Privacy Notice

Last updated 29 May 2024

COWI A/S, a company registered in Denmark under company registration number 44623528 (‘us’, ‘we’, ‘our’, ‘COWI), and our affiliated group companies worldwide, recognises and respects the right to personal data protection.

This Privacy Notice applies to all COWI's customers, business partners, customers' end users, visitors to our offices and websites, job candidates and other parties who have a direct or indirect relationship with us.

For the purpose of this notice, the term ‘personal data’ means any information relating to natural persons who can be identified or who are identifiable, directly from the information in question, or who can be indirectly identified from that information in combination with other information.

This privacy notice tells you what kind of personal we process, the purposes of the processing, the legal base or basis we rely on to process this data, for how long we retain it and other privacy related details. The information we process about you will vary depending on your relationship with us and how you interact with us.

When appropriate, we will provide a ‘just in time’ notice to cover any additional processing activities not mentioned in this notice.

Please be referred to our Privacy Notice for Employees, if you are a former or present employee, board member, external consultant, contractor, an agency staff, including those who are not directly employed by COWI.

If you have any questions about how we process your personal data, please do not hesitate to contact dataprivacy@cowi.com.

 

Contents

Contact Information
Clients    
Business Partners and Collaborators    
End Users   
Solicited and Unsolicited Job Applications   
Resource Database 
Outreach Recruitment    
Referees    
Website Visitors    
Office Visitors    
Newsletters    
Social Media    
Satisfaction Surveys    
Events, Seminars, Workshops and Webinars    
General Enquiries    
Video Surveillance    
Whistleblowing    
Personal data pertaining to third parties
COWI MultiViewer    
COWI FieldNotes App    
Recipients of Personal Data    
Transfer of Personal Data    
Retention Practices    
Your Privacy Rights   

 

Contact information

COWI A/S (Data Controller)
Company Registration Number: 44623528
Parallelvej 2
DK-2800 Kongens Lyngby
Denmark
+45 56 40 00 00

COWI Group Privacy Office: dataprivacy@cowi.com

 

Clients

As a client or potential client, we process your personal data to provide our services and to establish or execute an agreement with you or the organisation you represent. This includes the establishment of potential or nurturing of current client relationships and relationships with partners, business partners and similar.

 

The personal data we process: 

• The personal data we process is limited to what is necessary for us to perform the contract to which you are a party or to take steps at your request prior to entering a contract. This may include your name, title, contact information such as email address, telephone number, as well as professional information such as job title, company or organisation name, industry sector, and professional background.
• We may also collect financial information such as billing and payment information, information about the services requested or provided, including project details, timelines, and budgets, and any other information relevant to the provisions of our services.

Our purposes for processing this personal data:

• We use your personal data for various purposes, such as providing our services to you or the organisation you represent, entering and fulfilling contractual agreements, establishing, nurturing, and maintaining our relationship with you or the organisation you represent, communicating with you regarding our services or contractual obligations, and to comply with legal and regulatory obligations. 
• Additionally, we use your personal data for marketing purposes and to target our advertising, such as events and arrangements.

Where we source this personal data from:

• We may source this personal data directly from you, for example when you provide us with your contact details or when you enter into an agreement with us. 
• We may also collect this personal data from the organisation you represent and or from any other party that may be associated with our services.

Our legal bases for processing this personal data:

• Contract: We process your personal data when necessary for the performance of a contract to which you are party or in order to take steps at the request of you prior to entering into a contract.
• Legitimate interest: We process your personal data when necessary to meet our legitimate interests when permitted by law. For example, we rely on this legal basis to manage our contract with you or the organisation you represent, or for us to establish, nurture, and maintain our relationship with you or the organisation you represent. We may also process your personal data when necessary for the establishment, exercise or defence of legal claims.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• If you are participating in any of our joint projects, we may retain your personal data based on the liability period associated with that specific project. The duration of retention is determined by the estimated time it takes to complete the project after its closure, if the design services provided by us will be utilized for physical construction or development. We also consider the relevant statute of limitations or the agreed-upon contractual liability, selecting the longest duration among these factors.

Business Partners and Collaborators

We engage in partnerships and collaborations with numerous business partners and collaborators across various projects. As a result, we may need to process your personal data when we collaborate on a joint project or participate together in a joint venture or a bidding process. This processing of personal data enables us to effectively deliver services to our clients and optimise our collaborative efforts with our partners. We also process the data to facilitate collaboration and partnerships with the involved parties, or to assess the feasibility of establishing contractual relationships. For instance, we may engage in processing this data when participating in joint ventures or partnerships with other organisations or clients.

 

The personal data we process:

• The personal data we may process includes contact information such as your name, email address, phone number, and other relevant contact information. 
• Additionally, we may process professional information such as your job title, company name, business address, and other related professional information, including your CV and details listed therein. 
• Furthermore, we may also process any other personal data that you provide us with during our business interactions or that we consider legitimate to process in the course of our joint projects.

Our purposes for processing this personal data:

• Our processing of personal data of business partners and collaborators is necessary for effective collaboration and delivery of services with them and to our clients. The personal data collected, which may include contact and professional information, enables us to facilitate communication and collaboration, manage contractual and legal obligations, enhance project delivery, and maintain business relationships.
• Furthermore, depending on our relationship, our purpose of our processing is to share your personal data with relevant parties, for example when we submit your information to a client, or when we collaborate in a joint venture. We may also process this data for us to evaluate whether we can enter a contract with you or the organisation that you represent, based on the information submitted to us and depending on whether the information is deemed necessary of our client or other relevant third parties.

Where we source this personal data from:

• We may source this personal data directly from you or from the organisation you represent. This may occur when we collaborate on a project, participate in a joint venture, submit a bid for a project, or when we evaluate, together with our client, if we can enter into contract with you or the organisation you represent.

