This document specifies the processing of personal data that Dimmi ApS carries out on behalf of its clients. It forms Annex A to the Data Processing Agreement and is published separately so that a client's privacy team can review the scope of processing without reading the full agreement.
Where the Client wishes to vary the instruction, it may do so in writing under section 3.1 of the DPA. A variation that materially changes the scope, nature or purpose of the processing may require an adjustment to the fees under the agreement between the Parties.
1. Subject matter and purpose
Dimmi processes personal data for the purpose of delivering Dimmi aOS and the associated services:
- case management of residence and work permits, including family reunification, renewals and change of employer;
- social security determinations and certificates — A1 certificates within the EU/EEA and certificates of coverage under bilateral and totalisation agreements elsewhere;
- posted worker notifications and the registration obligations that travel with a posting;
- tax support, including residence and liability questions, arrival and departure, special regimes, employer obligations and cross-border working patterns;
- business travel and remote work threshold tracking, where the Client activates it;
- relocation and destination services, including housing, registration, banking, insurance, schooling, international moving and departure or repatriation;
- the Employee Portal, through which the individual concerned by a case submits documents and follows status;
- Dimmi Counsel and AI-assisted document extraction and quality control;
- compliance monitoring of permits, certificates, visas and expiry dates, and the reporting built on it;
- eligibility and cost projections;
- audit logging; and
- email and in-platform notifications.
2. Nature of the processing
Collection, registration, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission — including to delivery partners and to authorities as part of a case — alignment, restriction, erasure and destruction.
3. Categories of data subjects
- The Client's employees and candidates who are the subject of a case.
- Their accompanying family members.
- The Client's users of the platform and its contact persons.
4. Categories of personal data
| Category | Examples |
|---|---|
| User data (Client's staff) | Name, work email, phone, position and role, user settings |
| Employee case data | Name, date of birth, nationality, passport and ID details, photo, contact details, permit or certificate type and status, expiry dates, application documents and correspondence with authorities |
| Employment data | Employer, position, contract terms, salary where required for an application or a tax assessment, qualifications and diplomas |
| Family data | Marital status, family relations, dependants' identity data |
| Relocation data | Housing needs, school requirements, moving inventory, arrival details |
| Travel and threshold data | Trip dates and destinations, day counts per country, where business travel tracking is activated |
| Log and usage data | Login times, audit trail of look-ups and views |
5. Special categories of personal data
The processing is not directed at special categories of personal data within the meaning of Article 9 of the GDPR.
Immigration, tax and relocation casework may nonetheless incidentally involve such data where the process requires it — for example a medical certificate required by a destination country, biometric data collected by an authority as part of an application, or a document that indirectly reveals health, religious or trade union information. Such data is processed only to the extent necessary for the case, and is protected by the measures set out in the Security Measures.
6. Criminal convictions and offences
Certain immigration routes, and background screening where the Client activates it, require submission of a criminal record certificate or a declaration of good conduct. Where a case requires this, the document is processed solely for submission to the competent authority or for the screening the Client has instructed, and is subject to the retention schedule in Annex C.5 of the DPA.
7. Recipients
Sub-processors. Published and continuously updated at dimmi.dk/en/subprocessors.
Delivery partners. Engaged per case in the relevant jurisdiction, as described in Annex B.3 of the DPA. The partner engaged on a given case is visible in the Client Portal.
Public authorities. Authorities to which an application, notification or registration is submitted act as independent controllers for their own processing. Depending on the case these include the Danish Agency for International Recruitment and Integration (SIRI), the Danish Tax Agency (Skattestyrelsen), Udbetaling Danmark, the Danish Business Authority (RUT), the Danish Civil Registration System (CPR), the Danish Agency for Labour Market and Recruitment, and the equivalent authorities in other jurisdictions where a case is filed.
Independent professional advisers. Where professional rules require a direct engagement between the Client (or the data subject) and an adviser, the adviser acts as an independent controller, as set out in section 15 of the DPA.
8. Duration
The processing lasts for the term of the agreement between the Parties, plus the retention periods set out in Annex C.5 of the DPA.
9. Instruction
Dimmi processes personal data solely for the purposes and on the terms set out in this document, the agreement between the Parties and the DPA.
The Client's creation and initiation of a case in the Client Portal constitutes a documented instruction to process the data necessary for that case and to disclose it to the relevant authority and delivery partner.
Supplementary written instructions may be given via the contact person under section 14 of the DPA or through the platform.
Previous versions of this document are available at dimmi.dk/en/legal/archive.