Basico P/S – Personal Data Protection Policy

This personal data protection policy (hereinafter the “Policy”) describes how Basico P/S (hereinafter “Basico”, “us”, “we” or “our”) as data controller collect and process personal data about you in connection with your use of our website and our services as well as in connection with recruitment (both internally for Basico and externally for recruiting clients).

Basico has prepared this Policy because we are firmly determined to comply with our obligations as regards the processing of personal information under Danish law and EU law in this area (hereinafter “GDPR”). The purpose of our Policy is to inform you about our processing of your personal information and our GDPR compliance.

Basico’s address: Philip Heymans Allé 3, 5^th floor, DK-2900 Hellerup, CVR no. 35852190.

Basico collects your personal information in various ways, such as:

• If you apply for a job (either solicited or unsolicited);
• If you are undergoing a recruitment process at Basico;
• If you contact Basico in connection with a business cooperation;
• If you have business cooperation with Basico;
• If you subscribe to our newsletter;
• If you register for a seminar, meeting or course;
• If you contact Basico for other reasons.

We can collect the following information in connection with the above:

Your name, middle name, surname, address, company address, current and previous job titles, phone number, email address, birth date, sex; IP address; curriculum vitae and copies of exam papers and academic credentials; previous positions held, professional career, recreational activities, surveillance pictures, behaviour regarding email tracking as well as other specific information that you may choose to provide us with. During the recruitment process, we may find it relevant to take up references and to ask the candidate to fill in personality tests. If you are undergoing a recruitment process, we will also share test results and relevant information with the clients. We may also gather information that has been published for example on social media.

We may process your criminal record, if relevant, in connection with the recruitment process. In that case, this will be done on the basis of your express consent in accordance with section 8(3) of the personal data protection act.

When visiting our website(s), you enable Basico to collect data about you by means of cookies if you agree to this on the website(s). More information about our possibility of collecting and processing these data is available from our cookie policy.

Basico’s collection, storage and processing of personal information are restricted to situations with a specific purpose – such as an assignment or delivery about which an agreement has been concluded, security purposes, a recruitment process, consideration of your job application and recruitment of relevant persons in order to be capable of establishing and maintaining a file of relevant candidates for positions with us or our recruiting clients, submission of our newsletter, being a responsible business partner or, in some other way, being able to carry out and deliver on a service, etc. Furthermore, the information provided can be used for statistical purposes and customer surveys. We collect data in order to be able to measure and analyse our marketing measures on our website to make existing and potential customers have a better perception.

Basico can process your personal information on the following legal basis:

• If we have asked for your consent to process specific personal information, your consent is the basis for processing the specific data, cf. article 6(1)(a) of GDPR;
• the processing is necessary to carry out measures taken at the data subject’s request prior to the conclusion of an agreement or to deliver on an agreement that you have concluded with us, cf. article 6(1)(b) of GDPR;
• the processing is necessary in order for us to comply with applicable law, cf. article 6(1)(c) of GDPR, and/or to meet labour law obligations stipulated by law or collective agreement, cf. section 12(1) of the personal data protection act;
• the processing is necessary to pursue our legitimate interests, cf. article 6(1)(f) of GDPR, respectively section 12(2) of the personal data protection act. The interests that Basico may, for example, pursue include interests in relation to customer service, the performance of an assignment or recruitment process, and the consideration of your job application.

If we process sensitive personal information about you (so-called “special categories of personal data”), the processing will take place only if permitted under article 9 of GDPR, including in the following cases:

• After having acquired your express consent in accordance with article 9(2)(a) of GDPR;
• if the processing is carried out to meet our labour law, health or social security law obligations and to uphold specific rights insofar as the processing has its legal basis in EU law or the member States’ national law or a collective agreement pursuant to the member States’ national law that provides the necessary guarantees for the data subject’s fundamental rights and interests, cf. article 9(2)(b) of GDPR;
• if the processing is necessary to establish a legal claim pursuant to current law, cf. article 9(2)(f) of GDPR; or
• if you have – upon your own initiative – provided us with the information, cf. article 9(2)(e) of GDPR.

If we send direct marketing to you, including by email, we will ask for your prior consent in accordance with the provisions of the marketing act hereon.

When we process your personal data on the basis of your consent, you can withdraw your consent at any time by contacting us via the contact details found at the end of this Policy. If you withdraw your consent, we will delete the personal data processed on the basis of your consent unless they can or must be processed, for example in order to comply with a legal obligation.

Basico can disclose or make your personal information available to the following recipients:

• Basico’s affiliated companies;
• Suppliers, recruiting clients, business partners or other cooperating partners, including cooperating partners in connection with a recruitment process (such as providers of personality tests);
• Public authorities.

External companies will not receive or process your personal information unless the law permits the disclosure and processing hereof.

If the external companies or cooperating partners are data processors for us, your personal information will always be processed in accordance with a data processing agreement meeting the legislative requirements.

If the external companies or cooperating partners are independent data controllers, your personal information will be processed in accordance with their own privacy policy, data protection policy or personal data protection policy, which you will be made aware of by the external companies unless the law prescribes otherwise.