Our legal bases for processing this personal data:

• Contract: We process your personal data when necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering a contract.
• Legitimate interest: We process your personal data when necessary to meet our legitimate interests when permitted by law. For example, we rely on this legal basis to for the effective collaboration and delivery of services with business partners and collaborators. We also rely on this legal basis to evaluate and manage our relationship with you or the organisation you represent, including assessing and confirming suitability for entering a contract.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• If you are participating in any of our joint projects, we may retain your personal data based on the liability period associated with that specific project. The duration of retention is determined by the estimated time it takes to complete the project after its closure, if the design services provided by us will be utilized for physical construction or development. We also consider the relevant statute of limitations or the agreed-upon contractual liability, selecting the longest duration among these factors.

End Users

We provide a range of online platforms, including COWI PLAN, COWI Multiviewer, Detailhandelsportalen, COWI Dashboard, COWI S-PLAN and other digital solutions to our clients. As an end user of these platforms, we gather various data to provide you with access to the platforms, improve functionality, ensure optimal performance, and to gain insights into how our users engage with our platforms. This information helps us enhance the user experience, identify and troubleshoot any technical issues, and optimise the platforms to meet the needs of our clients and end users.

 

The personal data we process:

• The personal data we may process includes account details, logging information, product interactions, request data, performance data, diagnostic data, end user customer support data and user details such as names, initials, email, employer, title and similar.

Our purposes for processing this personal data:

• We utilise your personal data for a variety of reasons, including fulfilling our obligations to our clients, to personalise your experience and improve the relevance of our services, troubleshooting any errors that may arise, verifying appropriate user interactions with our platforms, detecting and preventing misuse, and for marketing purposes using anonymised data only.

Where we source this personal data from:

• We may source this personal data directly from you, for example when you log onto our platforms and when you interact with our customer support team. 
• We may also source your personal data from the organisation which has granted you access to our platforms, or by completing data entry fields directly within the platform or in connection thereto.

Our legal bases for processing this personal data:

• Legitimate interest: We process your personal data when necessary to meet our legitimate interests when permitted by law. For example, we rely on this legal basis to improve our platforms, to grant access, to help and support end users, to prevent misuse and to use anonymised data for legitimate marketing purposes.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.

Solicited and Unsolicited Job Applications

Our processing of your personal data in connection with our recruitment activities is to assess your qualifications and suitability for a solicited role you have applied for, or if you have submitted an unsolicited application. The personal data may also be used to contact you to progress your application with a view to offering you an employment contract and may further be used to screen if other open job vacancies might be of interest to you.

 

The personal data we process:

• We may process your name, email, phone number, resume, CV, cover letter, language, experience, education, qualifications, citizenship, and any other relevant information required for us to evaluate your application or information you have provided as part of your application.
• As part of our recruitment activities, we may create personal data about you through assessments and personality tests, which have independent privacy notices presented to you beforehand by our test providers. If you are called in for an interview, we may also process this data.
• In some circumstances, we may request a copy of your personal data relating to criminal convictions, offences, or related security measures. We will only collect this information with your prior explicit consent, and if this is reasonable considering the role you have applied for.
• As part of the hiring process, we may request that you answer questions about your self-identified gender to improve our diversity, equity, and inclusion initiatives. In the US, we may also ask questions relating to your race/ethnic group, disabilities, and veteran status to comply with regulations enforced by the Equal Employment Opportunities Commission (EEO Compliance). This information is used for government reporting purposes to which we are subject, but we may also use the data to generate statistics and evaluate whether we attract job applicants across self-identified genders. These questions are completely voluntary and will not be used as selection criteria for the hiring process.
• If your application is successful and you accept our conditional offer of employment, we will retain your application as part of your employee record and process additional personal data about you. Please visit our Privacy Notice for Employees to familiarise yourself with the personal data we may process as part of your employment with us.
• Please do not include personal data such as national identification numbers, data relating to criminal convictions and offences, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning sex life or sexual orientation in your application, unless requested by us directly and unless you agree to disclose this information.
• If you are currently suffering or have previously suffered from an illness that would significantly affect your ability to perform the specific job, please inform us about it no later than during a potential job interview. In such cases, if applicable, we will process this personal data in accordance with relevant data protection regulations

Our purposes for processing this personal data:

• Our processing of your personal data in connection with our recruitment activities is intended to evaluate your candidacy for a particular job, while also ensuring that we provide you with the best possible recruitment experience by keeping you informed of any suitable job vacancies. Our aim is to determine if you are the right fit for the position and to contact you to progress your application with the goal of offering you an employment contract.
• We may also process your personal data if you consent to be obtained in our talent pool prior to the erasure of your candidate profile. We may hereafter contact you to if suitable vacancies arise.

Where we source this personal data from:

• We may source this personal data directly from you when you apply for a job through our recruitment channels or when you send us an unsolicited application.
• We may also source your personal data from our test providers, referees, public authorities, and other third parties if permitted by law.
• We may also source this personal data from third-party sources, including recruitment platforms and websites, as well as social media sites of which you are a member.

