Privacy Policy

Last updated: [insert publication date]

At a glance

• Onivers is the data controller for the personal data we process.
• We only process information that is necessary for our website, enquiries, newsletter, memberships, events, volunteering and collaborations.
• You only receive our newsletter if you actively subscribe. We do not individually record whether you open newsletters or click links.
• Non-essential cookies and Google Analytics are only activated after you have given consent.
• If photographs or video are taken at an event, we inform participants as early as possible. You can opt out if you do not want to be photographed or filmed.
• You can ask us to access, correct or erase your information and withdraw consent, among other rights.
• For questions or to exercise your rights, contact us at info@onivers.org.

You can read more about each type of processing, retention periods and your rights below.

1. About Onivers and this Privacy Policy

Onivers is a Danish nonprofit association working to support mental health and wellbeing through knowledge, practice and community.

Onivers is the data controller for the processing of personal data described in this Privacy Policy.

Onivers
Danish registration number (CVR): 44684691
Havneholmen 14
2450 København S
Email: info@onivers.org

This Privacy Policy explains how Onivers processes personal data when you:

• visit our website;
• contact us;
• subscribe to our newsletter;
• register for events or activities;
• become a member;
• apply for or take part in volunteering or a collaboration;
• attend events where photographs or video may be taken;
• otherwise communicate or interact with Onivers.

Important information about photographs and video If photographs or video are taken at an event, we inform participants as early as possible. You can opt out if you do not want to be photographed or filmed.

You can find more information about cookies and other tracking technologies in our separate Cookie Policy and cookie declaration.

2. What personal data do we process?

Onivers only processes personal data that is relevant and necessary for the specific purpose. The information we process depends on how you use our website or interact with us.

When you contact us

We may process:

• your name;
• your email address;
• your phone number, if you provide it;
• the content of your message;
• our subsequent correspondence with you.

When you subscribe to the newsletter

We process:

• your email address;
• your name, if you choose to provide it;
• the time and method by which you gave consent;
• information about a later unsubscribe request or withdrawal of consent.

Onivers does not individually record whether you open newsletters or click links in them.

When you register for an event or activity

We may process:

• your name and contact details;
• information about your registration;
• payment information and payment status;
• practical information necessary to manage your participation;
• correspondence about the event or activity.

When you become a member

We may process the information necessary to create and administer your membership, including:

• your name and contact details;
• information about the start, status and duration of your membership;
• confirmation that you meet the age requirement;
• membership fee and payment information;
• relevant communication about your membership.

Onivers memberships and events are generally intended for people aged 16 or over.

When you apply to volunteer or contact us about a collaboration

We may process:

• your name and contact details;
• information you provide about your experience, interests and availability;
• your application or enquiry;
• our correspondence with you.

When you visit the website

Depending on your cookie choices and the technical configuration of the website, we may process:

• your IP address;
• browser and device information;
• the date and time of your visit;
• pages and features you use;
• the referring website;
• your cookie choices and consent status;
• general information about website use.

Onivers expects to use Google Analytics. Analytics and other non-essential technologies may only be activated when the necessary consent has been obtained. The specific technologies and cookies are described in our Cookie Policy and cookie declaration.

Photographs and video from events

When photographs or video are taken at an event, we inform participants as early as possible, for example during registration or at the beginning of the event.

You can opt out if you do not want to be photographed or filmed. We try to avoid unnecessarily close or prominent images of individuals and do not use images that may be exposing or offensive.

The material may be used to document and communicate Onivers activities, including on our website, in newsletters and on social media. We generally obtain consent for close-ups, portraits or material specifically intended for marketing.

Sensitive personal data

As a general rule, Onivers does not ask for information about health, religion, political views or other sensitive personal data.

You should therefore avoid sending such information unless we have specifically asked for it. If we nevertheless receive sensitive information, we only process it to the extent that this is necessary and lawful.

Where does the information come from?

We normally receive information:

• directly from you;
• automatically from the website and the technologies you have accepted;
• from a registration, payment or membership system that processes information on behalf of Onivers;
• from another person or organisation if you have asked them to contact us on your behalf.

