1. Data Controller
Copenhagen Staff Holdings ApS is the data controller responsible for your personal data.
Copenhagen Staff Holdings ApS
CVR: 46133412
35A Bülowsvej, Frederiksberg, 1870, Copenhagen, Denmark
Email: team@staffclubcopenhagen.com
Website: copenhagenstaff.com
For all data protection enquiries, please contact us at the email address above.
2. Scope of This Policy
This Privacy Policy applies to all personal data we process in connection with:
- Workers registering on or using our staffing platform
- Clients placing or enquiring about staff orders
- Visitors to our website (copenhagenstaff.com)
- Any other individuals whose data we handle in connection with our business
This policy describes our processing of personal data, including website measurement in section 10.
3. Personal Data We Collect
3.1 Workers
When you register as a worker or interact with our platform, we may collect:
- Identity data: Full name, date of birth, nationality, photo/profile image
- Contact data: Email address, phone number, home address
- Tax and employment data: CPR number (Danish civil registration number), bank account details for payroll, tax card information (A-skat/B-skat), work permit or right-to-work documentation
- Professional data: CV, work experience, qualifications, certifications, language skills, references
- Assignment data: Shift history, hours worked, client feedback, attendance records
- Financial data: Pay rates, holiday pay (feriegodtgørelse) accrual, payslip history
- Communication data: Messages and correspondence with our team
3.2 Clients
When you use or enquire about our staffing services, we may collect:
- Business data: Company name, CVR number, business address, industry type
- Contact data: Name, job title, email address, phone number of contact persons
- Order data: Staff requirements, shift dates and times, venue details, order history
- Financial data: Invoice history, payment records, billing address
- Communication data: Messages, emails, and correspondence relating to orders and services
3.3 Website Visitors
When you visit our website, we may automatically collect:
- IP address and approximate location data
- Browser type, version, and operating system
- Pages visited, time spent, referral source
- Validated campaign tags on enquiries (see section 10)
4. How We Use Your Personal Data
4.1 Workers
- To manage your registration and platform profile
- To match you with suitable shift assignments
- To communicate shift offers, confirmations, and updates
- To process payroll, including A-skat deductions, AM-bidrag, and feriegodtgørelse
- To comply with Danish employment law obligations (Vikarloven, Ferieloven, Arbejdstidsloven)
- To report to SKAT (Danish Tax Authority) as required by law
- To manage conduct, performance, and platform access decisions
- To respond to your enquiries and communications
4.2 Clients
- To process and manage your staff orders
- To issue and manage invoices and payments
- To communicate with you about your orders and our services
- To comply with our contractual obligations under the Client Master Service Agreement
- To meet legal and regulatory obligations
- To manage our business relationship with you
4.3 Website Visitors
- To operate and maintain our website
- To analyse website usage and improve our services
- To comply with legal obligations
5. Legal Bases for Processing
We process your personal data on the following legal bases under GDPR Article 6:
| Processing Activity | Legal Basis |
|---|---|
| Payroll processing and statutory deductions | Legal obligation (Article 6(1)(c)) — SKAT, Ferieloven, Arbejdstidsloven |
| Processing your registration and assignment matching | Performance of a contract (Article 6(1)(b)) |
| Client order processing and invoicing | Performance of a contract (Article 6(1)(b)) |
| Keeping business records and financial documents | Legal obligation (Article 6(1)(c)) — Danish Bookkeeping Act |
| Website analytics and performance monitoring | Legitimate interests (Article 6(1)(f)) |
| Marketing communications (if applicable) | Consent (Article 6(1)(a)) — you may withdraw at any time |
| CPR number processing | Legal obligation (Article 6(1)(c) + Databeskyttelsesloven §11) — employment and tax law |
6. Data Sharing and Third Parties
We may share your personal data with the following categories of recipients:
6.1 Clients (for workers)
When you are assigned to a shift, we share your name and contact number with the client venue solely for the purpose of facilitating that specific assignment. We share the minimum necessary data only.
6.2 Workers (for clients)
We share worker names and basic contact details with clients for confirmed assignments only.
6.3 Service Providers (Data Processors)
We engage third-party service providers who process data on our behalf under written data processing agreements:
- Payroll and accounting software — for processing wages and statutory deductions
- Email and communication platforms — for sending notifications and correspondence
- Website hosting providers — for operating copenhagenstaff.com
- Customer records and forms (Google Sheets) — to store and process enquiries
- Analytics services (Google Analytics) — for understanding website usage patterns
6.4 Statutory Authorities
We share data with SKAT (Danish Tax Authority) and other public authorities where required by Danish law.
