data is processed and archived in connection with:
Personnel administration, including recruitment, employment, termination, and payment of wages and other employment-related tasks.
Basic customer data in connection with the delivery of goods and services, the information is collected either with the purpose of delivering the ordered order, or for use for internal market research and statistics, or to be able to send you newsletters, if you have requested it. The information may also be used with the purpose of improving your experience on the webshop. Basic data for suppliers as well as requisitions and purchases.

Contracts

We have compiled a register where all personal data is noted, their purposes, and legal basis. Personal data is never used for purposes other than those listed. We do not collect more personal data than necessary in relation to the purpose.

Disclosure

The information you have provided to us is processed internally within Cabicon a/s or by external data processors. These are always subject to Cabicon’s instructions. Personal information is not passed on without your consent. We neither disclose nor sell your information to third parties in any way and we register no sensitive personal information.

Storage and Deletion

Cabicon has taken all necessary organizational and technical measures to protect the personal data for which we are responsible. To comply with the Regulation’s principle of fairness, we have implemented the following general guidelines for storage and deletion of personal data:
Personal data is stored in physical folders.
Personal data is stored in IT systems.
Personal data is not stored longer than what is necessary for the purpose of the processing.
Personal data of employees is deleted five years after the end of employment, and personal data on applicants is deleted after six months.

Data Security

Additionally, we have implemented the following security measures:
Only employees who have a work-related need for access to personal data, have access whether it concerns personal data stored physically or electronically
Of course, we have installed firewalls and antivirus programs on all our computers, as well as personal codes. In addition, we ensure that personal data is professionally deleted upon disposal. Paper form personal data is always deleted by shredding
Personal data containing social security numbers are stored in a locked environment
All external hard drives, USB keys, etc., are stored locked.
All employees are required to receive instruction on what they may do with personal data and how personal data should be protected.

Rights

When we process your personal data, as the registered individual you have the following rights:
The right to access the information we process about you
The right to have incorrect information about you corrected or incomplete personal data completed
In special cases, to request the deletion of information about you
In certain cases, to limit the processing of your personal data
In certain cases, the right to object to our otherwise legal processing of your personal data.

You can read more about your rights in the Data Protection Authority’s guidance on the rights of the data subjects, which you can find at www.datatilsynet.dk

For requests regarding access, correction, deletion, limited action, or objection, this must be sent to Cabicon – sales@cabicon.com or Cabicon a/s, Emil Neckelmanns Vej 5, 5220 Odense SØ.

Breach of Personal Data Security

In the event of a breach of personal data security, the company will report the breach to the Data Protection Authority as soon as possible and within 72 hours. The director is responsible for ensuring this occurs. The report will describe the breach, which groups of people it concerns, and what consequences the breach can have for these individuals as well as how the Company has or will remedy the breach. In case the breach involves a high risk for the people about whom the Company processes personal data, the Company will also notify these individuals. The Company documents all breaches of personal data security, and the list is found in a folder in a locked cabinet in the accountant’s office, which is also locked outside office hours.