Privacy Policy for Konsulenthuset ballisager A/S

Contents

• Career counselling
• Outplacement
• Recruitment
• General provisions for all processing

Introduction

In order to deliver satisfactory career counselling, recruitment or outplacement services, we need to process personal data about you. Our privacy policy describes what data we collect, why we collect it and what we use it for. Konsulenthuset ballisager A/S acts both as data controller (outplacement and recruitment programmes) and as data processor (career counselling programmes). The privacy policy explains how we process your data within our three areas: career counselling, outplacement and recruitment. For each area, the legal basis, the purpose and the security measures are described. This is followed by an account of your rights and the general principles we follow when handling your data across all areas.

If you use our website, including our free surveys and other material, or contact us via the website’s forms or chat function, please refer to our cookie and privacy policy, where you can read more about the information we collect and how we protect it.

If you have any questions or would like further information, you are welcome to contact our Data Protection Officer at dpo@ballisager.com

Data controller

Konsulenthuset ballisager A/S, Søren Frichs Vej 40A, 8230 Aabyhøj, Denmark (CVR no. 31299004).

Career counselling

Konsulenthuset ballisager A/S acts as data processor in career counselling programmes and acts on the instructions of a data controller. The data controller may be your municipality, your educational institution or another third party that has enrolled you in a career counselling programme.

Career counselling programmes vary considerably depending on the task at hand. Career counselling may be provided through your job centre or through your educational institution. Programmes may consist of one-to-one sessions, workshops or online programmes on our platforms Jobspot or Candeno, or a combination of these.

Purpose and legal basis
The purpose of processing your personal data is to assess your job readiness, carry out case management, help you into employment and support your future job search by giving you the right tools. If you have been enrolled via the job centre, the processing is based on the Danish Act on an Active Employment Effort (lov om aktiv beskæftigelsesindsats), cf. Article 6(1)(c) and Article 9(2)(b) of the GDPR. If you have been enrolled via other parties, e.g. your educational institution, the processing is based on your consent, cf. Article 6(1)(a) and Article 9(2)(a) of the GDPR.

In many cases, participation in a programme offered by the job centre is mandatory, and it is therefore necessary to process your personal data in order to carry out the career counselling programme with you.

We also process data for the purpose of invoicing our clients and fulfilling our contractual obligations. This processing is based on the balancing-of-interests rule (legitimate interests). Under the Danish Bookkeeping Act, we are required to retain invoice information for at least 5 years, and the information shown on the invoice is therefore retained in accordance with Article 6(1)(c) of the GDPR.

After your programme, we may ask you to share your experience with us on Trustpilot. We do not share your data with Trustpilot. If you choose to write a review, Trustpilot collects your data itself and is therefore responsible for processing it.

For up to 6 months after your programme, we may contact you to ask about your employment situation in order to provide outcome reports to the client. Your reply is voluntary.

The personal data concerned
We receive your personal data either from you or from the party that enrolled you in the programme.
The personal data processed in career counselling:

General personal data, including but not limited to:

• Date of birth
• Name
• Address
• Contact details (email and/or telephone number)
• Additional information provided at enrolment

Sensitive personal data, including:

• Health information

Confidential personal data, including:

• CPR number (Danish civil registration number) – used for invoicing and for assignments outsourced by a public authority

We subsequently record further information about you during your sessions with your consultant.

Health information and CPR numbers are not processed in all career counselling programmes. Such information is processed only where necessary to carry out the assignment.

Security
Sensitive and confidential data are delivered via secure email or via municipal IT systems in which our access is limited to enrolled candidates. Data are uploaded to our internal database hosted by It’s IT (see the list of suppliers below). Only persons with a work-related need have access to your personal data.

Retention and erasure
Personal data are erased or anonymised when they are no longer necessary to achieve the purpose, unless otherwise required by law. As we often act on behalf of a public authority, the possibility of erasure is severely limited.

Data are erased or anonymised by us 6 months after invoicing, so that we are able to invoice the client and document that we have fulfilled our obligations, and so that you are able to document that you participated in the programme.

If you have given consent to the processing, you may withdraw it by contacting the data controller that collected your consent.
Information shown on invoices is erased after 5 years in accordance with the Danish Bookkeeping Act; this information is therefore not erased if you withdraw your consent.

Disclosure
We may disclose your data to companies with a view to helping you obtain employment with them. As a rule, disclosure only takes place with your express knowledge.
Read more about disclosure in the section on this topic.

