Data Privacy Notice - Applicants

1 Scope
RMIG has a responsibility to protect the rights and privacy of the persons we are involved with, including applicants. 

The scope of this Privacy Notice is to provide mandatory information and to summarise how personal data are processed on applicants ("Data Subjects") in the RMIG Group.

RMIG reserves the right at any time to change the Privacy Notice in its own discretion. The Privacy Notice is available at RMIG’s website at all times.

2 Data controllers
This notice applies to each of the below RMIG group companies (each “RMIG” and combined the "RMIG Group") as data controllers for the processing of personal data: 

Each RMIG company is the data controller, and for recruitment processes relating to senior positions, each RMIG company is joint controller together with the parent company, RMIG A/S in Denmark (see section below).

If at any time you wish to contact us, if you have any question to this Privacy Notice or if you wish to exercise your data subject rights, you may reach out to our Data Privacy Manager at DPM@RMIG.com.

Limit information that you send to us
RMIG kindly asks you only to submit personal data about yourself in your job application, CV, or other relevant material you choose to provide us, to the extent such information is relevant for the specific position you are applying for. 

Therefore, you should not include information about your personal identification number in the submitted documents, and you should consider whether there are other personal details, such as health information, family circumstances, or similar, which are not necessary for RMIG's recruitment process. 

Also, be aware of email communication; if you choose to communicate with us via email, remember that a regular email is not considered secure communication. Therefore, you should not write anything in your email that is private or sensitive, or which you otherwise believe should be protected.

3 Joint controllers
As stated in the section above, each RMIG company is the data controller for the recruitment process. For recruitment processes relating to key positions, the parent company, RMIG A/S in Denmark, has decisive influence and is a joint controller together with the recruiting RMIG company.

The parent company in Denmark is responsible for complying with the GDPR in terms of adhering to the principles and the legal basis, for providing the information included herein, for preparing records of processing, for transfers to countries outside the EEA/UK/Switzerland, for handling any data breaches, responding to your requests for exercise of your rights as described below. 

Each party is responsible for compliance with provisions relating to preparing of risk assessments and implementation of security measures and provisions related to the use of data processors as well as documentation of privacy by design and default.

4 Information about applicants
RMIG collects and stores information about you in connection with your job application at RMIG. The information we process depends on the specific position you have applied for, and it may include:

•  Identification information, such as name, address, telephone number, or email address.
• Other information such as education, diplomas, recommendations, references, etc.
• Personality and aptitude tests (certain positions).
• Criminal record and information on criminal acts (specific positions, e.g. when required by legislation).

As a general rule, RMIG does not process special categories of personal data (sensitive personal data) covered by Article 9 of the General Data Protection Regulation ("GDPR") about you unless you specifically include such personal data e.g. in your job application,  your CV, or you provide it during an interview. However, we may process personal data about health in order to accommodate your needs or to find out if you have any illnesses which could jeopardise your fulfilment of the vacant position.

We do not use any automated decision-making in the recruitment process.

The information which is requested and provided by you in the recruitment process is necessary for us to evaluate the candidates. If you do not provide it, we will not be able to evaluate whether you are suited for the position.

If you are selected for a vacant position, we will also process

• Working and residence permits, as relevant
• National identification number
• Employment contract

This information is necessary to provide to us for contractual compliance purposes and for the purposes of compliance with laws. I you do not provide it, we are unable to enter into an employment contract with you.

5 Purposes
RMIG processes personal data in the application process for the following purposes:

• The administration of the recruitment process, including assessments of personality and aptitude, carrying out interviews and selection of the most suitable job candidate for the vacant position
• With your consent, the purpose is to store you application for later vacancies if you are not employed at the time of application
• Compliance with laws and regulations
• As relevant, safeguarding the commercial and legal interests of the RMIG Group

6 Information sources
RMIG processes the personal data you have provided us by submitting your job application, related materials and during the interviews.

Additionally, RMIG collects personal data from third parties, e.g., from public databases, via LinkedIn or other social media, online searches, or a recruitment agency.

RMIG may also collect statements from previous employers and contacts, such as information about your job tasks and qualifications, however, only if you have agreed to this.

If you have taken tests, RMIG receives the test results from the test provider.

If a criminal record is required, we collect it directly from you or from the national police based on your prior consent.

7 Legal basis
Below, we have inserted the legal basis for each country/region for the processing of personal data. Please beware to read both the local and any separate legal basis for Denmark when the parent company is co-controller (see section below).