3. Why do we process personal data?

Onivers only processes personal data when there is a lawful basis. Depending on the situation, processing is based on your consent, a contract with you, a legal obligation or Onivers’ legitimate interest in operating the association and communicating with members, participants and other people.

Contact and enquiries

When you contact us, we process your information to:

• respond to your enquiry;
• follow up on questions or agreements;
• document relevant communication;
• handle any complaints or disagreements.

Processing is normally based on Onivers’ legitimate interest in communicating with you and administering the association’s activities.

If your enquiry relates to an agreement, membership, registration or collaboration, processing may also be necessary to enter into or perform a contract with you.

Newsletter

We use your email address and, if provided, your name to send news, event updates and offers from Onivers.

Processing is based on your consent. You can withdraw your consent at any time by using the unsubscribe link in the newsletter or by contacting us at info@onivers.org.

Onivers does not individually record whether you open newsletters or click links in them.

Withdrawing consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

Events and activities

When you register for an event or activity, we process information to:

• register and administer your booking;
• receive and record payment;
• send practical information;
• inform you about changes or cancellations;
• deliver the event or activity.

Processing is normally necessary to enter into or perform the agreement concerning your participation.

Payment and accounting information may also be processed and retained where Onivers is legally required to do so.

Membership

We process membership information to:

• create and administer the membership;
• record membership status and fees;
• communicate about the membership;
• deliver Onivers membership activities;
• meet relevant administrative and legal obligations.

Processing is normally necessary to enter into and administer the membership agreement.

Volunteers and collaborations

When you apply to volunteer or contact us about a collaboration, we process information to:

• assess your enquiry;
• communicate with you;
• identify a suitable volunteering opportunity or collaboration;
• plan and administer any resulting arrangement.

Processing is normally based on Onivers’ legitimate interest in organising volunteering and collaborations.

If we enter into a specific agreement with you, processing may also be necessary to prepare or perform that agreement.

Website, security and analytics

We may process technical information that is necessary to:

• display and operate the website;
• protect it against errors, misuse and security incidents;
• remember your cookie choices;
• understand how the website is used and can be improved.

Processing necessary for the website’s basic operation and security may be based on Onivers’ legitimate interest in running a secure and functional website.

Google Analytics and other non-essential analytics or tracking technologies are only activated on the basis of your cookie consent. The specific technologies are described in the Cookie Policy and cookie declaration.

Photographs and video

Onivers may take and publish ordinary situational photographs from events following a specific assessment of our legitimate interest in documenting and communicating the activities.

We inform participants when photographs are being taken and provide an opportunity to opt out. We do not use images that may be exposing or offensive.

We generally obtain consent from identifiable people for close-ups, posed photographs, portraits or material specifically intended for marketing. The same applies if the context may be sensitive or private.

Legal requirements and protection of Onivers

In some cases, we may process information to:

• comply with laws and official requirements;
• maintain and retain accounting records;
• establish, exercise or defend legal claims;
• prevent or investigate misuse and security incidents.

In these cases, processing is based on a legal obligation or Onivers’ legitimate interest in protecting the association and its rights.

4. Who do we share personal data with?

Onivers does not sell or rent personal data.

We only share personal data where this is necessary to operate the association, provide an agreed activity or service, comply with the law or protect Onivers’ rights.

Providers processing data for Onivers

Onivers may use external providers for purposes including:

• operation and hosting of our WordPress website;
• email and document management through Google Workspace;
• sending and managing newsletters;
• contact forms and other website forms;
• membership and event administration;
• payments and bookkeeping;
• website analytics, including Google Analytics;
• security, technical support and backups.

These providers normally only process personal data on Onivers’ instructions and for the purposes we determine.

Where a provider acts as a processor for Onivers, we enter into the required data processing agreement. Onivers remains responsible for ensuring that the processing is lawful.

Other recipients

We may also share relevant information with:

• banks and payment providers in connection with payments;
• auditors, bookkeepers, legal advisers or other professional advisers;
• collaboration partners where this is necessary to deliver an activity or agreement and you have been informed;
• public authorities where we are legally required to do so;
• the police, courts or other relevant parties where necessary to establish, exercise or defend a legal claim.