Outplacement

Konsulenthuset ballisager A/S is the data controller for the data we process about you in an outplacement programme. We receive your contact details from your employer, after which we arrange a meeting with you. If you enquire about an outplacement programme via a form or the chat on our website, you and your enquiry will be registered in our CRM system, HubSpot. You can read more about our use of HubSpot here: https://ballisager.com/cookie-privatliv-politik/

Purpose and legal basis
The purpose of the processing is to help you into employment. We process the personal data so that we can assess your situation and your competencies in order to bring you into, or closer to, employment.

Before starting your outplacement programme, you give your consent to the processing of personal data, and the legal basis for the processing is Article 6(1)(a) of the GDPR. We may also ask you to complete a profile test. By giving your consent, you agree that we may carry out this test.

We also process your personal data in order to invoice the client; this processing is based on the balancing-of-interests rule (legitimate interests). Your personal data may appear in the invoicing documentation. As we are obliged to retain the invoicing documentation for 5 years under the Danish Bookkeeping Act, this continued retention is based not on consent but on Article 6(1)(c) of the GDPR.

After your programme, we may ask you to review your experience with us on Trustpilot. We do not disclose your data to Trustpilot. Trustpilot collects your data itself and is thus an independent data controller for that data if you choose to write a review of us on its website.

For up to 6 months after your programme, we may contact you to ask about your employment situation in order to provide outcome reports to the client.

The personal data concerned
We receive your contact details from your employer and collect further relevant information ourselves for the meetings.
The data collected in outplacement programmes:

General personal data, including but not limited to:

• Email address and telephone number
• Name
• Address
• Date of birth
• Detailed information about education and experience
• Test data
• Reference information
• Education and position
• Work experience and other information in your CV
• Minutes of meetings, including agreed activities
• Attendance record
• Information about companies contacted during the programme
• Agreements on employment, wage subsidy jobs or work placements

Security
As soon as you become a candidate in an outplacement programme, your data are uploaded to our internal database hosted by It’s IT (see the list of suppliers below). Only employees with a work-related need have access to your personal data.

Retention and erasure
Personal data are erased when they are no longer necessary to achieve the purposes. Data are erased 6 months after invoicing, so that we are able to invoice the client and document that we have fulfilled our contractual obligations. You always have the right to withdraw your consent, after which your personal data will be erased, with the exception of personal data necessary for invoicing.
Information shown on invoices is erased after 5 years in accordance with the Danish Bookkeeping Act; this information is therefore not erased if you withdraw your consent.

Disclosure
We may disclose your data to companies with a view to helping you obtain employment with them. As a rule, disclosure only takes place with your express knowledge.
We notify your former employer when you get a new job, but the name of your new employer is only disclosed with your consent.
Read more about disclosure in the section on this topic.

Recruitment programmes

In connection with recruitment programmes, we may either contact you via LinkedIn, or you may apply for a position through our website, either with us or with one of our clients. As part of the recruitment process, we may obtain additional publicly available information about you from the internet, including social media (primarily LinkedIn).

Purpose and legal basis
The purpose of processing your personal data is to assess whether you are the right candidate for the advertised position or for future positions. The processing and collection of your general personal data prior to a recruitment programme is necessary for us to pursue our legitimate interest in assessing applicants for a vacant position. Your data are therefore collected on the basis of Article 6(1)(f) of the GDPR.

At the start of the recruitment programme, you will be asked to register in the CV database Recruitio or you can do so when applying for a position with us or our clients. When registering, you will be asked to give your consent, and storage in Recruitio is based on Article 6(1)(a) of the GDPR.

You may also be asked to complete personality tests and cognitive tests in the E-stimate system. The legal basis for this processing is consent under Article 6(1)(a) of the GDPR.

The personal data concerned
The data that, where possible, are collected online or from the client before the recruitment programme:
General personal data, including but not limited to:
Email address and telephone number
Name
Information about education and experience
CV and application

The data collected in connection with the recruitment programme:
General personal data, including but not limited to:
Email address and telephone number
Name
Information about education and experience
Address
Personality test results
CV and application
References
Information about criminal offences (private criminal record certificate) – only in special cases, see above

Security
Data are collected in our recruitment system, Recruitio, and are accessible to employees of Konsulenthuset ballisager A/S with a work-related need, as well as to hiring managers at the client if the position is with one of our clients.

