Privacy notice

VELUX FONDEN (the "Foundation") takes the processing of your personal data seriously. We ensure reasonable and transparent processing in accordance with the applicable rules on the processing of personal data.

Under the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016), the Foundation is obliged to inform data subjects how the Foundation processes the personal data collected and registered about them.

This privacy notice describes how the Foundation processes your personal data.

VELUX FOUNDATION, company registration no. (CVR) 61023917, is the data controller regarding the processing of your personal data. 

The Foundation’s address is Tobaksvejen 10, DK-2860 Søborg.

The Foundation may be contacted by e-mail at info@veluxfonden.dk

We process the following general personal data about you:

• Name, title, address, telephone number, e-mail, gender, age, nationality
• If applicable researcher ID (ORCID)
• Application and CV
• Civil registration number
• Information necessary for the payment of a grant (bank details)
• Feedback, if any, on results of projects having received grants and projects not having received grants
• Other personal data which you may disclose in or in relation to your application

Please do not include sensitive personal data, including data about health or religion, in your application.

As a starting point, the information is collected from you via the Foundation’s application portal. If there are several applicants for the same application, information about co-applicants will be collected from the applicant submitting the application via the Foundation’s application portal.

In connection with the assessment of your application and for the purpose of research and statistics in connection with the evaluation of the Foundation’s programmes, the Foundation may obtain additional information about you if we consider this relevant and necessary.

This information may come from publicly available sources, including public registers, research and publication databases, websites of universities, research institutions or other organisations, media coverage, and relevant compliance sources, such as sanctions and PEP lists.

As a starting point, the information obtained will concern your professional background, research or project activities, publications, organisational affiliation, and any matters relevant to the Foundation’s lawful and responsible processing of the application.

In addition, we process pictures and video recordings of you if we have received your consent to do so. These pictures and videos will most often have been recorded by the Foundation, possibly by an external photographer.

The purposes of processing of your personal data are the following:

• Assessment of your application for potential grant allocation. The Foundation has a legitimate interest in processing and assessing applications received for the purpose of awarding or declining support. The legal basis for the processing is Article 6(1)(b) and/or (f) of the GDPR.

• Giving and administering grants, including entering into agreements on grants and administration thereof. The Foundation has a legitimate interest in administering an agreement on a grant, including in establishing, making or defending a legal claim, if any. Our legal basis for the processing is Article 6(1)(b) of the GDPR, if we have entered into an agreement on a grant, or Article 6(1)(f).
• Compliance with current legislation, consisting of declarations of grants to SKAT and foundation authorities. The legal basis for our processing of general personal data is Article 6(1)(c) of the GDPR, including, in particular, tax legislation, the Act on foundations and certain associations and section 11(2), no. 1 and 3 of the Danish Data Protection Act (processing of civil registration numbers).
• Inclusion in the Foundation’s register of supported projects on https://veluxfonden.dk/en. The register shows data on projects supported by the Foundation for the purpose of creating transparency for future applicants and other stakeholders, as well as providing insight into which projects have been awarded support. The processing is based on a legitimate societal interest in creating this transparency, and on potential applicants’ possibility of obtaining insight into and information about previous supported projects. The legal basis is Article 6(1)(f) of the GDPR. We also assess that the publication, in consideration of freedom of expression and information, is covered by section 3(1) of the Danish Data Protection Act.
• Including your data in an internal register of applications and supported projects to keep an overview of which projects the Foundation has supported. The Foundation’s legitimate interest is to be able to differentiate and administer grants, provide guidance to new and former applicants, as well as other administration. Our legal basis for the processing is Article 6(1)(b) of the GDPR, if we have entered into an agreement on a grant, or Article 6(1)(f).
• Evaluation of awarded support and declinations, use and disclosure of data for statistical, research and historical purposes, and for the pursuit of legitimate societal interests, including processing of information that may have been obtained from or combined with publicly available sources, for example from Statistics Denmark or from international publication databases, for these purposes. The Foundation has a legitimate interest in evaluating its grant-making activities and, as part of this, sending questionnaires or invitations to qualitative interviews, including processing the information collected thereby. The Foundation also has a legitimate interest in using data on the Foundation’s activities for the purposes stated. The legal basis for the processing is Article 6(1)(f) of the GDPR, and for information used for statistics and scientific studies section 10(1) of the Danish Data Protection Act, and for civil registration numbers section 11(2) no. 3 of the Danish Data Protection Act.

• Sending invitations to events and activities of professional relevance, for example network meetings or workshops with other grantees. For this purpose, we process your personal data, including your email address and name. The processing is based on our legitimate interest in strengthening and supporting grantees and supported projects, cf. Article 6(1)(f) of the GDPR.

