1. Introduction

The purpose of this Data Protection Policy is to inform our stakeholders (i.e. customers, candidates, users of our website, employees and consultants as well as suppliers and partners etc.) about how we handle their data. A-LEAF is committed to protecting the confidentiality, integrity and availability of our stakeholders’ personal information, especially regarding our recruitment process.

In A-LEAF, we give high priority to personal data security, and therefore we work continuously to ensure compliance with relevant legislation, including the rules in the Data Protection Regulation (GDPR) and the Danish Data Protection Act. It is crucial for A-LEAF that our stakeholders can feel secure in the processing of their personal data, which we obtain in connection with our daily operation of the company.

Our collection and processing of personal data is carried out in accordance with the current data protection legislation at any given time, and A-LEAF only processes personal data for which we have a legal basis and as described in this data protection policy.

2. Data Controller

Please do contact us if you have any questions about our processing of your personal data:

A-LEAF ApS

CVR: 35 52 00 23

Østergade 9

8370 Hadsten

Denmark

Att. Head of Legal, Lene Beck Sommer

lbs@a-leaf.dk

+45 21 54 54 20

We aim to guide and assist our stakeholders in answering questions about the processing of personal data. In addition, we continuously monitor our compliance with our Data Protection Policy as well as the data protection legislation in general.

3. Processing of personal data

As part of our daily work, we process a number of personal data about our stakeholders. In this section you can read more about the different processes.

3a. Website visit – use of cookies

When visiting our website, we collect and register personal information for the purpose of being able to provide a given service on our website. In addition, we collect personal information for use in targeted marketing, if you have agreed to this, and compile statistics which can be used to improve the structure of our website. For this purpose, we collect information about the type of browser used and your IP address. This type of information on the website is collected through the use of cookies.

You can read more about our use of cookies, including how long time we store your personal information in our cookie policy, which is available here: Cookie Policy

Legal: we process this personal data in order to optimize the structure of our website on the basis of user behavior, cf. Article 6 (1) (f) of the Data Protection Regulation or on the basis of your prior consent, cf. Article 6 (1) (a) of the Data Protection Regulation.

3b. Inquiries to us, newsletters and other brochure material

By contacting us by email through our website or via social media, we collect and process the information that appears in the inquiry. If you have consented to this, we collect and register personal information about you in order to be able to respond to your inquiry by sending our newsletters or other brochure material.

We only process the personal information that you submit or give your consent to, for example your name, telephone number, e-mail address, company and job title.

Legal: our processing of your personal data regarding the response to your inquiry is based on our legitimate interest in accordance with Article 6 (1) (f) of the Data Protection Regulation. We store your personal data for as long as our business purposes dictate to us. We do not process your personal information for purposes other than processing your inquiry.

The processing of personal data as part of the distribution of our newsletters or other brochure material takes place on the basis of your consent in accordance with Article 6 (1) (a) of the Data Protection Regulation. We store your personal data as long as you are subscribed to our newsletter or as long as necessary to submit our brochure material, including any follow-up. We do not process your personal information for purposes other than this.

3c. Customers

As a customer with us, we process your personal data for the purpose of being able to handle the cooperation with you, in the form of establishing customer relationships, delivery of the desired specialist competencies, sending invoices as well as administration and development of our business and services, handling operations and making statistical reports.

We only process ordinary personal information, including information such as your name, company, address, telephone number, e-mail address and any bank account information in connection with the payment of our invoices.

If you inform us, we will also process personal information on a contact person (for example a Project Manager) who has been added to the individual invoice to ensure correct arrival and payment on time. In this connection, we process name, possibly title, Purchase Order number, CVR/VAT number, email address and telephone number.

Our processing of personal data is necessary in order to fulfilling the agreement with you as a customer, including the measures that precedes it in accordance with Article 6 (1) (b) of the Data Protection Regulation. In addition, the processing is necessary for us to pursue a legitimate interest in being able to handle the customer relationship, manage this and develop our business, cf. Article 6 (1) (f) of the Data Protection Regulation.

We store your personal information for as long as we have a business purpose for the processing. When concluding agreements, we store relevant personal information, especially in relation to the 5-year archiving rule according to the Danish Accounting Act.

3d. Suppliers and Business Partners

As a supplier or business partner to us, we process personal data for the purpose of being able to administer our business, including the establishment of business relationships, handle contract management and to receive and deliver goods and services. We only process general personal information, including your name, company, CVR/VAT number, e-mail addresses, title and telephone numbers of contacts employed by the supplier or business partner in question.

The processing of personal data is necessary in order to fulfill the agreement with the supplier and the business partner, including the measures that precede it, cf. Article 6 (1) (b) of the Data Protection Regulation, or necessary for us to pursue our legitimate interest in being able to administer the relationship of cooperation within the meaning of Article 6 (1) (f) of the Data Protection Regulation.

