1. Introduction

At Klimate ApS, Hauser Plads 30A, st., 1127 København K, Denmark, CVR no. 41057165 ("Klimate"), we understand the importance of processing personal data securely and confidentially. This Privacy and Cookie Policy ("Privacy Policy") is intended for our website visitors, customers, business partners, suppliers, job applicants, and other persons with whom we interact with. Klimate is committed to complying with the requirements and obligations relating to the processing of personal data under applicable law, including the General Data Protection Regulation ("GDPR").

Klimate is the data controller for the processing of your personal data. This Privacy Policy provides an overview of Klimate's processing activities, including the purposes and legal basis of the processing.

If you have any questions in relation to this Privacy Policy, or if you wish to exercise your rights under Chapter III of the GDPR in accordance with para. 6 of this Privacy Policy, please contact Klimate at gdpr@klimate.co.

2. Processing activities

2.1 Website Visitors

2.1.1 What personal data do we process and for what purposes

When you visit Klimate's website, https://klimate.co/, Klimate will be processing personal data about you, such as cookies, browser information, IP address and time spent on the website. We use cookies i.a. to improve your user experience and the functionality of our website, to compile statistics, and to remember your preferences. You can read more about our use of cookies in para. 5 below. If you use our Klimate platform, we also process your work email address.

2.1.2 Legal basis

The legal basis for the processing of your personal data is Klimate’s legitimate interests, which, in Klimate’s view, are not overridden by your fundamental rights and freedoms as provided in Article 6(1)(f) GDPR. The legitimate interests pursued by Klimate are to make a well-functioning website available, to provide a unique user experience, and, if you are using our Klimate platform, our interests in handling our contractual obligations and maintenance, and strengthening of our customer relationships. In some cases, the legal basis is your consent, which you will be asked to give when you visit our website as provided in Article 6(1)(a) GDPR.

2.1.3 Disclosure of personal data

Klimate will in certain cases disclose your personal data to business partners or other partners for business purposes. Such third parties include, inter alia, social media providers as specified in para. 4 below.

Additionally, your personal data will be processed by certain third parties, among them the provider of the technical solution behind our website and the provider of our Klimate platform, on Klimate's behalf and in accordance with Klimate's instructions and the obligations laid down in the data processing agreement concluded with Klimate. These data processors may not process your personal data for their own purposes.

2.1.4 Storage of personal data

Personal data collected via cookies during visits to our website are stored for different periods of time depending on the type and purpose of the cookie. For details, see para. 5 below.

Personal data processed when using our Klimate platform is deleted upon termination of the contractual relationship.

2.2 Contacts at customers, suppliers, business partners, and other third parties

2.2.1 What personal data do we process and for what purposes

As a contact person at one of our customers, suppliers, business partners, or other third parties, Klimate will process personal data about you when you communicate with Klimate, for example via emails in the context of Klimate's (potential) contractual relationship with the company by which you are employed or in the context of the conclusion or termination of a contract, contract negotiations or in relation to providing responses to your inquiries. Klimate will process general personal data about you, including your name, email address, telephone number, job title, etc. for these purposes.

Provided that you have accepted a LinkedIn invitation from Klimate, Klimate will process information on your LinkedIn businesss profile for the above-mentioned purposes and with the aim to strengthen the business relationship with you.

Subject to applicable law, Klimate may reach out to contacts at our customers, suppliers, and business partners with relevant updates and information on new projects, laws and regulations, case studies or similar latest news topics.

2.2.2 Legal basis

The legal basis for the processing of your personal data is Klimate’s legitimate interests, which, in Klimate’s view, are not overridden by your fundamental rights and freedoms as provided in Article 6(1)(f) GDPR. The legitimate interests pursued by Klimate are the performance of our contractual obligations, the maintenance and strengthening of our customer relationships, marketing initiatives and image branding of Klimate, the invoicing of the services provided to Klimate by the company you are employed by and vice versa, and for documentation purposes where an agreement is concluded by email.

In certain cases, the processing of your personal data is necessary to comply with a legal obligation imposed on Klimate, for example in connection with the storage of accounting records under the Danish Bookkeeping Act. In such cases, the legal basis is Article 6(1)(c) GDPR.

2.2.3 Disclosure of personal data

Klimate will in certain cases disclose your personal data to business partners or other partners for business purposes. Such third parties include, inter alia, social media providers as specified in para. 4 below.

In certain specific cases, e.g. in the context of disputes, including where disclosure is necessary for the establishment, enforcement or defence of Klimate's legal claims, Klimate may disclose your personal data to advisors or other relevant third parties, if deemed lawful and necessary.

2.2.4 Storage of personal data

If you are a contact person of one of Klimate's customers, suppliers, business partners, or other third parties, Klimate will process personal data about you for as long as necessary, e.g. as long as Klimate is communicating with you because you are our contact person, for three years after termination of the contractual relationship, or until your personal data is no longer necessary for the establishment, exercise or defence of legal claims. Inquiries from potential customers will be deleted 6 months after the inquiry is resolved, unless a longer retention period is required for documentation purposes, e.g. to a dispute, including for the establishment, exercise, or defence of legal claims.

If your personal data are included in Klimate's accounting records, e.g. in connection with invoicing, your data will be stored for five years from the end of the financial year to which the accounting records relate. This is to ensure compliance with our legal obligations under the Danish Bookkeeping Act.

2.3 Job applicants

Klimate kindly requests that you only submit personal data about yourself in your job application, CV, or other relevant material you choose to provide to us, to the extent such information is relevant for the specific position you are applying for. For this reason, please do not include information on your CPR-number in the submitted documents and consider whether there is any other personal information, such as health information, information on family relations or similar, that is not necessary for Klimate's recruitment process.

2.3.1 What personal data do we process and for what purposes

Klimate processes the personal data you have provided to us by submitting your job application, CV, and other relevant material (such as diplomas, references, etc.). Further, Klimate may process personal data that are collected from third parties; for example, from public databases, via LinkedIn or other public social media platforms, or an online search. Klimate may also obtain statements from your former employers, such as information on your job assignments and qualifications, either by contacting references you have specifically stated or by contacting your former employer - in such case, Klimate will inform you that references will be obtained.

2.3.2 Legal basis

Klimate processes the personal data for recruitment purposes to pursue the legitimate interests of Klimate, such as administration of recruitment process and evaluation of the job applicants, including to hire the most suitable candidate for the specific position, cf. Article 6(1)(f) of the GDPR. If you are chosen for one of our vacancies, processing will also be necessary in order to take steps at your request prior to entering into an employment contract, cf. Article 6(1)(b) of the GDPR. As mentioned above under the introduction, Klimate will not process any special categories of personal data (sensitive personal data) about you unless you specifically include such personal data in your job application or in your CV etc. If you decide to include sensitive personal data in your job application etc., the processing is based on section 12 of the Danish Data Protection Act.

2.3.3 Disclosure of personal data

Klimate may disclose personal data about you to certain third-party recipients, such as service providers in relation to recruitment process, such as recruitment platform. Such parties will only process personal data about you on behalf of Klimate and in accordance with the instructions given by Klimate. Thus, these third-party recipients are not permitted to process your personal data for their own purposes.

To the extent it is required by applicable law, Klimate may disclose your personal data to other third parties e.g., public authorities or similar.

2.3.4 Storage of personal data

Your personal data will be stored as long as it is necessary and relevant to pursue the purpose. In general, we store your personal data until the vacant position has been filled and the recruitment process has been completed. We regularly review the personal data we hold, and your personal data will be deleted sooner if we determine that continued storage is not necessary.

2.3.5 Mandatory processing of personal data

Pursuant to the GDPR, you must receive information on whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and of the possible consequences of failure to provide such data.

