ENICMA Privacy Policy

This is a faithful translation of the Danish policy. In the event of a discrepancy, the Danish version prevails.

1. Who this policy applies to

This policy describes the processing of personal data about:

• employees with access to ENICMA on the web or in the employee app;
• applicants and prospective employees who use onboarding, approval or security forms through a personal link;
• former employees, for as long as their data is retained; and
• persons mentioned in incident reports, medic reports or other work-related documentation.

ENICMA is a closed internal workforce management system for employees. It is not a public or commercial consumer platform. Accounts are created by the employer, and access is provided by invitation and activation and restricted according to role and employment relationship.

2. The data controllers

Each company below is an independent data controller for data about its own applicants and employees. They are not joint controllers and are not processors for each other.

Coopers Crew ApS
CVR no. 44237598
Hammerensgade 1, 2. th.
1267 Copenhagen K
Denmark

Coopers Security & Intelligence ApS
CVR no. 44239027
Hammerensgade 1, 2. th.
1267 Copenhagen K
Denmark

The company to which you apply, by which you are invited or with which you are employed is the controller of your data. For other data subjects, such as persons mentioned in a report, the controller is the company whose assignment or employee the report concerns.

3. Contact and Data Protection Officer

Privacy enquiries and requests to exercise rights may be sent to:

contact@coopers-security.dk

The Data Protection Officer (DPO) for both companies is attorney Mario Rosenvold. The DPO may be contacted at the email address above or through the relevant controller's full postal address in section 2.

4. What data we process

4.1 General personal data

Name, address, email, telephone number, date of birth, employee ID, role, skill tags, employment details, shift schedule and shift responses, time registrations, holiday and neutral absence data, personnel administration correspondence, qualification and approval status, and application, CV and references.

4.2 National identification data

The Danish civil registration number (CPR number) is processed as a separate national identification number. A CPR number is not in itself special category data under Article 9 of the GDPR.

4.3 Pay and financial data

Bank details, tax information, pay and hours data, and accounting records.

4.4 Special category data

Health data may be processed where necessary, for example data concerning sickness absence, work adjustments, reimbursement or occupational injury. Other Article 9 data is processed only where specifically necessary and supported by a separate legal basis.

4.5 Data concerning criminal offences and authorisation

For employee categories for which a check is necessary, relevant data concerning criminal offences, a criminal record certificate obtained or inspected, the date and outcome of the check, and authorisation or authority-approval status may be processed. See section 8.

4.6 Data from the employee app and portal

Login and multi-factor authentication, shift schedule, shift responses, shift-swap requests, time registrations with any comments, acknowledgement of work messages, notifications, and the user's name, email address, telephone number and role.

4.7 Technical data

IP address, browser and device information, timestamps, activity and security information, and push token, device ID, device name, app version, platform and notification permission status when notifications are enabled.

4.8 Images, video, documents and report data

Internal identification or work photographs, documentation photographs from specific incidents, uploaded documents, and data about persons mentioned in incident or medic reports. Professional images and video for marketing are processed only with separate, voluntary permission.

ENICMA does not use tracking, targeted advertising or advertising and analytics SDKs and does not collect data about you across other apps or websites.

5. Where the data comes from

Data may come:

• from you when you complete a form, use employee functions or contact us;
• from your employer when your profile and employment relationship are administered;
• from your device when you sign in or enable notifications;
• from public registers, the police or another competent authority where relevant and lawful;
• from customers or partners where necessary for a specific assignment; and
• from employees, witnesses or other reporters when you are mentioned in an incident or medic report.

Where data was not obtained from you, the relevant company must separately assess whether and how you are to be informed under Article 14 of the GDPR. This assessment is particularly relevant to persons mentioned in incident and medic reports and must take account of any lawful exemptions and the need to protect investigations, confidentiality and the rights of others.