• Publication of your name, title and professional background, as well as information about your project and the grant received on https://veluxfonden.dk/en and in posts on social media, for example Facebook, LinkedIn, Vimeo and X. The legal basis is a legitimate interest in creating awareness of the Foundation’s grant-making activities and attracting other qualified applicants, cf. Article 6(1)(f) of the GDPR.

• Use of AI systems as decision support in the application and case-handling process to structure and summarise application material, extract relevant information, and perform quality assurance and analysis of application data, cf. the Foundation’s AI Principles. The legal basis is Article 6(1)(f) of the GDPR.

• Testing, development, operation and improvement of internal processes and systems, including AI systems, with a view to strengthening quality, security and efficiency in the application-handling process. The legal basis is Article 6(1)(f) of the GDPR.

• Screening of information relating to applicants and beneficial owners against relevant EU sanctions lists and publicly available sources, including through the use of AI systems, to ensure that funds are not made available to sanctioned persons or entities. The processing is based on Article 6(1)(f) GDPR, as it is necessary for the purposes of the legitimate interests pursued by the data controller. The legitimate interest pursued is to ensure compliance with applicable sanctions rules and to avoid criminal liability under section 110c(3) of the Danish Criminal Code for breaches of the European sanction’s regime.

• Sending newsletters, which may include inspiration regarding other foundation funding that you may be able to apply for. For this purpose, we process your personal data, including your email address and name. The processing is based on our legitimate interest in receiving as many qualified applications for foundation funding as possible, cf. Article 6(1)(f) of the GDPR. You may unsubscribe from the newsletter at any time by writing to info@veluxfonden.dk.

• Processing of pictures and video recordings of you, as well as explanatory text, if you have consented to this, on https://veluxfonden.dk/en, on social media, for example Facebook, LinkedIn, Vimeo and X, and in the Foundation’s annual publication or other printed profile material, for the purpose of informing about the Foundation. The legal basis for the processing is your consent, cf. Article 6(1)(a) of the GDPR.

The Foundation also processes your personal data for the purpose of updating the information registered about you. This may be e.g. your title, telephone number or e-mail address. We kindly ask you to contact us if your information needs to be updated.

The Foundation does not as a starting point disclose your personal data to third parties. However, with reference to the purposes stated under section 4, personal data may be disclosed or entrusted to the following categories of recipients:

• IT suppliers, including providers of AI systems
• External assessors (peer reviewers), panel participants and members of working groups under the Foundation’s board of directors
• VILLUM FOUNDATION, if we assess that your application has a better chance of receiving support there, as well as for administrative purposes
• Other grantees in connection with participation in professional networks and similar activities, where participant lists are shared stating name, title, email address and/or place of employment
• The Danish tax authorities (SKAT), foundation authorities and other relevant authorities that are entitled to receive the personal data
• Public authorities and private organisations, including Statistics Denmark, when necessary, in order for the Foundation to pursue a legitimate interest, e.g. to carry out a task in the public interest
• Researchers, research institutions and similar for scientific or historical research purposes or statistical purposes
• Social media, for example Facebook, LinkedIn, Vimeo and X, including pictures and video recordings of you if we have received your consent
• Attorneys, auditors and other consultants engaged by the Foundation

If the recipients act as data processors, the Foundation has entered into a data processing agreement with them. Further, data on grantees will be made available to the public at https://veluxfonden.dk/en as described in section 4.

Disclosure will be in accordance with the data protection legislation.

The personal data you pass on to the Foundation will be stored as a minimum until a decision has been made on your application, and thereafter based on the following criteria:

If your project is awarded support, the Foundation will store your information as a minimum until the project has been completed, and thereafter for as long and to the extent that the Foundation has an legitimate basis for doing so. Your information, including name, gender, age, civil registration number, nationality, title, place of employment where relevant, address, telephone number, email address, researcher ID (ORCID) where relevant, CV where relevant, project title, your application and an assessment thereof, as well as any support agreement/grant letter, will form part of the Foundation’s internal register of applications and supported projects.

The basis for continued storage depends on the purposes stated under section 4, including the Foundation’s interest in ensuring differentiation of support, evaluation of projects and the effect of support, as well as for statistics, research and historical purposes. The Foundation will periodically review data to ensure that we do not store information that is not necessary for these purposes.

The Foundation will conduct periodic reviews to ensure that we do not store data that is not necessary for the purposes stated.

Information relevant for bookkeeping purposes will be stored for five years and in the current accounting period after the project has been completed.

If your application is granted, your name, project title, place of employment where relevant and participation in the project awarded support, as well as your picture if you have consented to its publication, will also be stored in the Foundation’s register of supported projects, which is publicly available at www.veluxfonden.dk. We assess that this publication may be based on section 10 of the Danish Marketing Practices Act. The information will therefore remain published on the Foundation’s website without time limitation.