We store your personal information for as long as we have a business purpose for the processing. When concluding agreements, we store relevant personal information in accordance with the 5-year archiving rule according to the Danish Accounting Act.

3e. Candidates, external Consultants or/and Employees

As part of the development of our business, we process personal data for the purpose of being able to recruit, both for our customers and internally in A-LEAF. To be considered for a current and potential future position with us, you must register in our HR system “”Talentech Recruiter” which is accessed via our website.

We process the information about you, including any information about references etc. that you upload to us via our HR system. We recommend that you register the following information for use in the recruitment process: your name, place of residence, telephone number and e-mail address, together with your updated CV, references, certificates and other relevant educational documents as well as a recent photo. We reserve the right to collect personal information via publicly available media, such as Facebook® and LinkedIn® in order to assess whether you fit the customer’s or our internal corporate culture and work environment.

Please do avoid submitting documents containing sensitive information such as CPR/Social Security Number, criminal record, biometric data as well as private health information or other categories of sensitive personal information, unless you deem it necessary for us to assess you in relation to an employment.

If you are invited to a personal (or on-line) interview, we may also process personal information in connection with personality tests as well as any references, but after your specific consent.

Legal: the processing of personal data for the purpose of recruitment takes place on the basis of your prior consent, cf. Article 6 (1) letter a or Article 9 (2) letter a of the Data Protection Regulation, cf. Article 9 (1) of the Data Protection Act. 2, letter b, cf. the Data Protection Act § 12, para. 1, or so that we can pursue our legitimate interest in filling the position with the right candidate or to keep the information for future recruitment, cf. Article 6 (1) (f) of the Data Protection Regulation.

If you are not offered a position with A-LEAF or our customer, we will automatically delete the information after no later than 6 months, unless you have given consent for us to store the information for a longer period of time, due to the possibility of filling future positions or if special circumstances require longer storage.

4. Disclosure of information

Under certain circumstances, A-LEAF will pass on your personal information to customers and public authorities. However, the transfer will only take place to the extent that it is necessary to be able to perform the service that you request, e.g. in connection with the recruitment of a specialist for our customer.

In addition, we will disclose your personal information if we are required to disclose your personal information as a result of a judgment, other legal obligation, lawsuit or otherwise required by law, or if we believe it is necessary to prevent illegal activity or violation of our policies. For the above purposes, the transfer of information can also take place internally in A-LEAF.

If we pass on personal data to external data processors, such as external consultants, software vendors and the like, we comply to written data processor agreements in advance, which ensures that personal data is treated confidentially, only for the above purposes and in accordance with applicable rules and legislation.

5. Safety

A-LEAF has implemented technical and organizational security measures aimed at protecting all the information we process against unauthorized or illegal processing and against accidental loss, destruction or damage. We conduct regular internal follow-ups to ensure adequate treatment security and compliance with policies and guidelines.

5a. Your rights

When we process personal information about you, you have the following rights:

• You can request access to and an electronic copy of the personal data that we process about you
• You may update or change the contact information you have provided to us at any time
• You may – in certain cases – object to our processing of your personal data or request that we delete all or part of the personal data, we hold about you
• For certain personal information, you can have this transferred to yourself or to another data controller in a structured and ordinary way and in a machine-readable format
• You have the right not to be the subject of a decision based solely on automatic processing
• You have the right to request that any incorrect information about you is corrected

When we process personal data based on your consent, you have the right to withdraw your consent at any time. To revoke consent to our processing of personal data, please contact us. The revocation of the consent does not affect the lawfulness of the processing that we have carried out prior to your revocation.

6. Recruitment Process

When you apply for a project through A-LEAF, you must be aware that we – as the data controller – register, collect and process information about you. The following describes how we process your CV and what information we collect, including what practices we generally follow during recruitment.

6a. Your CV

 As part of our recruitment process, we receive and process the information you have provided as part of your profile in our online recruitment portal ”Talentech Recruiter”, as well as the information you have provided in your CV and any other appendices. When we receive your CV, you will receive a confirmation via email.

Then we review the current CVs and select who we want a further dialogue with. This choice is based on professional qualifications and personal competencies in relation to the current position and customer, and we will either call or email you about this if we want to continue the dialogue with you.

Legal: the processing basis for the information you have provided through the recruitment portal is the consent you provided in connection with the creation of your applicant profile and your CV. The legal basis is Article 6 (1) (a) of the Data Protection Regulation (Regulation (EU) 2016/679 of 27 April 2016).

6b. Additional Information

Ee will often seek additional information on which candidate we believe is best qualified. In this connection, we may ask you to send us more information about yourself. The information we collect in this connection will – unless we specifically inform you otherwise – include the following categories: information about work experience at previous workplaces, including information related to work tasks, competencies and performance, as well as information about personal behavior and collaboration skills, in the extent we deem this information relevant to assess your candidacy.

