All companies in the VELUX Group respect and protect your privacy. This VELUX Group Privacy Notice (‘Privacy Notice’) is meant to help you understand why we collect personal data about you, the types of personal data we collect, how we collect it and for how long we keep it, with whom we share it, as well as your rights. We also explain how we keep your data secure.
This VELUX Privacy Notice complies with the Data Protection Act 2018 and the UK General Data Protection Regulation (Regulation (EU) 2016/679) (“UK GDPR”).
Our parent company is VELUX A/S registered in Denmark under registration number 30003519 with its registered office at Aadalsvej 99, 2970 Hoersholm, Denmark.
The main reason we collect, use, and store your data is to allow us to provide our services to you. “Service”, “our service” and similar descriptions mean conducting business with you/your organisation and assisting you with inquiries, sales processes, and claims.
We also process information about your use of the services for business development purposes, to inform you of our business operations, products, and services through marketing, and to improve our services through any feedback you give us. We may also process your personal data for contractual and recruitment purposes and to comply with legal obligations.
We process personal data based on different legal bases as listed below.
Performance of a contract, including a purchase – Article 6(1)(b) of the UK GDPRThe following are the main types of personal data collected by VELUX, along with the main purpose and legal basis for collecting the personal data:
Activity | Types of personal data we collect (for illustration purposes) |
Purpose(s) | Legal basis |
---|---|---|---|
General business operations | Name, contact details, and other information necessary for conducting business with you or your organisation. | As part of general VELUX business operations, we collect personal data about individuals, customers, suppliers (including third-party service providers), and other stakeholders. We may also use your data for testing systems. | Based on general business operations being a legitimate interest and necessary in ensuring business handling throughout VELUX, within what is reasonably expected by you, cf. Article 6(1)(f) of the UK GDPR. |
Assisting with enquiries | Name, email address, phone numbers, conversations, other contact details, photos, floor plans of your house when you provide this to VELUX. | You may choose to provide us with personal data when contacting us by phone, email, post, chatbot, or digital platforms. This enables us to respond to requests, arrange services, or present claims under the VELUX guarantee. | Based on our assistance with enquiries being a legitimate interest and necessary in ensuring communication, cf. Article 6(1)(f) of the UK GDPR. |
Sales (including web sales) and order fulfilment | Name, contact details, payment and credit card details, credit information, and credit check. | We collect personal data to conduct business, process orders, fulfill deliveries, and handle customer service inquiries. | Necessary for the performance of a contract to which you or your organisation is a party, cf. Article 6(1)(b) of the UK GDPR. |
Campaigns | Name, contact details, etc. | Execution of various campaigns (e.g., reward programs, cashback campaigns, sweepstakes). Acceptance of terms and conditions is collected before entry. | Necessary for the performance of a contract to which you or your organisation is a party, cf. Article 6(1)(b) of the UK GDPR. |
Product claims | Name, contact details, etc. | Facilitate service of VELUX products under the VELUX guarantee or by paid service, i.e., we solve claims by call, email, and visits to building sites. In this connection, we may share your personal data with VELUX partners to assist you with a service. | GDPR – Article 6(1)(b) GDPR – Article 6(1)(f) Necessary for the performance of a contract to which you or your organisation is a party, cf. Article 6(1)(b) of the UK GDPR. |
Directly from you
In most cases, personal data is collected directly from you or generated as part of the use of our services, products, and channels. We collect personal data you provide to us, when you request products, services, or information from us, register with us, participate in public forums, use a chatbot or other activities on our digital platforms and apps, respond to customer surveys, or otherwise interact with us. We collect information through various technologies, e.g., cookies. For cookies, we refer to our website.
From our business partners
In some cases, we can collect your personal data from our business partners, when they need our assistance to provide you with the best possible service.
From your public website
In some cases, we collect your personal data on your company websites, when we want to offer you our services.
Links to other websites
This website contains links to other websites (such as Facebook, Google+, YouTube, and Pinterest) to which this this Privacy Notice does not apply. Please note that we do not endorse other websites and their content. We encourage you to read the privacy policies of each website you visit.
Automated decisions
VELUX uses automated decision-making in processing your personal data for some services and products. An example is our fraud prevention and detection efforts on our online platforms.
You may request that VELUX provides information about the decision-making methodology and ask us to verify that the automated decision has been made correctly.
We may reject the request, as permitted by applicable law, including when providing the information would result in a disclosure of a trade secret or would interfere with the prevention or detection of fraud or other crime. However, generally in these circumstances we will verify that the algorithm and source data are functioning as anticipated without error or bias.
We will only keep your personal data for as long as it is necessary for the purposes described in this Privacy Notice. This means that the retention periods will vary according to the type of the information and the reason that we have the information.