The client’s processing of data is governed by the master agreement between Konsulenthuset ballisager A/S and the company. The client is itself the data controller for its processing of your data; if you wish to exercise your rights against the client, you must therefore contact the company you are applying to. Konsulenthuset ballisager A/S will of course help you as far as we can.

Retention and erasure
Personal data are erased when they are no longer necessary to achieve the purpose. Data in Recruitio are erased after 180 days unless you consent to longer storage. The 180 days correspond to the client’s guarantee period; the data are therefore retained so that we can answer questions from the client or put forward other candidates should the guarantee be invoked.
You always have the right to withdraw your consent, after which your personal data will be erased. However, personal data will not be erased if we have legitimate grounds for retaining them for longer.

Disclosure
If we consider you a relevant match for a given position with a client, we send the hiring company a link containing your personal data, including your CV, application and test results. The client may access your personal data in our candidate database during the recruitment programme.
Read more about disclosure in the section on this topic.

General provisions for all processing

Your rights under the General Data Protection Regulation

You have several rights in connection with our processing of your personal data. You may not always be able to exercise all of them. When you contact us, we will accommodate your request as far as possible in accordance with the law and our data processing agreements. Your rights under the Regulation are as follows:

• The right to be informed about how we process your personal data (duty to inform).
• The right of access to your personal data.
• The right to have inaccurate personal data rectified.
• The right to have your personal data erased.
• The right to have the processing of your personal data restricted.
• The right to withdraw your consent (if you have given consent in connection with the processing).
• The right to object to your personal data being used for direct marketing.
• The right to object to automated individual decision-making, including profiling.
• The right to have your personal data transferred (data portability).

All of the above rights are handled by contacting our Data Protection Officer (DPO). You can contact the DPO by email: dpo@ballisager.com.

If you disagree with the way in which Konsulenthuset ballisager A/S processes your personal data, you can send your objection to dpo@ballisager.com.

We may refuse, or charge a fee for, requests that are unreasonably repetitive, require disproportionate technical effort (e.g. developing a new system or fundamentally changing an existing practice), affect the protection of other people’s personal data, or would be extremely impractical (e.g. requests concerning information held in backups).

Unless correcting information requires a disproportionate effort, we will do so free of charge. We strive to maintain our systems in a way that protects against accidental or malicious destruction. Among other things, this means that we take backups of our system. When we delete your personal data from our systems, they are deleted from the user interface but not from the backup.

You always have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Borgergade 28, 5th floor, 1300 Copenhagen K, Denmark. https://www.datatilsynet.dk/borger/klage-til-datatilsynet/.

Disclosure of data

We do not disclose personal data to companies, organisations or individuals outside Konsulenthuset ballisager A/S, except in the following three cases:

With your consent or knowledge
We may disclose personal data to companies, organisations and individuals outside Konsulenthuset ballisager A/S if we have your consent or another legal basis for processing your personal data. We disclose your data if we consider that the disclosure complies with the Regulation and is necessary to fulfil the purpose. This may, for example, be in recruitment programmes, where we disclose your data to the hiring company. As a rule, your data will not be disclosed without your knowledge.

To sub-processors
We store personal data with trusted partners with whom we have always concluded a data processing agreement containing specific instructions. They process data on the basis of our instructions and in accordance with our privacy policy and other applicable confidentiality and security measures. See the full list of sub-processors further down.

For legal reasons
We may disclose personal data to companies, organisations and individuals outside Konsulenthuset ballisager A/S if we believe in good faith that access to, or use, preservation or disclosure of, the information is necessary to:

• Comply with applicable laws, regulations, legal proceedings or enforceable requests from public authorities.
• Enforce applicable terms of service, including investigation of potential violations.
• Detect, prevent or otherwise address fraud, security or technical issues.
• Protect against harm to the rights, property or safety of Konsulenthuset ballisager A/S, our shareholder or the public, as required or permitted by law.

Recipients of your data

The contractual and confidentiality relationship between Konsulenthuset ballisager A/S and the suppliers we use to process personal data is always governed by a data processing agreement.
Below you will find a complete list of the data processors that Konsulenthuset ballisager A/S works with.

Recipients in third countries
Konsulenthuset ballisager A/S uses sub-processors located in the third country USA. The transfer mechanism is the European Commission’s EU-U.S. Data Privacy Framework, under which all our US-based sub-processors are certified. You can see a list of certified companies here: https://www.dataprivacyframework.gov/s/participant-search

Where no other transfer mechanism is available, we conclude Standard Contractual Clauses (SCCs) with our sub-processors in third countries.