In that connection, please note that under the Danish Health Information Act (helbredsoplysningsloven) job applicants must state, either at its own motion or by request, whether the applicant knows that she/he suffer from an illness or shows symptoms of an illness which will be of material importance for the applicant's capacity for work in the specific job. Further, in compliance with the Danish Health Information Act, Klimate may request the applicant to inform whether she/he has previously suffered from or showed symptoms of an illness which will be of material importance for the applicant's capacity for work in the specific job.

Further, if you are offered a position with us, Klimate must use certain personal data to draft the employment contract including name and address, cf. the Danish Employment Contracts Act (ansættelsesbevisloven).

Lastly, job applicants are subject to the general duty to disclose material facts in relation to the specific job, subject, however, to applicable exceptions under Danish mandatory employment law. Save for any mandatory statutory provisions, this means that you must not withhold information that may be relevant and of material importance to your future employer in relation to the specific job, and that you must answer relevant questions truthfully.

If you do not wish to provide material and relevant information as mentioned above, Klimate may not be able to offer you a position.

3. Transfer of personal data to third countries (countries outside the EU/EEA)

In certain cases, your personal data may be transferred to countries outside the EU/EEA. Klimate will ensure that the transfer takes place in accordance with applicable data protection law. This entails that any party outside of the EU/EEA that will receive your personal data will ensure an adequate level of protection, for example, by entering into the EU Commission's Standard Contractual Clauses (SCCs) with Klimate. Klimate will ensure the implementation of additional safeguards if deemed necessary on a case-by-case basis.

You can request a copy of the legal basis for the transfer by contacting gdpr@klimate.co.

4. Social media

Our website features integrated plug-ins and/or pixels from the social media Facebook, Instagram, and LinkedIn. When you visit any of our social media pages or our website with integrated plug-ins, the social media providers will collect and process personal data by means of cookies, provided you have consented to the use of cookies. Such collection and processing of personal data will take place whether you have a social media profile or not.

If you access our website, which features integrated social media plug-ins, your browser will contact the server of that social medium, load the visual presentation of the plug-in and present the content to you. While this is happening, the social media provider will receive information about your use of the website, as well as additional personal data, such as your IP address. Klimate will receive anonymous demographic and geographic statistics from the social media provider about visitors to our website and our social media pages.

Klimate is joint data controller together with the social media providers for the processing of personal data in connection with visits to our social media pages and our website. This means, i.a., that you can contact both Klimate and the social media provider if you wish to exercise your rights under the GDPR. Facebook, Instagram, and LinkedIn have primary responsibility for ensuring compliance with the GDPR and for responding to requests to exercise data subjects' rights. If you have a social media profile, you can exercise your rights through your account settings.

We have no influence on the amount of personal data that the social media provider collects via the active plugins. For details, please refer to the relevant privacy policy:

• Facebook: www.facebook.com/policy
• Instagram: https://help.instagram.com/519522125107875/
• LinkedIn: https://www.linkedin.com/legal/privacy-policy

5. Use of cookies

The first time you visit our website, you will be asked to consent to the use of cookies or to reject the use of cookies. Please note that the use of functionality cookies does not require your consent as such cookies are necessary to ensure the functioning of our website. We encourage you to accept the use of cookies on our website as it helps us improve yours and other users’ experience on the website. If you reject the use of cookies, certain website features may not be available to you.

When you use our website, we do not record any information that can directly identify you, such as your name and address. We do, however, record information about how you navigate the website so that we may learn more about how our website is used, and we also record your IP address, which may indirectly identify you.

5.1 What is a cookie?

A cookie is a small text file sent to your browser from our website and stored on your computer, phone or other device that you use to access the Internet.

Please note, however, that the word "cookies" as used in this Privacy Policy and in the consent text on our website includes other forms of automated data collection as well, e.g. Flash cookies (locally shared object), HTML5, JavaScripts, or cookies placed using other forms of software. The word "cookies" also refers to information about MAC addresses and other information about your device.

Cookies come in two types: Session cookies and persistent cookies. Session cookies are units of information that are deleted when you close your browser. Persistent cookies are units of information that are saved on your computer until deleted. Persistent cookies will delete themselves after a certain period but will be renewed each time you visit our website. Klimate uses both session and persistent cookies. You can read more about what specific cookies we use in the cookie declaration below.