Within the Basico group, the individual companies will now and then disclose data to other group companies in the EU/EEA and process personal data as data controllers or data processors depending on the specific circumstances.

Should you have any questions about our use of data processors, about the cooperation with other data controllers or transferring of data to third countries, including a request to be provided with a copy of documentation that the required guarantees have been made, please contact us. Our contact details are found at the end of this Policy.

In far most cases, Basico will not disclose your personal information to countries outside the EU/EEA. Should this become necessary, it will be done in accordance with the law, including ensuring the necessary basis for secure disclosure.

Basico will store your personal information only for as long as necessary to meet the purpose of processing your information. However, special provisions may apply and within certain areas your personal information may be stored for a longer period of time.

If you are engaged by us or if you conclude a cooperating agreement as an associate with us, your personal information will be transferred to the general staff administration in connection with the employment (collectively referred to as “employment”). Please contact Basico for further information about the special provisions (contact details are available below).

If you are not employed by us – or in case of recruitment for a customer – the general rule is that your personal information will be deleted after a maximum of six months unless you have consented to a longer period. In connection with recruitments, you can consent to us storing your CV, your application and other documents in our database for a period of up to five years and us recording the information contained in the said documents in order to contact you again if a similar relevant position becomes vacant during the period or if an existing applicant backs out.

We will not save information about employment with a recruiting client.

Some of your personal information must be kept for accounting purposes or to defend legal claims. These personal data will be kept until the expiry of the mandatory deadline, which is five years as regards the keeping of accounting material.

For marketing purposes, we will keep your information until you unsubscribe. You can do so at any time.

Basico is constantly focused on protecting your personal data and securing your rights as a data subject.

As a data subject, you have certain rights that are described below. Please observe that certain exemptions may apply, for example if the processing is necessary to comply with legal obligations, to bring forward legal claims or to exert or defend a legal claim. Should you have any questions about your rights as a data subject, please contact Basico (contact details are available below).

You have a right to request access to the personal data kept about you by Basico. Basico is obliged to make a number of information available to you, such as:

• the purpose of the processing,
• the categories of personal information concerned,
• the recipients or categories of recipients, including recipients in third countries,
• the storage period or the criteria for establishing the storage period,
• the right of appealing to the Danish Data Protection Agency,
• all information available about the source of personal information when they have not been collected from you as a data subject.

Basico must make a copy available of the personal information processed, free of cost and in electronic format, if the request has been forwarded in a common electronic form. We will endeavor to do so as soon as possible and, in any circumstance, to answer your request within a period of 30 days.

You have a right to have inaccurate personal data about you corrected, including to have incomplete personal data completed.

In certain circumstances, you are entitled to have your information deleted, which means that Basico must – upon your request – delete the personal data kept about you. Please observe that the right of deletion is not absolute, for which reason one of the following conditions must apply:

• the personal data are no longer required for the purposes for which they were collected or in any other way considered,
• you withdraw your consent and there is no other legal basis for processing your personal data (such as Basico’s overriding interests),
• you object to the processing and there are no overriding reasons for processing your personal data,
• the personal data have been processed illegally, or
• the personal data must be deleted in order to meet a legal obligation under EU law or Danish law.

If one of the following circumstances apply, you are entitled to restrict Basico’s processing of your personal data:

• The accuracy of the personal data is questioned by you – however, only for a period that will enable Basico to correct the accuracy of these personal data,
• The processing is illegal and you request restrictions on the use of the personal data rather than to have them deleted,
• Basico no longer needs to process the personal data, but you need the personal data to enforce a legal claim, exert or defend a legal claim, such as documentation of proof,
• For reasons related to your special situation, you have objected to the processing and expect confirmation that Basico’s legal reasons overrule the data subject’s reasons.

You are entitled to receive the personal data collected about you in a structured, common and machine-readable format. Where the processing is based on consent or agreement and when the processing is made in an automatically generated format, you are entitled to disclose these personal data to a third party without any hindrance from Basico.

In certain circumstances, you are entitled to object to Basico’s processing of your personal data.

When the processing of your personal data depends on your consent, you may at any time withdraw your consent by emailing gdpr@basico.dk. Please note that this will not affect Basico’s processing of your personal data prior to the withdrawal of your consent.

If you want to complain about Basico’s processing of your personal data, please contact Basico. If your complaint cannot be solved in a satisfactory manner, you can also contact the Danish Data Protection Agency.

This Policy is updated regularly and when required due to amendments of current law. Therefore, we reserve the right to update and amend this Policy. If we do so, we will amend the date and the version at the bottom of the page. In case of major amendments, we will inform you by means of a visible notice on our website.

Basico P/S

Philip Heymans Allé 3, 5^th floor
DK-2900 Hellerup

Tel. +45 70 27 03 71
CVR no. 35852190
Email: GDPR@basico.dk

Danish Data Protection Agency

Carl Jacobsens Vej 35
DK-2500 Valby

Tel. +45 33 19 32 00
Email: dt@datatilsynet.dk
Website: www.datatilsynet.dk

Date of the most recent version of the Policy

24 January 2022