Your employer has asked Dimmi to help with your move, your permit, your certificate or your tax position. This notice explains what happens to your information, who decides what happens to it, and what you can ask for.

It is written to be read by you, not by a lawyer. If anything here is unclear, write to info@dimmi.dk and we will explain it.

In short

Your employer decides what information is collected about you and why. In data protection terms, your employer is the controller.
Dimmi handles the information on your employer's instructions. We are the processor. We do not use your information for our own purposes.
Some things only you see. Information about your family, your housing search and your personal settling-in arrangements is shared with your employer only where they need it for a service they have asked us to provide.
You can ask us anything about your case at any time, and you can ask for a copy of your information.

1. Who is responsible

Your employer is the controller. They decide which services to order, what information is needed, and how long it is kept. If you want your information deleted or corrected, your employer makes that decision — though you can ask us and we will pass it on immediately.

Dimmi ApS is the processor. We handle the information to deliver the service your employer ordered. Our details:

Dimmi ApS · CVR no. 46 63 85 73 Karen Blixens Plads 16, 2300 København S, Denmark info@dimmi.dk Data Protection Officer: Massimo Hansen — massimo@dimmi.dk

One exception. For your Employee Portal account itself — your login, your security, the record of when you signed in — Dimmi is the controller. That is covered by our Privacy Policy.

2. What information we handle about you

It depends on what your employer has asked us to do. A permit application needs more than a housing search.

Identity and contact details. Name, date of birth, nationality, passport or ID details, a photograph, address, email and phone number.

Your case. The type of permit, certificate or service, its status, dates and deadlines, the documents that go with the application, and the correspondence with the authority.

Employment. Your employer, your position, your contract terms, your salary where the application or the tax assessment requires it, and your qualifications and diplomas.

Family. Marital status, family relationships, and identity details of anyone travelling with you, where they are part of the case.

Relocation. Housing requirements, school requirements, what you are moving and when you arrive.

Travel. Where your employer uses travel tracking, the dates and destinations of work trips and the day counts that follow from them.

How you use the portal. Sign-in times, and a record of who looked at what.

Sensitive information

Some applications require documents that reveal sensitive information — a medical certificate for a particular country, biometric data an authority collects, or a criminal record certificate for certain permit routes and for background screening.

We handle these only when the specific application requires them, we keep them to the case, and they are protected by the security measures described in our Security Measures.

3. Where the information comes from

Most of it comes from you, through the Employee Portal. Some comes from your employer — your position, your contract terms, your start date. Some comes back from the authority handling your application.

4. Why we handle it

To deliver the service your employer ordered: to prepare and file your application, to represent you before the authority within the power of attorney you grant, to keep track of expiry dates and deadlines, to arrange housing, registration, schooling, insurance or a move, to answer your questions, and to keep you informed.

The legal basis for the processing is your employer's, and they can explain it. In most cases it will be that the processing is necessary to perform your employment contract, or to comply with a legal obligation your employer has as an employer.

We do not use your information to train AI models. The platform uses AI to help extract information from documents and to answer questions about mobility rules, but your documents are not used to train those models, and everything runs on infrastructure hosted in the EU.

5. Who sees your information

Your employer. The people at your employer who manage your case. Not everyone — access is limited to those who need it.

Information about your private circumstances — your family situation, your housing search, your personal settling-in arrangements — is visible to your employer only where it is needed for a service they have ordered.

Dimmi's team. Only the people working on your case.

Delivery partners. For services outside Denmark, and some inside it, we work with local partners: immigration lawyers and licensed advisers, tax advisers, relocation agents, destination service providers and moving companies. A partner receives only what your case needs. The partner on your case is named in your portal.

Authorities. Whichever authority your application goes to — in Denmark this may be SIRI, Skattestyrelsen, Udbetaling Danmark, the CPR register or the Danish Business Authority, and abroad the equivalent body. They decide your application themselves, and handle your information under their own rules.

Our sub-processors. The companies that provide our hosting, storage, email and related infrastructure. They are listed, with what each one does and where it is, at dimmi.dk/en/subprocessors.

We do not sell your information, and we do not use it for marketing.

6. Where your information is held

On servers in the EU — Germany and Finland.

Some of our infrastructure providers process data outside the EU. Where they do, the transfer is protected by the EU Standard Contractual Clauses or by an adequacy decision, and we have carried out a written assessment of the risks. The details are on the sub-processors page.

If your case involves a country outside the EU, delivering the service means your information has to go there — to the local partner handling it, and to the authority deciding it. That is unavoidable: an application in Singapore has to reach Singapore. Where the country has no EU adequacy decision, we rely on the Standard Contractual Clauses in our partner agreements, or on the rule that permits a transfer necessary to perform a contract in your interest.

7. How long it is kept

Your employer decides. Under our standard terms, case data and documents are kept for five years after the case is completed, which reflects the periods during which an authority may reopen a matter and during which your employer may need to show what was filed.

Some things are shorter: your portal account is deleted 30 days after it is closed, exports you request are deleted after 30 days, and technical logs after 90 days. The audit record of who looked at your case is kept for 730 days.

When your employer's agreement with Dimmi ends, we delete or return everything within 60 days, unless the law requires us to keep something.

8. Your rights

You can ask to:

see what information is held about you, and get a copy;
correct anything that is wrong or incomplete;
delete information that is no longer needed;
restrict how it is used while a question about it is resolved;
object to processing based on legitimate interest; and
receive the information you provided in a machine-readable format.

How to ask. In the Employee Portal you can request a copy of your information and request deletion directly. For anything else, write to info@dimmi.dk or to massimo@dimmi.dk.

Because your employer is the controller, we pass requests about case data to them without delay and help them answer. We respond within 30 days.

If you are unhappy, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk — or to the data protection authority in the country where you live.

9. Do you have to provide the information?

For most of it, yes — not as a legal obligation to us, but because an application cannot be filed without it. If you do not want to provide something, tell us: sometimes there is another route, and sometimes the consequence is simply that a particular application cannot proceed. We will tell you which it is.

10. Automated decisions

No decision about your application is made by a machine alone. The platform uses AI to read documents, check them for problems and answer questions, but a person at Dimmi reviews everything before it is filed, and the decision on your application is made by the authority.

11. Changes

If this notice changes, the new version appears here with a new date, and you will see a notice in the portal.

Questions? info@dimmi.dk · Data Protection Officer: massimo@dimmi.dk

Previous versions of this document are available at dimmi.dk/en/legal/archive.