Privacy Policy
Keystone Investment Management A/S is the data controller with regard to any personal information we gather about you, and we make sure that your information is processed in compliance with the law.
As data controller we also have a duty to provide you with information about what personal information we process, why and how we process it, for how long we retain it, as well as how you can contact us about it and exercise your rights.
This privacy policy covers that duty in several sets of circumstances. If your situation is not covered in this policy, such as if you are employed with us, we have separate documents available to you with all necessary information.
Contact information
If you wish to get in touch with us about our processing of your personal information, you can get hold of us at:
Keystone Investment Management A/S
CVR: 32318827
Havnegade 25, 2nd floor
DK-1058 Copenhagen K
JG@keystoneim.dk
Processing of Personal Data
It is our responsibility to protect all personal information in our possession from being accidentally or unlawfully deleted, publicised, lost, corrupted, leaked, or misused. To do that we have taken a number of technical and organisational measures. We also ensure that processing only takes place when we can adhere to all our duties in data protection.
We keep your information up to date
As our services depend on our information about you being accurate, we ask that you keep us informed about relevant changes. You can always make use of the contact details above to let us know about any changes. We will update your information accordingly. If we find out on our own that our information about you is incorrect, e.g. spelling errors in your name or address, we will update it without further ado.
How did we get your information?
We gather personal information about you in a variety of ways, e.g. by receiving information from you, by way of questionnaires, contact forms or phone.
Below, you can see our purposes for processing personal information. For every type of processing, you can also see our legal basis for the processing. The legal basis means we can point to a law, which allows our processing. You will also be able to see our retention periods for the information we process. We have sorted our processing activities into headlines, to make it easier for you to find the information that pertains to your specific situation.
When we are the data processor
We provide services to other companies by administering and managing their properties. In connection with these services, we process personal data on behalf of those companies and therefore act as a data processor. It is always the data controller that must provide information about purpose and legal basis. Thus, if we process your personal information as data processor for another company, we cannot inform you as to any specifics. You should reach out to the data controller for further information. If you reach out to us, we cannot respond to your request but are instead required to pass it on to the relevant data controller in accordance with the data processing agreement governing our business relationship.
Tenants
For you, as a tenant in a property managed by us, please refer to Appendix A: “Privacy Notice for Tenants” below.
Investors, costumers, and business partners (later named “Stakeholders”)
For you, as a contact person or another physical person of interest, working as a representative, at one of our Stakeholders, it is necessary for us to process your personal data. This includes your general personal data, cf. GDPR article 6, and in some cases, we will process your confidential personal data, including your social security number.
We process your personal data on the purpose of administrating your relation to us and to fulfil our contractual obligations. If we process your social security number, we do this on the purpose of complying with our obligations within national money laundering acts.
We process your personal data on the legal basis of performance of our contractual obligations, cf. GDPR art. 6(1)(b), and for pursuing our legitimate interest, cf. GDPR art. 6(1)(f), which necessitated by our interest in administrating your relation to us. When processing your social security number, we do this on the legal basis of Databeskyttelseslovens §11 (2).
We store the data in the period established by legislation and deletes the data when they are no longer relevant. The period depends on the character of the data and the reason for the processing. Typically, data regarding clients will be deleted at the end of the agreement.
Data processed to comply with the Accounting Act (Danish, LBK. 648 af 15/06/2006), is being stored (processed) within a 5-year period, after the post has been recorded.
Job applicants
When we receive your application, it will be read and processed by the following procedures:
The application with attachments is shared between the relevant employees in the recruiting process. We only process the data given in your application and in other attachments given by you.
Personal data that appears in the recruiting process will be processed as follows:
We gather the data about you based on our legitimate interest, cf. GDPR article 6(1)(f)), which is to find the most qualified candidate. This necessitates the processing of these personal data, and the company assures that meeting this legitimate interest will not hurt the data subjects’ rights.
If we collect references, from former employers, we use the legal basis of consent cf. GDPR article 6 (1)(a), from the former employer.
We store your application with attachments until we find the right candidate for the job, and the recruiting process has ended. Then your application with attachments gets deleted.
We store unsolicited applications with attachments in 6 months whereafter they get deleted.
