Privacy Policy
Welcome to Epico's privacy policy.
Version 3.0 - updated 26/3-2026
When you visit our website, register in our CV database, are a customer of ours or otherwise interact with us, we collect information about you. Below, we have elaborated on what information is collected, for what purposes, and described which third parties have access to the information.
Please also see our Cookiepolitik for information on which cookies we use.
We are the data controller – How do you contact us?
Epico-IT A/S
Borupvang 2C, 2. Floor
2750 Ballerup
CVR: 32466249
Email: dataprivacy@epico.dk
1. What is personal data
The Danish Data Protection Agency defines personal data as follows:
"Personal data is any form of information that can be attributed to a specific person, even if the person can only be identified if the information is combined with other information."
2. Processing of personal data
We process your personal data in different ways and for different purposes. Below you can read more about how your personal data is processed:
Website visitors
Purpose
When you use our website, we collect and process a range of information about your behaviour for the purpose of compiling statistics on the use of the website, improving security, and enabling targeted marketing.
Types of personal data
We collect a unique ID and technical information about your computer, tablet or mobile phone, your IP address, geographical location, and which pages you click on (interests). We process personal data about your visit (e.g. information about how you access our websites, how you navigate around them, which pages you visit, content you view, your searches, advertisements you have seen, etc.). This personal data is obtained through cookies, log files and other technologies. You can read more about our use of cookies here: https://www.epicogroup.com/da.
Legal basis for processing
Our basis for processing essential cookies is our legitimate interests in making our website available to you in accordance with Article 6(1)(f) of the General Data Protection Regulation. Our basis for processing non-essential cookies is based on your consent in accordance with Article 6(1)(a) of the General Data Protection Regulation and Section 3 of the Executive Order on Cookies.
Storage period
We store personal data collected in connection with your visit to our website for 24 months. Information that we collect for statistical purposes is stored for 24 months, after which it is automatically deleted.
Automated decisions and profiling
We do not use personal data collected in connection with your visit to our website for automated individual decisions.
Creation in CV database
Purpose
When you create a profile on our website, we collect and process information about you in order to manage your profile.
Types of personal data
We process the information you have entered, including your general contact details such as name, email address, telephone number and address.
Legal basis for processing
Our basis for processing is the agreement with you, cf. Article 6(1)(b) of the General Data Protection Regulation, as well as our legitimate interest in being able to manage your profile in the CV database pursuant to Article 6(1)(f) of the General Data Protection Regulation.
Period of storage
The information will be stored until you request deletion of your profile. If you do not use your profile, update your CV or respond to our enquiry regarding job opportunities for 4 years, your profile will be deleted. One month before your profile is deleted, we will contact you to clarify your continued interest in remaining in our database. If we are unable to contact you, your profile in the CV database will be deleted at the end of the 4-year period.
Automated decisions and profiling
We use your information to screen our candidates, but we do not use personal data in connection with automated individual decisions.
Acqusitions of job opportunities
Purpose
When you create a profile on our website and upload your CV to our CV database, we collect and process information about you and your job profile in order to match you with relevant job opportunities, including freelance assignments, project-based employment and permanent positions with third parties.
Types of personal data
We process the information you provide to us, including your CV, whether you are seeking full-time employment, are a freelancer or NextGen, your application, if any, and other information you provide on your profile. We do not process sensitive personal data as part of our recruitment process. We therefore encourage you to refrain from including such information (e.g. information about health, religion, political beliefs or sexual orientation) in your CV, application or other material you send to us.
Legal basis for processing
Our basis for processing your information is our legitimate interest in assessing whether you are the right candidate for a position, cf. Article 6(1)(f) of the General Data Protection Regulation.
Retention period
The information will be stored until you request deletion of your profile. The countdown to the date of inactivity will be suspended while you are on assignment for Epico or otherwise active on your profile in the CV database. If you have been on contract, we will store the data required by Danish accounting legislation in our relevant systems for 5 years. The storage is for documentation purposes. If you have not been on contract, do not use your profile, do not update your CV or do not respond to our enquiry regarding job opportunities for 4 years, your profile will be deleted.
Automated decisions and profiling
We use your information to screen our candidates, but we do not use personal data in connection with automated individual decisions.
Signing confidentiality agreements
Purpose
Before informing you about potential positions or assignments, certain companies may require you to sign a confidentiality agreement. This is because the job title or nature of the assignment may contain trade secrets. In this case, your personal data will be processed to ensure mutual confidentiality.
Legal basis for processing
The processing of personal data is carried out for the purpose of implementing measures taken prior to entering into a contract in accordance with Article 6(1)(b) of the Data Protection Regulation or our legitimate interests in maintaining confidentiality agreements with you in accordance with Article 6(1)(f) of the Data Protection Regulation.
