Privacy Policy

Data Controller and Contact details

In accordance with this Privacy Policy, DKCO Attorneys-at-Law Ltd (hereinafter “DKCO” or “we”) acts as the data controller.

If you have questions or wish to exercise your rights, you can contact us via:

E-mail: @email

Telephone: +358 (0)20 527 4000
DKCO Attorneys-at-law Ltd
Köpmansgatan 4
AX-22100 Mariehamn

General information

DKCO is a law firm operating in Finland and on the Åland islands. DKCO is the data controller for the processing of your personal data as clarified below. This means that we are responsible for ensuring that your personal data is processed correctly and in accordance with applicable data protection legislation, including the GDPR (EU General Data Protection Regulation 2016/679).

Personal data is processed in connection with our business, i.a. for the purposes of assignment management, business development and recruitment. We take your privacy seriously, and this Privacy Policy and materials referenced herein, together with our Terms of Use, describes what personal data we process, why we process it, how we collect and process it, which service providers we share it with, how we protect them and your rights as a data subject. A set of purposes for which personal data is processed is listed below. However, the purposes applicable to you are ultimately dependent on your role vis-à-vis us. You may be e.g. a client, a visitor to our website, a counterparty to our client or a scholarship applicant. The personal data that we are processing about you is hence decided by your activity and your relationship with us.

For processing based on legitimate interest, DKCO has carried out a legitimate interest assessment between our interests and your interest, and your fundamental rights and freedoms. In many cases, our interests align with yours; nevertheless, based on these legitimate interest assessments, we have limited the scope of personal data, retention periods, and other aspects of processing to what is necessary for the purpose or required by law.

Your rights

We do our best to ensure that your personal data is stored securely and accurately and up to date. To help us with this, you may inform us at any time if your personal data changes by contacting @email. You may also contact us at any time to exercise your rights listed below. DKCO is governed by the Attorneys Act (496/1958) and the Finnish Bar Association’s rules, including confidentiality obligations in favour of our clients, as well as by confidentiality obligations related to anti-money laundering and terrorist financing. In practice, this may, in certain cases, limit your ability to exercise the rights listed below.

The list below is only a brief overview of your rights. You can read more on the Data Protection Ombudsman’s website: Know your rights | Data Protection Ombudsman’s Office.

Right of access

You have the right to obtain information as to whether we process your personal data, which personal data we process, and for what purpose. You also have the right to receive a copy of your personal data (a “data extract”). However, there may be circumstances in which we are not permitted to disclose certain data, for example due to legal professional privilege or confidentiality obligations, or to protect the rights and freedoms of others.

Right to data portability

You have the right to receive personal data in a structured, commonly used and machine-readable format so that you can use it for other purposes.

Right to rectification

You have the right to request that inaccurate personal data concerning you be rectified without undue delay. You also have the right to have incomplete data rectified.

Right to erasure

In certain cases, you have the right to request that we erase your personal data. This may apply, for example, when the data is no longer necessary for the purposes for which it was collected, when the data has been processed unlawfully, or when the processing is based on your consent. Under certain circumstances, we may refuse your request to erase personal data, for example when we are required by law to retain the data, where processing remains necessary to achieve the purpose for which it was collected, or where it is necessary to establish, exercise, or defend legal claims.

Right to restriction of processing

In certain cases, you have the right to request that we restrict the processing of your personal data so that it may only be processed for limited purposes. For example may the processing be restricted if you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data.

Right to withdraw consent

If our processing of your personal data is based on your consent, you have the right to withdraw that consent at any time.

Right to object

You have the right to object to the processing of your personal data, for example when the processing is based on legitimate interest. If we cannot demonstrate that we have a legal basis for processing your personal data, we must immediately cease the processing.

If the processing concerns direct marketing, you always have the right to object, regardless of our legal basis for processing. You can opt out of direct marketing at any time by contacting @email.