Our legal bases for processing this personal data:

• Contract: We process your personal data when necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering an employment contract.
• Legitimate interest: We process your personal data when necessary to meet our legitimate interests as permitted by law. For example, we rely on this legal basis to evaluate and manage our recruitment process, including assessing and confirming suitability for employment. We may also rely on this legal basis if we offer another open vacancy that may be of interest to you. 
• Consent: We process your personal data based on your explicit or implicit consent for certain processing activities. For instance, if we ask you to provide contact details for referees of former employers to collect information about you, we rely on this legal basis. Similarly, if we request a copy of your personal data relating to criminal convictions and offences or related security measures depending on the role you have applied for, we may rely on this legal basis. However, we will always obtain your approval before contacting any referrer or obtaining your data relating to criminal convictions and offences. We may also rely on this legal basis if you consent to be obtained in our talent pool.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• EU/EEA/remaining countries: We retain your candidate profile and application for up to six months. Please be referred to the details below.
• Canada and India: We retain your candidate profile and application for up to two years. Please be referred to the details below.
• USA: We retain your candidate profile and application for up to four years. Please be referred to the details below.
• Your candidate profile is retained based on your candidate country. The countdown to the erasure of your candidate profile is initiated from the last log-on. Before the erasure occurs, you will receive an email requesting you to advise us whether your candidate profile should be erased or included in our talent pool for further storage. If you consent to this processing, we will retain your candidate profile until you delete your profile or until you withdraw your consent.
• Your application is retained based on the country of the job requisition. The countdown to erasure is initiated from the time we have completed our assessment of your application.
• If your application is successful and you accept our conditional offer of employment, we will retain your application as part of your employee record and process additional personal data about you. Please visit our Privacy Notice for Employees to familiarise yourself with the personal data we may process as part of your employment with us, as well as the retention periods we apply.

Resource Database

We provide individuals with the chance to be included in our resource database for potential job opportunities in the future. This process is distinct from our recruitment activities, which involve the evaluation of your personal data solely for the purpose of assessing your qualifications and suitability for a specific role you have applied for. By consenting to be part of our resource database, you give us permission to reach out to you based on the information you have provided and to assess whether you are interested in any available vacancies or project opportunities that align with your profile and skills.

 

Our purposes for processing this personal data:

• We process your personal data if you consent to be included in our resource database, which after we may contact you to assess whether you are interested in any available vacancies or project opportunities that align with your profile and skills. We assess the personal data you have submitted to us to screen if you qualify for future job vacancies.

The personal data we process:

• We may process your name, email, phone number, resume, CV, cover letter, language, experience, education, qualifications, citizenship, and any other information you have provided to us.
• If your application is successful and you accept our conditional offer of employment, we will process additional personal data about you. Please visit our Privacy Notice for Employees to familiarise yourself with the personal data we may process as part of your engagement with us.

Where we source this personal data from:

• We source this personal data directly from you.

Our legal bases for processing this personal data:

• Consent: We process your personal data based on your consent. You may withdraw your consent at any time by deleting your profile in the resource database or by contacting us.
• If your application is successful and you accept our conditional offer, we process your personal data in accordance with our Privacy Notice for Employees.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.

Outreach Recruitment

We engage in outreach recruitment to build a diverse pool of talent with specialised skills and fill positions that are difficult to fill from our existing candidate pool. As part of this process, we collect personal data from third-party sources, including recruitment platforms and websites, as well as social media sites of which you are a member. This data allows us to identify and source talent and evaluate candidates' skills for open positions that match their qualifications and interests.

 

The personal data we process:

• The personal data we may process is your publicly available personal data, including your name, email, phone number, resume, CV, cover letter, primary language, experience, education, qualifications and any other relevant personal data you have made available.

Our purposes for processing this personal data:

• We use your personal data for various purposes, such as identifying and sourcing talent with specialised skills, to evaluating candidates' skills and qualifications for open positions, to build a diverse pool of talent, to fill positions that are difficult to fill from our existing candidate pool and to communicate with candidates during the recruitment process, if applicable.

Where we source this personal data from:

• We may source this personal data from third-party sources, including recruitment platforms and websites, as well as social media sites of which you are a member.

Our legal bases for processing this personal data:

• Legal interest: We process your personal data when necessary to meet our legitimate interests as permitted by law. For example, we rely on this legal basis to attract talented candidates to our workforce. We may also use your personal data to contact you through the above-mentioned platforms, or directly based on the information you have made available, in order to determine if you are open to further recruitment activities as outlined in this Privacy Notice.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data. 
• Personal data related to outreach recruiting is stored according to your settings on the recruitment platforms and third-party websites of which you are a member or when we have assessed whether further recruitment activities should be initiated.

Referees

To attract the right employees to our workforce, we engage with referees of those candidates who apply for solicited and unsolicited job vacancies with us. By conducting reference check interviews with referees, we gain information about the candidate and determine whether they are a good fit for our business. As a referee, it is important to us that we maintain transparency and ensure your understanding of the personal data involved in this process. Therefore, we would like to provide you with information regarding the personal data we process, the purposes behind it, and the legal bases we rely on for processing.

 

The personal data we process: 

• The personal data we may process includes your name, job title, employer, and contact details.
• If you agree to participate in our reference check interview, either electronically or over the phone, we may also process the data you share with us electronically or during the interview. This may include your perspective on the candidate's strengths and weaknesses, providing valuable insights that contribute to our assessment process.

Our purposes for processing this personal data:

• We use your personal data for us to conduct a reference check interview concerning a candidate which has applied for a solicited or unsolicited job which us. As a rule of thumb, we ask the candidate in question to provide us with your contact details before we contact you electronically or over the phone.
• The purpose of the reference check is to gather information about the candidate's work history, education, and characteristics, and we solely use your personal data to establish contact to you, and if you agree to proceed with the interview, to evaluate the candidates' strengths and weaknesses.

Where we source this personal data from:

• We source this personal data directly from a candidate which has applied for a solicited or unsolicited job with us. As part of our recruitment activities, we request your personal data from candidate for us to be able to conduct reference check interviews with appropriate referees.
• We may also source this personal data from third-party sources, including recruitment platforms and websites, as well as social media sites of which you are a member.

