This policy describes how Bomae ApS collects and processes personal data about you when you use our website, create an account, build a home dream or are a customer of ours. It applies to current and former customers as well as visitors who are not customers yet.
This is a translation. Our services are provided under Danish law, and the Danish version of this policy is the authoritative one.
Data controller
The data controller for the processing of your personal data is:
- Bomae ApS
- Nygårdsvej 5a, 2100 København Ø
- Company reg. (CVR) no. 38029940
- Email: [email protected]
- Phone: +45 72 600 400
If you have questions about how we process your personal data, you can contact Tomas Maltha Krogh at [email protected]. Please note that ordinary email is not a secure channel — do not send CPR numbers, copies of your passport or other confidential information by unencrypted email. We will point you to a secure channel where one is needed.
What personal data we process
When you are a customer
To advise you on buying a home, on mortgage credit and on the legal side of the transaction, we process:
- Identification details — name, address, phone number and email
- Your CPR number and a copy of your passport or driving licence, where we are required to verify your identity under the Danish Anti-Money Laundering Act (hvidvaskloven)
- Financial information — income, debt, disposable income, budget, account details and information retrieved from eSkat with your consent
- Information about your household — marital status, cohabitation, co-buyer and number of children, to the extent it affects your finances or your housing needs
- Information about your current home and the home you are looking for
- Purchase and payment history with Bomae
- Correspondence and notes from advisory meetings, and documents in your case
When you create an account or use Boligdrømme
You can use Boligdrømme without creating an account. If you do, your dream is stored solely in your own browser, tied to a random id — we cannot identify you from it. If you create an account, the dream is linked to your user, and we process:
- Name, email address and phone number
- Login details — your password is stored only as a cryptographic hash, never in plain text. If you sign in with Google or Apple, we receive your email address and name from them, but never your password
- Your home dream — free text, chosen areas, home preferences and saved favourites
- The financial information you enter yourself about household, income and disposable income, and any valuation of your current home
- Your meeting bookings, and your status in the buying process if you have become a customer
- Whether you have signed up for home alerts by email, and which homes you have been shown
When you simply visit the website
We process technical information about your visit — including IP address, browser type, device, referring page and your behaviour on the site — via cookies and similar technologies. This happens only to the extent you have consented. Read more in our cookie policy.
If you fill in the contact or booking form, we process the information you provide — typically name, email, phone number, your situation and your preferred meeting time. If you have found a specific home, you may voluntarily give the address or a link to the listing so the advisor can prepare before the meeting.
Purposes and legal basis
We process your personal data for the following purposes and on the following legal bases:
- To provide the advice you have ordered and administer the customer relationship — necessary to perform our contract with you, cf. Article 6(1)(b) of the GDPR
- To create and operate your account, store your home dream and show you relevant homes — performance of a contract, cf. Article 6(1)(b)
- To meet our obligations as a mortgage credit intermediary and under the Danish Anti-Money Laundering Act and the Bookkeeping Act — legal obligation, cf. Article 6(1)(c)
- To retrieve information about your finances from eSkat — your consent, cf. Article 6(1)(a), which you may withdraw at any time
- To send you home alerts and news by email — your consent, cf. Article 6(1)(a), which you may withdraw at any time
- To improve our website and measure the effect of our marketing — your consent to cookies, cf. Article 6(1)(a)
- To measure which ads lead to a booking (so-called enhanced conversions) — when you book a meeting and have accepted marketing cookies, Google converts your email address and phone number into an irreversible code in your browser before they are sent. Google never receives the information in readable form and may only use the code to recognise that the booking came from an ad. The basis is your consent to cookies, cf. Article 6(1)(a), which you may withdraw at any time
- To establish, exercise or defend legal claims — our legitimate interest in being able to document the advice we have given, cf. Article 6(1)(f)
Where the information comes from
Most information comes directly from you. In addition — with your consent, or where the law requires it — we obtain information from eSkat, from publicly available registers and property data, from estate agents and the seller's advisors in your specific transaction, and from banks and mortgage credit institutions when obtaining loan offers.