DKCO always strives to resolve any disputes directly with you. You have the right, however, to request that the data protection authority review matters concerning our processing of your personal data. The supervisory authority overseeing DKCO’s processing of personal data on the Åland islands and in Finland is the Office of the Data Protection Ombudsman (www.tietosuoja.fi). You may also lodge a complaint with the supervisory authority overseeing compliance with the GDPR in the country where you reside.

We are happy to answer your questions regarding your personal data and its processing. For more information, please contact @email.

How do we collect personal data?

We primarily collect personal data directly from our clients or their employers in connection with establishing or maintaining our business relationship. Personal data is collected, for example, when a client provides information while communicating with us through meetings, phone calls, e-mail and other digital channels, or when individuals participate in events we organise or provide services for us. Consequently, the personal data we need varies from person to person.

In order to carry out your assignment or fulfil our other commitments, we obtain the personal data required, which may be obtained from third parties such as counterparties and their representatives, other advisors, banks and insurance companies. In certain cases, we obtain information from authorities, courts and public registers.

Processing of personal data in our practice

Clients

This chapter addresses the processing of personal data relating to clients and other natural persons who have contact with us in the capacity of a client or in connection with a client relationship.

This includes, among others:

natural person who are themselves clients;
representative, contact person and employee of a client which is a legal person;
owner and beneficial owner of a client which is a legal person;
family member and relative of the client.

DKCO’s operations are extensively regulated by law, including our obligations under the Attorneys Act and the Finnish Bar Association’s rules. Our obligations include, among other things, registering clients and their assignments, investigating conflicts of interest, and preventing money laundering and terrorism.

To be able to manage and carry out our assignment, we also need specific information related to the assignment and other personal data to maintain contact with you and with any opposing party and their counsel, provide legal advice and services in accordance with your instructions, and handle job and scholarship applications. This concerns information relevant to our legal advice, including personal data relevant to any complaints, investigations, disputes, arbitration, and other legal advice.

Sharing your personal data is entirely voluntary, but please note that without it, we may be unable to fulfil the assignment or commitments made by you or your organisation.

If you place client funds in our custody, they will naturally be kept separate from our own assets. We hold your client funds in separate accounts, in accordance with the Attorneys Act (including the Finnish Bar Association’s rules).

Prevention of money laundering and terrorism

To fulfil obligations under the Finnish Bar Association’s rules and applicable legislation, we carry out necessary checks of our clients to prevent money laundering and terrorism.

Personal data processed. Identification details, e.g., personal identity code, passport details, photograph or other form of ID. Contact details, such as first and last name, postal address, e-mail address, telephone number, employer, and title. Representatives or owners of a legal entity client or information on whether you are a politically exposed person (PEP), as well as name and position. Special categories of personal data (e.g., racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or data concerning health or sex life) or data relating to criminal offences, e.g., data on money laundering, business prohibitions or other criminal acts, if necessary for handling the assignment. Other information and personal data necessary for the matter.

Legal basis. Legal obligation.

Retention period. Personal data processed to fulfil obligations under the Finnish Bar Association’s rules is kept for up to 10 years from the date of completion of the assignment, or longer if required due to the nature of the client relationship or assignment. Personal data processed to fulfil obligations under the Anti-Money Laundering Act is retained for up to 5 years from the end of a fixed client relationship or from the completion of the transaction. In addition, personal data processed to fulfil other legal requirements or for a legitimate interest retained for as long as necessary to fulfill the purpose of the processing or comply with the law.

Intern riskhantering

Vi behandlar dina uppgifter för att uppfylla krav om intern riskhantering som ställs på oss enligt Finlands Advokaters regelverk. Detta inkluderar kundkännedomskontroll (KYC) samt kontroll av jäv.

Personuppgifter. Identifieringsuppgifter, t.ex. personbeteckning, passuppgifter, fotografi eller annan form av identitetsbevis. Kontaktuppgifter, såsom för- och efternamn, postadress, e-postadress, telefonnummer, arbetsgivare och titel. Fakturerings-information, t.ex. namn, adress, referensperson och faktureringsadress. Annan information som är specifika och nödvändiga för uppdraget.

