Privacy policy

Company name: dba consult aps
Phone: 48 26 00 00
Email: gdpr@dba-consult.dk
Website: www.dba-consult.dk
Data controller
Name: Peter Heide
Phone: 48 26 00 00
Email: gdpr@dba-consult.dk
Representative
Name: Piotr Hahn
Phone: 48 26 00 00
Email: gdpr@dba-consult.dk

General information about data protection at dba consult aps
As part of activities relating to dba consult aps, we process personal data. This privacy policy describes how we process your data.

Transparency in data processing
In this privacy policy you can read how we process data about you and for which purposes it is processed. You have received, or will receive, some of the same information when you register your details on our website.
Regarding information provided on the basis of consent: Consent before we process your personal data. Before we process information about you, we obtain consent for the specific purposes, unless the data is collected and processed on another legitimate basis. We can inform you of such a basis and of our legitimate interest in processing your personal data. Consent is voluntary, and you can withdraw it at any time. See below how you can withdraw your consent.

Personal data is not disclosed without consent. We do not disclose personal data to other parties.
Withdrawal of consent: As a data subject, you can withdraw your consent at any time. If you wish to withdraw your consent, send an email to gdpr@dba-consult.dk, after which the data controller will confirm that the consent has been withdrawn. Please note that if you withdraw your consent, it may affect how our website works, or there may be services we can no longer offer, for example newsletters.

Rights of data subjects
As a data subject at dba consult aps, you have the following rights. Below we describe how we handle these rights and how you as a data subject can exercise them.

Information about the rights of data subjects
As a data subject you have the following rights, which you were also informed of when you registered. If you gave consent when registering on our website, you received an email with the same information. Your rights are:
Right of access
Right to rectification
Right to erasure
Right to object
Right to restriction of processing
Right to data portability
Right to withdraw consent
Right to lodge a complaint with the supervisory authority
The data controller informs the data subject without undue delay of how the company handles the data subject's exercise of their rights.

How to exercise your rights

Right of access: You have the right at any time to be informed of which data we process about you, where it comes from and what we use it for. You can also be informed of how long we store your personal data and who receives data about you, to the extent we disclose data in Denmark and abroad. If you wish to exercise your right of access to the personal data provided for a given purpose, do as follows:
You can send an email to gdpr@dba-consult.dk and ask to receive the information registered and the purposes for which it was collected.

Right to rectification: You have the right to have the information we process about you rectified. If you wish to exercise your right to rectification of the personal data provided for a given purpose, do as follows:
You can log in to your profile on exact.dba-consult.dk and correct the information the company has registered in connection with this consent, as well as the purposes for which it was collected.

Right to erasure: In certain cases you have the right to have the information we process about you erased. However, there are cases where we have a legal obligation to keep it. We have routines that ensure we delete personal data that no longer serves a purpose or that we are no longer legally obliged to keep and process. We delete your personal data when it is no longer necessary for the purpose for which we collected, processed and stored it. If you believe the personal data we process about you is incorrect, you have the right to have it corrected or deleted. If you wish to exercise your right to erasure of the personal data provided for a given purpose, do as follows:
You can send an email to gdpr@dba-consult.dk stating which information you want deleted.
When the data controller receives a request for erasure, the data controller assesses whether there are exceptions to erasure. If the data controller finds an exception, the data controller informs you without undue delay of the reason and legal basis for the exception. If there are no exceptions, the data controller deletes the personal data provided in connection with this consent and informs you of this.

Right to object: You have the right to object to our processing of your personal data.
If you wish to exercise your right to object to the processing of personal data provided for a given purpose, do as follows: You can send an email to gdpr@dba-consult.dk stating that you wish to exercise your right to object. The data controller then ensures that the personal data is not processed for the purpose for which it was collected as long as an objection to the processing is pending.

Right to restriction of processing: You have the right to request restriction of our processing of your personal data. If you wish to exercise your right to restriction of processing of personal data provided for a given purpose, do as follows: You can send an email to gdpr@dba-consult.dk, which is then handled by the data controller. If your request for restriction is justified, we restrict the processing of your personal data. You will then receive a confirmation describing the actions taken and an assessment.
Right to data portability: You have the right to request that your personal data be transferred to another provider of the same service. If you wish to exercise your right to data portability for personal data provided for a given purpose, do as follows:
You can send an email to gdpr@dba-consult.dk stating that you wish to exercise your right to data portability. The data controller then ensures that the personal data is delivered to you in a common, machine-readable format.