Examples of retention time:
We will also retain your personal data where this is advisable to safeguard or improve our legal position (for instance in relation to statutes of limitations, security, litigation, or regulatory investigations).
We share your personal information within the Altaterra Kft., but only if it is necessary to fulfil the purpose for which we are processing your personal data.
We may also share your personal data with selected third parties, including but not limited to:
When we cooperate with external service providers, we enter into a data processing agreement, if relevant. These service providers are prohibited from using your personal data for purposes other than those requested by us or required by law.
As a global organisation with offices and operations throughout the world, we will transfer personal data collected by us on an aggregated or individual level to various divisions, subsidiaries, joint ventures and affiliated companies of the VELUX Group around the world located inside or outside the EEA for the purposes stated above and in accordance with applicable laws, as well as to sub-contractors to VELUX (data processors) for storage and service purposes. Your personal data will not be disclosed to anyone outside the VELUX Group unless permitted or required under applicable legislation and where necessary subject to appropriate written assurances from third parties who have access to your personal data, in which they must guarantee that they will protect the data with security measures designed to provide an adequate level of protection.
Unless you are otherwise notified, any transfers of your personal data from within the EEA to third parties outside the EEA will be based on an adequacy decision or are governed by the EU-Commission Standard Contractual Clauses and/or Binding Corporate Rules. Any other, non-EEA originating, international transfers of your personal data, will take place in accordance with the appropriate international data transfer mechanisms and safeguards.
You can always request a copy of the transfer agreements, which includes the transfer of personal data, by sending an e-mail to privacy@velux.com.
The security, integrity, and confidentiality of your personal data is important to us. We have implemented technical, administrative, and physical security measures that are designed to protect your personal data from unauthorised access, disclosure, use, and modification. From time to time, we review our security procedures to consider appropriate recent technologies and methods. Please be aware that despite our best efforts, no security measures are perfect or impenetrable.
The Data Protection Act 2018 and the UK General Data Protection Regulation (Regulation (EU) 2016/679) (“UK GDPR") provides you, as the data subject, with the following rights in respect of the personal data we store about you:
Your rights | Legal basis | Elaboration |
---|---|---|
Withdraw your consent | GDPR – article 7 (3) | You have the right to withdraw your consent at any time by opting out of the e-mail or by contacting us. This will not affect our right to process personal data obtained prior to the withdrawal of your consent, or our right to continue parts of the processing based on other legal bases than your consent. |
Access to your data | UK GDPR article 15 | You have the right to request information about whether VELUX processes personal data relating to you, and if so, you have the right to request a copy of the personal data we have processed. There are some exemptions, which means you may not always receive all the data we process. |
Request rectification | UK GDPR article 16 | At any time, you have the right to request correction of any incorrect or incomplete personal data we may process on you. |
Request erasure | UK GDPR article 17 | You have the right to request deletion of your personal data depending on the processing activity, and under certain circumstances, before we would normally be obligated to cease processing. |
Request restriction of processing | UK GDPR article 18 | You have the right to request the restriction of processing which means that you can request that VELUX restricts the use of your personal data in certain limited circumstances. |
Withdraw your consent | UK GDPR article 7(3) | You have the right to withdraw your consent at any time by opting out in the e-mail or by contacting us. However, this will not affect our right to process personal data obtained prior to the withdrawal of your consent, or our right to continue parts of the processing based on other legal bases than your consent. |
Data portability | UK GDPR article 20 | Under certain conditions, you have the right to receive the personal data you provided to us in a machine-readable format where the processing is based on your consent or a contractual fulfilment. |
Right to object | UK GDPR article 21 | If you are not satisfied with how we process personal data in VELUX, you can send your objections to privacy@velux.com. However, it only applies in certain circumstances, and we may not need to stop the processing of your personal data if we can give legitimate reasons to continue using your personal data. If a complaint is made, the name and contact details of the complainant must be provided to VELUX. |
If you have any questions regarding the specific personal data we process or retain about you, or if you want to exercise your rights, please contact privacy@velux.com.
We will respond to your request to exercise any of your rights within one month, but we have the right to extend this period by two months. If we extend the response period, we will inform you within one month of your request.
If you consider that we have failed to resolve the complaint satisfactorily, you may file a complaint to the Information Commissioner's Office. You can find the contact details of the Information Commissioner's Office on their website.
From time to time, we may change this Privacy Notice to accommodate the latest technologies, industry practices, regulatory requirements, or for other purposes. At all times, we will post the most recent version on our digital platforms. We advise you to read the Privacy Notice regularly.
This Privacy Notice was last updated: 08/01/2025.