Privacy notice– Summit A/S
Privacy Notice for our Customers, External Contact Persons and Visitors of our Website
Version: 01 June 2024
1. Introduction
This privacy notice describes how Summit A/S (“Summit” or “we”) is processing your personal data as a data controller.
Summit processes personal data about you as a data controller in connection with providing our consultancy services; our workshops; marketing; when you visit, use or engage with us on our website or LinkedIn; and when you act as a contact person employed at a customer, vendor, reseller, consultancy business or other business partner that we have entered into or prospectively will enter into a contract with.
When Summit processes personal data as part of providing the online personality assessment platforms, including HALO and Qualtrics XM, we consider ourselves a data processor, as we process personal data on behalf of our customers and only in accordance with our customers’ instructions. We will enter into a data processing agreement with our customers containing instructions, terms and conditions for our processing of personal data.
2. The Data Controller
The legal entity responsible for the processing of your personal data is Summit A/S, VAT No. 26787610, Sundkrogsgade 7, 4. floor, 2100 Copenhagen, Denmark.
3. Description of the Processing and Categories of Personal Data
Business contact persons:
We will process basic personal data about you when you interact with us, for instance, via e-mail correspondence, or when you are the contact person in relation to our existing contractual relationship or the establishment or termination of such. In this respect, we process ordinary personal data, which you have provided to us, such as your name, (work) email address, telephone number, (work) address, job title/position, name of employer, customer ID (if applicable).
Consultancy services:
We will process personal data about you when we provide our consultancy services to the company you are/were employed at as part of your current or previous job function, e.g. if you have received feedback on your personality assessment results or coaching sessions from our consultants related to e.g. employee development, team development, leadership development etc. We will process e.g. your name, (work) email address, telephone number, (work) address, job title/position, name of employer, interpretation of your personality assessment results and other information you may provide during our sessions.
Workshops:
When you have participated in our workshops, we will process basic personal data about you, such as name, (work) email address, telephone number, (work) address, job title/position, name of employer, information on the workshops you have participated in as part of your current or previous job function (or as a case-person), Hogan-ID (if applicable), personality assessment results, received feedback and/or coaching our consultants has provided to you as part of such workshops.
Webinars and online meetings:
When you participate in one of our online meetings or webinars, we will usually process your registered e-mail address, your name, IP-address and other information provided by you in order to register and participate in the webinar or online meeting.
Newsletters and marketing:
If you subscribe to our newsletters via our website, we will receive your name, (work) email, telephone number, (work) address, job title/position, name of employer, country, phone number. We will use your contact details for marketing purposes, including sending tailored communication to you and invitations to e.g. events.
Social Media:
We may process information pertaining to your Social Media profile(s) to communicate with you, e.g. directly or via marketing on LinkedIn. We reserve the right to process personal data which are manifestly made public by yourself to the extend necessary for these purposes.
Website (Cookies):
When you visit our website, and if you accept the website’s use of cookies, we collect personal data about you via the specific type of cookies you have accepted. In this regard we may collect information about your online behaviour, such as your IP-address, information about the chosen operating system on your computer, your mobile device, chosen internet browser and your online activities on the website (depending on the type of cookies accepted). You can change your cookie settings at any time via the shortcut (‘CO’) in the lower left corner of the screen.
Browser controls:
Most browsers also allow you to control cookies through the browser settings, which may be adapted to reflect your consent to the use of cookies. Further, many browsers also enable you to review and erase cookies, including Summit cookies. To learn more about browser controls, please consult the documentation provided by the developer of your internet browser.
Please note: We do not process special categories of personal data (so-called sensitive personal data) about you in any way or form.
4. Purposes and Legal Basis for the Processing
We limit our processing of personal data to situations where the processing is relevant and necessary for specific purpose(s).
The processing of your personal data may be necessary in order for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract with us, e.g. in relation to the provision of our services, cf. Article 6 (1) (b) of the General Data Protection Regulation (“GDPR”), or because processing is necessary for the purposes of the legitimate interests pursued by us where such interests are not overridden by your interests or fundamental rights and freedoms, cf. Article 6 (1) (f) of the GDPR. Such legitimate interests are, for instance:
- fulfilment of obligations that are not strictly contractual (added services) with the company you represent or work for,
- providing consultancy services, including coaching, to you as part of an agreement with your current or former employer,
- carrying out workshops, courses and certifications and provision of feedback and coaching in this regard,
- providing customer service or communicating with you if you have questions to specific services,
- maintaining and enhancing customer relationships,
- marketing and events,
- seminars and courses, e.g. online (webinars),
- invoicing for the services we provide to your company or vice versa, or
- documentation of events, correspondence, etc. in case of a specific dispute between us and the company you are employed with.
Certain processing activities are necessary to comply with legal obligations, cf. Article 6 (1) (c) of the GDPR, namely retaining accounting material pursuant to applicable bookkeeping rules and tax legislation.
Newsletter & Marketing:
If you sign up for newsletters and other digital publications via our website, the direct marketing communications are provided to you based on your marketing permission, cf. Section 10 (1) of the Danish Marketing Practices Act, and your consent for processing your personal data, cf. Article 6 (1) (a) of the GDPR.
5. Recipients of your Personal Data
We engage third parties (data processors) to process personal data on behalf of us and in accordance with our instructions, such as our IT service providers and/or other third-party suppliers (where relevant). When you participate in a workshop, we use Hogan Assessment Systems Inc. (HALO) as our processor for your personality assessment.
To the extent we disclose or share your personal data to third parties who may use your personal data for their own purposes, such disclosure or sharing will only take place if it is in accordance with applicable law and with prior consent obtained from you, where such consent is required.
