Privacy notice for family and emergency contacts

Version: March 2025

In connection with emergency contacts for DIS students and with the Family Newsletter, Fonden DIS and DIS Stockholm AB will, as the joint data controllers, collect and process personal data about Family and Emergency Contacts of DIS students.

1. Categories of personal data and purposes

DIS collects and processes the following types of personal data about Family and Emergency Contacts of DIS students: name, location, contact information, newsletter subscription status, and associated DIS student.

DIS processes the personal data for the following purposes:

• To be in contact in case of an emergency involving DIS students
• To keep family members informed about DIS programming before and during their student’s time abroad
• For statistical and research purposes
• To comply with applicable personal data protection regulation and other legitimate interests, e.g.
  • Documentation requirements
  • Compliance with basic principles and legal grounds for processing personal data
  • Putting in place, maintaining and testing technical and organisational security measures
  • Investigating and reporting suspected personal data breaches, if any
  • Handling requests and complaints from data subjects and others, if any
  • Handling inspections and queries by supervisory authorities, if any
  • Handling disputes with data subjects and third parties, if any

2. Sources

The personal data for Family and Emergency contacts are collected from DIS students during their registration process.

3. The legal basis for the collection and processing of the personal data

The legal basis for collection and processing of name, location, contact information, and associated student are:

• Based on GDPR art. 6(1)(b), processing which is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract

When DIS collects personal data directly from your related DIS student for the purpose of emergency contact, they are obliged to provide DIS two contacts to use in the case of an emergency. DIS students may change individual emergency contacts, but are required to provide two contacts in order to enroll in the DIS program.

The legal basis for collection and processing of contact information and newsletter subscription status are:

• Based on GDPR art. 6(1)(f), processing which is necessary for the purposes of the legitimate interests pursued by the controller.

DIS has a legitimate interest interest to keep families informed by proactively sharing resources and advice to support their DIS student in their preparation for study abroad and during their time in Scandinavia. Newsletters are an important resource for families who wish to help their DIS student arrive prepared and thrive abroad. DIS students themselves and their Family and Emergency contacts have right to object to any further processing for the Family Newsletter on the basis that their interests outweigh the legitimate interests of DIS as an organization. To exercise this claim, DIS students can choose to opt-out their contacts by de-selecting the relevant option when submitting their Emergency contacts, or by contacting the DIS Data Protection Officer (dataprotectionofficer@dis.dk) detailing to which legitimate interest they are objecting, and why their interests outweigh those of DIS in the specific instance. Further, Family and Emergency Contacts themselves can choose to opt-out themselves by clicking unsubscribe in the Family Newsletters, or by contacting the DIS Data Protection Officer (dataprotectionofficer@dis.dk) detailing to which legitimate interest they are objecting, and why their interests outweigh those of DIS in the specific instance.

4. Disclosure of the personal data to other controllers

The name, location and contact information may be disclosed in an emergency to the following categories of controllers:

• Public Authorities
• Health Professionals
• Partner Universities

The legal basis for this disclosure is the following:

• Based on GDPR art. 6(1)(d), processing which is necessary in order to protect the vital interests of the data subject or of another natural person.

5. Transfer of personal data to data processors

In case of an emergency, DIS may transfer name, location, and contact information to the following data processor, which processes the data on behalf of DIS:

• Black Swan

In relation to the Family Newsletter, DIS transfers contact information and newsletter subscription status to the following data processors, which processes and stores the data on behalf of DIS:

• Element 451
• Mailchimp

6. International transfers of personal data to recipients (both controllers and processors) in countries outside the EU/EEA

We transfer the personal data to the following recipients located in countries outside the EU/EEA:

EU Standard Contractual Clauses as a transfer basis, means that DIS and the other organization(s) have agreed to additional contractual language from the EU, which protects the legal rights Family and Emergency Contacts have as data subjects, even though Family and Emergency Contacts’ personal data is shared outside of the EU. Family and Emergency Contacts the right to obtain a copy of these clauses, which can be exercised by contacting dataprotectionofficer@dis.dk.

7. Retention period

DIS stores the personal data of Family and Emergency Contacts for as long as necessary to fulfil the purposes above, but the data is deleted on an annual basis about 1-1½ year after the conclusion of the related DIS student’s enrollment.

8. Your rights

Subject to the conditions set out in the applicable data protection legislation, you enjoy the following certain rights:

• The right to request access to the personal data
• The right to rectification of the personal data
• The right to erasure of the personal data
• The right to restriction of processing
• The right to data portability
• The right to objection to the processing of the personal data

You also have the right to lodge a complaint with the competent supervisory authority, such as the Danish Data Protection Agency or the Swedish Data Protection Agency as relevant. Please consult their website for how to submit a complaint at www.datatilsynet.dk or www.imy.se respectively. 

9. Contact

Family and Emergency Contacts should contact DIS if they have any questions in regards to the protection of their personal data or if they wish to exercise their legal rights.

Contact details of the controller(s):

Fonden DIS – Danish Institute for Study Abroad

Contact details of the data protection officer: