Introduction

This Privacy Notification describes how we collect and process personal data concerning you when you apply for a job at Cubris.

The data controller of the collection and processing of your personal data is:

Cubris ApS

CVR-nr.: 31744172

Industriparken 39

2750 Ballerup

+45 46 97 54 00

gdprlink@cubris.dk

Collection and processing of your personal data

Job applicants

Purpose

We collect and process the personal data that appears on your application and CV as well as any supporting documents for your application. If you are invited to an interview, we collect and evaluate the information you provide to us in this regard. The purpose of collecting and processing your personal data is to assess your suitability for the position.

Categories of personal data

Below you will find an explanation of personal data that we collect and process concerning you.

Contact information, job application, CV and any supporting documents

We process your contact information (name, direction, e-mail and phone) and personal data that appears in your job application, your CV, including any supporting documents such as educational certificates or recommendations.

Background checks

When we access your application, we may obtain publicly available personal data concerning you from Linkedin, Facebook, Google, etc., to the extent that the information is considered relevant to the position in question. We will typically look at information about your previous employment, activities, competencies, including your general appearance.

Reference checks

As part of our evaluation of you and your application, we may obtain references from your former and/or current employer if you consent to this. If necessary, we will obtain references on your professional and social skills.

Personality test and cognitive ability test

In some cases, you will be asked to complete a personality test and/or a cognitive ability test, which will be used to assess your suitability for the position. The tests are usually carried out after the first interview and only for applicants who are eligible for the position. The tests shed light on and evaluate the applicant’s natural and learned behavioral traits, preferences, strengths and development opportunities and cognitive ability.

Sources

We collect personal data concerning you as applicant from a recruitment agency. We also collect personal data directly from you as applicant.

Legal bases for processing

• Contact information, job application, CV and any supporting documents: GDPR, art 6(1)(f) (legitimate interest). Legitimate interest is justified by the need to assess and evaluate the application and to invite to and conduct job interviews.
• Background check: GDPR, art 6(1) (f) (legitimate interest). Legitimate interest is justified by the need to assess and evaluate the applicant’s suitability for the position.
• Reference check: GDPR, art 6(1) (a) (consent).
• Personality test and cognitive ability test: GDPR, art 6(1)(f) (legitimate interest). Legitimate interest is justified by the need to assess and evaluate the applicant’s suitability for the position.

Retention period

If you are an unsuccessful job applicant, we delete your personal data when the recruitment process ends, unless you have given us consent to store personal data concerning you for up to 6 months from the receipt of the application.

If you are a successful job applicant and becomes an employee at Cubris, we will keep your personal data for the duration of your employment and up to 5 years after the employment has ended.

Recipients

We may share your CV with our parent company Thales Group, if your CV impresses us. Our legal basis for transfer of your CV to Thales Group is GDPR art 6(1) (f) (legitimate interest). Legitimate interest is justified by the need to access whether you as applicant may be suitable for positions at Thales Group.

Your privacy rights

Right to withdraw consent

You have the right to withdraw your consent at any time in case that our processing is based on your consent. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right of access

You have the right to obtain from Cubris the confirmation as to whether personal data concerning you are being processed, and you have the right of access to personal data concerning you.

Right to rectification

You have the right to obtain from Cubris the rectification of inaccurate personal data and you have the right to have incomplete personal data completed.

Right to erasure

Your personal data is deleted when it is no longer necessary in relation to the purpose for which it was collected (se section “retention period”). For compelling reasons, you have the right to have some types of personal data deleted before the end of our usual retention period. If you withdraw your consent and we do not have another legal base for processing your personal data, you have the right to have your personal data deleted, unless we have a legal obligation to retain the data.

Right to restriction

In exceptional circumstances, you have the right to have the processing of your personal data restricted.

Right to data portability

You have the right to data portability of personal data provided by yourself when the processing is based on consent or performance of an agreement with you and the processing is carried out by automated means. If you have the right to data portability, information will be provided in a commonly used and machine-readable format that you can transfer to another service provider, if technically feasible.

Right to object

You have the right to object to processing of your personal data, if the data controller processes your data on point of:

• The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• The processing is necessary for the data controller or a third party to pursue a legitimate interest, unless your interests or fundamental rights and freedoms that require the protection of personal data prevail.

Questions

If you have any questions, concerns, or complaints about our processing of your personal data, you can contact us (see contact details in the section “Introduction”).

We process inquiries as soon as possible and we usually respond no later than one month after receipt of the inquiry unless it is not possible due to the complexity or scope of the request. In this case, the deadline for replying may be up to 3 months after the date of receipt of the request, cf. GDPR, art 12(3).

Danish Data Protection Agency

You have the right to lodge a complaint with the Danish Data Protection Agency, if you are dissatisfied with the way we process your personal data. You can find the Danish Data Protection Agency’s contact information on www.datatilsynet.dk.

Updates to this Privacy Notification

This Privacy Notification was last updated on 8th of March 2023.