Privacy policy
Nordic Estates Asset Management A/S ("the Company", "we", "us") processes personal data in accordance with Regulation 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, "GDPR") and Danish Act No. 502 of May 23, 2018 on supplementary provisions to the regulation on the protection of natural persons (the Danish Data Protection Act).
Version 3.1 · Last updated May 1, 2026
Data controller
The data controller responsible for processing personal data is:
CVR no. 44866889
Bredgade 30
1260 København K
Denmark
Phone: +45 81 91 50 00
E-mail: dataprotection@nordicestates.dk
The Company is a registered alternative investment fund manager (AIFM) with the Danish Financial Supervisory Authority under registration number FT23401 and manages alternative investment funds pursuant to the Danish Act on Managers of Alternative Investment Funds, etc. (the Danish AIFM Act). This regulatory framework entails specific documentation and retention requirements that affect the processing of personal data about investors and business partners.
What personal data we process
The Company processes only personal data necessary to fulfill contractual, statutory, and supervisory obligations. Processing typically covers the following categories:
General personal data
- Identification information (name, date of birth, Danish civil registration number (CPR number) or foreign identification, copy of passport or other photo ID).
- Contact information (address, telephone number, email).
- Financial information (account number, financial circumstances, investment experience, tax status, FATCA/CRS status).
- Information about beneficial owners, controlling persons, and authorized signatories for corporate investors.
- Correspondence and documentation relating to the client relationship, including investor portal logs.
Sensitive information and information about criminal offenses
As a general rule, the Company does not process sensitive personal data under Article 9 of the GDPR. However, to comply with the Danish Anti-Money Laundering Act, we may process information about politically exposed persons (PEPs), sanctions list checks, and adverse media screening, which may include information about criminal offenses under Section 8 of the Danish Data Protection Act.
Purposes and legal bases
Personal data is processed for clearly defined purposes, each supported by a legal basis under Article 6 of the GDPR (and, where relevant, Article 9 or 10).
- Investors
- Identification, onboarding, capital calls, distributions, reporting, and ongoing administration of mandates.
Legal basis: GDPR Art. 6(1)(b) (performance of a contract), Art. 6(1)(c) (legal obligation under the Danish Alternative Investment Fund Managers Act, the Danish Anti-Money Laundering Act, and Danish tax legislation), and Art. 6(1)(f) (legitimate interest in secure operations). - Tenants
- Entering into and administering leases, collecting payments, operating and maintaining properties, and communicating about matters relating to the tenancy.
Legal basis: GDPR Art. 6(1)(b) (performance of a contract) and Art. 6(1)(c) (Danish tenancy legislation and the Danish Bookkeeping Act). - Business partners and suppliers
- Entering into and administering agreements with advisers, auditors, real estate brokers, attorneys, banks, and other suppliers, including contacts at legal entities.
Legal basis: GDPR Art. 6(1)(b) and Art. 6(1)(f). - Inquiries submitted through forms and email
- Processing incoming inquiries, including contact forms and requests for investment materials.
Legal basis: GDPR Art. 6(1)(f) (legitimate interest in responding to inquiries). - Website visitors
- Technical logs necessary for secure operations, troubleshooting, and preventing misuse. The Company uses cookies sparingly and only with consent, in accordance with the Danish Cookie Executive Order.
Legal basis: GDPR Art. 6(1)(f) for necessary logs; Art. 6(1)(a) (consent) for nonessential cookies. - Applicants and employees
- Recruitment and compliance with employment law obligations.
Legal basis: GDPR Art. 6(1)(b), 6(1)(c), and 6(1)(f), and Sections 11–12 of the Danish Data Protection Act for processing CPR numbers.
Sources
Personal data is primarily collected directly from the data subject. However, we may supplement this information from the following sources when necessary for the purpose or required by law:
- Publicly accessible registers, including the Danish Central Business Register (CVR) and the Danish Land Register.
- Sanctions lists and PEP databases from recognized compliance providers.
- Tax authorities in Denmark and abroad (FATCA/CRS).
- Banks, auditors, attorneys, and other professional advisers in connection with onboarding or transactions.
Recipients and disclosure
Personal data is treated confidentially and disclosed only when necessary to fulfill the purpose or required by law. Recipients may include:
- 01The Company's data processors, including providers of IT operations, the investor portal, KYC screening, email distribution, and document management.
- 02Public authorities, including the Danish Financial Supervisory Authority, the Danish Tax Agency, the Danish State Prosecutor for Serious Economic and International Crime (SØIK), and municipal authorities, where a legal obligation applies.
- 03External auditors and attorneys in connection with audits, due diligence, or legal advice.
- 04Banks and payment intermediaries when processing capital calls, distributions, and rent collection.
- 05Potential acquirers or their advisers in connection with structured transactions, but only under a confidentiality agreement.
Transfers to third countries
As a general rule, the Company processes personal data within the EU/EEA. To the extent that processing takes place outside the EU/EEA—for example, through certain cloud or screening providers—transfers are made only on a lawful basis under Chapter V of the GDPR, including:
- The European Commission's Standard Contractual Clauses (SCCs), under Art. 46(2)(c), supplemented by technical and organizational measures where required (TIA).
- Adequacy decisions adopted by the European Commission under Art. 45.
- The EU-U.S. Data Privacy Framework, where the recipient is certified.
A copy of the transfer mechanism used may be requested by contacting dataprotection@nordicestates.dk.
Retention periods
Personal data is retained no longer than necessary for the purpose for which it was collected. Retention periods are determined according to the following principles:
- Investor documentation
- As a general rule, 5 years after the client relationship ends, under Section 30 of the Danish Anti-Money Laundering Act, although certain information may be retained for up to 10 years where necessary for investigations or civil claims.
- Accounting records
- 5 years from the end of the financial year to which the records relate, under Section 12 of the Danish Bookkeeping Act.
- Lease documentation
- Until the tenancy ends and for 5 years thereafter, to account for limitation periods and bookkeeping rules.
- Inquiries and correspondence
- Retained for up to 3 years after the last contact, unless a longer retention period is necessary.
- Recruitment materials
- Deleted no later than 6 months after the recruitment process ends, unless separate consent is obtained.
- Technical logs
- Typically retained for 90 days for operational purposes and security monitoring.
Security
The Company has implemented technical and organizational security measures appropriate to the risks associated with processing, in accordance with Article 32 of the GDPR. These measures include:
- Need-to-know access controls and two-factor authentication.
- Encryption of data in transit and, where relevant, at rest.
- Logging, monitoring, and periodic security testing of business-critical systems.
- Written procedures for handling personal data breaches.
- Ongoing employee training in data protection and information security.
Personal data breaches are reported to the Danish Data Protection Agency without undue delay and no later than 72 hours after the Company becomes aware of the breach, where notification is required under Article 33 of the GDPR.
Data subjects' rights
Data subjects have a number of rights under the GDPR. Inquiries regarding these rights may be directed to dataprotection@nordicestates.dk. The Company responds to inquiries as promptly as possible and no later than within one month.
- Access
- The right to obtain confirmation as to whether personal data about the individual is being processed and, if so, to access that data and receive a copy.
- Rectification
- The right to have inaccurate information corrected and incomplete information completed.
- Erasure
- The right to have data erased where one of the grounds specified in Article 17 of the GDPR applies. This right may be limited by statutory retention requirements.
- Restriction
- The right to restrict processing in the circumstances specified in Article 18 of the GDPR.
- Objection
- The right to object to processing based on legitimate interests or the public interest, under Article 21 of the GDPR.
- Data portability
- The right to receive personal data in a structured, commonly used, and machine-readable format where processing is based on consent or a contract and is carried out by automated means.
- Withdrawal of consent
- Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
Automated decision-making and profiling
The Company does not use automated decision-making, including profiling, that produces legal effects concerning the data subject or similarly significantly affects the individual, as specified in Article 22 of the GDPR.
Cookies
The Company's website uses only cookies that are strictly necessary for its operation and—with separate consent—cookies for analytics and operational improvements. No marketing cookies are placed. Cookie settings may be changed at any time through the consent banner at the bottom of the page.
Complaints to the Danish Data Protection Agency
Data subjects have the right at any time to lodge a complaint with the Danish Data Protection Agency if they are dissatisfied with the Company's processing of personal data. The Danish Data Protection Agency can be contacted through datatilsynet.dk or by telephone at +45 33 19 32 00.
However, we encourage you to direct any complaint to the Company first so that we have an opportunity to review the matter.
Changes to the privacy policy
The Company may amend this privacy policy at any time. The current version is published on the Company's website. Affected investors are notified directly of material changes through the investor portal or by email.
Version 3.1 · Last updated May 1, 2026 · Approved by executive management, NE-POL-001.
- Conflicts of interestIdentification, prevention, and management of conflicts of interest.
- Complaint handlingProcedure for handling inquiries and complaints.
- AML & KYCAnti-money laundering and customer due diligence in accordance with the Danish Anti-Money Laundering Act.
- Policies · overviewThe Company's complete set of policies and governance documents.
Questions about the processing of personal data or the exercise of rights should be directed to dataprotection@nordicestates.dk.
Contact data protectioninfo@nordicestates.dk
