Privacy Policy

1. Introduction

At VESCO, we take the protection of your personal data seriously.

This privacy policy describes how we collect, use, store and protect personal data when you visit our website, shop in our webshop, participate in online courses or contact us.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Danish data protection legislation.

2. Data Controller

VESCO is operated by:

Vestergaard & Co ApS
Secondary name: VESCO ApS
VAT no.: DK29407509
Tulipanvang 18
9500 Hobro
Denmark

Email: info@vesco.dk
Website: www.vesco.dk

Vestergaard & Co ApS is the data controller for the processing of personal data where we ourselves determine the purposes and means.

When we process information on behalf of a business customer, we may instead be a data processor. The division of roles depends on the specific processing and the agreement with the customer.

3. What personal data do we process?

Depending on your relationship with VESCO, we may process the following information:

• Name, email address and telephone number.
• Company name, address and CVR/VAT number where applicable.
• Information about purchases, orders, payments and invoicing.
• Information about registering for and participating in online courses.
• Course activity, progress, test results, and completion status.
• Issued course certificates and associated documentation.
• Login information and necessary technical information.
• Correspondence with our customer service.
• Information about signing up for newsletters and any consents.
• Information about the use of our website, including cookies where applicable.

We only collect information that is relevant and necessary for the purposes for which it is processed.

4. Purpose and legal basis

Purchasing and order management

When you purchase courses or other products from VESCO, we process information that is necessary to complete the purchase, deliver the product, administer payment and provide customer service.

For purchases made by private individuals, the legal basis is generally GDPR Article 6(1)(b) (performance of a contract).

When purchasing on behalf of a company, the processing of contact persons’ information may be based on our legitimate interests, cf. Article 6(1)(f).

Information that we are obliged to process under, for example, accounting legislation, is processed in accordance with Article 6(1)(c).

Delivery of online courses

We process student information in order to:

• Create and manage student access.
• Provide online training.
• Record course activity and completion.
• Administer tests and evaluations.
• Issue and store course certificates.
• Provide technical support and customer service.

The legal basis depends on whether the student purchased the course themselves or whether the course was purchased by an employer.

The processing may be based on an agreement, cf. GDPR Article 6(1)(b), or legitimate interests, cf. Article 6(1)(f).

If VESCO processes information as a data processor for a business customer, the data controller customer determines the legal basis for the processing in question.

Customer service and communication

When you contact us, we process your contact information and the content of your enquiry in order to answer questions and provide support.

The processing takes place depending on the nature of the enquiry, on the basis of an agreement or our legitimate interest in providing customer service.

Newsletters and marketing

When you sign up for our newsletter, we process your email address and any other information you provide when signing up.

We use double opt-in, which means that you will receive an email asking you to confirm your registration.

This applies both to registration via our website and to voluntary registration in connection with a purchase.

We send newsletters and marketing based on your consent, cf. GDPR Article 6(1)(a), and in accordance with the rules of the Marketing Practices Act.

You can unsubscribe at any time via the unsubscribe link in our emails or by contacting us at info@vesco.dk.

Contact form protection against spam

We use an external security solution to protect the contact form on our website against spam, automated requests and abuse.

In this connection, technical information may be processed, including IP address, browser information and other technical signals used to distinguish between regular visitors and automated traffic.

The processing is based on our legitimate interest in protecting the website and ensuring a well-functioning contact form, cf. GDPR Article 6(1)(f).

The processing may involve the transfer of information to countries outside the EU/EEA. Such transfers must be made on a valid transfer basis under the GDPR.

Statistics and improvement of the website

We may process information about the use of our website to analyse traffic, improve functionality and optimize the user experience.

Where processing requires consent, we obtain this before it begins.

5. Online courses and student information

When you participate in an online course at VESCO, we record information about your course participation, including course activity, progress, test results, and completion.

The information is used to administer your training and document which courses you have completed.

Course certificates

When you complete a course, a course certificate is automatically generated, which you can download from our learning platform.

The course certificate may contain your name, course title, completion date and other relevant information.

Course certificates are not automatically sent to your employer.

Business customers’ access to course information

If your employer has purchased a course for you, the company can, by agreement, obtain administrator access to our learning platform.

Such access allows the company’s designated administrator to track employees’ course progress, view completion status, and retrieve course certificates.

Administrator access is optional and is only created after agreement with the company.