Rättslig grund. Rättslig skyldighet.

Lagringstid. Personuppgifter som behandlas för att uppfylla skyldigheter enligt Finlands Advokaters regelverk sparas upp till 10 år från dagen för uppdragets slutförande, eller längre tid om det krävs på grund av klientförhållandets eller uppdragets natur.

Internal risk management

We process your data to meet internal risk management requirements imposed on us under the Finnish Bar Association’s rules. This includes know-your-customer checks and conflict-of-interest checks.

Legal basis. Legal obligation.

Retention period. Personal data processed to fulfil obligations under the Finnish Bar Association’s rules is kept for up to 10 years from completion of the assignment, or longer if required due to the nature of the client relationship or assignment.

Assignment management and fulfilment of commitments

To prepare, administer, and handle our assignments and fulfil our commitments, such as communicating with the client, providing documentation, administering time and billing records, and archiving closed matters.

Personal data processed. Identification details, e.g., personal identity code, passport details, photograph or other form of ID. Contact details, such as first and last name, postal address, e-mail address, telephone number, employer, and title. Representatives or owners of a legal entity client or information on whether you are a politically exposed person (PEP), as well as name and position. Special categories of personal data (e.g., racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or data concerning health or sex life) or data relating to criminal offences, e.g., data on money laundering, business prohibitions or other criminal acts, if necessary for handling the assignment. Other background information and personal data necessary for the assignment.

Legal basis. If you as a natural person are a client, the legal basis is performance of a contract. If you represent a legal person that is a client, the legal basis is legitimate interest based on a legitimate interest assessment. DKCO has done a legitimate interest assessment of your interests and fundamental rights and our interests. In many situations our interests and yours are aligned, but we have, based on the legitimate interest assessment, nevertheless limited the personal data, retention periods and other processing activities to what is necessary for the specific purpose. You may object to our legitimate interest assessment at any time and read more about your rights in section 3.

Retention period. Personal data is retained for up to 10 years from the completion of the assignment, or longer if required due to the nature of the client relationship or assignment.

Handling of client funds

Legal basis. Performance of a contract.

Retention period. 10 years after the assignment ends, or longer if required due to the nature of the client relationship or assignment.

Establishing, exercising, and defending legal claims

Personal data processed. Identification details (e.g., personal identity code, passport details, photograph, or other form of identification). Contact details such as first and last name, postal address, e-mail address, telephone number, employer, and title. Other information specific and necessary for the assignment.

Legal basis. Legitimate interest. DKCO has done a legitimate interest assessment of your interests and fundamental rights and our interests. In many situations our interests and yours are aligned, but we have, based on the legitimate interest assessment, nevertheless limited the personal data, retention periods and other processing activities to what is necessary for the specific purpose. You may object to our legitimate interest assessment at any time and read more about your rights in section 3.

Retention period. Personal data is retained for up to 10 years from completion of the assignment, or longer if required due to the nature of the client relationship or assignment.

Invoicing, payments, and receivables

Personal data processed. Contact details such as first and last name, postal address, e-mail address, telephone number, employer, and title. Payment information for invoicing.

Legal basis. If you, as a natural person, are our client, the legal basis is performance of a contract. If you represent a legal person that is our client, the legal basis is legitimate interest based on a legitimate interest assessment. We assess that the processing of personal data is necessary in order to administer the accounts receivable ledger, prepare and send invoices, record and process payments, communicate on payment matters, and to monitor, collect and defend our receivables. DKCO has done a legitimate interest assessment of your interests and fundamental rights and our interests. In many situations our interests and yours are aligned, but we have, based on the legitimate interest assessment, nevertheless limited the personal data, retention periods and other processing activities to what is necessary for the specific purpose. You may object to our legitimate interest assessment at any time and read more about your rights in section 3.