Where relevant, we may disclose or share your personal data to other data controllers, e.g. affiliates, vendors, or other business partners for business purposes. Where our associate consultants (independent contractors) are engaged in a coaching assignment or project, these are considered as independent data controllers.
6. Social Media
When you visit our social media sites on e.g. LinkedIn or our website, where social media plugins have been installed, our social media service providers collect and process your personal data using cookies, subject to your consent to the service provider, as applicable. Such collection and processing may take place even if you have no account on the social media. When you visit our LinkedIn site, we will receive anonymous demographic and geographic statistics from LinkedIn on the visitors on our website and/or LinkedIn site. This happens via LinkedIn’s plugins (“LinkedIn Insight Tag”).
In such case, we will be a joint data controller with the social media providers for personal data collected and processed in connection with your visit to our social media sites and our website. It means, among other things, that you may contact both Summit and the social media providers to exercise your data protection rights. LinkedIn has primary responsibility for ensuring compliance with the applicable data protection laws and responding to requests from visitors on LinkedIn. If you are registered as user of LinkedIn, you may exercise your rights via your account settings on LinkedIn.
7. Transfer of your Personal Data to a third Country (Outside of the EU/EEA)
In certain cases, your personal data may be transferred to countries outside of the EU/EEA (data export). Such transfer will be carried out in accordance with applicable data protection laws. This entails that we will identify and verify the relevant transfer mechanism to rely on and adopt any supplementary measures that are necessary to bring the level of data protection of the transferred personal data up to the EU standard of essential equivalence. We may, for example, ensure this by entering the EU standard contractual clauses (“SCC”) with the data importer and – where relevant and necessary – by implementing supplementary measures.
Hogan Assessment Systems Inc., Oklahoma, United States are self-certified under the EU-U.S. Data Privacy Framework which constitutes an adequacy decision by the European Commission, cf. Article 45 GDPR.
If you wish to obtain a copy of the relevant information on third country transfers, please send us an email (contact details below).
8. Storage of your Personal Data
We will only store your personal data as long as necessary to fulfil the purpose(s) for the processing of your personal data.
In relation to workshops, we will store personal data related to personality assessments for six (6) months after the personality assessment has been taken. Please note that if your employer wishes to have your personality assessment report transferred to your employer’s own HALO account, we must receive such request immediately after you have completed your certification. Your employer will need to obtain your written explicit consent to the transfer and send the request and consent to us. Please note that transferring data from one HALO account to another is subject to a standard fee.
Please note that when you take a personality assessment as part of your employment, Summit is the data processor, and the company you work for is the data controller. The personality assessment is taken via the online platform, HALO, provided by Hogan Assessment Systems, Inc., United States (and for the Hogan 360ᵒ assessment by Peter Berry Consultancy Pty. Ltd., Australia, via the Qualtrics XM platform in Frankfurt, Germany).
As a starting point, all personality assessments are stored for two (2) years unless otherwise instructed by your employer. Please contact the company you work for, for further information.
We advise that you keep a copy of your own personality assessment report if you wish to keep it for longer. You will usually receive a copy via e-mail from your employer.
We will store personal data about you as a contact person of our customers, vendors, resellers, etc. only until termination of the contractual relationship between Summit and the company that you are employed at or otherwise represent, or for as long as we keep communicating, unless further processing is deemed necessary for the establishment, exercise or defence of legal claims If there is an actual or potential legal dispute with the company you are employed at, your personal data will be retained for as long as necessary for these purposes after which such personal data will be deleted.
We will store your personal data that is necessary for accounting purposes, such as invoices, credit notes, account statements etc., for five (5) years from the end of the fiscal year to which the accounting material relates in accordance with the Danish Bookkeeping Act (700/2022).
If you have subscribed to our newsletter, we will keep your personal data for as long as you wish to receive digital material from us and for two (2) succeeding years after you have unsubscribed.
9. Your Rights as a Data Subject
We have taken all necessary and adequate steps to protect your personal data and ensure your rights as a data subject.
Subject to certain exceptions and/or on specific terms, you have the following rights as a data subject:
- right of access to the personal data that we process about you (Article 15),
- right to rectify inaccurate personal data concerning you, including completion of incomplete personal data (Article 16),
- right to have your personal data deleted upon request if we do not have grounds for further processing (Article 17),
- right to restrict the processing of personal data concerning you (Article 18),
- right to data portability, e.g. to receive the personal data concerning you in a structured, commonly used and machine-readable format (Article 20),
- right to object at any time to our processing of personal data concerning you (Article 21), and
- right to not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you (Article 22).
In case you have given your consent to a processing activity, you have the right to withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing based on your consent before its withdrawal.
The Danish Data Protection Agency has issued a guideline on the data subjects’ rights. If you want to read more about your rights, please click here. Please note that the information is in Danish.
If you wish to exercise any of your rights as a data subject, you are welcome to contact us by using the below-mentioned contact details.
10. Contact and Complaints
If you wish to file a complaint regarding our processing of your personal data, you may contact:
Summit A/S, Sundkrogsgade 7, 4. floor, 2100, Copenhagen, Denmark
Telephone number: +45 45 85 15 15
E-mail address: data@summitlead.com
You may also contact the supervisory authority in relation to the data protection rules, e.g. if your complaint is not resolved by Summit to your satisfaction. The supervisory authority in Denmark is the Danish Data Protection Agency (Datatilsynet) and the contact details are:
Datatilsynet, Carl Jacobsens Vej 35, DK-2500 Valby
Telephone number: +45 33 19 32 00
E-mail address: dt@datatilsynet.dk
Website: www.datatilsynet.dk
If your national supervisory authority is located outside of Denmark, you can find its contact details here.
11. Changes to the Privacy Notice
This privacy notice will be updated on a regular basis and when necessary due to changes in applicable law and/or practices and, thus, we recommend that you keep yourself updated on a regular basis.
