PRIVACY NOTICE FOR EMPLOYEES

Last updated 08 March 2024

COWI A/S, a company registered in Denmark under company registration number 44623528 (‘us’, ‘we’, ‘our’, ‘COWI’), and our affiliated group companies worldwide, recognises and respects the right to personal data protection.

This Privacy Notice for Employees applies to all COWI's former and present employees, board members, external consultants, contractors, and agency staff, including those who are not directly employed by COWI.

For the purpose of this notice, the term ‘personal data’ means any information relating to natural persons who can be identified or who are identifiable, directly from the information in question, or who can be indirectly identified from that information in combination with other information.

During and after your employment, or relationship or interaction with us, we receive and process personal data about you for various reason.

This privacy notice tells you what kind of personal data we process, the purposes of the processing, the legal base or basis we rely on to process this data, for how long we retain it and other privacy related details. The information we process about you will vary depending on your location, role, and personal circumstances. Please be aware that data privacy laws may vary in different jurisdictions where COWI operates, and that this privacy notice is a general guide to how we process your personal data.

This notice should be read in conjunction with our general Privacy Notice and our other group policies, notices, and procedures. When appropriate, we will provide a ‘just in time’ notice to cover any additional processing activities not mentioned in this notice.

If you have any questions about how we process your personal data, please do not hesitate to contact dataprivacy@cowi.com

Contents

1) Contact Information

2) Personal Data We Process

3) Purposes for Our Processing

4) Legal Bases for Our Processing

5) Recipients of Personal Data

6) Transfer of Personal Data

7) Retention Periods

8) Sources of Data

9) Your Privacy Rights

10) Other Terms

1) Contact Information

The controller of your personal data is your COWI entity employer as stated in your employment agreement, or otherwise stated. Ultimately, these entities process your personal data in accordance with instructions from:

COWI A/S
Parallelvej 2
2800 Kongens Lyngby
Denmark

To contact our Group Privacy Office, please contact dataprivacy@cowi.com

Please find our global contact detail and offices here

2) Personal Data We Process

We may collect and process several categories of personal data about you as part of your employment or relationship with us as described below:

  • Personal details, such as your name, gender, nationality, employee photos, date of birth, driver’s license, languages spoken, and other personal details which can be used to identify you.
  • Contact details, such as private addresses, phone numbers, email addresses, emergency contacts such as next of kin, and other contact details.
  • Employment details, such as job title, position, office location, hire and termination dates, employment agreements or engagement, offer letters, work contact details, work location, employment number, business unit details, initials, performance and disciplinary records, grievance procedures and documents, eligibility-to-work information, time registration, sickness and holiday records, termination details and agreements, reason for termination, surveys and interviews, promotion and demotion information, remuneration information, overtime and bonus details, benefits, incentive schemes, pension details, expense and reimbursement claims, attendance and absence records, holiday and vacation days, requests and approvals, communication during work or via our platforms, return to work interviews and details, HR and manager communications, appraisals, business travel details, Personal Development Plan (PDP), Employee Development (ED), personality tests, safety approvals, billability, purchases, certifications, photos and videos from social events, subscriptions to various work related offers and benefits, as well as other personal data that relates your employment, relationship and interaction with us whether or not this relates to an employment with us. We may also process other categories of personal data about you provide to us, or data which may source from third parties, if legitimate and permitted by law.
  • Education, professional and private background, such as academic and professional qualifications, former employments, education, CV and job applications, assessment data, details of offers made to you, references, interview notes, beneficiary and dependents information, marital/civil status, and other private related details, if legitimate and permitted by law.
  • National identifiers, such as national ID, passport details, immigration status and documentation, visas, work authorisations, social security numbers, national security numbers, citizenship, country registration certificates and/or similar. We may process further details if you take part in a secondment agreement or otherwise if involved in a mobility case.
  • Financial information, such as banking details, tax information, payroll information, withholdings, salary, bonuses, benefits, expenses, company and car allowances, stock details, and other financial information.
  • IT and facility information, such as information required to provide access to our IT-systems and networks such as IP-addresses, device addresses, use of our resources and facilities, log files, login information, sites visited, software and hardware inventory, IT-incidents and history, and e-mails sent and received using our platforms.
  • Sensitive data, criminal and offence information, such as information about short- and long-term sickness or disabilities, which we may process in accordance with applicable law. In rare cases, if permitted by law and depending on your location and personal circumstances, we may also process personal data related to trade union membership, health, criminal convictions and offences, and related security measures. If you are subject to a workplace incident, a near-misses, a psychosocial incident, stress and/or harassment, we may process a number of details about the incident and how this has impacted you.
  • Control measures, including CCTV monitoring at offices, GPS monitoring of vehicles and equipment, logging and control of the use of the internet, programs, systems and e-mails, access to our locations, and time registration. We only conduct these control measures, if permitted by law, and if these measures pursue an operational purpose, are none-offensive, and if proportionate.
  • Other personal data you choose to share with us.