Retention period. Personal data processed for invoicing is retained for 10 years after the assignment has ended, pursuant to the Accounting Act (1336/1997).

Whistleblowing channel

Whistleblowing service for own employees

We provide a whistleblowing channel for our employees. We process personal data when someone reports a whistleblowing matter through our channel and during the subsequent investigation

Personal data processed. Name, if the whistleblower discloses it, as well as any information about the people mentioned in the report. The content of the report and associated data. The whistleblower’s e-mail address remains anonymous to DKCO. Our service provider processes personal data as a data processor.

Legal basis. Legal obligation

Retention period. The retention period for the whistleblowing service is 5 years from receipt of the report, unless it is necessary to retain the information for a longer period due to the nature of the report.

Whistleblowing service for other companies

Personal data processed. We process the personal data the reporter themselves provides in the channel, for example third-party personal data. The reporter may choose to voluntarily provide their name or remain completely anonymous. Please note that the e-mail address used in the reporting channel is collected by the service provider of the whistleblowing channel as technical part of the service’s functionality. If the reporter chooses anonymity the e-mail address is processed exclusively by the service provider in accordance with a data processing agreement.

Legal basis. Legitimate interest. We consider the processing of personal data to be necessary to provide a whistleblowing service and handle the reports. DKCO has done a legitimate interest assessment of your interests and fundamental rights and our interests. In many situations our interests and yours are aligned, but we have, based on the legitimate interest assessment, nevertheless limited the personal data, retention periods and other processing activities to what is necessary for the specific purpose. You may object to our legitimate interest assessment at any time and read more about your rights in section 3.

Other individuals occurring in connection with client engagements

When administering and conducting client assignments, personal data of natural persons may appear in various capacities, for example as an opposing party or their representative, a contact person, witness, arbitrator, judge, expert, public official, contracting party, or similar.

Internal risk management regarding counterparties

If you are a counterparty to our client, we process your data to meet internal risk management requirements imposed on us under the Finnish Bar Association’s rules. This includes know-your-customer checks and conflict checks.

Legal basis. Legal obligation.

Retention period. Personal data processed to comply with the Finnish Bar Association’s rules is retained for up to 10 years from the date of completion of the assignment, or longer if required due to the nature of the client relationship or the assignment.

Assignment management and fulfilment of commitments

To prepare, administer, and handle our assignments and fulfil our commitments, such as communicating with the client, providing documentation, administering time and fee records, and archiving closed assignments.

Personal data processed. Identification details, e.g., personal identity code, passport details, photograph, or other form of identification. Contact details, such as first and last name, postal address, e-mail address, telephone number, employer, and job title. Information on beneficial owners or a person authorised to represent a legal entity. Special categories of personal data (e.g., racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or data concerning health or sex life) or data relating to criminal convictions and offences, such as information on money laundering, disqualification from business activities, or other criminal offences, where necessary for handling the assignment. Other background information, circumstances, and personal data necessary for the assignment.

Retention period. Personal data is retained for up to 10 years from completion of the assignment, or longer if required due to the nature of the client relationship or assignment.

Establishing, exercising, and defending legal claims

Personal data processed. Identification details, e.g., personal identity code, passport details, photograph, or other form of identification. Contact details such as first and last name, postal address, e-mail address, telephone number, employer, and job title. Other background information and personal data necessary for the assignment.

Legal basis. Legitimate interest. We have assessed that processing is necessary to establish, exercise and defend legal claims. DKCO has done a legitimate interest assessment of your interests and fundamental rights and our interests. In many situations our interests and yours are aligned, but we have, based on the legitimate interest assessment, nevertheless limited the personal data, retention periods and other processing activities to what is necessary for the specific purpose. You may object to our legitimate interest assessment at any time and read more about your rights in section 3.

Retention period. Personal data is retained for up to 10 years from the date of completion of the assignment, or for a longer period if required due to the nature of the client relationship or the assignment.

