Why do we process personal data and the lawful bases for collection

The main reason we collect, use, and store your data is to allow us to provide our services to you. “Service”, “our service” and similar descriptions mean conducting business with you/your organisation and assisting you with inquiries, sales processes, and claims.

We also process information about your use of the services for business development purposes, to inform you of our business operations, products, and services through marketing, and to improve our services through any feedback you give us. We may also process your personal data for contractual and recruitment purposes and to comply with legal obligations.

We process personal data based on different legal bases as listed below.

Performance of a contract, including a purchase – GDPR article 6(1)(b):

• When we process personal data in relation to a contract, our legal basis is ‘performance of a contract’, including a purchase.

Consent – GDPR article 6(1)(a):

• When we send out a newsletter about our products, we do this based on your consent. When the lawful basis for processing is consent, you have the right to withdraw your consent at any time.

Legal obligation – GDPR Article 6(1)(c):

• If we share your personal data with law enforcement agencies or other governmental bodies, we share this because we have a legal obligation to do so.

Legitimate interest - GDPR Article 6(1)(f):

• We have a legitimate business interest in processing your data, for example, when we assist you with enquires.

Special categories – GDPR Article 9(2)(a) and GDPR Article 9(2)(f):

• When we process special categories of data, we do so to comply with regulatory requirements related to compliance matters.

The types of personal data we process

The following are the main types of personal data collected by VELUX, along with the main purpose and legal basis for collecting the personal data:

How do we collect your personal data

Directly from you

In most cases, personal data is collected directly from you or generated as part of the use of our services, products, and channels. We collect personal data you provide to us, when you request products, services, or information from us, register with us, participate in public forums, use a chatbot or other activities on our digital platforms and apps, respond to customer surveys, or otherwise interact with us. We collect information through various technologies, e.g., cookies. For cookies, we refer to our Cookie Policy - velux.com 

From our business partners

In some cases, we can collect your personal data from our business partners, when they need our assistance to provide you with the best possible service.

From your public website

In some cases, we collect your personal data on your company websites, when we want to offer you our services.

Links to other websites

This website contains links to other websites (such as Facebook, Google+, YouTube, and Pinterest) to which this this Privacy Notice does not apply. Please note that we do not endorse other websites and their content. We encourage you to read the privacy policies of each website you visit.

Automated decisions

We use automated decision-making in processing your personal data for certain services and products, such as our efforts in fraud prevention and detection on our online platforms. You have the right to request information about the methodology behind these automated decisions and to seek verification of their accuracy. We may reject such requests as permitted by applicable law, particularly if providing the information could disclose trade secrets or impede our ability to detect fraud or other criminal activities. However, in such instances, we will generally verify that the algorithm and source data are functioning as intended, without error or bias. 

How long do we keep your personal data

We will only keep your personal information for as long as it is necessary for the purposes described in this Privacy Notice. This means that the retention periods will vary according to the type of the information and the reason that we have the information. Examples of retention time:

• Call recordings will be stored for a period of 90 days.
• Until you opt out of a marketing campaign, which you can do at any point in time.
• We will store the photo and testimonials for as long is necessary and as described in a contract.
• Personal data are kept until the end of a recruitment process or withdrawal of the consent (if given for future recruitments).
• For compliance with, e.g., anti-corruption regulations, we will keep the data accordingly to laws which we are obliged to comply with.

Who do we share your personal data with

Our company is a part of the VELUX Group, which operates globally. We share your personal information within the VELUX Group, but only if it is necessary to fulfil the purpose for which we are processing your personal data. All entities in the VELUX Group have entered into an Intercompany Data Processing Agreement and/or joined agreement where everyone follows the same procedures when processing personal data, ensuring that the same level of security is maintained throughout the Group; dividing the roles and responsibilities between the VELUX companies. If two or more companies act as joint controllers, each of the joint controllers is obliged to independently:

• Be the first contact for you.
• Fulfil the information obligations referred to in Articles 13 and 14 of the GDPR.
• Exercise your rights provided in Articles 15-22 of the GDPR.
• Deal with privacy breach Notices and privacy complaints.

We may also share your personal data with selected third parties, including but not limited to:

• Business partners, suppliers, and sub-contractors that we cooperate with to deliver you the best services during the support and sales process, including, for example, logistic providers and outsourced customer services, as well as third parties in relation to customer satisfaction surveys.
• Technology providers, for example, analytics, tracking technologies, targeting and re-targeting technologies, and search engine providers that assist us in the improvement and optimisation of our platforms, as well as companies who provide us with website support and hosting.
• Advertisers and advertising networks that use data to select and serve relevant adverts to you and others if you have given your consent. · Social networking sites such as Facebook, Instagram, and Google, if required, when processing for marketing purposes and based on your consent.
• With other parties to ensure the safety and security of our customers, to protect our rights and property, to comply with legal processes, or in other cases if we believe in good faith that disclosure is required by law.
• VELUX Group companies or third parties who operate digital platforms and tools on behalf of our company to provide services connected with our activities (e.g., points collection programs, cashback campaigns, sweepstakes, and training). When we cooperate with external service providers, we enter into a data processing agreement, if relevant. These service providers are prohibited from using your personal data for purposes other than those requested by us or required by law.

Transfer to third countries

In some cases, we may also transfer personal data to companies in so-called ‘third countries’, which are countries outside of the European Economic Area. If we do so, we make sure we safeguard data, and only transfer if one of the following conditions apply:

• there is an adequate level of protection in the country in question, as determined by the European Commission,
• the company is certified under the EU - U.S. Data Privacy Framework, or
• we use standard contractual clauses (EU model-clauses) approved by the European Commission and additional supplementary measures to regulate the data transfer.

Data Security

The security, integrity, and confidentiality of your personal data is important to us. We have implemented technical, administrative, and physical security measures that are designed to protect your personal data from unauthorised access, disclosure, use, and modification. From time to time, we review our security procedures to consider appropriate recent technologies and methods. Please be aware that despite our best efforts, no security measures are perfect or impenetrable.

Your Privacy rights 

The GDPR provides you, as the data subject, with the following rights in respect of the personal data we store about you:

If you have any questions regarding the specific personal data we process or retain about you, or if you want to exercise your rights, please contact privacy@velux.com.

We will respond to your request to exercise any of your rights within one month, but we have the right to extend this period by two months. If we extend the response period, we will inform you within one month of your request. If you consider that we have failed to resolve the complaint satisfactorily, you may file a complaint to your local Data Protection Agency. You can find the contact details of your national Data Protection Agency on the European Data Protection Board website: www.edpb.europa.eu.

Changes to this VELUX Privacy Notice

From time to time, we may change this Privacy Notice to accommodate the latest technologies, industry practices, regulatory requirements, or for other purposes. At all times, we will post the most recent version on our digital platforms. We advise you to read the Privacy Notice regularly.

This Privacy Notice was last updated: 13-02-2025