Our legal bases for processing this personal data:

• Legitimate interest: We process your personal data when necessary to meet our legitimate interests as permitted by law. For instance, before contacting you as a referee, we rely on this basis to obtain your personal data from the candidate in question and to contact you. Once we reach out to you, we will request your consent to participate in a reference check interview. Your consent is necessary for us to proceed with the interview and record it in the candidate's profile.
• Consent: We may process your personal data based on your consent. Prior to conducting the reference check interview, we ensure to obtain your consent in writing if we contact you electronically, or verbally if we reach out via phone. This consent allows us to proceed with the interview, including filing the interview with the candidate's profile.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.

Website Visitors

We may place cookies on your devise when you visit our websites, for example to personalise content, to provide social media features and to analyse our traffic. We also share information about your use of our websites with our social media, advertising and analytics partners who may combine it with other information that you have provided to them or that they have collected from your use of their services.

Data Transfers: Please note that we may use third-party cookie providers who may transfer your personal data to countries outside the EU/EEA, if you consent to our use of preference, statics and marketing cookies. These countries may not provide for an adequate level of data protection based on a European Commission decision, or other appropriate privacy safeguards. Furthermore, these countries may not have a local supervisory authority to safeguard personal data, and no or limited personal data protection or privacy rights. If you allow for our use of cookies, wholly or partly, you explicitly consent to our transfer of your personal data to these third-party cookie providers.

Joint Data Controllers: Please note that we are so-called 'joint data controllers' with our third-party cookie providers, meaning that we jointly determine the purposes and means of our processing of your personal data, and that we may process personal data for own separate purposes. A comprehensive list of all our third-party cookie providers is listed in our Cookie Notice, including their respective privacy notices and instructions on how to exercise your privacy rights.

 

The personal data we process: 

• The personal data we may process is your IP address, device ID, browser information, location data, user preferences and settings, login and authentication information, session cookies, browsing activity and integration with website features, as well as other personal data which you have made available on third party websites of which you are a member or have visited.

Our purposes for processing this personal data:

• We use your personal data for various purposes, such as to improve website performance and functionality, to remember your preferences, settings and sessions, to provide personalised content and advertising, to track website analytics and user behaviour, and to enhance website security.

Where we source this personal data from:

• We may source this personal data directly from you when visiting our websites and from third-party sources such as other website you have visited.

Our legal bases for processing this personal data:

• Legitimate interest: We process your personal data when necessary to meet our legitimate interests as permitted by law. For example, we rely on this legal basis to place necessary cookies for website functionality purposes, to ensure proper user authentication and website security and to remember your user preferences and settings. 
• Consent: We process your personal data if you consent to our use of preferences, statics, marketing and unclassified cookies. You may withdraw your consent at any time by changing our cookie settings. Please be referred to our Cookie Notice.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• Personal data in relation to the use of our websites is deleted depending on the functionalities you choose to use. The retention period is stated by independent terms that are associated with the functionality, for example if you apply to an open position. Personal data in relation to cookies is retained as stated in our Cookie Notice.

Office Visitors

Our offices receive a diverse range of visitors, including clients, potential clients, suppliers, tradespeople, stakeholders, job candidates, business partners and collaborators. Consequently, we may process your personal data for the purpose of managing your visit and providing you with access to our Wi-Fi network.

 

The personal data we process: 

• The personal data we may process is your name, contact details, company name and job title, contact person in COWI and other information of relevance to your visit.
• If you choose to sign onto our Wi-Fi network, we may process your device information, location data and network activity data.

Our purposes for processing this personal data:

• We use your personal data to provide you with access to our office and ensuring the safety and security of all individuals on the premises, including our assets.
• If signing onto our on-site Wi-Fi, we process your personal data to grant you access to our network, to manage our network and for security and safety purposes.

Where we source this personal data from:

• We may source this personal data directly from you or from the organisation you represent.

Our legal bases for processing this personal data:

• Legitimate interest: We process your personal data when necessary to meet our legitimate interests as permitted by law. For example, we rely on this legal basis to maintain the security of our premises and Wi-Fi network and to manage access control to our offices and networks.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• Personal data in relation to visitors to our offices is deleted 30 days after visit.

Newsletters

To send you news stories, invitations, marketing materials, and other information related to our consultancy services and COWI, we process your personal data as part of your subscription to our newsletters.

 

The personal data we process: 

• The personal data we may process is your name, e-mail, interest areas and other information you may have provided in connection with your subscription.

Our purposes for processing this personal data:

• We use your personal data to send you relevant newsletters and invitations depending on the information you have provided to us. We use your engagement and behaviour to analyse how our subscribers interact with our newsletters and for us to improve our content and distribution.

Where we source this personal data from:

• We source this personal data directly from you upon your subscription.

Our legal bases for processing this personal data:

• Consent: We process your personal data based on your consent.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• We usually retain your personal data in relation to newsletters until you unsubscribe or withdraw your consent, which after we delete it.

Social Media

We use social media to communicate with our target groups and position ourselves as a leading consultant, employer, expert, and stakeholder in the public agenda. We share information about our company, projects, and expertise and engage in conversations about topics that matter to us and our industry on social media platforms such as Facebook, LinkedIn, Instagram, X, YouTube, and Vimeo (social media service providers).

Joint Data Controllers: Please note that we are so-called 'joint data controllers' with our social media service providers, meaning that we jointly determine the purposes and means of our processing of your personal data, and that we may process personal data for own separate purposes.

When you visit our accounts on social media platforms or our websites, where social media plugins are placed, our social media service providers collect and process personal data about your behaviour using cookies. This process is based on the consent you may have given to the social media service provider, even if you do not have an account on these platforms.

Additionally, when you visit our social media accounts, we receive anonymous statistics, such as demographics and geography, regarding visitors to our websites and social media pages using plugins.