Whistleblowing – internal channel

Personal data processed. Name, if the whistleblower discloses it, as well as any information about the persons mentioned in the report. The content of the report and associated data. The whistleblower’s e-mail address remains anonymous to DKCO. Lantero processes the personal data as a data processor.

Legal basis. Legal obligation

Whistleblowing service for external companies

Legal basis. Legitimate interest. We consider the processing of personal data to be necessary to provide a whistleblowing service. DKCO has done a legitimate interest assessment of your interests and fundamental rights and our interests. In many situations our interests and yours are aligned, but we have, based on the legitimate interest assessment, nevertheless limited the personal data, retention periods and other processing activities to what is necessary for the specific purpose. You may object to our legitimate interest assessment at any time and read more about your rights in section 3.

Supplier relationships

This section applies to representatives or employees of a supplier, consultant, or comparable external party providing services for and on behalf of DKCO (“Supplier”). When we purchase goods and services, we process personal data to manage orders and make payments. The processing is based on the performance of a contract and legitimate interest.

Contract administration and supplier management

We process your personal data for contract administration, payment processing, fulfilment of obligations towards suppliers and external parties, delivery follow-up, and contractual communications.

Personal data processed. Identification details, e.g., personal identity code, passport details, photograph, or another form of identification. Contact details such as first and last name, postal address, e-mail address, telephone number, employer, and job title. Billing information. Other background information and data, beyond what is mentioned above, that are relevant to the assignment.

Legal basis. Legitimate interest. We have assessed that processing is necessary to perform and administer contracts, handle invoicing and payment, conduct follow-up, and communication between the parties in accordance with the contractual relationship. DKCO has done a legitimate interest assessment of your interests and fundamental rights and our interests. In many situations our interests and yours are aligned, but we have, based on the legitimate interest assessment, nevertheless limited the personal data, retention periods and other processing activities to what is necessary for the specific purpose. You may object to our legitimate interest assessment at any time and read more about your rights in section 3.

If you are a contracting party directly with us as a natural person, the processing of personal data is based on the performance of a contract.

Retention period. Personal data processed in supplier contracts with suppliers are retained for 10 years after the end of the engagement.

Events, marketing, and business development

We offer many different services that we want you to have access to, and we keep you updated on legal news. Newsletters and other marketing are therefore ways for us to be more relevant to you. The processing of personal data is based on legitimate interest. You can deregister at any time by contacting @email. In addition, you can always contact the sender of the newsletter if you wish to decline further marketing.

We believe that various types of events are excellent opportunities to meet and network, and we would be delighted for you to participate. If you sign up, we need to handle the invitation and any allergies. This type of processing is based on our legitimate interest and the applicable terms for the event. You are not obliged to provide your personal data, but note that this may mean, for example, that you cannot participate in events we organise.

Direct marketing and newsletters

To administer and send newsletters. DKCO does not distribute mass communications to its customers.

Personal data processed. Contact details such as first and last name, e-mail address, telephone number, employer, and title. Language preference.

Legal basis. Legitimate interest. We have assessed that processing is necessary to market our practice and inform you about relevant news or other information of interest to you or your business. DKCO has done a legitimate interest assessment of your interests and fundamental rights and our interests. In many situations our interests and yours are aligned, but we have, based on the legitimate interest assessment, nevertheless limited the personal data, retention periods and other processing activities to what is necessary for the specific purpose. You may object to our legitimate interest assessment at any time and read more about your rights in section 3.

Retention period. Until you choose to deregister. You may deregister at any time by contacting @email.

Contact register

Personal data processed. Contact details such as first and last name, postal address, e-mail address, telephone number, employer, and title. Language preference.

Legal basis. Legitimate interest. We have assessed that processing is necessary to market our operations and inform you about relevant news or other information of interest to you or your business. DKCO has done a legitimate interest assessment of your interests and fundamental rights and our interests. In many situations our interests and yours are aligned, but we have, based on the legitimate interest assessment, nevertheless limited the personal data, retention periods and other processing activities to what is necessary for the specific purpose. You may object to our legitimate interests assessment at any time and read more about your rights in section 3.

