This policy explains how we collect, use and protect personal data about the people we deal with in our business, other than candidates. It covers temporary workers, clients, suppliers and other business contacts, referees, emergency contacts and dependants, website users, staff alumni and visitors to our premises. Separate notices apply to:
References to the GDPR include the EU General Data Protection Regulation (2016/679), the Danish Data Protection Act and, where relevant, the UK GDPR.
The data controller is Tessero Denmark A/S, Kongens Nytorv 8, 1050 Copenhagen K, Denmark ("Tessero", "we", "us"). Our data protection team can be contacted at denmark@tesserogroup.dk or by post at the address above (marked "Data Protection Team").
Where we and other Tessero group entities jointly determine why and how personal data is processed, we act as joint controllers under Article 26 GDPR. You can exercise your rights against any of us using the contact details above.
Temporary workers employed or engaged directly by us (in addition to the data in our Candidate Privacy Notice)
Personal data: Staff number, CPR or other identifier; workplace; leave and absence; travel; residence and work permits; performance, bonuses and promotions; grievances and disciplinary matters; sickness absence (health data)
Purposes: Running the employment relationship: payroll and invoicing, terms of work, performance and feedback, absence management, and meeting tax and other statutory duties
Legal basis (GDPR): Contract; legal obligation; legitimate interests. Health data: where required or permitted by employment law, otherwise with consent
Clients and their employees
Personal data: Name, job title and contact details; engagement with our website, emails and candidate profiles; information you give us; call recordings and video footage (with consent); identity documents where verification is required
Purposes: Providing our services (candidates, RPO, MSP, consultancy, training for your employees); managing the relationship; B2B marketing; satisfaction surveys and market research; obtaining candidate references; identity verification; investigations and whistleblowing reports
Legal basis (GDPR): Legitimate interests; consent (recordings, cookies, marketing where required); legal obligation
Suppliers and other business contacts (e.g. investors)
Personal data: Name, job title and contact details; business bank details; identification number; information you or others give us; identity documents and video ID footage
Purposes: Managing the relationship and payments; statutory checks (e.g. that social contributions are paid); identity verification; investigations; legal claims
Legal basis (GDPR): Contract; legal obligation; legitimate interests
Referees, emergency contacts and dependants
Personal data: Name, contact details, date of birth, marital status; references given; limited health data or data from which other sensitive information can be inferred, where needed for benefits
Purposes: Obtaining references; contacting you in an emergency; administering employee benefits and pay; marketing to referees only with opt-in consent
Legal basis (GDPR): Legitimate interests; employment law obligations; consent (marketing)
Website users
Personal data: Name and contact details (if provided); IP address, device, log, usage and location data; preferences
Purposes: Providing services you sign up for (e.g. newsletters, webinars, surveys); securing our systems and preventing fraud; improving and personalising our websites
Legal basis (GDPR): Legitimate interests; contract; consent (non-essential cookies and marketing); legal obligation
Staff alumni
Personal data: Name, contact details, date of birth, gender, photograph, marital status, nationality; education and employment history
Purposes: Running our alumni network; newsletters, events, vacancies and opinion polls
Legal basis (GDPR): Legitimate interests; consent (marketing)
Visitors to our premises
Personal data: Name, date of birth, ID document, vehicle registration, email, job title, purpose of visit; CCTV images; guest Wi-Fi device data; health and travel information where needed for health and safety
Purposes: Visitor management; security of our premises; guest Wi-Fi; protecting staff and visitors from infectious diseases
Legal basis (GDPR): Legitimate interests; public interest in public health (Art. 9(2)(i)) for health data
Sources. We collect data from you directly. We also collect it from your organisation; our candidates, temporary workers and staff; background check, pension and benefits providers; tax authorities; medical professionals (in limited cases); market research, event delegate lists, B2B data vendors and public sources; and automatically through our websites, emails, CCTV and Wi-Fi.
Required data. Some data is required by law (e.g. a CPR number for payroll) or by contract. If you do not provide it, we may be unable to work with you.
Legitimate interests. We rely on our interest in running and developing our recruitment business: maintaining relationships, providing relevant services, keeping our premises and systems secure, and handling claims and investigations. You can object at any time (see section 6).
Consent. Where we rely on consent, you can withdraw it at any time. This does not affect processing carried out before you withdraw it.
If you switch on marketing cookies and we can recognise you as an existing candidate or contact (for example, because you clicked a link in one of our emails), we record which pages of our website you view and link this to your record in our recruitment system, so that we can suggest relevant roles and follow up with you. We rely on your consent for this.
We only make decisions based solely on automated processing (Art. 22 GDPR) where this is necessary for steps you have asked us to take before entering into a contract.
Some providers process data as independent controllers for their own purposes (e.g. security, legal compliance or anonymised product improvement) under their own privacy policies.
When we transfer data outside the EEA, we rely on an adequacy decision, the EU Standard Contractual Clauses, another approved mechanism, necessity for a contract in your interest, or your consent.
Deleted data may remain in archives and back-ups for a limited time. There it is put beyond use and removed from back-ups where technically feasible.
You have the right to:
Contact denmark@tesserogroup.dk. We will respond within one month and may need to verify your identity. Access is free unless a request is manifestly unfounded or excessive.
Under Danish law, we may refuse access where crucial private interests prevail (e.g. protecting trade secrets or enforcing civil claims). We may also refuse erasure of data processed on the basis of legitimate interests where overriding legitimate interests apply.
You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, tel. +45 33 19 32 00, dt@datatilsynet.dk.
Our website uses cookies and similar technologies. Strictly necessary cookies are always on. Analytics and marketing cookies are set only if you switch them on, and you can reject them as easily as accept them. You can change your choice at any time through the Cookie Preferences link on every page. The Cookies section of our group privacy page, Privacy at Tessero, explains each cookie we use, what it is for, who sets it and how long it lasts.
We use appropriate technical and organisational measures to protect your data. Please tell us immediately if you suspect misuse.
We are not responsible for third-party websites or services linked from ours.
We may update this policy and will publish changes on this page.