Some recipients may be independent data controllers. This means they decide how they process the information they receive, and their own privacy policies apply to that processing.

Social media and publication

When Onivers publishes photographs, video or other content on social media, the information may be processed by the relevant platform under its own terms and privacy policy.

We do not publish participant lists, contact details or other private information without an appropriate lawful basis.

Transfers outside the EU and EEA

Some providers used by Onivers may process or store personal data outside the EU and EEA.

If personal data is transferred to a country outside the EU and EEA, Onivers ensures that a lawful transfer mechanism is in place. This may include:

• a European Commission adequacy decision;
• the European Commission’s Standard Contractual Clauses;
• the EU-US Data Privacy Framework, where applicable;
• other lawful safeguards under data protection law.

You can contact us at info@onivers.org for more information about our providers or the safeguards used for transfers of personal data outside the EU and EEA.

5. How long do we retain personal data?

Onivers only retains personal data for as long as it is necessary for the purpose for which it was collected.

Information is erased or anonymised when we no longer have a relevant need for it, unless the law requires longer retention.

Contact and general correspondence

Information from contact forms, emails and other general enquiries is normally erased no later than 12 months after the enquiry has been closed.

Information may be retained for longer if it forms part of an ongoing membership, registration, agreement, complaint, dispute or other matter that still needs to be handled.

Newsletter

Your email address and, if provided, your name are retained while you remain subscribed to the newsletter.

When you unsubscribe, we stop using the information to send newsletters and remove you from the active recipient list as soon as possible.

We may retain limited documentation of your consent and unsubscribe request for up to two years after the most recent newsletter sent to you. The documentation is only used to demonstrate compliance with electronic marketing rules.

Events and activities

Information about your registration and participation is normally erased no later than 12 months after the event or activity has ended.

Information may be retained for longer where necessary to:

• handle payment, refunds or a complaint;
• administer an ongoing programme or membership;
• perform a contract or meet a legal obligation;
• establish, exercise or defend a specific legal claim.

Membership

Information necessary for membership administration is retained while the membership is active.

When membership ends, ordinary membership information is normally erased no later than 12 months after withdrawal, unless the information remains necessary, for example because of an outstanding payment, a specific dispute or a legal requirement.

Volunteers and collaborations

Information about a volunteering enquiry, application or possible collaboration is normally erased no later than six months after it has been established that no collaboration will take place.

If you become a volunteer or enter into a collaboration with Onivers, we retain the relevant information for the duration of the relationship and normally for up to 12 months after it ends.

Payments and accounting

Information included in accounting records is retained for the period required under applicable accounting rules.

As a general rule, accounting records must be retained for five years from the end of the financial year to which the records relate.

Website, cookies and technical information

Technical log information used for operations, troubleshooting and security is normally retained for up to 12 months, unless a shorter period is used by the relevant provider.

Information collected through cookies and Google Analytics is retained for the periods stated in our current Cookie Policy and cookie declaration.

You can change or withdraw your cookie consent at any time.

Photographs and video

Photographs and video may be retained for as long as the material remains relevant for documenting and communicating Onivers activities. We review the material and remove it when the purpose is no longer relevant.

Where use is based on your consent, you can withdraw that consent. We will then remove the material from the digital channels controlled by Onivers to the extent possible, unless another lawful basis applies.

Backups

For a limited period, information may remain in technical backups after it has been erased from active systems.

Backups are overwritten or erased according to the provider’s ordinary security and deletion routines and are not used for ordinary processing.

When longer retention is necessary

Onivers may retain information for longer than the periods described where this is necessary to:

• meet a legal requirement;
• handle a specific complaint or dispute;
• document an agreement or payment;
• establish, exercise or defend a legal claim.

In such cases, we only retain the information necessary for the specific purpose.

6. How do we protect personal data?

Onivers protects personal data through technical and organisational security measures appropriate to the nature of the processing and the risks it may involve.