We may also seek relevant information available from the internet, including social media. If we search for information about you on the internet, the basis for processing is that we consider that the acquisition follows a legitimate interest, cf. Article 6 (1) (f) of the Data Protection Regulation, as the purpose is to assess whether you are the right candidate for the position, including whether there may be relevant information about your professional and social activities that is relevant to our overall assessment of you as a relevant candidate.

6.c References

If we would like to seek further information about you from your current or former employer via references, we ask you for a written consent. If you do not give us this consent, we will not collect reference information. However, you should be aware that if you do not agree that we can obtain reference information, it may mean that you are not eligible for the current position. The processing basis for the information we collect from your current or former employer is the consent you give for use in the reference collection.

Legal: the legal basis is Article 6 (1) (a) of the Data Protection Regulation.

6.d Interviews

During the recruitment process, we conduct interviews where the focus is on both on your professional and personal competencies, the project’s challenges and the customer’s organization and culture. These interviews take place either in person or online.

We note some of the information that appears under the dialogue. Only the information that is relevant, when assessing whether you should be offered a project position, is collected.

The processing basis for the information you provide during the interview (s) is either your consent or that we assess that the processing follows a legitimate interest, as the purpose is to assess whether you are the right candidate for the position you have applied for. Legal: the legal basis is Article 6 (1) (a) and 6 (1) (f) of the Data Protection Regulation.

6.e Cognitive tests and personality analyses

For some specific positions, we use personality analyzes and cognitive tests in our recruitment process. However, this requires that you give specific consent hereto. The consent is given in connection with you carrying out the test/analysis. If you do not give consent, be aware that this may mean that your candidacy will be rejected.

Such tests/analyses will never stand alone, but form part of the overall basis for selecting the right candidate for the given position. You will always be offered feedback on tests/analyses at A-LEAF or our partners. The processing basis for the information that we note and store in connection with your tests/analyses is the consent you give to this. Legal: the legal basis is Article 6 (1) (a) of the Data Protection Regulation.

6.f Criminal record
In connection with the recruitment process, we sometimes ask for criminal records. If we consider that it will be relevant to obtain a criminal record in relation to the actual project you are applying for, we will ask you to obtain such a certificate from the police and show us a copy of it. We do not store your criminal record digitally.

Whether a criminal record is obtained depends, among other things, on the position in question, including the responsibilities and powers that the position entails. The processing basis for our processing is the consent that you give in connection with you submitting the certificate to us.

Legal: the legal basis for our collection of the criminal record from you is the Data Protection Act, section 8, subsection. 3.

6.g Health information

In connection with your project or employment, you have a duty to inform A-LEAF and our customer about any illness that will have a significant impact on your ability to work in the position in question. In very special cases, we may ask you for more information about your health. It may be relevant in those situations where an illness will have a significant impact on your ability to handle the position.

If health information is specifically deemed necessary, we will indicate which diseases or symptoms of diseases information is requested. Of course, we respect the framework and restrictions set by the Health Information Act in this connection. The processing basis for obtaining and storing information about your health is the consent you have given before the collection.

Legal: the legal basis is Article 9 (2) (a) of the Data Protection Regulation and the Danish Health Information Act.

6.h The further course

The candidates who have been to an interview will receive an answer by telephone. Once the position is occupied, the other candidates will receive a rejection, either by telephone or by email. If you end up being employed by us or our customer, the information we have received and processed in connection with our recruitment process will be stored in your personnel file in accordance with our guidelines for this.

In that case, you will be informed about the personal data policy of the company where you are employed. If your CV is rejected, we will delete the information we have received and processed in connection with the recruitment process as soon as possible – and no later than 6 months after you have received the rejection, unless there are special circumstances or we could have a common interest in storing your application material for a longer period of time.

7. Processing of data in third countries

The information you have uploaded via our recruitment portal, including your contact information, certificates and CV, is processed in the recruitment portal, which is a system offered by an external partner, Talentech. Talentech is the responsible data processor for ”Talentech Recruiter”,.

The recruitment system HR Manager is available to employees at A-LEAF’s departments in Denmark.

8. The Danish Data Protection Agency

You can read more about your rights regarding our processing of your personal information on the Danish Data Protection Agency’s website: www.datatilsynet.dk

9. Changes to this Data Protection Policy

This Data Protection Policy is version 1.1 and is valid from May 25^th  2021.

We reserve the rights to change this Data Protection Policy on an on-going basis. The latest version of this A-LEAF Data Protection Policy is available on our website.

10. How to complain

If you wish to complain about our processing of your personal data, please send an e-mail with the details of your complaint to lbs@a-leaf.dk. Then we will process the complaint and get back to you as soon as possible.

You also have the right to complain to the Danish Data Protection Agency if you are dissatisfied with our processing of your personal data, or if you disagree with a decision on the processing of your personal data or rights.

You can find the contact information for the Danish Data Protection Agency, together with a complaint guidance on www.datatilsynet.dk.