Privacy Policy for Candidates

Last revised December 2022

1. Purpose

This policy is aimed at informing you of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will be retained for.

It provides you with certain information that must be provided under the General Data Protection Regulation ((EU) 2016/679) (GDPR) and the local data protection law.

In case of a conflict between this Privacy Policy and applicable law, applicable law will govern.

2. Data protection principles

We will comply with data protection law and principles, which means that your data will be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Maintained only for as long as necessary for the purposes we have told you about, i.e., in relation to the recruitment exercise.
• Kept securely and protected against unauthorised or unlawful processing and against loss or destruction using appropriate technical and organisational measures.

3. Scope

The Privacy Policy is applicable for all recruitment exercises related to CM Holding A/S (“CM”, “the Company”, “the Company Group”, “us”, “we” or “ours”) and associated companies, NAVI Merchants A/S, Copenhagen Merchants A/S, CM Biomass Partners, etc.

3.1 Relevance of Privacy Policy

This Privacy Policy only applies to the personal data of job applicants, potential candidates for employment or partnership, and those who participate in our recruiting programs and events.

This personal data is submitted directly to CM through the online application process (mainly via TeamTailor recruitment platform), the test/assessment-process (mainly via Deeper Signals and Hogrefe's online assessment platforms) and follow-up communications and/or through alternative channels (e.g., Recruiting and Executive Search firms).

This Privacy Policy does not apply to the personal data of our employees, partners, clients, vendors, or any other person from whom CM collects personal data for other purposes.

4. Data we collect and use

We define personal data broadly as information that directly identifies an individual or that makes an individual identifiable when combined with other information

4.1 Data related to role

The types of personal data that we request from you and the ways that we process it are determined by the requirements of the country in which the role you apply for is located, and not the country in which you reside.

Should you apply to more than one location or should the role to which you apply be available in more than one country, the types of personal data we request from you and the ways that we process it are determined by the requirements of all the countries in which the position is located.

4.2 Data

In connection with your application, we will collect, use, and store the following categories of personal data about you:

• The data you have provided to us in your curriculum vitae (CV) and the personal data contained in your covering letter.
• The data you have provided on our application form and in the recruitment process, including name, title, home/temp. address, telephone number, personal email address, employment history, qualifications, nationality, social media accounts, profession, professional memberships, educational achievements, diplomas, transcripts, languages, computer skills, national service completion (if applicable), photographs, videos, test results (e.g. personality, skills and IQ-tests), identification number/identity documents and any data you provide us during interviews at our premises.
• When applicable, any personal data provided to us about you from third partis, such as references (employment confirmation, performance during previous employment, culture/team-contribution), former employers, recruiting companies.
• Data provided from CM employees with whom you have been interviewed or who recommended your candidacy.
• Online data about you to the extent that you have chosen to make this data publicly available. For example, we may find your profile on professional social media websites, e.g., LinkedIn and Xing.
• If you receive an offer from us, we may collect data related to criminal offences and proceedings. If employed, such data will be deleted, and only confirmation of CM having been presented with such will be stored.

4.3 Sensitive Personal Data

Sensitive personal data is a subset of personal data that includes ethnicity, health/disabilities, trade union membership, philosophical beliefs, sexual orientation, and other categories as prescribed by law.

We may collect sensitive personal data about a candidate to the extent permitted to do so by applicable laws (e.g., U.S. equal opportunity laws) and e.g. to support our efforts to create an inclusive and diverse work environment, or to assess whether a work permit and visa will be necessary.

We may also collect sensitive personal data to the extent that a candidate chooses, without being asked, to voluntarily disclose it during the recruiting process.

Under limited circumstances and to the extent permitted by applicable law, we may also collect sensitive personal information relating to health and medical characteristics, such as status of infection, test results, and vaccination status, to address our public health and workplace safety obligations and to protect the Company and its employees, clients, and third parties.