Right to withdraw consent: You have the right to withdraw your consent at any time. If you wish to withdraw a consent, do as follows: You can withdraw your consent at any time by logging in to exact.dba-consult.dk with the user details you registered with. Under your user profile you can change or withdraw your consent. You will receive an email and a confirmation page on the website informing you of the changes and the withdrawal. You can also send an email to gdpr@dba-consult.dk stating that you wish to withdraw your consent and for which purpose it was given.
The data controller then ensures that the personal data is not processed for the purpose for which it was collected. If there are no exceptions or legal obligations preventing erasure, the data controller ensures that the personal data is deleted.

Right to lodge a complaint with the supervisory authority: If you wish to exercise your right to lodge a complaint with the supervisory authority:
You can lodge a complaint by contacting the supervisory authority. In Denmark, the supervisory authority is the Danish Data Protection Agency (Datatilsynet). You can lodge a complaint on Datatilsynet's website.

The data controller's duty to notify: If you have exercised your rights to any rectification or erasure of personal data or restriction of processing carried out under Article 16, Article 17(1) and Article 18, the data controller notifies all recipients to whom the personal data has been disclosed, so that the parties take the necessary actions to protect your rights.

What do we use your data for? (processing of personal data)
We store and process the following information about you. We use data about you to be able to offer you assignments that we have entered into on your behalf with a company that needs your skills. The data we use includes:
General personal data: Name, Contact details, Information the data subject has included in their CV*
*dba consult aps advises data subjects not to include any information in their CV that may be considered special categories of personal data.

We collect and store your personal data for specific purposes
We collect and store your data in connection with specific purposes or other legitimate interests and purposes.
This happens when we need to carry out:
Storage of CVs in the company's CV database and the Exact system for administration of consultants
Processing of CVs in the company in connection with offering the data subject as a consultant
Disclosure of the complete CV to potential clients. This only ever happens with the data subject's prior approval.
Disclosure of an anonymised CV to potential clients. This happens without further consent.
Processing of personal data in Outlook in connection with communication

We only process relevant personal data about you
We only process personal data about you that is relevant and adequate in relation to the purposes for which it was collected. Which information is adequate and relevant depends on the purpose. When you provide your information, you are informed why we collect each piece of information. We only collect, process and store the personal data necessary to fulfil the purpose for which it was collected. There may be legal obligations that apply to the data controller and that are the reason why we collect, process and store personal data. You can always request access as described above.

We continuously update personal data where possible
We check that the personal data we process about you is not incorrect or misleading. We also make sure to update your personal data on an ongoing basis. All our services depend on the information being correct and up to date. We therefore ask you to inform us of any inaccuracies or changes in your personal data.

We use cookies for several purposes on the website. Read more about cookies on the website.

Security of processing, organisational and technical
Security: We protect your personal data and have internal rules and processes for information security. We have introduced instructions and measures that protect your personal data against being destroyed, lost or altered, against unauthorised disclosure and against unauthorised persons gaining access to or knowledge of it.

Technical security measures
Security on the website: The website uses SSL (Secure Socket Layer). SSL is an encryption protocol and means that only the sender and recipient can read the information sent between them. You can therefore enter your information securely on our website.
Security in receiving systems: When we receive your information, it is stored securely. We use Heroku as the application layer under Exact, which provides the following technical security guarantees: The data centres are certified with ISO 27001, SOC 1 and SOC 2/SSAE 16/ISAE 3402 (previously SAS 70 Type II), PCI Level 1, FISMA Moderate and Sarbanes-Oxley (SOX). Heroku is built on security features such as isolated environments, which ensure that there is no access from other applications in a Heroku setup or from outside. Client data is secured in its own separate, access-controlled database. All underlying systems are updated to the latest version. All systems are part of backup routines, which means that data can be restored if it is destroyed, lost or inappropriately altered.

Organisational measures: To protect your information as well as possible, we have set up processes for the people who may come into contact with your information. Only people acting on direct instructions from the data controller can access information in the systems. This is ensured by internal processes at subcontractors.