At EMD International A/S (“EMD”), data is at the heart of what we do. Our software, data services and consultancy help customers plan, build and operate energy projects, and our customers trust us with project, production and operational data that is often business-critical. This policy describes the principles we follow when we collect, use, store and share data, and how we use artificial intelligence responsibly.

EMD is owned by a non-profit Danish commercial foundation. We see responsible handling of data as part of our social responsibility and as a precondition for the long-term trust of our customers, partners and employees.

1. Scope
This policy applies to all data handled by EMD in connection with our software products (including windPRO, energyPRO, vectIO and related modules), data services and APIs, consultancy services, support and our website. It covers personal data as well as non-personal data, such as project, production, market and operational data.
How we process personal data, and your rights as a data subject, are described in our GDPR policy [link]. The legal terms for our products are set out in our General Terms and Conditions of Sale and General License Terms.

2. Our principles
•    Transparency. We are open about what data we collect, why we collect it and how it is used.
•    Purpose. We use data only for the purposes for which it was provided or that are described in our terms and policies [link to General Terms and Conditions of Sale and General License Terms].
•    Data minimisation. We aim to collect and retain only the data that is relevant and necessary for legitimate business and customer purposes, in accordance with applicable agreements, policies and legal requirements.
•    Customer rights and control. We respect our customers’ rights in relation to the data they provide to EMD and use customer data in accordance with our agreements, applicable terms and policies.
•    Security. We protect data against loss, misuse and unauthorised access.
•    Human responsibility. Our tools support human decisions. They do not replace professional judgement.
•    Accountability. We take responsibility for our handling of data and review our practices regularly.

3. The data we handle
•    Customer data: data that customers enter into or generate with our software and services, such as project, site, production, forecast, market and bid data.
•    Usage and technical data: for example license activation data, API calls, bug reports and support project exports, which we use to deliver, secure and support our products.
•    Data sets provided by EMD: for example mesoscale and climate data sets. Some are based on data from third-party providers, and we respect their license terms and attribution requirements.
•    Personal data: for example contact details of customers, users and website visitors, handled as described in our GDPR policy.

4. How we use customer data
•    We use customer data to deliver, support and maintain the products and services the customer has ordered.
•    Customers retain their rights to the data they provide. We do not sell customer data, and we do not make it available to third parties other than sub-suppliers who help us deliver our services and who are bound by confidentiality and, where relevant, data processing agreements.
•    We may use customer data in anonymised and aggregated form that does not identify the customer to maintain, develop and improve our software and services, as further described in our applicable terms.
•    We retain and delete customer data in accordance with applicable agreements, legal requirements and EMD’s data retention policies. Where applicable, customers are provided with appropriate options for accessing or exporting their data.

5. Artificial intelligence
Some of our products include, or may in future include, features based on artificial intelligence or machine learning. When we develop and use such features, we:
•    design them as decision support, so that the user remains responsible for decisions and can review and verify the output;
•    strive to provide appropriate transparency about AI-enabled functionality and relevant limitations;
•    use customer data in connection with AI only in accordance with applicable agreements, legal requirements and EMD’s policies for responsible AI use, and apply appropriate safeguards when AI systems process confidential, customer or personal data;
•    do not use identifiable customer data for general-purpose AI model training unless such use has been specifically agreed or is otherwise lawfully permitted ; and
•    follow applicable regulation, including the EU AI Act.

6. Sharing and third parties
We use carefully selected sub-suppliers, for example for hosting and payment. They may only process data on our instructions and for the agreed purpose. Data is primarily stored within the EU/EEA. If data is transferred outside the EU/EEA, we ensure an adequate level of protection in accordance with the GDPR.

7. Security
We protect data through appropriate technical and organisational security measures, including access controls, confidentiality requirements and processes for managing security incidents.

8. Our employees
All employees who handle data are expected to follow this policy. We promote awareness of data protection, information security and responsible data use among employees and provide relevant guidance and training. Employees can raise concerns about data handling with their manager or through our whistleblower scheme [link].

9. Governance and review
This policy is approved by the Executive Management of EMD International A/S. The policy is reviewed at least once a year and updated when our products, technologies or legal requirements change.

10. Contact
Questions about this policy or about how we handle data can be sent to Susan Bastrup, EMD International A/S, Niels Jernes Vej 10, 9220 Aalborg Ø, Denmark, swb@emd.dk.