Recruitment process for all 

• Legitimate interests: RMIG pursues legitimate interests such as the administration of the recruitment process and the evaluation of job applicants, including hiring the best suited candidate for the specific position, including e.g. carrying out personality tests and aptitude tests. 
  EU/EEA: These are legitimate purposes which have a legal basis in Article 6(1)(f) of the GDPR.
• Criminal data: If we process criminal records for the given vacancy, the legal basis is our legitimate interests in safeguarding the interests of the RMIG Group in preventing crime and protecting RMIG and our trade secrets.
  EU/EEA: These are legitimate purposes which have a legal basis in Article 6(1)(f) of the GDPR.
• Denmark: For the records which include criminal convictions and offenses, the processing of personal data is based on Section 8(3-5) of the Data Protection Act as the processing, including a possible disclosure, can take place when it is necessary in order to pursue a legitimate interest which clearly overrides the interest of the data subject. 

If you are selected for one of our vacant positions

• Permits: If you are selected for employment, we process personal data on working and residential permits as well as national identification numbers as we are required under national laws to ensure that foreigners have the right to work in the country.
  EU/EEA: Article 6(1)(c) of the GDPR on legal requirements combined with national laws on residence and working permits
• Employment contract: The processing of the employment contract is necessary to take steps at your request before entering into an employment contract
  EU/EEA: Article 6(1)(b) of the GDPR on contractual relationships
• National identification numbers: If you are selected for employment, we process personal data on national identification numbers under the applicable tax legislation as we are required under national laws to report income to tax authorities and withhold and pay taxes to the relevant public authorities. 
  EU/EEA: Article 6(1)(c) of the GDPR and In Denmark, this is subject to Section 11 of the Danish Data Protection Act.

Job bank

• Job bank: If you are not selected for the position you have applied for, but your profile is interesting to us, and you accept further storage of your personal data for a potentially relevant and future vacancy, this storage takes place based on your consent
  EU/EEA: Article 6(1)(a) of the GDPR

8 Recipients
If deemed necessary, RMIG may disclose personal information about you to certain third-party recipients, such as intra-group companies or service providers in connection with the recruitment process, including recruitment agencies.

RMIG also uses data processors to provide certain functions in connection with the recruitment process. This applies, for example, to a supplier of a system that can handle applications. RMIG has concluded data processing agreements with the suppliers, and such suppliers will only process personal data about you on behalf of and in accordance with the instructions given by RMIG.

We pass on information to authorities if we are required to do so by law.

9 Transfer of personal data to a country outside the EU/EEA, UK and Switzerland
Personal data may be transferred to countries outside the EU/EEA, UK and Switzerland in which case RMIG ensures that such transfers will be carried out in accordance with the applicable data protection laws. This means that any party outside the EU/EEA that receives your personal data will ensure an adequate level of protection, e.g. by entering into the EU's standard contract clauses with RMIG. RMIG will adopt supplemental measures if necessary for the specific transfers. You can receive a copy of the legal basis for transfers upon request. Please contact DPM@RMIG.com.

10 Storage of personal data
If you have not been selected for the vacant position, we delete personal data no later than 6 months after the employment process has been completed. However, if RMIG stores your personal data for relevant future recruitment based on your consent, we will delete the data in accordance with the consent given. If you withdraw your consent before then, we will delete your personal data as soon as possible.

If the law obliges us to store the recruitment information for a longer period, or, on a case-by-case basis, if the purpose of storing the information is the establishment, defense or exercise of a legal claim, the period may be longer.

If you are employed with RMIG, you application file will be kept together with you personnel file and will be stored according to the Privacy Notice for Employees.

11 Rights of the data subjects
RMIG has implemented a number of measures to protect your personal data and ensure your rights. As a Data Subject you have certain rights which RMIG is obliged to fulfil unless otherwise exceptionally provided by the data protection legislation. These rights include the right to be informed, the right of access, the right to rectification, the right to erasure ("the right to be forgotten"), the right to restriction of processing, the right to data portability, the right to object, the right not to be subject to a decision based solely on automated processing, including profiling. Please note that certain limitations may apply to your ability to exercise these rights, for example, when your right to obtain the information is found to be overwritten by essential considerations of private interests.

If RMIG is processing personal data based on your consent, you also have the right to withdraw this consent at any time. Please note that withdrawal of consent does not affect the lawfulness of the processing prior to the withdrawal of the consent.

To exercise any of your rights, you can contact RMIG Data Protection Manager by e-mail at DPM@RMIG.com.

If you disagree with the way in which RMIG processes your personal data, you may file a complaint with the relevant data protection supervisory authority in the country which is data controller. 

However, we encourage you to contact us first at DPM@RMIG.com for a closer dialogue and mutual agreement.

Version: November 2024