Privacy notice

Who is responsible

Dansk Firmaidræt (CVR 29784515, Storebæltsvej 11, 5800 Nyborg, Denmark) is the data controller for Novo Step Challenge.

E-opinion ApS (IT Heroes) develops and runs the platform for Dansk Firmaidræt as its data processor.

Novo Nordisk handles its own internal communication about the campaign separately, outside this platform.

What we collect

• Your name, work email, language and time zone.
• The steps you enter per day, including steps converted from other exercise.
• Which team you are on, and the team's country and EVP area, set by the captain.
• The work email addresses of colleagues a captain invites.
• What is needed to run the service securely: a single-use sign-in link or code, a session cookie, your IP address for a short time to limit sign-in attempts, and a record of which emails were sent to you.

Why

So you can sign in, join a team, record your steps, see the standings and take part in the competitions and prize draws. The prize draws are made in the platform. Novo Nordisk sees only team names, not who is on the teams.

The legal basis is that the processing is necessary to deliver the campaign you signed up for yourself (GDPR Article 6(1)(b)).

What we never do

We do not assess your health, use tracking or analytics, use AI on your personal data, sell your data, or connect to HR systems.

Who sees what

Every participant

All your own data, including your steps per day. On your own team: the members' names, total steps, number of days entered, average per day and place in the campaign. On other teams: the team name, number of members, share of days entered and average per member. Never other participants' email addresses, other people's day-by-day steps, or a ranking of individuals outside your own team.

Team captains, in addition

The members' names and step totals (no email addresses), the email addresses the captain has invited, and the names of colleagues who ask to join. Colleagues a captain invites see the captain's name and the team name.

Novo Nordisk campaign administrators

The campaign settings, overall figures, the number of recipients when a campaign message is sent, and the team names in the competitions and the winning teams. No participant list, names, email addresses, individual steps or exports.

Dansk Firmaidræt support

For support only, with two-step sign-in: a participant's name, work email, team, language and time zone. Support can view a participant's own page read-only to solve a problem, and this is logged. No step data on the support screens, and no exports.

The data is stored by Hetzner in Germany. All emails from the platform are sent through Mailchimp Transactional (Mandrill) in the USA under the EU-US Data Privacy Framework, with open and click tracking switched off.

How long

All participant data is deleted 30 days after the campaign's last day. After that, only anonymous overall figures and the names of the winning teams remain. Backup copies and the email provider's logs are deleted within a further 30 days.

When a captain invites a colleague, the colleague's work email is kept on the invitation. If the invitation is not used, it is deleted about a week after it expires; it expires 30 days after the captain last sent it. If it is used, the address is deleted with everything else after the campaign.

Your rights

You can ask to see, correct or delete your data, to restrict its use, and to receive it so you can take it elsewhere (data portability).

The email address has not been published yet. Until then, you can write to Dansk Firmaidræt at the address under "Who is responsible".

You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).

Cookies

We use only the cookies needed to keep you signed in and to protect forms. No tracking cookies.

Your browser may also briefly remember where you were on a page, or a figure on its way to a day. It stays in that tab and is deleted once the next page has used it, or when the tab is closed.