6.5 No Data Sales
We never sell, rent, or trade your personal data to third parties for commercial purposes.
7. International Transfers
We aim to keep your data within the EU/EEA. Where any service provider processes data outside the EU/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, in compliance with GDPR Chapter V.
8. Data Retention
We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable law:
| Data Category | Retention Period | Basis |
|---|---|---|
| Worker registration and profile data | 5 years after last assignment | Legitimate interests; legal claims |
| Payroll records and tax documents | 5 years (Danish Bookkeeping Act) | Legal obligation |
| CPR number | Duration of employment + 5 years | Legal obligation (SKAT) |
| Client contact and order data | 5 years after last transaction | Legitimate interests; legal claims |
| Invoice and financial records | 5 years (Danish Bookkeeping Act) | Legal obligation |
| Website visitor data (analytics) | Up to 26 months | Legitimate interests |
| Marketing consent records | Until consent withdrawn + 1 year | Consent |
9. Your Data Subject Rights
Under GDPR (Articles 15–22) and the Danish Data Protection Act, you have the following rights:
- Right of access (Article 15): You may request a copy of all personal data we hold about you, along with information on how it is processed.
- Right to rectification (Article 16): You may request that we correct any inaccurate or incomplete personal data we hold about you.
- Right to erasure (Article 17): You may request deletion of your personal data where it is no longer necessary, where you withdraw consent, or where processing is unlawful. This right may be limited where we have legal obligations to retain data.
- Right to restriction of processing (Article 18): You may request that we limit how we use your data in certain circumstances.
- Right to data portability (Article 20): Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
- Right to object (Article 21): You may object to processing based on legitimate interests or for direct marketing purposes.
- Right to withdraw consent: Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at team@staffclubcopenhagen.com. We will respond within 30 days. There is no charge for exercising your rights, unless requests are manifestly unfounded or excessive.
10. Measurement without cookies
We do not use advertising cookies or persistent visitor attribution in localStorage or sessionStorage. No cookie setting enables that storage. Previously saved consent choices do not grant storage; known old measurement cookies and tracking choices are removed where the browser permits.
Existing Google measurement runs with ad_storage, analytics_storage, ad_user_data and ad_personalization denied. Google may receive cookieless measurement requests, including technical browser and connection information. This does not guarantee anonymity. Google signals, advertising personalisation and advanced matching are disabled. Page addresses sent to Google Analytics omit query parameters and fragments.
We do not use OpenAI Pixel, OpenAI Conversions API, Meta Pixel or customer-list uploads to advertising platforms. We do not send form names, email addresses, phone numbers or messages to OpenAI for conversion measurement. OpenAI Ads Manager reports ad views, clicks and spend within its own platform.
Ad links can contain static campaign tags (UTMs). Validated tags and any Google click identifiers travel in current-page memory and URLs during internal navigation and language changes. They are not added to external links, downloads or shared calculator links. Tags identify a campaign, language group and creative variant, not a person.
When you submit an enquiry, we store its campaign source with your contact details in existing customer records and the owner notification. We use Google Sheets and email through Resend for this. A submission identifier helps recognise retries. A received enquiry is separate from a qualified customer or confirmed booking. Later untagged visits and visits on other devices cannot reliably be attributed to the ad.
11. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include:
- Access controls and role-based permissions
- Encrypted data transmission (HTTPS/TLS)
- Regular security reviews and updates
- Staff awareness and data protection training
- Incident response procedures
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Danish Data Protection Authority (Datatilsynet) within 72 hours as required by GDPR Article 33, and affected individuals where required under Article 34.
12. Supervisory Authority
You have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet) if you believe we have processed your personal data unlawfully:
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby, Denmark
Phone: +45 33 19 32 00
Email: dt@datatilsynet.dk
Website: www.datatilsynet.dk
We encourage you to contact us first at team@staffclubcopenhagen.com so we can resolve your concern directly.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will publish the updated policy on this page with a revised effective date. For material changes, we will notify affected individuals by email where practicable.
14. Contact Us
For any questions, requests, or concerns relating to this Privacy Policy or the processing of your personal data:
Copenhagen Staff Holdings ApS
35A Bülowsvej, Frederiksberg, 1870, Copenhagen, Denmark
CVR: 46133412
Email: team@staffclubcopenhagen.com