Privacy Policy for Candidates – BIRD & LOCK ApS

1. Introduction

Here, you can read about how BIRD & LOCK ApS (hereinafter “we”, “us”, and “our”) collects, processes, and stores your personal data as part of our operations and the activities described in section 3 below.

Responsible handling of this personal data is crucial for our business goals and reputation. Therefore, this privacy policy outlines how and why we collect personal data about you, how the data is used, when it is deleted, and how you can, among other things, access your personal data.

2. Data Controller

BIRD & LOCK ApS is the data controller for the processing activities described in this privacy policy unless otherwise specified in sections 3 and 4 below.

If you have any questions regarding this privacy policy or our processing of your personal data as described in section 3 below, feel free to contact us here:

BIRD & LOCK ApS
CVR No.: 44 93 88 47
Havnegade 39, 5th Floor
1058 Copenhagen K

Phone: +45 53 63 08 75
Email: kontakt@birdandlock.com

3. How do we process personal data as part of our activities?

We collect and process personal data in various situations, and the purpose of collection, the use of the data, and when it is deleted can vary. Each activity where BIRD & LOCK ApS (as the data controller) collects personal data about you is described separately below.

3.1 When you register as a candidate in BIRD & LOCK’s candidate database
When you register as a candidate in our candidate database, we collect, store, and share certain personal data about you for use in our Executive Search activities. Your personal data will be used for the purposes described below.

3.1.1 What personal data is processed, and where does it come from?
You provide personal data to us when you complete your career profile in our candidate database, and you generally determine which personal data you provide. We also expect to collect the following personal data about you:

• Contact details, including name, email, phone number, and address
• Personal data contained in your CV, including a potential photo, current position, profession, employer, experience, skills, certifications, diplomas, and other documents you may have uploaded, as well as information on job performance, education, and training
• Results of personality and possibly skills tests you are asked to complete during a recruitment process, and notes from interviews
• References from previous employers that you have authorized us to contact
• Publicly available information e.g., from social media, including skills, achievements, hobbies, and image
• For certain high-trust positions (e.g., CFO), we may collect information from third parties about your financial standing, political exposure, trusted professions, etc.
• For an extended second interview in a specific process, we may ask you to provide a criminal record
• Any health-related data relevant to the job or that may impact your work and is important for us or your prospective employer to know
• Other personal data you provide during a recruitment process

3.1.2 Why is personal data processed?
We process your personal data for the following purposes:

• To register and store you as a candidate in our candidate database for a recruitment purposes
• To evaluate whether you are the right candidate for one or more of our recruiting clients

3.1.3 What is the legal basis for the processing?
Our processing of general personal data and sensitive personal data is based on the following legal grounds:

• Consent: When you register as a candidate in our candidate database, you also consent to us processing the entered information, including consent for conducting personality and skills tests and processing any personal data collected during interviews. We also obtain your consent to contact references from previous/current employers, educational institutions, and other relevant parties as part of a recruitment process. For high-trust positions (e.g., CFO), we may collect information from third parties about your financial standing, political exposure, etc., from publicly available sources, personal knowledge, and networks. This legal basis is found in Articles 6 and 9 of the General Data Protection Regulation (GDPR). You can withdraw your consent at any time by contacting us (see section 2 above).

Our processing of data related to criminal offenses is based on the following legal grounds:

• Consent: We request your consent and collect your criminal record if it becomes relevant to the position in question. This legal basis is found in §8, section 3 of the Danish Data Protection Act. You can withdraw your consent at any time by contacting us (see section 2 above).

3.1.4 Who is the data shared with?
For the purposes mentioned above, we may need to share your personal data with clients and possibly third parties, such as IT providers, recruitment agencies, and other subcontractors. Our subcontractors only process your personal data under our direct instructions and in accordance with a data processing agreement. Our subcontractors do not process personal data for their own purposes, only as data processors.

3.1.5 How long is personal data stored?
Your personal data is stored and deleted one year after registration in our candidate database, unless you consent to us storing your data for an additional year.

If we have asked you to provide your criminal record, it will be deleted immediately after we conclude the specific recruitment process.

4. Disclosure of personal data

In certain situations, we may need to disclose your personal data to third parties beyond recruiting clients and subcontractors (see section 3.1.4). Under special circumstances and in accordance with the law, it may be necessary to disclose your personal data to the following recipients:

• Lawyers and auditors
• Courts and other public authorities
• Potential buyers of the company

If our corporate structure changes, for example, through a partial or full sale of BIRD & LOCK ApS, your personal data may be disclosed based on our legitimate interest in transferring parts of our assets and making commercial changes (GDPR Article 6).

For transfers of personal data to recipients outside the EU/EEA ("third country transfers"), the transfer is based on EU Commission standard contractual clauses or relevant adequacy decisions by the EU Commission (GDPR Chapter 5).

5. Your Rights

You have the following rights under the data protection laws:

• Access: You have the right to request access to and a copy of the personal data we process about you, as well as additional information.
• Objection: You have the right to object to our collection and further processing of your personal data.
• Rectification: You have the right to have inaccurate data about you corrected.
• Deletion: In certain cases, you have the right to have your personal data deleted before our general deletion timeframe occurs.
• Restriction: In some cases, you have the right to restrict the processing of your personal data. If you are entitled to restriction, we may only process your data (aside from storage) with your consent or for the establishment, exercise, or defense of legal claims, to protect a person, or for important public interests.
• Data Portability: In some cases, you have the right to receive a copy of the personal data you have provided in a structured, commonly used, and machine-readable format.

If you wish to exercise your rights, please contact us at kontakt@birdandlock.com. Your request will be handled in accordance with applicable law. If necessary, we will contact you for additional information needed to properly address your request.

For more information about your rights, you can visit www.datatilsynet.dk.

6. How to File a Complaint

If you wish to complain about our processing of your personal data, we would like to hear from you. You can find our contact information in section 2 above.

You also have the right to file a complaint with the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby on their website www.datatilsynet.dk.

7. Updates to the Privacy Policy

We may update this privacy policy as needed to reflect changes in our processing of personal data.

If significant changes occur in how we process personal data that we already have about you, you will be notified of the update, either directly or through a notice on our website.

This privacy policy was last updated in October 2024.