Kolo DC and its group entities (“we”, “our”, or “us”) are committed to protecting your personal data and handling it with transparency and care. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal data when you interact with our websites, services, or premises. It also outlines your rights under the General Data Protection Regulation (GDPR) and applicable local laws.

1 Who We Are

This Privacy Policy applies to the Kolo DC Group, including the following entities:

• Fuzion A/S – Denmark
• EcoDataCenter AB – Sweden
• Serverius B.V. – Netherlands

Each entity acts as a data controller when processing your personal data in its respective country. Contact details are provided in the Local Annexes below.

2 What Data We Collect

Depending on how you interact with us, we may collect the following types of personal data:

• Contact information (e.g. name, email address, phone number)
• Identification data (e.g. passport or ID card, visitor badge number)
• Website usage data (e.g. IP address, browser type, cookies)
• CCTV footage
• Billing and financial data
• Recruitment-related data (e.g. CV, application forms)
• Communication records

3 Legal Bases for Processing

We process your personal data under the following legal bases:

• Consent (e.g. for marketing, cookies, or recruitment communication)
• Contractual necessity (e.g. to provide or manage services)
• Legal obligations (e.g. compliance with tax laws, KYC regulations)
• Legitimate interest (e.g. IT security, service improvement, facility safety)

4 How We Use Your Data

We use your data for purposes such as:

• Providing, managing and securing our data center services
• Responding to inquiries and maintaining customer relationships
• Managing recruitment and employment processes
• Complying with legal and regulatory requirements
• Hosting and analyzing website traffic
• Organizing or co-hosting events

5 Cookies and Tracking

We use cookies and similar technologies on our websites to enhance your browsing experience and collect analytics data. You can manage your cookie preferences via the cookie banner on our website. For details, see our Cookie Policy.

6 Data Sharing and International Transfers

We may share personal data with:

• Service providers (e.g. IT, payment, or security partners)
• Law enforcement or public authorities when required by law
• Group entities for internal administrative purposes
• Event partners (if you register for co-hosted events)

We do not sell your personal data. If data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards such as Standard Contractual Clauses (SCCs).

7 Data Retention

We retain your personal data only as long as necessary for the purpose it was collected, or to meet legal obligations. Retention periods are defined in each entity’s local annex.

8 Your Rights

Under GDPR, you have the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to object
• Right to data portability
• Right to withdraw consent (where applicable)

You can exercise your rights by contacting the relevant entity (see Local Annexes).

9 Security Measures

We implement appropriate technical and organizational measures to protect personal data from unauthorized access, alteration, disclosure, or destruction. These include encryption, access controls, staff training, and physical security.

10 Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. The latest version will always be available on our websites.

Local Annex: Denmark (Fuzion A/S)
Data Controller: Fuzion A/SNiels Bohrs Vej 35, 8660 Skanderborg, DenmarkEmail: info@fuzion.dkPhone: +45 70 40 40 80
Specific Retention Periods: Not specified in detail. Data is retained as long as necessary for the stated purpose and deleted thereafter.
Supervisory Authority: Datatilsynet – www.datatilsynet.dk

Local Annex: Sweden (EcoDataCenter AB)
Data Controller: EcoDataCenter AB
Box 45063, 104 30 Stockholm, Sweden
Email: dso@ecodatacenter.se
Phone:+46 10 145 00 99
Retention Periods:

• Marketing contacts: 36 months after last interaction
• CCTV footage: 90 days

Supervisory Authority: IMY – www.imy.se

Local Annex: Netherlands (Serverius B.V.)
Data Controller: Serverius B.V.
De Linge 26, 8253 PJ Dronten, Netherlands
Email: privacy@serverius.net
Retention Periods:

• Chatbot data: 30 days
• Camera footage: 30 days
• Visitor logs, access card forms: 6 months
• Client contact data: 5 years after contract ends
• Invoices: 7 years after contract ends
• KYC & UBO docs: 6 months post-contract
• Job candidates: 1 year

Supervisory Authority: Autoriteit Persoonsgegevens – www.autoriteitpersoonsgegevens.nl