For further information about the processing of your personal data and to exercise your privacy rights, please refer to the privacy policies of our social media platform providers:

Facebook Privacy Policy

LinkedIn Privacy Policy

Instagram Privacy Policy

X Privacy Policy

YouTube Privacy Policy

Vimeo Privacy Policy

The personal data we process: 

When visitors and followers interact with our social media accounts by commenting, liking, or sharing our posts, we may collect and process certain personal data that they have made publicly available on their social media profile. This information helps us to better understand our audience and tailor our content to their interests and preferences. We also process your IP-address.

 

Our purposes for processing this personal data:

• We may use personal data collected through social media interactions to improve our products and services, to respond to inquiries and feedback, to target our branding and marketing initiatives, and to measure the effectiveness of our social media campaigns.
• We incorporate social media plugins on our websites to gather information about the number of visitors we receive as a result of our social media advertisements.

Where we source this personal data from:

• We may source this personal data directly from you or the social media platforms of which you are a member.

Our legal bases for processing this personal data:

• Legitimate interest: We process your personal data when necessary to meet our legitimate interests as permitted by law. For example, we rely on this legal basis to communicate with our social media visitors, promote our brand, products, and services, for marketing purposes, statistics, and to gain valuable business insights.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• Personal data in relation to social media is deleted in accordance with your settings, announcements, and/or interactions on our social media platforms. We do not actively store any of your personal data pertaining from social media in our capacity directly. 

Satisfaction Surveys

We are dedicated to consistently enhancing the aspects that hold utmost significance for both our customers and business partners. In order to achieve this, we frequently distribute satisfaction surveys to our clients and business partners who are associated with our diverse services and projects. This practice allows us to gather valuable feedback and insights from our clients and business partners, enabling us to understand their needs, preferences, and areas where we can make improvements.

 

The personal data we process: 

• We may use your name and contact information to send you a survey invitation.
• If you decide to participate in the survey, we will process the feedback or comments you provide, which may include information about the services you have used or the projects you have been involved in. Additionally, we collect data such as your IP address, survey start and end dates, duration, and progress.

Our purposes for processing this personal data:

• The purpose of these surveys is to identify areas for improvement, assess our strengths, and ensure that we are meeting the needs of our clients and business partners. By analysing the feedback, we are able to continually improve our services and maintain our position as a leading consultancy firm.

Where we source this personal data from:

• We may source this personal data directly from you, the organisation you represent, or from any other party that may be associated with our services.

Our legal bases for processing this personal data:

• Legitimate interest: We process your personal data when necessary to meet our legitimate interests as permitted by law. For example, we rely on this legal basis to send you our satisfaction surveys.
• Consent: If you choose to participate in our satisfaction survey, we will process your survey feedback and comments based on your implied consent.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.  
• We store your personal data collected through customer satisfaction surveys for a period of up to two years, after which it is deleted.

Events, Seminars, Workshops and Webinars

We are committed to providing valuable insights, knowledge, and opportunities to our clients, business partners, job candidates, and the public. Through a wide range of events, including seminars, workshops, and webinars, we aim to create informative and engaging experiences for attendees. These events serve as platforms for sharing industry expertise, fostering networking opportunities, and facilitating professional growth.

 

The personal data we process: 

• We may use your name and contact information to grant you access to our events, seminars, workshops, and webinars. Additionally, we may collect other personal data if you choose to provide it, such as dietary requirements, accessibility needs, or other information related to your participation in the event.
• Please be advised that we may take photographs, record videos, and livestream our events, seminars, workshops, and webinars. We do this to share the content of these events with a wider audience and capture the atmosphere of these occasions. We may opt to publish these photographs, videos, and livestreams through our online channels and in print media, if we can identify a legitimate interest to do so.

Our purposes for processing this personal data:

• The purpose of our processing activities is to ensure that you have access to our events, seminars, workshops, and webinars, customized based on your specific needs and preferences. Additionally, we may utilize your personal data to evaluate and improve our offerings.
• In addition, we may use photographs, videos, and livestreams captured during our events for promotional and marketing purposes. These visual materials serve to showcase the impact of our events, enabling us to effectively communicate the value and benefits they offer.

Where we source this personal data from:

• We may obtain this personal data directly from you, as well as through your participation and involvement in our events, seminars, workshops, and webinars.

Our legal bases for processing this personal data:

• Consent: We process your personal data based on your consent if you choose to participate in our events, seminars, workshops, and webinars.
• Legitimate interest: We process your personal data when necessary to meet our legitimate purposes as permitted by law. For example, we rely on this legal basis when you participate in our events, seminars, workshops, and webinars, and we have a legitimate purpose of capturing and sharing the content of these occasions. We also rely on this legal basis for our evaluation and improvement purposes.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• Personal data in relation to your attendance at an event, seminar, workshop, or webinar is retained until you unsubscribe or withdraw your consent, after which it is deleted.

General Enquiries

As an organisation, we receive several enquiries from different sources, including private individuals, the general public, and various entities. These enquiries cover a wide range of topics, including our organisation, the services we offer, and the projects we are involved in.

 

The personal data we process: 

• Depending on the enquiry and what information and personal data you have made available to us, we may process that personal data for us to respond to your query. Generally, we may process your name, contact details, enquiry content and any additional information voluntarily provided in your enquiry.

Our purposes for processing this personal data:

• The purpose of our processing activities is to respond to your enquiry effectively, provide you with the requested information, address your concerns or issues, and offer customer support. In some cases, we may share your personal data with relevant business partners and collaborators if we believe they can address your enquiry and provide the necessary assistance.

Where we source this personal data from:

• We obtain this personal data directly from you when you submit an enquiry through our website, email, phone call, or any other communication channel.