We may ask you to provide other personal data not described above. In these cases, we will make clear to you why we need the data, what we use it for, and all other statutory information.

We may process these personal data after employment, or after our relationship comes to an end, if the processing is lawful, legitimate or for the establishment, exercise or defence of legal claims.

3) Purposes for Our Processing

We use your personal data primarily for the purposes of managing our employment or relationship with you and for other legitimate business purposes such as:

  • Managing our relationship with you, to carry out our employment or service agreement with you or the organisation you represent, to manage our human resource processes, to monitor your performance, to provide you with access to our business services and benefits, and to align expectations, goals and activities for learning and development. We also process your personal data for us to comply with legal obligations such as labour and employment laws, health and safety, whistleblower requirements, and tax and anti-discrimination laws. We may also process personal data when the processing is necessary for the establishment, exercise or defence of legal claims, e.g., in connection with disciplinary actions or termination.
  • Managing of business activities such as billing clients for completed work, and for travel, education and expense claims.
  • Managing of next of kind data for security purposes so that we are able to contact family and/or relatives in case of immediate illness, accidents or similar. We may also use this data for secondment and mobility purposes.
  • Managing and disclosure of your professional CV as part of your employment or relationship with us to bid and participate in projects of relevance for our business.
  • Managing of workplace security such as various IT-logs, video surveillance and access to our premises. We do this to protect our business, our employees and visitors.
  • Managing our whistleblower cases in connection with your reporting to us or as part of our investigation of a case in which you are involved.
  • Managing of your engagement if this data is not anonymised. We use this data to determine what we do right and wrong, and for us to act based on your feedback. We also carry out this processing for us to assess talent capacity, to identify critical positions and succession for critical positions. We also carry out workplace assessments for us to monitor our work environment for compliance purposes, and for us to improve in areas when needed.
  • Managing our business relations after end of hire. This means that we may store emails send and received on mail systems provided by us. Mails of business relevance may be read after your employment. The purpose of the processing is to store data of relevance to our business and to maintain customer relationships. We do not actively store or read mails which contain private content.
  • Managing and compliance with employment, immigration, tax and other statutory laws when we are subject to these and for us to fulfil our agreement or relationship with you.
  • Managing the establishment, exercise or defence of legal claims.
  • Processing for other legitimate purposes reasonably required for day-to-day operations.

4) Legal Bases for Our Processing

We may only process your personal data when we have a legal basis or bases to do so. We rely on the following legal bases when processing your personal data, depending on the personal data concerned and the context in which we process it:

  • Contractual obligation: We process your personal data when necessary to perform and fulfil the contractual obligations we have with you. For example, we rely on this legal basis to carry out our employment agreement with you.
  • Legal Obligation: We process your personal data when necessary for us to comply with legal obligations to which we are subject. For example, we rely on this legal basis when we share personal data with local tax authorities.
  • Legal interest: We process your personal data when necessary to meet our legitimate purposes when permitted by law. For example, we rely on this legal basis when we grant you access to our IT systems, when we bill our clients, and when we process your personal data to meet our everyday business needs.
  • Vital interest: We process your personal data when necessary for us to protect your vital interests or someone else's vital interest. For example, we may share information about you in the event of an emergency.
  • Consent: We only process your personal data based on your consent, explicit or implicit, when we are not able to rely on any other legal bases. For example, we may ask for your consent to participate in marketing material or for us to obtain and process your criminal record when appropriate.

5) Recipients of Personal Data

Sometimes we may share your personal data with other organisations and authorities, but only when this is legitimate, necessary and/or when we have a legal basis or bases to do so. For example, we may share your personal data with:

  • Other legal entities in the COWI Group, including COWIfonden and other funds and staff associations.
  • Clients, potential clients, and other business partners.
  • Public authorities and government bodies, as well as third parties, when required by law or when the transfer of personal data is legitimate, for example, in relation to the establishment, exercise, or defense of legal claims.
  • As part of the operation of our business, your personal data may be disclosed to external suppliers, including independent data controllers and data processors such as system vendors and pension and insurance providers.

Please note that we may transfer relevant personal data about your employment with us, if considered lawful, necessary and legitimate for tendering in projects to be undertaken on behalf of or together with third parties. We may also transfer personal data about you to third parties in connection with third-party investments, acquisitions and/or the sale of COWI Group entities or parts thereof.

