Privacy notice– Summit A/S
Privacy Notice for our Customers, External Contact Persons and Visitors of our Website
Version: 01 January 2023
This privacy notice describes how Summit A/S (“Summit” or “we”) is processing your personal data as a data controller.
Summit processes personal data about you as a data controller in connection with providing our consultancy services; our workshops; marketing; when you visit, use or engage with us on our website or LinkedIn; and when you act as a contact person employed at a customer, vendor, reseller, consultancy business or other business partner that we have entered into or prospectively will enter into a contract with.
When Summit processes personal data as part of providing the online personality assessment platforms, including HALO, we consider ourselves a data processor, as we process personal data on behalf of our customers and only in accordance with our customers’ instructions. We will enter into a data processing agreement with our customers containing instructions, terms and conditions for our processing of personal data.
2. The Data Controller
The legal entity responsible for the processing of your personal data is Summit A/S, VAT No. 26787610, Sundkrogsgade 7, 4. floor, 2100 Copenhagen, Denmark.
3. Description of the Processing and Categories of Personal Data
Business contact persons:
We will process basic personal data about you when you interact with us, for instance, via e-mail correspondence, or when you are the contact person in relation to our existing contractual relationship or the establishment or termination of such. In this respect, we process ordinary personal data, which you have provided to us, such as your name, (work) email address, telephone number, (work) address, job title/position, name of employer, customer ID (if applicable).
We will process personal data about you when we provide our consultancy services to the company you are/were employed at as part of your current or previous job function, e.g. if you have received feedback on your personality assessment results or coaching sessions from our consultants related to e.g. employee development, team development, leadership development etc. We will process e.g. your name, (work) email address, telephone number, (work) address, job title/position, name of employer, interpretation of your personality assessment results and other information you may provide during our sessions.
When you have participated in our workshops, we will process basic personal data about you, such as name, (work) email address, telephone number, (work) address, job title/position, name of employer, information on the workshops you have participated in as part of your current or previous job function (or as a case-person), Hogan-ID (if applicable), personality assessment results, received feedback and/or coaching our consultants has provided to you as part of such workshops.
Webinars and online meetings:
When you participate in one of our online meetings or webinars, we will usually process your registered e-mail address, your name, IP-address and other information provided by you in order to register and participate in the webinar or online meeting.
Newsletters and marketing:
If you subscribe to our newsletters via our website, we will receive your name, (work) email, telephone number, (work) address, job title/position, name of employer, country, phone number. We will use your contact details for marketing purposes, including sending tailored communication to you and invitations to e.g. events.
We may process information pertaining to your LinkedIn profile to communicate with you on LinkedIn, e.g. directly or via marketing on LinkedIn.
We do not process special categories of personal data (sensitive personal data) about you.
4. Purposes and Legal Basis for the Processing
We limit our processing of personal data to situations where the processing is relevant and necessary for a specific purpose.
The processing of your personal data may be necessary in order for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract, e.g. in relation to the provision of our services, cf. Article 6 (1) (b) of the General Data Protection Regulation (“GDPR”), or because processing is necessary for the purposes of the legitimate interests pursued by us where such interests are not overridden by your interests or fundamental rights and freedoms, cf. Article 6 (1) (f) of the GDPR. Such legitimate interests are, for instance:
Certain processing of personal data is necessary in order to comply with a legal obligation, cf. Article 6 (1) (c) of the GDPR, namely retaining bookkeeping material pursuant to applicable bookkeeping rules.
When you sign up for newsletters via our website, the direct marketing communications are provided to you based on your prior consent, cf. Section 10 (1) of the Danish Marketing Practices Act. The personal data processed for this purpose is based on our legitimate interests to provide you with the content of the newsletter as requested by you, cf. Article 6 (1) (f) of the GDPR.
5. Recipients of your Personal Data
We may engage third parties (data processors) to process personal data on behalf of us and in accordance with our instructions, such as our IT service providers and/or other external suppliers (where relevant). When you participate in a workshop, we use Hogan Assessment Systems Inc. (HALO) as our processor for your personality assessment.
To the extent we disclose or transfer your personal data to third parties who may use your personal data for their own purposes, such disclosure or transfer will only take place if it is in accordance with applicable law and with prior consent obtained from you, where such consent is required.