Types of personal data
Only your name and signature are processed in connection with this processing. Recipients of personal data We disclose your personal data to companies with relevant job opportunities. However, personal data is not disclosed outside the company without prior written agreement, but is entrusted to data processors. We only use data processors in the EU/EEA or in countries that can provide adequate protection for your data.
Retention period
You can always obtain a copy of the confidentiality agreement, which is stored for a period of 5 years in order to handle any disputes.
Automated decisions and profiling
We do not use personal data in connection with automated individual decisions.
Use of AI in the recruitment process
Purpose
We use artificial intelligence (AI) as a tool to improve our recruitment processes and ensure an efficient and accurate assessment of CVs from both freelance consultants and candidates for permanent positions. AI technology helps us analyse and match qualifications, experience and skills with the requirements of the various positions. The data that customers provide to us, including job descriptions, values and the like, is used exclusively for the purposes described in this privacy policy and in the contracts entered into with customers.
Types of personal data
We process the information described in this privacy policy, including general contact information, information from CVs, applications, etc., as well as information from our customers about job descriptions, company values, etc.
Legal basis for processing
Our basis for processing is the processing basis we have described in more detail in this privacy policy, including our legitimate interest in being able to assess whether you are the right candidate for a position, cf. Article 6(1)(f) of the General Data Protection Regulation. This constitutes profiling under Article 4(4) of the General Data Protection Regulation, but not a decision without human intervention under Article 22 of the General Data Protection Regulation, see also below.
Retention period
The information will be stored for as long as you have an active profile on our website. See more about storage and deletion under the sections 'Creation in CV database' and 'Acquisition of job opportunities'.
Automated decisions and profiling
We use AI to screen candidates or freelance consultants, but we do not use personal data to make decisions based solely on automated processing.
Enquiries via the website, email or telephone
Purpose
When you contact us by telephone, via contact forms or email, we collect and process personal data for the purpose of responding to your enquiry.
Types of personal data
We process your contact details, including your name, company, position (if applicable), telephone number and email address. In addition, we process the content of your enquiry, which may include information about your current position, job preferences, CV, etc.
Legal basis for processing
Our basis for processing is our legitimate interest in being able to follow up on your enquiry and subsequently contact you in accordance with Article 6(1)(f) of the General Data Protection Regulation.
Retention period
The information will be deleted no later than 24 months after the last processing if no collaboration or customer relationship is established.
Automated decisions and profiling
We do not use the personal data collected through enquiries in connection with automated individual decisions.
Registration for webinar
Purpose
When you register for a webinar, we collect and process personal data about you for the purpose of administering the webinar, enabling you to participate in the webinar and sending you relevant material.
Types of personal data
We process information such as your name, email address, title, organisation (volunteer) and your IP address.
Legal basis for processing
Our basis for processing is our legitimate interests in holding the webinar in accordance with Article 6(1)(f) of the General Data Protection Regulation or your consent in accordance with Article 6(1)(a) of the General Data Protection Regulation and Section 10 of the Marketing Practices Act.
Retention period
The information will be deleted no later than 24 months after the webinar has ended or until you have unsubscribed from receiving relevant material from us.
Automated decisions and profiling
We do not use personal data in connection with automated individual decisions.
Receipt of newsletter
Purpose
When you sign up for our newsletter, we collect and process personal data for the purpose of sending out our newsletter.
Types of personal data
We process information such as your name, email address and IP address, as well as your use of the marketing material we send you, e.g. whether you have opened emails from us, read emails, etc.
Legal basis for processing
Our basis for processing is your consent in accordance with Article 6(1)(a) of the General Data Protection Regulation and Section 10 of the Danish Marketing Practices Act. You can withdraw your consent at any time by writing to us at marketing@epico.dk . It is also possible to unsubscribe from the newsletter via an "unsubscribe" link at the bottom of the newsletter. You can read more about the legal effect in section 7.
Retention period
We store personal data about you as a recipient of our marketing for as long as the contact is active and you have not withdrawn your consent. If you withdraw your consent, documentation of the original consent will be stored for two years from the date of withdrawal in accordance with the guidelines and requirements of the Consumer Ombudsman. Our legal basis for processing this documentation is our legal obligation under Article 6(1)(c) of the General Data Protection Regulation.
Automated decisions and profiling
We do not use personal data collected via newsletters for automated individual decisions.
Use of references and testimonials
Purpose
When you agree to provide a testimonial about our company and services, we process your personal data for the purpose of using the testimonial in our marketing.
Types of personal data
We process information such as your name, email address, position, company and your statement itself. Legal basis for processing Our basis for processing is your consent in accordance with Article 6(1)(a) of the General Data Protection Regulation and Section 10 of the Danish Marketing Practices Act. You can withdraw your consent at any time by writing to us at marketing@epico.dk . You can read more about the legal effect in section 7.
Retention period
The information will be deleted no later than 36 months after it has been published.
Automated decisions and profiling
We do not use personal data collected for the purpose of references and statements in connection with automated individual decisions.
Visitors to social media
Purpose
When you visit our Facebook, Instagram and LinkedIn pages, we collect and process your personal data. The purpose of the processing is to be able to market ourselves to potential customers, respond to enquiries and similar related purposes.
Types of personal data
We process the personal data that you yourself have made available on our social media, including your name, reactions, opinions, etc.
Legal basis for processing
Together with the social media providers, including Meta (Facebook and Instagram) and LinkedIn, we are joint data controllers for the collection that takes place on our respective company profiles. This means that the social media providers also process personal data from our company profiles for their own purposes, over which we have no control or responsibility. Similarly, personal data may be transferred to countries outside the EU/EEA. It is our understanding that this is done legally under the EU-U.S. Data Privacy Framework (DPF).
When using Facebook, we have entered into a joint data responsibility agreement that clarifies the division of roles and responsibilities between the parties. The agreement can be read here.
When using LinkedIn, we have also entered into a joint data responsibility agreement that clarifies the division of roles and responsibilities between the parties. The agreement can be read here.
Our basis for processing is our legitimate interests in making content available and marketing our services through social media in accordance with Article 6(1)(f) of the General Data Protection Regulation.
Storage period
The information is stored for as long as your activity on our Facebook, Instagram and LinkedIn pages exists and for a maximum of 3 years after publication.
Automated decisions and profiling
We do not use personal data collected on our social media in connection with automated individual decisions.
Use of our services as a customer (company)
Purpose
When you use our services as a customer, we collect and process personal data for the purpose of providing our services to you. This includes identifying and presenting suitable candidates for positions at your company and sending you relevant information and news about our services and related topics. If you pay for our services, we may also process your personal data for the purpose of issuing and sending invoices and fulfilling our obligations under the Danish Accounting Act.
Types of personal data
We process information such as name, email address, telephone number, title and department. In connection with invoicing, we also process an internally generated invoice number, what you have purchased and payment information.
Legal basis for processing
Our basis for processing is the agreement with you pursuant to Article 6(1)(b) of the General Data Protection Regulation, our legal obligations to store information pursuant to the Danish Accounting Act pursuant to Article 6(1)(c) of the General Data Protection Regulation, and our legitimate interests in managing your personal data as a customer of ours pursuant to Article 6(1)(f) of the GDPR.
Retention period
The information is stored for as long as the customer relationship exists. After the end of the customer relationship, personal data is stored in accordance with the Danish Accounting Act for a subsequent period of five (5) years from the end of the financial year to which the accounting material relates.
Automated decisions and profiling
We do not use personal data about our customers in connection with automated individual decisions.
Communication for sales purposes
Purpose
We may collect and process personal data from third parties (via interviews, the company's website, social media or similar) for the purpose of selling our services.
Legal basis for processing
The processing of personal data is carried out in accordance with legitimate interests under Article 6(1)(f) of the General Data Protection Regulation. We weigh up the desire for processing against the desire not to process and ensure that the processing does not violate fundamental rights.
Types of personal data
We collect your name, title, email address, telephone number and company name. Recipients of personal data Personal data is not disclosed outside the company but is entrusted to data processors. We only use data processors in the EU/EEA or in countries that can provide adequate protection for your data.
Retention period
The information will be deleted within 24 months of the last processing if no collaboration or customer relationship is initiated, or if it is assessed that the information is necessary in relation to the processing.
Automated decisions and profiling
We do not use personal data in connection with automated individual decisions.
Job applications for a specific position at Epico-IT or a third party
Purpose
When you send us a job application, we process your information for the purpose of assessing and selecting the applicant for a specific job.
Legal basis for processing
The processing of personal data is carried out under legitimate interest pursuant to Article 6(1)(f) of the Data Protection Regulation. We weigh the consideration that you yourself have submitted the personal data for the purpose of being assessed in relation to a specific job.
Types of personal data
The personal data contained in the application and CV is processed for the purpose of evaluating the application. We and any third parties will also evaluate and assess the applicant's performance and skills through an interview.
Recipients of personal data
For personal data disclosed for a specific position at Epico, the personal data will not be disclosed outside the company but will be entrusted to data processors. Our data processors will only process your personal data for our purposes and on our instructions. For personal data disclosed for a specific position at a third party, the personal data will only be disclosed to the specific company that you are informed of at the time of disclosure. We only use data processors in the EU/EEA or in countries that can provide adequate protection for your data.