6) Transfer of Personal Data

If you are located in the European Economic Area (EEA), please be informed that we may transfer your personal data for the purposes set forth in this notice to countries outside of the EEA. For example, we may transfer your personal data to our COWI Group entities located in the United States, Canada and India for us to cooperate and function as a global business. We have established the necessary and appropriate guarantees to protect this transfer using the European Commission's so-called Standard Contractual Clauses (SCCs). A copy of these clauses can be obtained by contacting dataprivacy@cowi.com

7) Retention Periods

We retain your personal data as long as we need it to carry out the purposes as described above, or as otherwise required or permitted by law. Generally, we retain your data as long as you are employed by us, or as long as your relationship with us is ongoing, plus as long as we are legally allowed to. For example, we may retain your data to comply with tax and accounting requirements to which we are subject, or as long as we have legitimate business needs. We always seek to retain your personal data for the shortest time possible, either by deleting or anonymising it. If we process your personal data based on your consent, we will retain this data until the consent is withdrawn or until we decide to delete or anonymise this data.

8) Sources of Data

We collect your personal data from various sources such as:

  • Yourself, for example when you enter an employment agreement with us, when you give us the data directly or when we collect this data from you indirectly to fulfil our described purposes above.
  • Referees, for example when we obtain your consent to contact your former employers to collect information about you in connection with our recruitment activities.
  • Employees, for example if you are subject to a whistleblower case or if you are involved in a near-miss or accident.
  • Business partners, external individuals and organisations, for example if we receive a complaint about you or when we use a vendor to conduct a personality test on behalf of us.

9) Your Privacy Rights

Under applicable law, you have several rights in relation to our processing of your personal data. If you wish to make use of your rights, please contact dataprivacy@cowi.com

  • The right to access: You have the right to request access to the personal data that we process about you, as well as additional information.
  • The right to rectification: You have the right to have inaccurate personal data rectified, or completed if it is incomplete.
  • The right to erasure: In certain circumstances, you have the right to have personal data about you deleted before the time of our general deletion or anonymisation occurs.
  • The right to restrict processing: In certain circumstances, you have the right to request the restriction of the processing of your personal data. If you are entitled to restrict the processing, we may only process your personal data with your consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest.
  • The right to object: In certain circumstances, you have the right to object to your processing of your personal data.
  • The right to data portability: In certain circumstances, you have the right to receive your personal data in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance.
  • The right to withdraw consent: Where the processing is based on consent, you have the right to withdraw your consent at any time. To withdraw your consent, please contact dataprivacy@cowi.com. The withdrawn consent will not affect the lawfulness of the processing before its withdrawal. You will never be penalised for refusing to consent to any processing activities, nor will you be penalised for withdrawing your consent at a later point.
  • The right to lodge a complaint: If you wish to complain about the processing of your personal data, please contact dataprivacy@cowi.com. You may also file a complaint to the national supervisory authority. The national supervisory authority responsible for COWI A/S is Datatilsynet (The Danish Data Protection Agency), Denmark.

If you need further guidance in relation to your rights, please contact your national supervisory authority.

10) Other Terms

The terms listed below only applies to those individuals who consent to these separately from this notice:

Terms of Consent for COWI’s Use of Your Photo (CV Database)

These terms are only applicable for the COWI Group’s (‘us’, ‘we’, ‘our’, ‘COWI’) processing of your photo for use in our professional COWI CVs. Our employees’ professional CVs are crucial for our business as these are used for proposals and in projects. However, we need your positive opt-in consent before we may include your photo in our processional CVs. The purpose of this processing activity is to personalize the CVs we use as part of proposals and in projects.

  • By uploading your photo, you consent to COWI’s use of your photo in COWI’s professional CVs as part of proposals and in projects.
  • By uploading your photo, you consent to having your photo added to COWI’s CV database. Your photo will hereafter be visible to other employees in the COWI Group and may be disclosed and transferred to customers and potential customers, public bodies and public authorities, business partners and other independent data controllers as part of COWI’s professional CVs.
  • Please note that your consent to this processing activity is solely your decision and that you may withdraw your consent at any time. COWI will never require you to provide your consent against your will, COWI will never penalise you for refusing to consent to this processing activity, nor will COWI penalise you if you withdraw your consent later on.

You photo referred to in these terms may be disclosed or transferred to the following categories of recipients as part of our processional CVs: COWI Holding A/S and other companies in the COWI Group, customers and potential customers, public bodies and public authorities, business partners and other independent data controllers.

We may transfer your photo to third countries, e.g., to countries outside the EU/EEA where the COWI Group is present. We have established the necessary and appropriate guarantees to protect this transfer. A copy of the guarantees can be obtained by contacting dataprivacy@cowi.com.

We retain your photo until you delete it or until you withdraw your consent, or in line with our general CV retention period as stated in this Privacy Notice for Employees.

Under applicable law, you have a number of rights in relation to our processing of your personal data, including the right of access, right to rectification, right of erasure, right to restrict processing, right to object, right to data portability, rights related to automated decision-making incl. profiling, and the right to complain to a supervisory authority. Please be referred to section 9 (Your Privacy Rights) for further details.