If we want to store your application with attachments in more than 6 months, we will contact you to get you consent. Your consent is voluntary, and you can withdraw it at any time by contacting us using the contact information above.
Website Visitors
We do not use cookies on our website and do not place cookies or similar technologies on your device.
Our Social Media
When you follow, like, or otherwise interact with our company page on social media, we get access to the following information about you:
- Your name, your likes, and your comments – including the contents of your comments
- Any backend statistics for our page, aggregated from user interactions. We only have access to this information after it has been pseudonymised, and only the Social Media platform could identify you. More info on this and how your personal information is used to aggregate statistics will be available to you on the social media platform in question.
Our purpose with this processing is to reach and potentially interact with followers and other interested parties on social media regarding marketing of vacant leaseholds.
Our legal basis for the processing is:
- Our legitimate interest in marketing our business/products (GDPR art. 6(1)(f))
LinkedIn
We have joint controllership with LinkedIn regarding the information collected about you, when you interact with our company profile. This means that we cooperate with LinkedIn, when it comes to establishing and delegating responsibilities for our compliance regarding the processing of your personal information.
We have an agreement regulating this joint controllership, which you can find here: https://legal.linkedin.com/pages-joint-controller-addendum
If you do not have a personal LinkedIn-profile, LinkedIn collects information about the device you use, when accessing LinkedIn, your location/geodata, and information about your activity on LinkedIn. Any information your cookie settings allow to be tracked as regards your visits to other websites, will also be collected.
If you do have a personal LinkedIn profile, LinkedIn collects the same information as above. In addition to this, LinkedIn also collects any information, you have consented to, through creating your user profile, ie. Your reactions, comments, shares and any other activities on LinkedIn connected to your profile.
Of all the information gathered by LinkedIn, we only receive that which you give us through direct interactions, e.g.: messages, likes/reactions, or comments. Beyond that, LinkedIn Page Analytics gives us access to anonymised statistics based on the information LinkedIn collects as described previously.
If you wish to delete the information LinkedIn has about you, you can delete your user profile. If you choose to do that, all of your posts, pictures and information will be deleted. If you have any questions regarding the inner workings of LinkedIn Page Analytics, please contact LinkedIn directly.
Facebook & Instagram (Meta platforms)
We have joint controllership with Meta regarding the information collected about you, when you interact with our company profiles (KeyLetting) on Facebook or Instagram. This means that we cooperate with Meta, when it comes to establishing and delegating responsibilities for our compliance regarding the processing of your personal information.
We have an agreement regulating this joint controllership, which you can find here: https://www.facebook.com/legal/controller_addendum
Meta uses Insights on their platforms to collect and aggregate statistical data about user activities, these include age, gender, relationship status, work, lifestyle, interests, purchase information, and geodata. For this purpose, Meta places a cookie on your device, when you visit one of their platforms. Every cookie contains a unique identifier, which remains active for 2 years unless deleted before the end of that period. Meta collects your personal information by using these cookies, and they store and process your information for the mentioned statistics. We receive these statistics, but not the raw data, they are built on. You can read more about Meta’s use of cookies on Facebook here and on Instagram and Threads here.
We do not pass along any information about you that we receive from Meta. Meta may do so, however, and we encourage you to read more about their information exchange with third parties in their Privacy Policy.
If you wish to delete Meta’s cookies from your devices/browsers, you can see how in our cookie banner or you can contact Meta for further information.
Meta will process information about you even if you do not have an account on one of their platforms. You can read more about this in Meta’s policy here.
Data minimisation
We only process the information necessary for the fulfilment of our stated purposes. Beyond those, we may be required by law to collect and retain certain information about you. We only retain personal information for the necessary retention period or as required by law. The personal information is deleted or anonymised when it is no longer necessary for us to process it.
We keep data up-to-date
As our services depend on your personal information being correct and updated, we request that you inform us of any relevant changes in your personal information. As tenant you can inform us of changes to your personal information via the relevant property manager (please include lease number). Otherwise, you can use Udlejning@keystoneim.dk or the contact point noted above to inform us of the changes. We will then make sure to update your information in our databases. If it comes to our attention that our information about you is incorrect, we will update it and notify you of this.