Our legal bases for processing this personal data:

• Consent: We process your personal data based on your consent. By submitting your enquiry, you provide us with the consent to use your personal data for the purposes stated above.
• Legitimate interest: We process your personal data when necessary to meet our legitimate interests as permitted by law. For example, we rely on this legal basis to respond to your enquiry effectively.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• Personal data concerning general enquiries is retained as long as we have a legitimate reason to keep this information, or for as long as it is necessary to provide the services we offer.

Video Surveillance

Depending on the location, we use video surveillance for various purposes, including crime prevention, security enhancement, and the overall safety of our employees and visitors. Additionally, we may utilize the video recordings to exercise or defend legal claims when necessary.

 

The personal data we process: 

• Depending on the location, we may process personal data such as visual images of individuals who are within the field of view, including faces, clothing, and other physical characteristics. We may also process date, time, and location data.

Our purposes for processing this personal data:

• The purpose of our use of video surveillance is for crime prevention, security, and enhancing the safety of our employees and visitors. We may also use the recorded video material as evidence in the event of criminal activities, such as theft, vandalism, or break-ins. In such cases, we may share our video recordings with law enforcement agencies, such as the police, or with our insurance partners and similar.

Where we source this personal data from:

• We obtain this personal data directly from you when you appear in our video recordings.

Our legal bases for processing this personal data:

• Legitimate interest: We process your personal data when necessary to meet our legitimate purposes as permitted by law. For example, we rely on this legal basis in preventing and solving crime and enhancing the safety of our employees and visitors. We also rely on this legal basis when involving law enforcement agencies, such as the police, or our partners.
• Criminal offences: We may process criminal offences, for example, if our video surveillance recordings capture criminal activity. In such cases, our legal basis for this processing is in accordance with Union or Member State law, including when necessary to meet our legitimate interests, which supersedes the interests of the individuals in question.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• We retain the video surveillance recordings in accordance with national legislation depending on the location of the video cameras.

Whistleblowing

At the heart of our organisation, our core value is to do the right thing, always, embodying our fundamental identity and the standards we aspire to uphold. Our utmost priority is to comply with statutory regulations while maintaining the highest levels of ethics and integrity. To adhere to these standards, it is imperative that we identify and prevent any potential misconduct or non-compliant behaviour. To streamline the reporting of such incidents, our whistleblower program is available for employees, partners, and other stakeholders to express their concerns and report any inappropriate behaviour occurring within the various entities of the COWI Group. Reports and inquiries submitted through our whistleblower system are treated with confidentiality and kept separate from COWI Group servers. Whistleblowers have the option to either disclose their identities or submit their reports anonymously, though we strongly encourage you to provide your name and contact details, as this will enable us to address your concerns more effectively.

 

The personal data we process: 

• Generally, we may process your name, contact details, whistleblower concerns, whistleblower report, and any other personal data you choose to share with us. We may also process sensitive personal data, national identification numbers, and personal data related to criminal convictions and offenses, if reported by you or if relevant to the case.
• We may also process this personal data pertaining to individuals involved or connected to the reported behaviour or those under investigation.

Our purposes for processing this personal data:

• We process your whistleblower case to investigate the concerns you have submitted. We may involve our legal partners, the police, and public authorities if required by law or if we have lawful bases or legitimate interests to do so.
• If the whistleblower report identifies individuals, it is our standard procedure to notify these individuals. This notification will be issued once we have received the report, and our authorised personnel initiate the investigation. However, if circumstances surrounding the report necessitate it, such as for the purpose of the investigation or in cases of significant and legitimate interest on the part of the whistleblower or other parties that offset the consideration for the identified individual, the timing of the notification may be postponed or omitted, as permitted by applicable legislation. The notice will not entail the disclosure of information contained within the report, as this content is subject to confidentiality. Furthermore, if revealing the whistleblower's identity, whether directly or indirectly, is unavoidable to provide notification, we will refrain from issuing such notification. In accordance with applicable whistleblower legislation, we do not disclose the whistleblower's identity to the reported person without obtaining explicit consent from the whistleblower.

Where we source this personal data from:

• We source this personal data directly from you when you submit your whistleblower case. We may also source your personal data if you are subject to the whistleblower case or if you are involved in the investigation.

Our legal bases for processing this personal data:

• Consent: We may process your personal data based on your consent. By submitting your name, contact details and other direct or indirect personal data about you to us, you provide us with the consent to use your personal data for the purposes stated above.
• Legitimate interest: We may process your personal data when necessary to meet our legitimate purposes as permitted by law. For example, we rely on this legal basis to investigate the submitted whistleblower case.
• Obligations and exercising specific rights: We may process your personal data when necessary for the purposes of carrying out the obligations and exercising specific rights as required and permitted by applicable legislation.
• Establishment, exercise or defence of legal claims: We may process your personal data when necessary for the establishment, exercise or defence of legal claims.
• Criminal convictions and offences: We may process your personal data relating to criminal convictions and offences if permitted by applicable legislation.
• National identification numbers: We may process your national identification numbers if permitted by applicable legislation.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• In the event that a whistleblower case leads to employment sanctions, the personal data and the case itself will be retained in accordance with national legislation pertaining to the affected employees. For additional information regarding this retention period, please visit our Privacy Notice for Employees.

Personal Data Pertaining to Third Parties

As an integral part of our business operations, we may collect CVs and other personal data pertaining to employees of external companies, including consultancy and construction firms, as well as data from freelancers and independent individuals. This information is gathered and processed to facilitate collaboration and partnerships with the involved parties, or to assess the feasibility of establishing contractual relationships. For instance, we may engage in processing this data when participating in joint ventures or partnerships with other organisations or clients.

 

The personal data we process: 

• Generally, we may process your name, contact details, education, qualifications, CV and the information stated therein, including any additional information which is provided to us or any other personal data which is deemed necessary depending on our relationship.