Business customers can also contact VESCO and request to be sent course certificates or reports on their own employees’ course activity and completion.

We only disclose information to persons who are authorized to receive it and limit disclosure to the information that is relevant to the purpose.

6. Storage and deletion

We retain personal data for as long as necessary for the purposes for which the information was collected.

Course information and course certificates

Information about course completion and issued course certificates can be stored for up to 6 years after completion of the individual course.

This is due, among other things, to the fact that certain courses are valid for up to 5 years and that subsequent documentation may be required.

Student profiles and other activity information are only kept for as long as necessary.

Purchasing and accounting information

Accounting material is generally stored for 5 years from the end of the financial year to which the material relates, in accordance with accounting legislation.

Newsletters

Newsletter subscription information is processed as long as you are subscribed.

When you unsubscribe, we will stop sending newsletters. We may continue to retain necessary documentation of previous consent for a limited period of time if relevant to document compliance with the law.

Other information

Other personal data is deleted or anonymised when it is no longer necessary, unless legislation requires longer storage.

7. Sharing of personal data

VESCO uses external suppliers to operate and administer our services.

This includes, among others, suppliers in the following areas:

• Hosting and technical operation of website and webshop.
• Operation and administration of our digital learning platform.
• Payment processing and card acquiring.
• Invoicing, bookkeeping and accounting administration.
• Sending newsletters and electronic communication.
• Cookie and consent management as well as web statistics.
• Delivery of physical products when applicable.
• Security solutions to protect the contact form against spam and automated abuse.

Where suppliers process personal data on our behalf, we enter into data processing agreements in accordance with applicable data protection legislation.

Some partners, such as payment providers, may be independent data controllers for parts of their processing.

We may also disclose information to public authorities if we are legally obliged to do so.

8. Storage and processing outside the EU/EEA

Our website and webshop use hosting infrastructure in Denmark, while our digital learning platform is hosted in Ireland.

Certain suppliers may process or access personal data from countries outside the EU/EEA, including the USA.

When personal data is transferred to countries outside the EU/EEA, we ensure that there is a valid basis for the transfer under GDPR.

This could, for example, be an adequacy decision from the European Commission or the EU Commission’s standard contractual clauses with necessary supplementary measures.

You can contact us at info@vesco.dk for further information about relevant international transfers and the protection measures applied.

9. Cookies

Our website uses cookies and similar technologies for necessary functions and, depending on your consent, statistics and possible marketing.

We use an external solution for handling cookies and consent.

You can read more about the individual cookies, their purposes and storage periods in our separate cookie policy.

You can change or withdraw your consent at any time via the website’s cookie settings.

10. Information security

We use appropriate technical and organizational security measures to protect personal data against unauthorized access, loss, alteration and misuse.

This includes, among other things, access control and restriction of access to personal data.

We continuously adapt our security measures to the information we process and the risks the processing entails.

11. Your rights

When VESCO is the data controller for the processing of your personal data, you have a number of rights under the GDPR.

You have the right, among other things, to:

• Access: To be informed about what personal data we process about you.
• Rectification: To have incorrect information corrected.
• Erasure: To request deletion when the conditions are met.
• Restriction: To request restriction of processing in certain situations.
• Data portability: To receive certain information in a structured format when the conditions are met.
• Objection: To object to certain types of processing.
• Withdrawal of consent: To withdraw consent without affecting the lawfulness of the processing already carried out.

The rights depend on the specific processing and are not absolute in all cases.

If we process information on behalf of your employer, we may need to refer your request to the company or assist the company in responding to it.

You can contact us at info@vesco.dk if you wish to exercise your rights.

12. Complaints

If you have any questions or are dissatisfied with our processing of personal data, please feel free to contact us.

You also have the right to file a complaint with:

Danish Data Protection Authority
Carl Jacobsens Vej 35
DK-2500 Valby
www.datatilsynet.dk

13. Changes to the Privacy Policy

We may update this Privacy Policy if our services, processing of personal data, or applicable law changes.

The current version will always be available on our website.

The date of the last update appears at the top of the document.

14. Contact

If you have any questions about our privacy policy or the processing of personal data, you can contact:

Vestergaard & Co ApS (VESCO)
Tulipanvang 18
DK-9500 Hobro
VAT no.: DK29407509
Email: info@vesco.dk
Website: www.vesco.dk