Retention period
The information will be deleted within 6 months of rejection if no dialogue about possible employment is initiated.
4. Security
We have taken technical and organisational measures to protect your information against accidental or unlawful deletion, disclosure, loss, deterioration or unauthorised access, misuse or other processing in violation of the law. We regularly conduct internal follow-ups on the adequacy and compliance of policies and measures.
We also ensure that your personal data is deleted in a secure manner when it is no longer necessary to process it.
5. Sharing of personal data
We may disclose your personal data to other suppliers and/or service providers in connection with the normal operation of our business.
We may also disclose your personal data to a public authority and external advisors, e.g. auditors and lawyers, in situations where we are specifically obliged to disclose your personal data in accordance with legislation and notification obligations to which we are subject. If it becomes necessary to report a matter to the police as a result of, for example, CCTV surveillance or a telephone conversation, we may disclose your personal data to the police.
It may, for example, be necessary to disclose personal data to the following recipients:
Companies that have relevant job opportunities
We try to limit the disclosure of data in a personally identifiable form and thus the disclosure of information that can be traced back to you personally. We may also entrust your personal data to data processors. Our data processors only process your personal data for our purposes and on our instructions.
6. Transfer of personal data to countries outside the EU/EEA
We may transfer personal data to countries outside the EU/EEA that the European Commission considers having an adequate level of protection. We may also transfer your personal data to countries outside the EU/EEA that have not been pre-approved as having an adequate level of data protection. Such transfers are made on the basis of the EU Commission's Standard Contractual Clauses (SCC), which have been specifically designed to ensure an adequate level of protection. For companies established in the United States, the transfer may also be based on the company's adherence to the EU-U.S. Data Privacy Framework (DPF).
We regularly assess whether the basis for transfer is adequate and, if necessary, implement additional measures to ensure an adequate level of protection.
You can read more about the transfer of personal data to countries outside the EU/EEA on the European Commission's website. You can also find an overview of US companies registered with the DPF here: https://www.dataprivacyframework.gov/s/participant-search
If you would like further information about our transfer of personal data to countries outside the EU/EEA, please feel free to contact us.
7. Your rights
You have a number of rights in relation to the processing of your personal data. These rights mean, among other things, that you can obtain information about what personal data we hold about you and, under certain conditions, have the data deleted.
If you wish to exercise any of your rights, please contact us by email at dataprivacy@epico.dk. We will then contact you regarding the rights you wish to exercise and to verify your identity.
The right of access
You have the right to request access to the personal data we process about you. This means that you can ask us what personal data we process for what purpose, etc.
The right to object
You have the right to object if you disagree with a specific processing operation. This means that the information may still be used for other legitimate purposes. Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing.
The right to request rectification
You can request that personal data that you believe to be incorrect be rectified.
The right to request erasure
You may request the deletion of personal data that you believe we should not or are not allowed to have registered. This right is not absolute, as certain personal data cannot be deleted due to other legislation or if an agreement and purpose give the right to store the personal data.
The right to request restriction
You may request that the processing of personal data be restricted. This means that the personal data will not be deleted, but that it has been specified that it may not be processed and that access to it is restricted.
The right to data portability
You have the right to have your personal data delivered to you in a machine-readable format. Please note that this only applies to personal data that you yourself have provided to us and only if your personal data is processed by automated means on the basis of your consent or a contract with you. You have the right to have your personal data, which you yourself have provided to us, transferred to you in a structured, commonly used and machine-readable format.
Right to withdraw consent
If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. This can be done by sending an email to marketing@epico.dk. Withdrawing your consent will not have any negative impact. However, it may mean that we will not be able to fulfil specific requests from you in the future. Withdrawing your consent will not affect the lawfulness of processing based on consent before its withdrawal. Furthermore, it will not affect any processing carried out on other legal grounds.
Voluntary/obligatory nature of providing personal data
Providing personal data is voluntary, however it is necessary for the conclusion and performance of the agreement with us (if applicable). The provision of certain data may be required by applicable laws. Providing data for purposes for which the basis for processing is consent is voluntary, but necessary for achieving the purpose specified in the consent statement.
Right to complain
If you have any questions about the processing of your personal data, please feel free to contact us at dataprivacy@epico.dk.
If you are dissatisfied with our processing of your personal data, you can lodge a complaint with or contact the Danish Data Protection Authority (Datatilsynet) or your local data protection authority. See more at http://www.datatilsynet.dk. You may also, at any time, bring a case before the courts to have a matter concerning the processing of personal data clarified.
Version 3.0, updated on 26 March 2026