1. INTRODUCTION

1.1 Data protection

1.1.1

As part of our business, we process personally identifiable information (personal data) about you as our customer and have therefore adopted this data protection policy, which describes how your data is processed and what rights you have as a data subject.

1.1.2

In order to protect your personal data in the best possible way, we assess the risk of our data processing negatively affecting your fundamental rights. To this end, we process your personal data based on the following basic principles:

• The processing is carried out in a lawful, fair and transparent manner in relation to you
• The processing is subject to a purpose limitation
• Processing is based on the principle of data minimisation
• Processing is based on a principle of accuracy to ensure that the data we process about you is correct and up to date
• Processing is based on a principle of storage limitation
• Processing is based on a principle of integrity and confidentiality

1.2 Data controller

1.2.1

The controller of your personal data is Nordic Bloom P/S, CVR no. 43 01 78 37, Tuborg Boulevard 5, 2900 Hellerup, Denmark.

1.2.2

This company is thus responsible for ensuring that your personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation) and applicable Danish national legislation.

1.2.3

If you have any questions regarding the processing of personal data in the company, please contact Torben Mauritzen, Chief Compliance Officer, at tm@nordicbloomfunds.com.

2. GENERAL INFORMATION ABOUT OUR PROCESSING OF PERSONAL DATA

2.1 Processing of personal data

2.1.1

Processing of personal data takes place as part of our marketing, counselling and management of the investment products we offer and manage, including in connection with contact with you as a potential or current customer.

2.2 Types of personal data

2.2.1

Types of personal data that we process about you are:

• Name
• Email address
• Address
• Phone number
• CPR number.
• Wealth ratio
• Tax conditions
• Bank details

2.2.2

We do not process special personal data (sensitive personal data) about you that includes:

• Racial or ethnic background
• Political, religious and philosophical beliefs
• Trade union affiliations
• Processing of generic or biometric data for unique identification purposes
• Health and sexual conditions

2.3 Purpose and legal basis for the processing of personal data

2.3.1

We collect and store your data for specific and legitimate purposes, for example:

• When we need the information for our counselling of you as a potential or current customer
• When we register you as a customer or contact person for the purpose of ongoing correspondence, money transfers, registration of ownership shares in our investment products, etc.
• To fulfil our obligations to obtain information in accordance with the Money Laundering Act

2.3.2

When we collect information from you or third parties, you will be informed that we collect the information and for what specific purposes.

2.3.3

If we later need to use the data for a purpose other than that stated, we will contact you and obtain your consent.

2.3.4

Our legal basis for processing your personal data will typically be

• GDPR Art. 6(1)(a): Consent
• GDPR Art. 6(1)(b): Performance of contract
• GDPR Art. 6(1)(c): Legal obligation
• GDPR Article 6(1)(d): Protection of your or other private persons or vital interests
• GDPR Article 6(1)(f): Balancing of interests

2.3.5

In connection with the collection of your personal data, you will be informed of the legal basis(s) for the processing.

2.4 The scope of the data

2.4.1

Before we process your personal data, we examine whether it is possible to minimise the amount of personal data in relation to the purpose of the processing. We also investigate whether some of the data types we use can be used in anonymised or pseudonymised form. This is possible if it does not negatively affect our legal obligations or our daily operations.

2.4.2

We only collect, process and store personal data that is necessary to fulfil the intended purpose, including fulfilling a contract or other legal obligation.

2.5 Control

2.5.1

We continuously check that your personal data is not incorrect or misleading to the extent possible. In this connection, we ask you to inform us of relevant changes to your personal data.

3. SAFETY

3.1

To protect you from unauthorised access to your personal data, we use IT solutions that automatically ensure that data is only accessible to relevant people.

3.2

In addition, Nordic Bloom P/S has adopted internal procedures and policies regarding information security. These procedures and policies contain instructions and actions to protect your data from being destroyed, lost, altered, published and from unauthorised access or sharing.

4. DISCLOSURE OF PERSONAL DATA

4.1

As part of our business, we are sometimes required to disclose personal data to third parties. This can be, for example, in connection with statutory reporting to public authorities.

4.2

Third parties include, for example:

• Danish Business Authority (typically the register of legal and ultimate owners)
• The Danish tax authorities
• Tax authorities in the countries where investments are made through our investment products (e.g. IRS, US tax authorities)
• Financial Supervisory Authority
• The National Bank
• Pension company, if the customer has invested pension funds

4.3

Disclosure of personal data to a third party will always be legally justified and/or necessary to fulfil your or your company's interests.

5. YOUR RIGHTS

5.1 Right of access

5.1.1

Upon request, you can gain insight into what personal data and category of personal data we process about you and what the purpose of the processing is, if you have not already been informed of this. You can also gain insight into how long we store your personal data and who else has access to your personal data.

5.2 Right of objection

5.2.1

You can object to the processing of your personal data at any time and withdraw previously given consent to the processing of your personal data.

5.2.2

However, you should be aware that there will be certain personal data that we may process without your consent if we have a legitimate interest and if the protection of your interests does not override that interest.

5.3 Right to rectification

5.3.1

If you believe that the personal data we process about you is inaccurate or misleading, you have the right to have it corrected. To do so, please contact Torben Mauritzen, Chief Compliance Officer, at tm@nordicbloomfunds.com.

5.4 Right to have personal data restricted and/or deleted

5.4.1

For as long as you are our customer and up to 10 years after the customer relationship has ended, we will retain your personal data for the purpose of fulfilling obligations to public authorities and in the event of legal disputes. We will ensure that the data is then deleted.

5.4.2

However, in some cases, we will have an obligation to delete your personal data earlier. This applies, for example, if you withdraw consent or if the storage of your personal data is no longer necessary for the stated purposes.

5.4.3

If you request correction or deletion of your personal data, we will investigate whether the conditions for this are met and if so, we will make the necessary changes or deletions as soon as possible.

5.5 Right to data portability

5.5.1

If you request to know what personal data we process about you and the conditions are met, you are entitled to receive it in a structured, commonly used and machine-readable format and we cannot and will not prevent you from transmitting this information to third parties. If you request it and it is technically feasible, we will arrange to transmit the requested personal data directly from us to a third party.

5.6 Right to complain

5.6.1

If you believe that your personal data is processed in violation of applicable laws or other legal obligations, you have the right to lodge a complaint with the Danish Data Protection Agency (dt@datatilsynet.dk).