Who we share information with
We disclose your personal data only where it is necessary to deliver the advice, or where we are required to. Recipients may be:
- Banks and mortgage credit institutions — when obtaining and comparing loan offers and when drawing down a loan
- The seller's estate agent and the seller's advisors in your specific transaction
- The Danish Land Registration Court, in connection with the deed and registration
- Public authorities where we are required to — including the Danish State Prosecutor for Serious Economic and International Crime under the Anti-Money Laundering Act
- Our data processors, all of whom are covered by a data processing agreement
We never sell your personal data, and we do not pass it on to third parties for their own marketing.
Data processors
We use the following categories of data processors to run the website and our systems:
- Hosting and operation of the website, customer system and database
- Mailgun — sending service messages, login links and home alerts
- Cookiebot — obtaining and documenting your cookie consent
- Google — Google Tag Manager and the measurement tools configured within it, plus sign-in with Google and address lookup
- Apple — sign-in with Apple
- Trustpilot — showing reviews on the website
- OpenRouteService and OpenStreetMap — calculating travel time and showing maps in Boligdrømme
Transfers to third countries
Our customer data is stored within the EU/EEA. A few of the services we use on the website — including Google, Apple and Trustpilot — are established in, or transfer information to, the USA. Such transfers take place on the basis of the European Commission's adequacy decision (the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses. You can obtain a copy of the transfer basis by contacting us.
How long we keep the information
- Customer information and case documents are kept for 10 years plus the current year after the customer relationship ends. The period follows the limitation rules and the documentation requirements for financial advice
- Identification and know-your-customer information collected under the Anti-Money Laundering Act is kept for 10 years after the customer relationship ends
- Enquiries via the contact form that do not lead to a customer relationship are deleted after 120 days
- Your account and your home dream are kept for as long as the account is active. If you delete your dream or your account, we remove the information unless we are required to keep it under the above
- Cookies and the information they collect are stored for the period stated in our cookie policy
Security
We have put appropriate technical and organisational security measures in place against your information being accidentally or unlawfully deleted, published, misused or otherwise processed contrary to the law. All traffic to and from the website is encrypted, passwords are stored solely as cryptographic hashes, and access to customer data is limited to the employees who need it.
Cookies
We use cookies and similar technologies on the website. You give or refuse consent in the cookie banner, and you can change your choice at any time. See which cookies we use, and what they do, in our cookie policy.
Your rights
Under the GDPR you have the following rights:
- Right of access — you can find out what information we process about you, and get a copy of it
- Right to rectification — you can have inaccurate information about you corrected
- Right to erasure — in certain cases you can have information about you deleted before our ordinary deletion date
- Right to restriction of processing — in certain cases you can have the processing of your information restricted
- Right to data portability — in certain cases you can receive your information in a structured, commonly used and machine-readable format
- Right to object — you can object to otherwise lawful processing of your information, including to direct marketing
- Right to withdraw consent — where processing rests on your consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before the withdrawal
To exercise your rights, write to [email protected]. We reply as quickly as we can and no later than one month after receiving your request. Conditions or limitations may apply to the rights — for example, we cannot delete information we are required to keep under the Anti-Money Laundering Act.
Right of withdrawal
If you buy advice from us as a consumer without having met us in person, you have a 14-day right of withdrawal under the Danish Consumer Contracts Act. If you want us to start work before that period expires, you must tell us — and you lose your right of withdrawal once the service has been fully delivered.
Preventing money laundering and terrorist financing
As a mortgage credit intermediary we are covered by the Danish Anti-Money Laundering Act. We are therefore required to obtain and retain identification for you — name, address and CPR or CVR number, plus documentation of beneficial owners if you act on behalf of a company. Where money laundering or terrorist financing is suspected, we are required to notify the State Prosecutor for Serious Economic and International Crime immediately, and we may not tell you that a notification has been made. Bomae ApS does not accept cash payments.
How to complain
If you are unhappy with the way we process your personal data, we would very much like to hear from you first so we can try to put it right. You also always have the right to complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby — see datatilsynet.dk.
Complaints about the advice itself are handled under the guidance you will find at our permissions.
Changes to this policy
We update this policy when our processing of personal data changes. The version in force is always on this page, and the version number at the top shows when it was last changed.