Transmission of your information
We use a number of third parties to store and process information, among them IT-solutions. They only process your information on our behalf and are not permitted to use the information for their own purposes. When relevant, your information may be disclosed to banks, public authorities etc.
We prioritize data processors from within the EU and from third countries approved by the European Commission with regards to an adequate level of protection of personal data, cf. GDPR art. 45.
Transmission of information to third countries
We make use of some data processors/suppliers in unsafe third countries. When legislation in those countries does not offer the same level of protection as we have here in the EU, we have stricter obligations to protect your personal information.
When we transfer personal information to recipients in e.g. the USA, we do so based on The European Commissions standard contractual clauses (GDPR art. 46(2)(c)) or Data Privacy Framework (GDPR art. 45(9). If you wish to know more about whether your personal information is transferred and the steps we have taken to protect it, you can reach out to us to learn more. You can also request our documentation for appropriate safeguards.
If you would like to know more about the transfer mechanisms that apply to your information, you can contact us by the above information.
Your rights
By contacting us at the contact point at the top, you may:
- achieve access to the personal information we have on you
- rectify any faulty personal information
- have your personal information erased
- receive a copy of your personal information (data portability) for the purpose of moving it to another data controller
- object to the processing
- have the processing of your personal information restricted
When you contact us, requesting to exercise your abovementioned rights, we will respond within a month. If we cannot honour your request, you will receive an explanation.
In order to exercise your rights, or if you have questions about our processing of your information, you can always contact us. Our contact information is at the top.
If, after having been in touch, you are dissatisfied with how we process your information, you have the right to file a complaint with
Datatilsynet.
Copenhagen, 01-10-2026
Appendix A: Privacy Notice for Tenants
We process different categories of personal data about you as a tenant, both before, during and after the end of your tenancy.
Where do we obtain your personal data from?
Most of your personal data is collected directly from you. For example, we process the information you provide when you register on our waiting list or when you enter into a tenancy agreement with us.
However, some information may be obtained from other sources. In certain cases, for example, we may receive information from the municipality or from other housing associations.
We may also process personal data about you if another tenant submits a complaint about you.
Below, you can read more about why we process the different categories of personal data and how long we retain them.
Waiting list or application process
Before we rent a property to you, you will be registered on a waiting list or you will apply for being considered for at lease. We process the following personal data:
- Name, email address, telephone number, address and housing preferences
- Salary and income information or other information used to assess your ability to pay the rent.
- CPR number (Danish personal identification number)
- Where relevant, confidential information, such as information about criminal offences or credit information (e.g. RKI registration)
The purpose is to ensure that rental properties are allocated to the appropriate applicants.
We use the following legal basis for processing:
- Your consent to process your personal data (Article 6(1)(a) of the General Data Protection Regulation (GDPR)).
- Fulfilment of a contract or taking steps at your request prior to entering into a contract (Article 6(1)(b) of the (GDPR).
- Where applicable, compliance with a legal obligation to which we are subject (Article 6(1)(c) of the GDPR).
Your CPR number
- Your CPR number is processed on the basis of your consent (Section 11(2)(2) of the Danish Data Protection Act).
Special categories of personal data
- Where properties are allocated based on special criteria, including consideration of health conditions, we may process information about, for example, disabilities. This processing is carried out on the basis of our legal obligation under the Danish Rent Act (Article 9(2)(f) of the GDPR), or on the basis of your explicit consent (Article 9(2)(a) of the GDPR).
Ongoing screening
As part of our ongoing compliance procedures, we carry out KYC (Know Your Customer) checks, sanctions screening and PEP (Politically Exposed Person) screening. This may involve checking relevant personal data against applicable sanctions lists, PEP databases and other relevant sources. The purpose of the screening is to verify relevant information, identify whether you are subject to sanctions or are a politically exposed person, and determine whether additional checks or measures are required. The screening is carried out on an ongoing basis where relevant.
Under the GDPR, we are required to inform you whether the provision of personal data is a statutory or contractual requirement, or whether it is necessary in order to enter into a contract. We must also inform you whether you are obliged to provide the personal data and of the possible consequences of not providing such data.