Our purposes for processing this personal data:

• Depending on our relationship with the company, freelancer or the independent individual, our purpose of our processing is to share your personal data with relevant parties, for example when we submit your information to a client, or when we collaborate in a joint venture. We may also process this data for us to evaluate whether we can enter a contract with you or the organisation that you represent, based on the information submitted to us and depending on whether the information is deemed necessary of our client or other relevant third parties.

Where we source this personal data from:

• We obtain this personal data directly from you when you submit your CV and other personal data to us. We may also obtain this personal data through the organisation you represent.

Our legal bases for processing this personal data:

• Contract: We process your personal data when necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering a contract.
• Legitimate interest: We process your personal data when necessary to meet our legitimate purposes as permitted by law. For example, we rely on this legal basis to evaluate and manage our relationship with you or the organisation you represent, including assessing and confirming suitability for entering a contract or to establish appropriate collaboration.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.

Notifications about sub-processors

COWI may engage standard sub-processors to assist providing our services as stated in our data processing agreements entered with our clients acting as data controllers. We may add, change or remove standard sub-processors from time to time as our business needs may change. Data controllers may subscribe to notifications of our standard sub-processor as listed here: Standard Sub-Processors.

 

The personal data we process:

• If you choose to subscribe to notifications of sub-processor changes or updates, COWI will process personal data such as the name of your organisation and email. We use this information to send you notifications of updates or changes.
• We may also process your name, email and name of your organisation, if you take part of or is party of a data processing agreement with us to inform you of any updates or changes.

Our purposes for processing this personal data:

• We solely use your name, email and name of your organisation to inform you of any changes or updates to our list of sub-processors.

Where we source this personal data from:

• The personal data is sourced directly from you or from the organisation you represent.

Our legal bases for processing this personal data:

• Contract: We process your personal data when necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering a contract.
• Consent: We may process your personal data based on your consent. If you have provided your consent to the processing of your personal data, we may rely on this as a legal basis for processing. You consent to our processing of your personal data when you sign up to notification service.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• Personal data in relation to your subscription to notifications of sub-processor changes or updates is retained until we no longer have any contractual liabilities to notify you about these changes or updates, or until you unsubscribe or withdraw your consent.

COWI MultiViewer

We process personal data in connection with our street photo products in selected countries offered to public authorities and private organisations for professional use. The processing of street photos, and the personal data associated therewith, is to provide tools for public authorities and private organisations for documentation purposes and to improve workflows in various connections. All personally identifiable information, such as faces and license plates, is blurred in the final product.

 

For more information, please be referred to:

COWI MultiViewer Denmark

COWI MultiViewer Faroe Island

COWI MultiViewer Greenland

 

The personal data we process: 

• We process personal data in connection with our street view products (COWI MultiViewer), which are offered to public authorities and private organizations for professional use. In the process of data collection, we may process personal data such as images of buildings, roads, address registration, as well as the date and time the images were taken. In this context, there may be images of individuals and license plates, which are blurred using algorithms. Before blurring the license plates, we may use them to improve the algorithms' blurring techniques and then delete the information.

Our purposes for processing this personal data:

• The street images and accompanying personal data are processed to offer tools to public authorities and private organizations for documentation purposes. This processing aims to improve various workflows for these end users. We train our algorithms' blurring techniques to effectively enhance the blurring of license plates.

Where we source this personal data from:

• The personal data is collected from predefined publicly accessible roads, paths, and areas in accordance with applicable legislation.

Our legal bases for processing this personal data:

• Legitimate interest: We process your personal data when necessary to meet our legitimate purposes as permitted by law. For example, we rely on this legal basis in offering tools to public authorities and private organizations for documentation purposes and to im-prove a wide range of workflows relating to urban development and planning. Furthermore, it is in our legitimate interest to process license plates to improve our blurring techniques.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• The processing of personal data in relation to COWI MultiViewer is carried out until the collection and blurring of data is completed. This process typically takes 6 months, after which the personal data is deleted or blurred.

COWI FieldNotes App

The COWI FieldNotes app is designed to streamline the work process for field work in order to save time and to increase quality. The app is intended for COWI’s employees, external collaboration partners and clients. Use the app to take pictures, make digital notes and annotations to observations onsite and upload it all to a relevant project.

 

The personal data we process: 

• By utilizing the COWI FieldNotes app, we may collect and process certain personal data. This is done to accurately identify you and your device, enhance the functionality of our app, and gather information pertaining to the field notes you generate during app usage.
• In this regard, COWI may process personal data such as your contact information such as your initials, location data such as where your submitted photos and videos were taken, content which you submit such as photos, videos and text and other user-generated content, user and device IDs, activity and usage data, diagnostics such as crash data, performance data and other diagnostic data.

Our purposes for processing this personal data:

• Identification: We process personal data, such as your contact information and user/device IDs, to accurately identify you and your device when using the COWI FieldNotes app.
• Enhancing functionality: We use personal data to enhance the functionality of our app, ensuring a smooth and efficient user experience. This may involve analysing user behaviour and preferences, as well as collecting diagnostic and performance data to improve app performance.
• Field note management: Personal data, including content you submit such as photos, videos, and text, is processed to manage and organize the field notes generated through the app. This allows for better collaboration, tracking, and retrieval of relevant project information.
• Project coordination: Personal data, such as location data where your submitted photos and videos were taken, is processed to facilitate project coordination and communication between COWI employees, external collaboration partners, and clients. It helps in providing accurate information and ensuring efficient workflows.
• Quality assurance: Processing personal data enables quality assurance by monitoring and analysing user-generated content, activity, and usage data. This helps in identifying issues, improving app features, and ensuring the highest possible data integrity and accuracy.
• Troubleshooting and support: Personal data, including diagnostics such as crash data, is processed to troubleshoot app issues and provide support to app users. This allows us to identify and rectify technical problems, enhancing the overall user experience.
• Security and fraud prevention: We process personal data to maintain app security, detect and prevent fraudulent activities, and ensure the protection of user data. This includes monitoring and analyzing user behavior patterns and taking necessary actions to mitigate risks.