5.2 Purpose of cookies

Cookies can be used for a variety of purposes but are mainly used to store information about your activity on the internet. Cookies contain information that can later be read by a server on the Internet domain that issued the
cookie. This means that the relevant website will remember you the next time you visit it.

We use cookies on the website for the purposes of improving your user experience and our products, providing, and improving functionality, generating statistics, analysing the performance of the website, and remembering your preferences. The advantage for you is that you will save time the next time you visit the website as you will not have to enter the same information again, and the content will be adapted to your preferences.

5.3 For how long are cookies stored?

Cookies delete themselves after periods of varying lengths but are automatically updated when you visit our website again. Information about your online behaviour, including cookies, will be deleted at different intervals, see the cookie declaration below for details.

5.4 Third party cookies

In order to further develop and improve the website, we use cookies from certain third parties. The purposes are compilation of statistics and analysis of online behaviour. The third parties place the cookies on your computer and compile the statistics, etc., on our behalf. The third parties are identified in the cookie declaration below.

5.5 Cookie declaration

The cookie declaration was last updated on 26 Jul. 23 by Hubspot Inc:

5.6 Opting out of cookies

You can always refuse or opt out of having cookies placed on your computer by changing your browser settings or by visiting our cookie banner.

However, please know that if you do so there will be many features and services on our website that you will not be able to use because they require that the website remembers the choices you make.

Cookies that you have previously accepted can be easily deleted afterwards. If you are using a computer with a new or fairly new browser, you can delete your cookies using shortcut keys CTRL + SHIFT + Delete. If the shortcut keys do not work, and/or if you are using a MAC, please first find out which browser you are using and then click on the relevant links with instructions on how to opt out of cookies:

• Guide - Firefox
• Guide - Google Chrome
• Guide - Edge
• Guide - Safari
• Guide - Explorer

Please note that you must delete cookies in all your browsers if you are using more than one browser.

6. Your rights

We have taken a number of measures to protect your personal data and safeguard your rights. Because of our processing of personal data about you, you will have the rights described below. However, some rights apply only
in certain circumstances. The Danish Data Protection Agency has issued guidance on the rights of data subjects. For details about your rights, please see here (in Danish).

• You have the right to request access to, and receive a copy of, the personal data that we are processing about you and, in this context, also to receive a range of additional information.
• You have a right to have incorrect personal data about yourself rectified and to have incomplete personal data completed.
• You have the right to request that personal data about you be deleted in certain circumstances, e.g. if processing is based on your consent and you choose to withdraw that consent.
• You have a right to have the processing of your personal data restricted, e.g. if the accuracy of the personal data is contested.
• Where our processing is done automatically and is based on your consent or the performance of an agreement with you, you have the right to request to receive the personal data that you have provided to us in a structured, commonly used, and machine-readable format and to request the transmission, where technically feasible, of such data to another controller.
• You may object to the processing of your personal data by us, including in particular in relation to direct marketing.
• You may request not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
• You may withdraw your consent to the processing of your personal data at any time. Withdrawal of your consent will not affect the processing of your personal data that took place before the date of withdrawal, however.

If you wish to exercise any of the above rights, or if you wish to withdraw your consent, please feel free to contact us at gdpr@klimate.co.

7. Questions or complaints

If you have any questions about this Privacy Policy or if you wish to exercise any of your rights as explained above or if you disagree with the way we process personal data about you, please contact Klimate on gdpr@klimate.co.

If you disagree with the way in which Klimate processes your personal data, you may file a complaint with the Danish Data Protection Agency, using the contact details that are available here. However, we hope that you will contact us first, using the below contact details, so that we may try to come to an agreement.

8. Amendments to this privacy policy

This Privacy Policy is regularly updated and amended, including as required on account of changes to statutes, practices and rules and regulations on the data protection area. You are advised, therefore, to stay up-to-date on the contents of this Privacy Policy at all times.