6. Purposes of processing

We process data to:

1. recruit, enter into and administer employment relationships and create employee access;
2. schedule shifts, staff assignments, manage shift swaps and operate the business;
3. register working time and administer pay, tax, pension and accounting;
4. administer personnel, holiday, absence, work adjustments and necessary correspondence;
5. assess and document qualifications, authority approvals and authorisations where necessary;
6. protect the system through access control, security checks and prevention of misuse;
7. document incidents, medic operations and assignment performance;
8. establish, exercise or defend legal claims;
9. send work-related messages and notifications; and
10. use images or video for marketing where separate, voluntary permission has been given.

7. Legal bases by main purpose

Ordinary necessary HR, payroll, absence, scheduling and personnel administration is not generally based on consent. Use of the app does not constitute consent.

An ordinary customer requirement is not in itself a legal obligation or an independent legal basis. If a customer requirement makes a check relevant, the relevant company must first document necessity, proportionality and a valid legal basis.

Where processing relies on legitimate interests, a specific balancing assessment is carried out, and you may object, see section 17.

8. Criminal record certificates, criminal offences and authorisation of security personnel

For employees who are to perform security work requiring authorisation for Coopers Security & Intelligence ApS, relevant data concerning criminal offences is processed as part of assessing and documenting whether the employee may be approved and authorised for security work under the rules governing security businesses. Relevant data concerning criminal offences and the employee's suitability forms part of the police's or another competent authority's assessment of whether the employee may be approved for security work.

The processing is not a general check of all employees. A distinction is made between:

• security personnel and other employee categories for which authority approval or authorisation is required;
• employees of Coopers Crew ApS, who are not automatically subject to the same authorisation requirements; and
• other functions for which a check may take place only following a separate, documented assessment of necessity, proportionality and legal basis.

A distinction is also made between three forms of processing:

1. Processing by the authority: The police or another competent authority assesses relevant data concerning criminal offences and the employee's suitability under the applicable approval scheme.
2. Coopers' check: The relevant Coopers company may obtain or inspect a criminal record certificate where the check is necessary and has a documented basis.
3. Documentation of status: Coopers may retain limited documentation of check and approval status without retaining details from the certificate for longer than necessary.

The processing must have a relevant Article 6 basis and comply with Article 10, section 8 of the Danish Data Protection Act and the specific authorisation and approval scheme.

The criminal record certificate itself is deleted as soon as possible after the check is completed and, as a general rule, no later than 30 days afterwards. Where necessary, the following limited documentation may be retained for the ordinary employment-related retention period:

• the date of the check;
• whether approval was obtained or refused;
• authorisation or approval status;
• the validity period; and
• who carried out the internal check.

Specific details about convictions, offences or other content of the certificate must not be retained for longer than necessary.

9. Use of the ENICMA employee app

The employee app provides access to limited employee functions. Employees can sign in, view their own and available shifts, respond to shifts, create and respond to shift-swap requests, register time, read work messages and receive notifications. The app may display the employee's name, email address, telephone number and role, but it does not provide a function for employees to view or edit other HR master data.

The app does not display CPR numbers, bank details, criminal record certificates, security screenings, onboarding responses, HR notes, health or absence documentation, or employment documents. Such data is processed in the administrative web application or through separate external flows and is available only to authorised roles.

The app uses local storage on the device for the login session and settings. It does not use cookies or similar technologies for marketing or statistics.

10. Push notifications and device data

If you allow notifications, a push token is registered together with a device ID, device name, app version, platform and permission status in order to deliver work-related messages. Notifications are delivered through Apple's notification service. You can turn them off at any time in your device settings.

11. Onboarding, data approval and security flows outside the app

Some data is collected through personal, time-limited links that normally open in a browser. This may include onboarding, approval of data, contract signing, documentation concerning criminal record certificates or authorisation, security screening and incident reporting.

Access links may be time-limited, revocable and single-use. New active tokens are generally stored in hash-protected form. Historical delivery or log data may require separate remediation, so we do not describe all link data as absolutely non-reconstructable.

12. Mandatory and voluntary data

The relevant form or context identifies which data is mandatory and which is voluntary. Data necessary to enter into or administer employment, complete statutory reporting, assess a required authorisation or staff an assignment must be provided if that purpose is to be carried out.

