Privacy notice for applicants and job candidates at Cookie Information A/S

Last modified: 29th of January 2026

In accordance with articles 13 and 14 of the General Data Protection Regulation (GDPR), this privacy notice describes how Cookie Information A/S (“CI”, “we” or “us”) process personal data about candidates for positions with us.

1. Data controller

The legal entity responsible for the processing of your personal data is:

Cookie Information A/S
Company Registration (CVR) no. 38 75 82 92
Købmagergade 19, fourth floor
1150 Copenhagen K
Denmark
privacy@cookieinformation.com
+45 89 87 47 54

2. Description of processing activities

2.1. Recruitment

In order for us to manage the recruitment process (including: reviewing applications, contacting candidates, conducting interviews, qualification tasks, and making a hiring decision), we may process the following categories of personal information about you:

  • Name
  • Contact information, including address, telephone number and e-mail address
  • Information on educational background, including diplomas
  • Information on current and prior occupation, including appraisals and other statements from prior employers
  • Information on specific competencies, e.g. languages spoken, certifications, etc.
  • Results from tests taken during the recruitment (personality and skills tests)
  • References
  • Any other information provided by you
  • Information posted on your profiles on social media, such as LinkedIn

We collect data either directly from you or from persons you have allowed us to contact for references as well as from social media.

We will process your personal data based on the following legal basis:

  • Article 6(1)(b) of the General Data Protection Regulation, as the processing is necessary for the entering into or performance of a contract with you.
  • Article 6(1)(f) of the General Data Protection Regulation, as the processing is necessary for us to pursue our legitimate interest in identifying the most relevant candidates to offer employment to.

We may disclose your personal information to external advisors supporting us in the recruitment process. Furthermore, we share your personal information with providers of IT-services, such as hosting of our IT systems, including systems used for personality and skills testing.

If the recruitment process results in you being employed with us, the information from the recruitment process will be transferred to your personnel file and stored in accordance with the retention procedures for information about employees as set out in our privacy notice for employees.

If we are not able to offer you a position – or if you reject a job offer from us – we will keep your personal data for up to 6 months from the end of the month we were mutually informed that you will not be working with us. However, we may ask you for consent to store your information for a specified period.

However, under special circumstances such periods may be shorter or longer, e.g. if data is necessary for us to comply with a legal obligation or to establish, exercise or defend a legal claim. 

3. Export of personal data to third countries

We are using:

  • BambooHR as our HR system. BambooHR is based in Utah, USA and is using Amazon Web Services as a data processor. 
  • Google Workspace as documents repository. Google is based in the USA and data is hosted in Google’s US based data center. 
  • Fireflies.ai as an AI supported automated meeting notes taking tool. Fireflies.ai is based in the USA.

For every of the above services, we ensure a legal basis under the General Data Protection Regulation for such transfers by the use of Standard Contractual Clauses or – where applicable – the EU-US Data Privacy Framework. 

4. Mandatory information

Any information you provide to us is provided voluntarily. However certain information is required to process your application. If you do not provide this information, it may affect our possibilities to offer you a relevant position with us.

5. Your rights

You have the following rights:

  • You are entitled to request access to, rectification or erasure of your personal data.
  • You are also entitled to oppose the processing of your personal data and to request restriction of the processing of your personal data.
  • If the processing of your personal data is based on your consent, you are entitled to revoke such consent at any time. Revocation of your consent will not affect the lawfulness of the processing carried out prior to your revocation of consent.
  • You are entitled to receive personal data which you have provided to us in a structured, commonly used and machine-readable format (data portability)
  • You can always lodge a complaint with a data protection authority, for example the Danish Data Protection Agency (https://www.datatilsynet.dk/).

Such rights may be subject to conditions or restrictions. Accordingly, there is no certainty that you will be entitled to for example data portability in the specific situation; it will depend on the circumstances of the processing.

You can exercise your rights by contacting us, using the contact information provided in section 1.

6. Updates to this notice

We may update this privacy notice on an ongoing basis when this is necessary to provide a fair description of our processing of personal data, or where changes in relevant legislation causes a need for updates of the document.

If we make material changes to how we process  your personal data already in our possession, we will inform you of the update (e.g. by email).