Version: May 22, 2018
In connection with search & selection, Compass Human Resources Group will, as the data controller, collect and process personal data about candidates.
Categories of personal data and purposes
We collect and process the following types of personal data:
Non-confidential personal data:
- The non-confidential “personal data” include your name, telephone number, e-mail address, resume information which is publicly available e.g. through professional media such as e.g. LinkedIn profile, employment history, education, courses and accreditations, board member positions, personal and professional qualifications and credentials, skills, language skills, hobbies, any photographs of you that are provided by you in a public profile.
Confidential personal data:
- In general; The confidential “personal data” include your address, citizenship, any photographs of you that are provided by you to us, family situation, salary package expectations, driver’s license, notification periods with your (at any time) current employer, availability.
Where relevant; Interest in and possibility of relocation.
We process the personal data for the following purposes:
For recruitment purposes.
To comply with applicable personal data protection regulation and other legitimate interests, e.g.
- Documentation requirements
- Compliance with basic principles and legal grounds for processing personal data
- Putting in place, maintaining and testing technical and organisational security measures, including but not limited to the prevention of unauthorized access to systems and information, to prevent the receipt or distribution of malicious code, (denial-of-service-attack) and damage to computer systems and electronic communication systems
- Investigating and reporting suspected personal data breaches, if any
- Handling requests and complaints from data subjects and others, if any
- Handling inspections and queries by supervisory authorities, if any
- Handling disputes with data subjects and third parties, if any.
The personal data are collected from résumés/CV’s, applications, telephone/Skype interviews, personal interviews, assessments, references and public databases i.e. LinkedIn, Xing etc.
The legal basis for the collection, processing & disclousure of the personal data
The legal basis for collection, processing and disclosure of personal data is the following:
- Consent, cf. article 6(1)(a) of the General Data Protection Regulation and section 6(1) of the Danish Data Protection Act with regard to General processing and disclosure, assessments, references, criminal records and registration in the candidate database
- Compass’ legitimate interests when preparing gross-lists and long-lists and discussing with our customers which individuals to reach out to, cf. article 6(1)(f) of the General Data Protection Regulation and section 6(1) of the Danish Data Protection Act.
- Compliance with legislation, cf. article 6(1)(c) of the General Data Protection Regulation and section 6(1) of the Danish Data Protection Act
When we collect personal data directly from you for the purpose of recruitment/matching you for a job, you provide the personal data voluntarily. You are not obliged to provide the information to us. The consequences of not providing the personal data are that we cannot work with you as a candidate for the job.
You have the right to withdraw your consent. If you withdraw the consent, this will not affect the lawfulness of the processing and/or disclosure prior to the withdrawal.
Transfer of personal data to data processors
We transfer the personal data to Dillistone, which stores the personal data on our behalf.
We store the personal data for as long as necessary to fulfil the purposes above, however, for no longer than a period of two years from the time of obtained consent.
Subject to the conditions set out in the applicable data protection legislation, you enjoy the following certain rights:
- The right to request access to the personal data
- The right to rectification of the personal data
- The right to erasure of the personal data
- The right to restriction of processing
- The right to objection to the processing of the personal data
You also have the right to lodge a complaint with the competent supervisory authority, such as the Danish Data Protection Agency (DK)/the Information Commissioner’s Office (UK).
Please contact us via the contact details stated below or visit our contact page if you have any questions in regard to the protection of your personal data or if you wish to exercise your legal rights.