The measures may include:

• access to personal data only for people with a relevant need;
• individual user accounts, strong passwords and multi-factor authentication where possible;
• regular security updates for WordPress, plugins, devices and other systems;
• encryption, backups and other security features where relevant;
• appropriate settings and access controls in Google Workspace and other services;
• selection of providers offering an appropriate level of security;
• instructions for employees and volunteers who have access to personal data;
• procedures for deletion, security incidents and loss of information.

Access for employees and volunteers

Employees, volunteers and other people with access to personal data may only use the information for the tasks entrusted to them.

Access is restricted or removed when it is no longer necessary, for example when a task or volunteer role ends.

Personal data breaches

A personal data breach may include information being:

• sent to the wrong recipient;
• lost or erased by mistake;
• made available to unauthorised people;
• compromised through theft, hacking or misuse of an account.

If Onivers becomes aware of a possible breach, we investigate the incident and limit its consequences as quickly as possible.

We notify the Danish Data Protection Agency and affected people where required by law.

No solution is completely risk-free

Although Onivers works to protect personal data, no digital transmission or storage method can be guaranteed to be completely risk-free.

If you believe information about you has been handled insecurely, contact us at info@onivers.org.

7. Your rights

You have a number of rights in relation to Onivers’ processing of your personal data. Your rights depend on the circumstances and are not always absolute.

Right of access

You can ask us to confirm whether Onivers processes personal data about you.

You can also ask for:

• a copy of the information;
• information about why we process it;
• the types of information we process;
• who the information is or may be shared with;
• how long we expect to retain it;
• where the information comes from if we did not receive it directly from you.

Right to rectification

You can ask us to correct inaccurate or incomplete information about you.

Right to erasure

In some cases, you can ask us to erase information about you, for example if it is no longer necessary or if you withdraw consent and there is no other lawful basis for the processing.

The right to erasure does not always apply. Onivers may need to retain information to comply with the law, document payments or handle a legal claim.

Right to restriction

In some cases, you can ask us to restrict the processing of your information, for example while we investigate whether information is accurate or whether an objection is justified.

Right to object

You can object to processing based on Onivers’ legitimate interests.

If you object, we assess whether there are compelling legitimate grounds to continue the processing.

You can always object to direct marketing. If you no longer want to receive the newsletter, unsubscribe using the link in the newsletter or contact us.

Right to data portability

Where processing is based on your consent or a contract and is carried out automatically, you may in some cases ask to receive information you provided in a commonly used, machine-readable format.

You may also ask for the information to be sent directly to another controller where technically possible.

Right to withdraw consent

Where processing is based on your consent, you can withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

It must be as easy to withdraw consent as it was to give it.

Automated decisions and profiling

Onivers does not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

How to exercise your rights

Contact us at info@onivers.org.

Please describe what your request concerns so that we can handle it correctly.

We may ask for additional information where necessary to confirm your identity. We only request the documentation that is necessary and generally do not ask for identification unless this is specifically required.

We normally respond to your request within one month of receiving it. For complex or extensive requests, the deadline may be extended by up to two additional months. If so, we inform you of the extension and the reason before the first month has expired.

Exercising your rights is generally free of charge. For manifestly unfounded or excessive repeated requests, the rules may allow us to charge a reasonable fee or refuse the request.

8. Questions and complaints

For questions about this Privacy Policy or Onivers’ processing of personal data, contact us at:

Onivers
Danish registration number (CVR): 44684691
Havneholmen 14
2450 København S
Email: info@onivers.org

If you believe that Onivers processes your personal data in breach of data protection law, we encourage you to contact us first so that we can investigate and try to resolve the matter.

You also have the right to complain to the Danish Data Protection Agency:

Datatilsynet (Danish Data Protection Agency)
Carl Jacobsens Vej 35
2500 Valby
Denmark
Phone: +45 33 19 32 00
Email: dt@datatilsynet.dk

Your right to complain to the Danish Data Protection Agency does not limit any other administrative or judicial remedies available under data protection law.

9. Information you need to provide

Providing personal data to Onivers is generally voluntary. Some information is necessary, however, if we are to provide a particular service, enter into a contract with you or meet a legal requirement.

Contact form

Your name, email address and message are necessary so that we can identify and respond to your enquiry.