4.4 How we will use your data

We will use the personal data we collect about you for legitimate human resources and business management reasons to:

• Assess your skills, qualifications, and suitability for the role/future roles.
• Carry out background and reference checks, where applicable.
• Communicate with you about the recruitment process.
• Keep and maintain records related to recruiting and hiring.
• Comply with legal or regulatory requirements, including relating to public health and workplace safety.
• Foster diversity and inclusion programs.
• Identify and evaluate the potential match to the CM Culture.
• Protect our legal rights.
• Protect the workplace in the event of an emergency or public health event, such as when the health or safety of you or one or more individuals may be endangered, including, to the extent permitted by applicable law, sharing data about the status of an infection, test results, and vaccination status.
• Improve our recruitment exercise processes.

It is in our legitimate interests to decide whether to appoint you to the role since it would be beneficial to our business to appoint a suitable candidate to that role.

We also need to process your personal data to decide whether to enter a contract with you.

5. Data flow in process

Having received your CV, cover letter, provided prerequisites and the results from any skillstests you took, we will then process that data to decide whether you meet the basic requirements to be shortlisted for the role.

If you do so, we will decide whether your application is suitable to invite you for an interview.

If we decide to invite you for an interview, we will use the data you provide to us at the interview to decide whether to invite you to perform personality and IQ-tests and for a further assessment interview.

Having received the results of the personality and IQ tests and conducted the assessment interview, we will use the data to decide to invite you in for final interviews.

If we decide to offer you the role, we may then take up references and/or any other check before confirming your appointment.

The Data flow (recruitment process) can be slightly different across recruitments as well as other recruitment-steps may be used.

6. Data Sharing

Your personal data will only be shared for the purposes of processing your application with entities within the Company Group.

We use third-party service providers regarding recruitment systems (ATS – Applicant Tracking System) – mainly through the digital platform of TeamTailor. Other platforms can be used.

7. Automated Decision-making

CM does not base decisions that will have a significant impact on you based solely on automated decision-making. CM evaluate each individual candidate on their own merits.

Certain roles may though require specific prerequisites or skills (for example, fluency in a certain language, particular professional qualifications or certifications, or number of years in a similar role). Applications that do not meet those requirements may be automatically rejected.

8. Data security

CM uses generally accepted standards of technical and operational security to secure your personal data. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal data on our specific instructions, and they are subject to duty of confidentiality.

9. Data Retention

If you accept an offer of employment with CM, any relevant personal data collected during your pre-employment period will become part of your personnel records and will be retained in accordance with specific country requirements and with the Privacy Policy applicable to CM employees, which will be provided during the on-boarding process.

If you are unsuccessful (are not employed), we shall retain your personal data for 24 months.

We retain such personal data in case a similar role becomes vacant for which you will be a fitting candidate.

We further retain your personal data for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way.

10. If you fail to provide personal data

If you fail to provide personal data when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we may not be able to process your application further. For example, if we require references for a role and you fail to provide us with relevant details, we will not be able to take your application further.

11. Submitting data

By submitting your personal data to us, you acknowledge that:

• You have read and understood this Privacy Policy and agree to the use of your personal data as set out herein.
• Your personal data may be transferred and processed worldwide, including in countries that may not be deemed to provide the same level of data protection as your home country, for the purposes and in the manner specified in this Privacy Policy.
• All your representations are true and correct to the best of your knowledge and belief, and you have not knowingly omitted any related information of an adverse nature. Providing any inaccurate information may make you ineligible for employment.
• This Privacy Policy does not form part of any contract of employment offered to candidates hired by CM.

12. Your rights

CM takes reasonable steps that are designed to keep your personal data accurate, complete, and up to date for the purposes for which it is collected and used.

In accordance with applicable law, you may have one or more of the following rights:

• Request access to your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data corrected.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
• Object to processing of your personal data where CM are relying on a legitimate interest and there is something about your situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal data to another party.

If you want to review, verify, or correct your personal data, you can do so by logging into the online system (TeamTailor) or you can contact hr@copmer.com.

If you wish to request erasure of your personal data or object to the processing of your personal data, please send an email to hr@copmer.com.

13. Contact

If you have any questions about this Privacy Policy, please contact hr@copmer.com.