If your project is not awarded support, your information will be included in the Foundation’s internal register of applications received, including your name, gender, age, civil registration number, nationality, title, place of employment where relevant, address, telephone number, email address, researcher ID (ORCID) where relevant, CV where relevant, project title, your application and an assessment thereof.

The Foundation will store your information for as long and to the extent that the Foundation has an legitimate basis for doing so, based on the purposes stated under section 4, including the Foundation’s possibility of providing the best possible guidance to applicants who have previously been declined, the Foundation’s interest in ensuring differentiation of support, evaluation of projects and the effect of support, and for statistics, research and historical purposes.

The Foundation will conduct periodic reviews to ensure that we do not store data that is not necessary for the purposes stated.

As a starting point, the personal data collected from applicants is processed within the EU. The Foundation may choose to transfer data to external assessors (peer reviewers), panel participants and members of working groups under the Foundation’s board in countries outside the EU/EEA, where the same level of legal protection of personal data as within the EU/EEA is not provided. In addition, transfers may take place to other third parties in countries outside the EU/EEA as mentioned under section 5, including IT suppliers and consultants.

If a transfer to a third country takes place, the Foundation will ensure an adequate legal basis, generally by way of the EU Commission’s standard contractual clauses or Article 49(1)(b) or (c) of the GDPR. You may receive a copy of the basis for any transfers by contacting the Foundation, see the contact details under section 2.

As part of the processing of your personal data, information is stored on servers located in the EU, but information stored in the cloud solution Salesforce may be stored via backup in the USA by Salesforce. The transfer to Salesforce is based on the European Commission’s standard contractual clauses and binding corporate rules. For more information, see Salesforce’s website.

If the Foundation shares information about grant activities on social media, for example Facebook, LinkedIn, Vimeo and X, data such as your name, title and professional background, as well as information about your project and grant received, will be transferred to the United States. The same applies to pictures and video recordings of you, if you have consented to the Foundation’s use of these on social media.

Transfers to so-called insecure third countries may take place on the basis of a number of different transfer mechanisms, whereby arrangements have been established to ensure the necessary protection of the rights of data subjects. By way of example, this may include the conclusion of the European Commission’s standard contractual clauses on data protection hereor the use of recipients subject to specific certification mechanisms, such as the EU-U.S. Data Privacy Framework in the case of transfers to the United States here.

The Foundation acts as a joint data controller with the aforementioned providers of social media services in relation to the personal data collected and processed through these media. This means, among other things, that you may exercise your rights under the General Data Protection Regulation and the Danish Data Protection Act in relation to both the Foundation and the aforementioned providers.

• Facebook: https://www.facebook.com/privacy/explanation 
• LinkedIn: https://www.linkedin.com/help/linkedin/answer/62533?trk=microsites-frontend_legal_privacy-policy&lang=da 

Vimeo: https://vimeo.com/privacy

If you wish to exercise the below rights, please contact us using the contact details stated at the top of the privacy notice.

• Right of access: You are entitled to obtain access to the personal data processed about you and various additional data. However, the right of access should not adversely affect the rights or freedoms of others.
• Right to rectification: You are entitled to have inaccurate personal data about you rectified.
• Right to erasure: In some cases, you are entitled to have personal data about you erased before deletion would otherwise take place under our normal retention periods.
• Right to restriction of processing: In certain situations, you are entitled to have the processing of your personal data restricted. If you are entitled to restricted processing, we may only process your personal data - except for storage - with your consent or for the purpose of establishing, exercising or defending a legal claim or to protect a person or important public interests.
• Right to transmit data (data portability): You are entitled to data portability if our processing of your personal data is based on your consent or a contract, and the processing has taken place automatically. This right implies that you are entitled to have your personal data forwarded in a structured, commonly used and machine-readable format which you are entitled to transfer to another controller.
• Right to object: If we base our processing on Article 6(1)(f) of the GDPR, you have in certain cases the right to object to our otherwise lawful processing of your personal data.
• Right to withdraw your consent: If our processing is based on your consent, you are entitled to withdraw your consent to our processing of your personal data wholly or partly at any time. The withdrawal of your consent will not affect the lawfulness of the processing made by us until you withdraw your consent. Withdrawal of your consent will thus only be valid from that point in time.

Your request will be processed in accordance with the data protection rules, and conditions or restrictions may apply. For more information on your rights, see the Danish Data Protection Agency’s guidelines describing the data subject’s rights at www.datatilsynet.dk. If you exercise either of the above rights, we will also process personal data about you in connection with the receipt of and response to the inquiry.

You may complain to the Danish Data Protection Agency at any time about the Foundation’s processing of your personal data. Contact details are available at www.datatilsynet.dk.

This privacy policy is updated on an ongoing basis and was most recently updated on 12 May 2026. The Foundation will notify material updates.