Where we source this personal data from:

• The personal data is sourced directly from you as the user. This includes the personal information you provide, such as your contact information, as well as the content you submit, such as photos, videos, and text. Additionally, the app may collect data related to your device, user activity, and usage patterns to enhance functionality and improve user experience.

Our legal bases for processing this personal data:

• Consent: We may process your personal data based on your consent. If you have provided your consent to the processing of your personal data, we may rely on this as a legal basis for processing. You may have consented to the app's terms of use or privacy policy, which include the processing of personal data.
• Legitimate interest: We may process your personal data when necessary to meet our legitimate purposes as permitted by law. For example, we rely on this legal basis for purposes of enhancing app functionality, project coordination, quality assurance, troubleshooting, and security.

How long we retain this personal data:

• Please refer to our Retention Practices for more information about the criteria we use to decide how long we retain your personal data.
• Personal data in relation to the COWI FieldNotes app is stored for as long as you use the app or for as long as it is necessary for the purposes for which the personal data is processed. The retention period may vary depending on specific circumstances, including national limitation periods and liability periods applicable to the projects in which you have submitted your field notes. If required, the personal data may be stored for a shorter or longer duration. We may also use anonymized data to generate various statistics.

Recipients of Personal Data

Sometimes we may share your personal data with other organisations and authorities, but only when this is legitimate, necessary and/or when we have a legal basis or bases to do so. For example, we may share your personal data with:

• Other legal entities in the COWI Group, which is under COWI Holding A/S (Company Registration Number: 32892973).
• We may share your personal data with third parties where necessary for the provision of our services or the fulfilment of our contractual obligations. This may include sharing your personal data with our sub-contractors or partners who are involved in the provision of our services.
• We may also share your personal data with our professional advisers, regulators, or other third parties where required by law.
• As part of the operation of our business, your personal data may be disclosed to external suppliers, including independent data controllers and data processors such as system vendors, external legal councils etc.
• We may also transfer personal data about you to third parties in connection with third-party investments, acquisitions and/or the sale of COWI Group entities or parts thereof.

Transfer of Personal Data

If you are located in the European Economic Area (EEA), please be informed that we may transfer your personal data for the purposes set forth in this notice to countries outside of the EEA. For example, we may transfer your personal data to our COWI Group entities located in e.g., the United States, Canada and India for us to cooperate and function as a global business. We have established the necessary and appropriate guarantees to protect this transfer using the European Commission's so-called Standard Contractual Clauses (SCCs). A copy of these clauses can be obtained by contacting dataprivacy@cowi.com 

 

Retention Practices 

• We retain your personal data for the duration necessary to fulfil the specific purposes outlined above. These purposes may encompass providing our services, offering customer support, meeting contractual and legal obligations, and ensuring the security and integrity of your data. We only maintain data that is pertinent to these objectives.
• Our retention practices adhere to applicable laws and regulations. We conform to the retention periods mandated by the legislation governing our operations. This includes laws related to data protection, taxation, employment, and industry-specific regulations. In instances where specific legal requirements do not specify a retention period, we keep data based on justified needs.
• Personal data may be retained for our legitimate interests if these interests clearly outweigh those of the data subject. For instance, we may keep personal data for the purpose of establishing, exercising, or defending legal claims, whether in court proceedings or in an administrative or out-of-court procedure. This ensures that we can safeguard our rights and interests in legal matters.
• Our commitment to data minimisation means that we endeavour to retain your personal data for the shortest possible duration, unless we have strong justifiable reasons to retain it. Once the data is no longer necessary for the purposes for which it was collected, or otherwise, we take measures to either delete it or anonymise it, making it no longer identifiable to any individual.
• If we process your personal data based on your consent, we will retain this data until the consent is withdrawn or until we decide to delete or anonymise it.

Your Privacy Rights

Under applicable law, you have several rights in relation to our processing of your personal data. If you wish to make use of your rights, please contact dataprivacy@cowi.com

• The right to access: You have the right to request access to the personal data that we process about you, as well as additional information.
• The right to rectification: You have the right to have inaccurate personal data rectified, or completed if it is incomplete.
• The right to erasure: In certain circumstances, you have the right to have personal data about you deleted before the time of our general deletion or anonymisation occurs.
• The right to restrict processing: In certain circumstances, you have the right to request the restriction of the processing of your personal data. If you are entitled to restrict the processing, we may only process your personal data with your consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest.
• The right to object: In certain circumstances, you have the right to object to your processing of your personal data.
• The right to data portability: In certain circumstances, you have the right to receive your personal data in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance.
• The right to withdraw consent: Where the processing is based on consent, you have the right to withdraw your consent at any time. To withdraw your consent, please contact dataprivacy@cowi.com. The withdrawn consent will not affect the lawfulness of the processing before its withdrawal. You will never be penalised for refusing to consent to any processing activities, nor will you be penalised for withdrawing your consent at a later point.
• The right to lodge a complaint: If you wish to complain about the processing of your personal data, please contact dataprivacy@cowi.com. You may also file a complaint to the national supervisory authority. The national supervisory authority responsible for Arkitema K/S is Datatilsynet, The Danish Data Protection Agency, Denmark.
• If you need further guidance in relation to your rights, please contact your national supervisory authority.

Please note that the content of this privacy notice is provided for informational purposes only and is subject to change without prior notice. We recommend reviewing this notice periodically for any updates or changes.