If necessary data is not provided, the consequence may be that an application cannot be processed, an employment relationship or pay cannot be administered correctly, a required authority approval cannot be documented, or the employee cannot be assigned to the relevant task. A failure to provide voluntary data does not have those consequences, and voluntary consent may be refused or withdrawn.

13. Recipients and categories of processors

Where necessary, data may be disclosed or entrusted to:

• the hosting, database, storage and operations platform for ENICMA;
• the edge and network provider delivering traffic and TLS;
• the transactional email provider;
• Apple as provider of the notification service for iOS devices;
• Microsoft 365/Microsoft Graph for document and contract handling;
• public authorities and registers, including the authority responsible for approving security personnel;
• customers and partners with the data necessary for a specific assignment, but not as an independent basis for criminal record checks; and
• advisers, including auditors, lawyers and insurers, where necessary.

Timezynk is not an active integration. Medic SMS is not an active service where no provider is configured.

14. Transfers outside the EU/EEA

We seek to keep processing within the EU/EEA. Third-country transfers may occur through global operations, network, email or notification services. A transfer may take place only on a valid basis, such as an adequacy decision or the European Commission's Standard Contractual Clauses with any necessary supplementary measures.

Information about the transfer mechanisms used can be obtained by contacting contact@coopers-security.dk.

15. Retention periods and manual compliance

Main rule: Necessary data concerning the employment relationship is retained during employment and for up to 5 years after termination. It is deleted earlier if it is clearly no longer necessary.

Accounting material: Accounting and bookkeeping material is retained for 5 years from the end of the financial year to which it relates. If a document is both employment and accounting material, the longest relevant period is applied.

Detailed health data, medical certificates and other sensitive documentation are retained only for as long as the specific need exists. Incident reports are retained for up to 5 years. Data may be retained for longer under a documented legal hold in an occupational injury, insurance, authority or dispute matter. A legal hold is lifted when the need ceases.

The system does not perform automatic deletion or anonymisation. Until any automation has been implemented, a documented manual deadline register is maintained. A review is carried out on each termination, monthly for categories with 30- and 90-day deadlines, and at least annually for all other categories. The responsible person, review date, categories covered, deletions, justified exceptions and any legal holds are documented. The short 30- and 90-day deadlines must therefore be met without depending on the annual review.

16. Security and access restrictions

Access is granted according to role and work-related need. CPR numbers and bank details are stored in encrypted form. Login data and active access tokens are protected using appropriate technical measures, including hashing where supported by the specific solution. Data transferred to and from the ordinary services is protected using HTTPS/TLS; this is not a guarantee that every conceivable item of internal or external traffic is always encrypted.

Access requires authentication, and selected roles use multi-factor authentication. Significant actions are recorded in security and audit trails that are access-restricted and protected against unauthorised alteration; they are not described as technically immutable. Files are held in non-public storage areas.

17. Your rights

Depending on the circumstances, you have the right to:

• access the data we process about you;
• rectification of inaccurate data;
• erasure where the conditions are met;
• restriction of processing;
• object to processing based on legitimate interests;
• data portability for data you provided and which is processed by automated means on the basis of contract or consent; and
• withdraw consent without affecting the lawfulness of processing before withdrawal.

You may contact contact@coopers-security.dk. We generally respond within one month. Accounts are created and closed by the employer; direct account deletion in the app is therefore not promised, but you may request deactivation of access and erasure of data where the conditions are met.

18. Limitations, automated decisions and complaints

Data cannot always be erased immediately. It may remain necessary to document the employment relationship, comply with accounting, tax and reporting rules, document authority approvals, or establish, exercise or defend legal claims. In those circumstances, access is restricted where appropriate until erasure can take place.

No decision producing legal effects or similarly significantly affecting you is made solely by automated processing, and no profiling with such effects takes place.

You may lodge a complaint directly with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, www.datatilsynet.dk. You are not required to contact Coopers first.

19. Changes to this policy

The policy is updated when the processing, legislation or system changes materially. The current version is published in the same place, and material changes are communicated through relevant work-related channels.

20. Version date