Retention period. Until you choose to deregister. You may deregister at any time by contacting @email.

Invitations to events

Personal data processed. Contact details such as first and last name, postal address, e-mail address, telephone number, employer, and title. Language preference.

Legal basis. Legitimate interest. We have assessed that processing is necessary to send invitations to events, seminars, or other types of meetings. DKCO has done a legitimate interest assessment of your interests and fundamental rights and our interests. In many situations our interests and yours are aligned, but we have, based on the legitimate interest assessment, nevertheless limited the personal data, retention periods and other processing activities to what is necessary for the specific purpose. You may object to our legitimate interest assessment at any time and read more about your rights in section 3.

Retention period. Until you choose to deregister. You may deregister at any time by contacting @email. Information about your deregistration is retained until the event has taken place.

Event registration

Personal data processed. Contact details such as first and last name, postal address, e-mail address, telephone number, employer, and title. Participant type, programme choices, language preference, and any allergies.

Legal basis. Legitimate interest. We have assessed that processing is necessary to send invitations and organise events, seminars, or other types of meetings. DKCO has done a legitimate interest assessment of your interests and fundamental rights and our interests. In many situations our interests and yours are aligned, but we have, based on the legitimate interest assessment, nevertheless limited the personal data, retention periods and other processing activities to what is necessary for the specific purpose. You may object to our legitimate interest assessment at any time and read more about your rights in section 3.

Retention period. Until you choose to deregister. You may deregister at any time by contacting @email. Information about your deregistration is retained until the event has taken place.

Personal data collected through cookies

When you first visit our website, you will be given the option to choose which cookies may be used during your visit.

Cookies are small text files that websites store on your device when you visit them to retain certain information, such as which browser you use and your chosen language on the website. The next time you visit the same website, your browser sends back this cookie so that the website can “recognise” you, for example by automatically displaying the site in the language you previously chose.

Strictly necessary cookies cannot be declined and are always active to enable the website. Other cookies can be rejected, but rejecting cookie settings may result in certain functions on the website being limited.

This is only a summary. For more detailed information about processing of personal data in connection with the use of cookies, please read our cookie policy. LÄNKA

Recruitment and scholarship applications

DKCO annually awards a scholarship to an aspiring lawyer. Administering and evaluating applications, disbursing the scholarship to the winner, and publishing the winner require personal data. We base this processing on legitimate interest, the terms and conditions of the scholarship, and consent.

During recruitment, DKCO processes personal data in order to manage the application process. This includes assessing experience and qualifications, contacting you before and after an interview, and drawing up a potential employment agreement. The processing is based on DKCO's legitimate interest and consent, for example if you would like us to retain your personal data for future career opportunities.

The recruitment process

Personal data processed. Contact details, such as first and last name, postal address, e-mail address, telephone number, employer, and title. Information submitted in your application, e.g., CV, cover letter, transcript of student record and/or degree certificate, references and other study- and work-related information. Interview notes

Legal basis. Legitimate interest. We have assessed that processing is necessary to administer the recruitment process and evaluate applications. DKCO has done a legitimate interest assessment of your interests and fundamental rights and our interests. In many situations our interests and yours are aligned, but we have, based on the legitimate interest assessment, nevertheless limited the personal data, retention periods and other processing activities to what is necessary for the specific purpose. You may object to our legitimate interest assessment at any time and read more about your rights in section 3.

Retention period. Your personal data is retained during the recruitment process. You may, in your application, consent to our storing your contact details so we can contact you regarding future job opportunities. If you have given your consent, your data is stored for as long as necessary to fulfil the purpose for which it was collected or until consent is withdrawn. You may withdraw consent at any time by contacting @email.