Your personal data will be deleted no later than the end of the current year + 5 years after your tenancy has ended. If you are not allocated a property, your personal data will be deleted 90 days following you lease application, or if you have subscribed to our waiting list, your personal data will be deleted when you unsubscribe from the waiting list or 24 months following the subscription.
Moving In
In connection with your tenancy, we process various categories of personal data about you.
We process the following personal data:
- Name, address, telephone number and email address
- Tenancy number
- Bank account details
- CPR number
The purpose is to administer your tenancy, including rent collection, rehousing, general communication and services. The purpose is also to ensure that we comply with our obligations towards you under the tenancy agreement.
We use the following legal basis for processing:
- Performance of the tenancy agreement (Article 6(1)(b) of the General Data Protection Regulation (GDPR)).
- Compliance with a legal obligation, for example, we are required to carry out inspections under the Danish Rent Act (Article 6(1)(c) of the GDPR).
Your CPR number
- Your CPR number is processed on the basis of your consent (Article 6(1)(a) of the GDPR). You have consented to us processing your CPR number for the following purposes:
o Unambiguous identification
o Payments to your NemKonto (designated bank account)
o Digital communication
Special categories of personal data
- Where properties are allocated based on special criteria, including consideration of health conditions, we may process information about, for example, disabilities. This processing is carried out on the basis of our legal obligation under the Danish Rent Act (Article 9(2)(f) of the GDPR), or on the basis of your explicit consent (Article 9(2)(a) of the GDPR).
We retain your personal data throughout your tenancy.
Your personal data will be deleted when your tenancy ends. However, we may have a legitimate interest in, or another legal basis for, retaining personal data about you after the end of your tenancy. In such cases, the personal data will not be retained for longer than 5 years after the end of your tenancy, unless there are outstanding amounts owed or other circumstances that necessitate continued retention of the personal data.
Handling of Complaints
When handling complaints, we process various categories of personal data.
We process the following personal data:
- The complainant’s name, address and telephone number
- The subject matter of the complaint
- The name and address of the person the complaint concerns
The purpose is to handle complaints from tenants and, where necessary, take appropriate action towards tenants who, for example, fail to comply with applicable rules of conduct and good neighbourly behaviour, in order to ensure a safe and secure living environment for our tenants.
We use the following legal basis for processing:
- Legitimate interests (Article 6(1)(f) of the General Data Protection Regulation (GDPR)).
- Performance of the tenancy agreement, including compliance with the rules and regulations applicable to the tenancy (Article 6(1)(b) of the GDPR).
- Compliance with a legal obligation under the Danish Rent Act (Article 6(1)(c) of the GDPR).
If the subject matter of a complaint concerns criminal offences, we may record and process such information pursuant to Section 8(3), second sentence, of the Danish Data Protection Act, where this is necessary for the purposes of pursuing our legitimate interest in preventing criminal offences in and around our rental properties.
Information concerning criminal offences may be disclosed to the police pursuant to Section 8(4), second sentence, of the Danish Data Protection Act. This also applies where the report is based solely on assumptions or suspicion and regardless of whether the alleged offence is of a less serious nature. The purpose of such disclosure is to enable the police to assess whether to initiate further investigation, etc., pursuant to Section 742 of the Danish Administration of Justice Act.
Your personal data will be deleted when your tenancy ends. However, we may have a legitimate interest in, or another legal basis for, retaining personal data about you after the end of your tenancy. In such cases, the personal data will not be retained for longer than 5 years after the end of your tenancy, unless there are outstanding amounts owed or other circumstances that necessitate continued retention of the personal data.
Utilities
As part of your tenancy agreement, we process your personal data for the purpose of registering you with various utility providers, including heating, water, gas and/or electricity (as applicable).
We process the following personal data:
- Name, address and email address
- Tenancy number
- CPR number
- Consumption data
The purpose is to register you for the requested utility services.
We may obtain your consumption data relating to your use of electricity, heating, gas and/or water (as applicable) from the relevant utility provider(s) for the purpose of pursuing our legitimate interests in generating CO₂ accounts to support energy-saving initiatives, marketing activities, and environmental support and compensation. We may engage a professional service provider to act as a data processor for the purpose of assisting us in achieving these objectives.