Your phone number is optional.

If you do not provide the necessary information, we may be unable to respond to or handle your enquiry.

Newsletter

Your email address and consent are necessary if you wish to receive the newsletter.

Providing your name is optional.

If you do not provide your email address or consent to the newsletter, we cannot send it to you.

Events and activities

When you register for an event or activity, you need to provide the information necessary to:

• register your booking;
• communicate with you;
• administer your participation;
• handle any payment.

If you do not provide the necessary information, we may be unable to complete your registration.

Membership

To become a member, you need to provide the information necessary to:

• create and administer your membership;
• confirm that you meet the minimum age of 16;
• handle membership fees and payments;
• communicate with you about the membership.

If you do not provide the necessary information, we cannot create or administer the membership.

Volunteering and collaborations

You generally decide what information to provide in a volunteer application or collaboration enquiry.

We may, however, need certain contact details and relevant information about your interests, experience or availability to assess and handle the enquiry.

Optional information

Where information is marked as optional, you can choose not to provide it without losing access to the relevant service.

We do not ask for more information than we consider necessary for the specific purpose.

10. Cookies and similar technologies

Onivers uses cookies and similar technologies on the website. Some are necessary for the website and its basic functions to work. Others are only used if you give consent.

Necessary cookies

Necessary cookies may be used for:

• website security and technical operation;
• forms and registration functions;
• remembering your cookie choices;
• other functions you have expressly requested.

Necessary cookies may be used without consent where they are technically required to provide the requested function. The information must not be used for other purposes.

Statistics and Google Analytics

Onivers uses Google Analytics to gain general insight into how the website is used and how it can be improved.

Google Analytics and other non-essential statistics or tracking technologies are only activated after you have consented to statistics cookies.

We do not use the information to make automated decisions about you.

External content

The website may contain content or features from external services, such as videos, maps or social media.

Where these services use non-essential cookies or similar technologies, they are only loaded after you have given the relevant consent.

Your cookie choices

You can choose to:

• accept all cookies;
• reject non-essential cookies;
• select individual categories;
• change or withdraw your consent later.

You must be able to reject non-essential cookies and continue using the website’s basic functions.

You can change your choices using the Cookie Settings link on the website.

Cookie declaration

The specific cookies and technologies used on the website are listed in our cookie declaration. It includes:

• the name of the technology or cookie;
• the provider;
• the purpose;
• how long it is retained;
• the category it belongs to.

The cookie declaration is updated when the website’s technical configuration or services change.

Relationship with this Privacy Policy

The cookie declaration describes the specific technologies used by the website.

This Privacy Policy explains how Onivers processes personal data that may be collected or generated through those technologies.

11. Children and young people

Onivers memberships, newsletter, event registrations and other registration functions are generally intended for people aged 16 or over.

If you are under 16, you should not independently:

• create a membership;
• register for an event or activity;
• subscribe to the newsletter;
• submit a volunteer application;
• submit personal data through our forms.

You or your parent or guardian are welcome to contact us at info@onivers.org with questions about participation or the processing of personal data.

If Onivers becomes aware that we have received personal data from a person under 16 in breach of our age requirement, we erase the information unless there is a lawful and necessary reason to retain it.

Photographs and video of young participants

We take particular care with photographs and video of participants under 18.

We try to avoid close or prominent images of young participants without a clear agreement.

For portraits, posed photographs or material specifically intended for marketing, we obtain the necessary consent and assess whether a parent or guardian should also be involved.

Participants can always opt out if they do not want to be photographed or filmed.

12. Changes to this Privacy Policy

Onivers may update this Privacy Policy if our activities, website, systems or processing of personal data change, or if changes in law or official guidance make an update necessary.

The latest version will always be available on our website and show the date it was last updated.

If a change has a significant effect on how we process your personal data, we will clearly inform you where relevant and required.

Updating the Privacy Policy does not replace any consent that may be required. If Onivers wishes to use personal data for a new purpose that requires your consent, we will ask for new and separate consent.

We review the Privacy Policy when introducing new forms, services or providers and otherwise at appropriate intervals to ensure the information remains accurate and understandable.