Scholarship applications

Personal data processed. Contact details, such as first and last name, postal address, e-mail address, telephone number, employer, and job title. Information submitted in your application, e.g., CV, cover letter, transcript and/or diploma, references, or other study- and work-related information

Legal basis. Legitimate interest. We have assessed that processing is necessary to administer the scholarship process and evaluate applications. DKCO has done a legitimate interest assessment of your interests and fundamental rights and our interests. In many situations our interests and yours are aligned, but we have, based on the legitimate interest assessment, nevertheless limited the personal data, retention periods and other processing activities to what is necessary for the specific purpose. You may object to our legitimate interest assessment at any time and read more about your rights in section 3.

Retention period. Your personal data is retained during the scholarship process. You may consent in your application to our storing your contact details so we can contact you for future opportunities. If you have given your consent, your data is stored for as long as necessary to fulfil the purpose for which it was collected or until consent is withdrawn. You may withdraw consent at any time by contacting @email.

Publication of scholarship recipient on social media

Personal data processed. Photograph. Other study- or work-life information you share with us

Legal basis. Consent. You may withdraw consent at any time by contacting @email.

Retention period. Personal data is retained until you withdraw your consent.

Processing of special categories of personal data

In connection to our client engagements, it may be necessary for us to collect and process sensitive data, so called special categories of personal data (e.g., data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, data concerning health, or data concerning a natural person’s sexual orientation or activity) as well as data relating to criminal convictions and offences, e.g., business prohibition, breaches of anti-money laundering law, or other criminal acts. The processing of sensitive data is carried out for the purpose of assisting our clients in exercising or fulfilling their rights and obligations under applicable legislation, or to establish, exercise, or defend legal claims.

For example, in estate inventories (probate), we may need to collect and process sensitive data such as membership of a religious community or outstanding debts such as medical expenses. Likewise, in employment disputes it may be necessary for the matter to obtain, for example, information on the employee’s trade union membership for negotiations with the union or other sensitive data to assist in discrimination cases.

Third-party personal data

If you provide information about your opposing parties, employees, or other individuals besides yourself and/or your business, you must ensure that they are aware that their personal data has been provided to us and our service providers, that they understand how we process their personal data.

How we do not process your personal data

DKCO does not engage in automated decision-making, including profiling.

With whom do we share personal data?

DKCO primarily processes personal data within our own organisation. However, in order to deliver the services you and/or your organisation have requested, we may need to share your personal data with parties that act as independent data controllers for the personal data they receive (e.g., public authorities, courts, audit firms), or with external suppliers that provide services to us (so-called data processors). Data processors perform services on our behalf and therefore process personal data under contract solely for our purposes and in accordance with our instructions. This may for example include investigations (KYC) for the prevention of money laundering and financing of terrorism, third parties for job applicants’ aptitude assessments, organising events, or administrative services. For more information on how we share personal data read our terms and conditions.

Where we transfer personal data to an external service provider, we ensure through contractual measures that your personal data is processed and protected appropriately and in accordance with the law and this Privacy Policy.

Transfer of personal data outside the EEA

DKCO processes your personal data mainly within the EU and the EEA. However, due to technical reasons, DKCO may need to transfer certain personal data to third countries where the level of personal data protection may be lower than within the EU and the EEA. Where such countries are not covered by an adequacy decision of the EU Commission, appropriate safety measures are applied to ensure the protection of personal data. Such safeguards are principally standard data protection clauses adopted by the EU Commission, and you will find more information on the matter at https://ec.europa.eu/info/law/law-topic/data-protection_en. Countries considered to provide an adequate level of data protection are listed here: Data protection adequacy for non-EU countries.

How we protect your personal data

DKCO protects your personal data and is committed to handling it properly, with a high level of confidentiality and security. We therefore take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, or unauthorised disclosure, or unauthorised access to the personal data we store and process. These measures include, among other things, encrypted data connections (VPN connections), regularly reviewing and updating security policies and internal processes, and continuous training in data and information security to safeguard our systems and working methods.

Updates

We may update this Privacy Policy due to changes in our processing activities or applicable legislation.

This privacy policy was updated on 3 March 2026.