We use the following legal basis for processing:
- Performance of the tenancy agreement (Article 6(1)(b) of the General Data Protection Regulation (GDPR)).
- Consent (Article 6(1)(a) of the GDPR).
- Legitimate interests in ensuring that you are registered with the relevant utility providers and generating CO₂ accounts (Article 6(1)(f) of the GDPR).
Your CPR number will only be disclosed to utility providers where you have given your consent to such disclosure, in accordance with Section 11(2)(2) of the Danish Data Protection Act.
The personal data collected for these purposes will be deleted or anonymised no later than five years after the consumption data was obtained.
Moving out / Termination of Tenancy
In connection with the termination of your tenancy, we record relevant information about the reason for the termination and/or your move-out. We also carry out a move-out inspection.
We process the following personal data:
- Name, address and email address
- Telephone number
- CPR number
- Reason for moving out
- Bank account details
The purpose of the processing is to document the reason for the termination of your tenancy and to ensure that you receive any amount to which you are entitled.
We use the following legal basis for processing:
- Compliance with a legal obligation under the Danish Rent Act (Article 6(1)(c) of the General Data Protection Regulation (GDPR)).
- Legitimate interests in providing your telephone number to prospective new tenants so that they can view the property, as you would otherwise be required to make the property available for viewings in accordance with the Danish Rent Act (Article 6(1)(f) of the GDPR).
Your CPR number:
- Your CPR number is processed on the basis of your consent (Article 6(1)(a) of the GDPR). You have consented to us using your CPR number in connection with payments made through NemKonto (your designated bank account).
Your personal data will be deleted when your tenancy ends. However, we may have a legitimate interest in, or another legal basis for, retaining personal data about you after the end of your tenancy. In such cases, the personal data will not be retained for longer than 5 years after the end of your tenancy, unless there are outstanding amounts owed or other circumstances that necessitate continued retention of the personal data.
Storage and Disclosure of Personal Data
Storage of Personal Data
Your personal data is stored at our premises at Havnegade 25, 2nd floor, 1058 Copenhagen K, Denmark. Some personal data is also stored by our data processors, such as providers of cloud services or other systems used to process personal data.
Our data processors may only process personal data on our instructions, and we have entered into data processing agreements with all of our data processors.
Disclosure of Personal Data
We treat all personal data confidentially and do not disclose it to third parties unless we are legally permitted or required to do so.
In certain circumstances, we are also required to disclose personal data to the municipality. This may, for example, apply where a tenant who was allocated their home by the municipal council falls into rent arrears during the first year of the tenancy and we subsequently send the tenant a formal payment demand. In such circumstances, the municipal council must also be notified of the payment demand.
We may also be required to notify the municipality in writing if we request that the Enforcement Court evict a tenant due to non-payment of rent, so that the relevant social services can assist the tenant.
Your personal data may also be disclosed to our legal counsel, auditors or other professional advisers in connection with the handling of a specific matter. This may be necessary, for example, where we require legal assistance in relation to a matter in which you, as a tenant, are involved.
Personal data may also be disclosed in connection with complaints concerning rent and other matters. In such cases, information from complaint proceedings may be provided to the Rent Board and may also be disclosed to the Housing Court, which may, among other things, assess whether the termination of a tenancy is justified.
We use data processors and other service providers to process personal data. We prioritise service providers located within the EU, as well as providers located in third countries for which the European Commission has adopted an adequacy decision regarding the level of protection of personal data pursuant to Article 45 of the GDPR.
Transfers of Personal Data to Third Countries
In some cases, we use data processors or service providers located in third countries that are not considered to provide an adequate level of protection under EU data protection law.
Where the legislation of a third country does not provide the same level of protection as within the EU, additional safeguards and requirements apply to the protection of your personal data.
Your personal data may be transferred to recipients in the United States based on, for example, the European Commission’s Standard Contractual Clauses (Article 46(2)(c) of the GDPR), or the EU-U.S. Data Privacy Framework (Article 45 of the GDPR).
If you would like further information about such transfers, you may contact us. You may also request further information and documentation concerning the appropriate safeguards applicable to the transfer.