Compliance and cooperation with supervisory authorities

We regularly review our compliance with our own privacy policy. We monitor new legislation in the field of data protection and adjust our practices and policies accordingly. When we receive formal written complaints, we contact the sender to follow up. We cooperate with the relevant regulatory authorities, e.g. the Danish Data Protection Agency, to resolve complaints, e.g. regarding the transfer of personal data, that we cannot resolve directly with the individual concerned.

Security

We work hard to protect Konsulenthuset ballisager A/S and our candidates against unauthorised access to, alteration of or disclosure of the personal data we store.

Our IT supplier has implemented secure technical measures, and we continuously keep ourselves updated on compliance with them.

Internally, we have implemented a number of measures, including regular awareness training for employees, a requirement for employees to sign confidentiality agreements, and much more.

Data processors

Below you will find a list of the data processors that Konsulenthuset ballisager A/S works with in connection with the programmes described above.

Data processors

It’s IT
It’s IT hosts our IT, including files, Exchange and candidate databases. We own our candidate database ourselves. Location of processing: Visionsvej 51, 9000 Aalborg, Denmark. Applies to the entire company.

SurveyXact
Used to evaluate our programmes. Email addresses may be linked to the candidate’s responses. Location of processing: Olof Palmes Allé 20, 8200 Aarhus N, Denmark. Applies to the business areas career counselling and outplacement.

Uniconta A/S
Used for invoice information, name and CPR number. Where the client requires personal data on the invoice, these will appear on it and be retained for 5 years in accordance with bookkeeping legislation. Location of processing: Klausdalsbrovej 601, 2750 Ballerup, Denmark. General business areas: career counselling and outplacement.

E-stimate
As part of a recruitment process with us, you may be asked to complete a personality profile test provided by E-stimate. Location of processing: Boulevarden 13, 8300 Odder, Denmark. General business areas: outplacement and recruitment.

Recruitio
When you apply for a position through our website (including the CV database), your data are registered in this HR system. Location of processing: Paul Bergsøes Vej 16, 2600 Glostrup, Denmark. General business area: recruitment.

Ubivox Technologies ApS
Ubivox is an email automation system. We use Ubivox for our online job search programmes. Email addresses and names are stored here. Location of processing: Østre Stationsvej 43, 3rd floor, 5000 Odense C, Denmark. General business area: Jobspot, covering both career counselling and outplacement.

Mailgun
Used as an email sender. We use Mailgun in connection with Jobspot programmes. Location of processing: 112 E Pecan St, #1135, San Antonio, Texas 78205, USA. General business area: Jobspot.

GAIS
GAIS is used for employee well-being surveys. Location of processing: Klokhøjen 4, 8200 Aarhus N, Denmark. General business area: Jobtrack programmes under outplacement.

Candeno
Candeno is used in our online career counselling programmes and is an online job search platform. Location of processing: Klosterport 4E, 2nd floor, 8000 Aarhus C, Denmark. Candeno is used in career counselling programmes.

Microsoft Ireland
Microsoft is our general platform. We use Outlook for email and SharePoint for sharing documents. Location of processing: South County Business Park, One Microsoft Place, Carmanhall and Leopardstown, Dublin, D18 P521, Ireland. Microsoft’s parent company is based in the USA. Microsoft is used throughout the company.

Crisp
Crisp is a chat function that we use in our Jobspot solution. Location of processing: 2 Boulevard de Launay, 44100 Nantes, France. Crisp is used only in Jobspot programmes.

Addosign
Addosign is used to obtain declarations of consent in outplacement programmes. Location of processing: Gærtorvet 1, 5th floor, 1799 Copenhagen V, Denmark. The data processor is used in outplacement programmes.

Warnich IT
Warnich IT hosts our FileMaker solution, in which we store information about candidates. Location of processing: J.P. Larsensvej 26, 8220 Brabrand, Denmark, and the general business areas are career counselling and outplacement. Warnich IT is bound by a confidentiality agreement rather than a data processing agreement.

Changes

Our privacy policy may change from time to time. We will not restrict your rights. Any changes to this privacy policy will be posted on this page, and if the changes are significant, we will draw attention to them more prominently (for certain services, for example, we notify changes by email).

Revision history

Version – V5.4 (English)

Note – Privacy policy amended; English translation

Date – 08.10.2026

Edited by the Data Protection Officer (DPO), dpo@ballisager.com