Where relevant, we may disclose or transfer your personal data to other controllers, e.g. affiliates, vendors, or other business partners for business purposes. Where our associate consultants (independent contractors) are engaged in a coaching assignment or project, these are considered as independent data controllers.
6. Social Media
When you visit our social media sites on e.g. Linkedin or our website, where social media plugins have been installed, our social media service providers collect and process your personal data using cookies, subject to your consent to the service provider, as applicable. Such collection and processing may take place even if you have no account on the social media. When you visit our LinkedIn site, we will receive anonymous demographic and geographic statistics from LinkedIn on the visitors on our website and/our LinkedIn site. This happens via LinkedIn’s plugins (“LinkedIn Insight Tag”).
In such case, we will be joint data controller with the social media providers for personal data collected and processed in connection with your visit to our social media sites and our website. It means, among other things, that you may contact both Summit and the social media providers to exercise your data protection rights. LinkedIn has primary responsibility for ensuring compliance with the applicable data protection laws and responding to requests from visitors on LinkedIn. If you are registered as user of LinkedIn, you may exercise your rights via your account settings on LinkedIn.
7. Transfer of your Personal Data to a third Country (Outside of the EU/EEA)
In certain cases, your personal data may be transferred to countries outside of the EU/EEA. Such transfer will be carried out in accordance with applicable data protection laws. This entails that we will identify and verify the transfer tool to rely on and adopt any supplementary measures that are necessary to bring the level of protection of the transferred personal data up to the EU standard of essential equivalence. We may, for example, ensure this by entering into the relevant EU standard contractual clauses (“SCC”) with the data importer and – where relevant and necessary – by implementing supplementary measures. For example, we have entered into the relevant SCC with Hogan Assessment Systems Inc., Oklahoma, United States. If you wish to obtain a copy of the relevant information on third country transfers, please send an email to the email address provided under contacts below.
8. Storage of your Personal Data
We will only store your personal data as long as necessary to fulfil the purpose for the processing of your personal data.
In relation to workshops, we will store personal data related to personality assessments for 6 months after the personality assessment has been taken. Please note that if your employer wishes to have your personality assessment report transferred to your employer’s own HALO account, we must receive such request immediately after you have completed your certification. Your employer will need to obtain your written explicit consent to the transfer and send the request and consent to us. Please note that transferring data from one HALO account to another is subject to a standard fee.
Certain consultants employed with us may be authorised psychologists, who are subject to, inter alia, the Danish Act on Medical Record-Keeping and the Danish Act on Psychologists. In this case, we will (if applicable) store personal data in accordance with the mandatory record-keeping rules, e.g. as a minimum 5 years after the last noted remark. We will therefore as a general rule store all personal data obtained as part of our consultancy services and projects, e.g. coaching, for 5 years. This does not apply to personal data stored in the online assessment platform(s), e.g. HALO (see below).
Please note that when you take a personality assessment as part of your employment, we are the data processor and your employer is the data controller. The personality assessment is taken via the online platform, HALO, provided by Hogan Assessment Systems, Inc., United States (and for the 360Hogan test, Peter Berry Consultancy Ltd., Australia). As a starting point all personality assessments are stored in HALO for 2 years unless otherwise instructed by your employer. Please contact your employer (current/former) for any further information.
9. Your rights as a Data Subject
We have taken all necessary and adequate steps in order to protect your personal data and ensure your rights as a data subject.
Subject to certain exceptions and terms, you have following rights:
In case you have given your consent to a processing activity, you have the right to withdraw your consent at any time. In such case your withdrawal will not affect the lawfulness of processing based on your consent before its withdrawal
If you wish to exercise any of your rights as a data subject, you are welcome to contact us by using the below-mentioned contact details.
10. Contact and Complaints
If you wish to file a complaint regarding our processing of your personal data, you may contact:
You may also contact the supervisory authority in relation to the data protection rules, e.g. if your complaint is not resolved by Summit to your satisfaction. The supervisory authority in Denmark is the Danish Data Protection Agency (Datatilsynet) and the contact details are:
If your national supervisory authority is located outside of Denmark, you can find its contact details here.
11. Changes to the Privacy Notice
This privacy notice will be updated on a regular basis and when necessary due to changes in applicable law and practice and, thus, we recommend that you keep yourself updated on a regular basis.