Privacy notice

Introduction

Level Consulting A/S (“Level” or “we”) is committed to protecting the confidentiality, integrity and availability of information, including personal data about our clients, suppliers, collaborators, applicants and employees. We are strongly committed to protecting personal data and continuously strive to ensure ongoing compliance with data protection law, including the General Data Protection Regulation (“GDPR”).

Level’s data processor activities

When we process personal data on behalf of our clients and in accordance with our client’s instructions in connection with our services, Level is the data processor, and our client is the data controller. Consequently, we enter into a written data processing agreement with our client, setting out instructions and terms and conditions for Level’s processing of personal data.

Level obtains an ISAE 3000 (GDPR) audit statement in its capacity as data processor. The latest audit report is available by contacting our DPO.

If you have any questions regarding your data processing agreement or the audit statement, please contact either your normal contact at Level or the DPO.

Data controller

When processing personal data in connection with e.g., our client engagement, recruitment and administration, we consider ourselves as data controller.

This privacy notice provides information about Level’s processing of personal data when Level is acting as a data controller. Read more about this below.

Contact information

The data controller is

Data protection officer (DPO)

If you want to exercise your rights as described below, or if you have any questions about this privacy notice or how and why we process personal data, please contact our DPO:

Our processing activities

To learn more about the specific categories of data that Level is processing, and the purposes and legal basis of the processing, please see the relevant sections below.

• Client engagement and administration
• Visitors
• Visitors to our website
• Marketing
• Events and network
• Supplier and business partner administration
• Recruitment

Client engagement and administration

Purpose

The purpose is to manage the engagements with our clients, including providing consultancy services and invoicing, and administer and manage our business and services.

Data subject

The client, its owners and contacts, if any.

Categories of personal data

Level processes non-sensitive personal data, including names, addresses, telephone numbers and email addresses of our clients and their owners, and names, job titles, telephone numbers and email addresses of the clients’ contacts.

Legal basis for processing

The processing of personal data is necessary in order for us to perform the agreement with the client or implement measures at the client’s request prior to the conclusion of the agreement, see Article 6(1)(b) of the General Data Protection Regulation.

Furthermore, processing is necessary in order for us to pursue our legitimate interest in managing the client cooperation, administering and managing our business and services, operating and maintaining IT systems made available to or used as part of our servicing of the client, as well as hosting, administering and managing our website, systems and applications, see Article 6(1)(f) of the General Data Protection Regulation.

Source

The client, its owners and contacts, if any.

Period of retention

Level retains personal data for ten years, counted from the end of the calendar year of the last engagement, unless special circumstances require shorter or longer periods of storage.

Contacts are deleted as soon as possible after Level becomes aware that such contacts are no longer employed with the client.

Recipients

Level discloses personal data to public authorities, if Level is required to do so. Besides this, Level does not disclose information to third parties, but we engage data processors, including IT suppliers, to whom we make personal data available. Level enters into data processing agreements with all data processors to ensure appropriate security.

Visitors

Purpose

We process personal data about visitors for administrative purposes, including meeting management and for security and access control purposes.

Data subject

Visitors.

Categories of personal data

Level processes non-sensitive personal data, including names, job titles, email, company names and the names of the Level hosts. In addition, we process personal data through video surveillance.

Legal basis for processing

The processing of personal data is necessary in order to pursue our legitimate interest in ensuring a high level of security, see Article 6(1)(f) of the General Data Protection Regulation.

Level’s processing of personal data is carried out in accordance with s. 3(1) of the Danish Act on Television Surveillance (tv-overvågningsloven). There are signs in our office showing that CCTV is in operation.

Source

Visitors.

Period of retention

Registrations of visitors by the reception are stored for up to one year.

Both registrations and CCTV recordings are securely stored and reviewed only on a need-to-know basis (e.g., to investigate a security incident) and only by persons with a work-related need for this. CCTV footage is typically overwritten automatically after 30 days unless an issue that requires investigation (such as a theft) has been identified.

Recipients

Personal data will be disclosed to the police only where a security incident requires investigation (e.g., theft).

Level engages data processors, including IT suppliers, to whom we make personal data available. Level enters into data processing agreements with all data processors to ensure appropriate security.

Visitors to our website

When you use the contact form on our website, we receive your name, company, email, where your geographical interest is and your message, and we send you a copy of your message. We use this only to answer you and follow up on your inquiry. The legal basis is our legitimate interest in answering inquiries, see Article 6(1)(f) of the General Data Protection Regulation, or steps you ask us to take prior to the conclusion of an agreement, see Article 6(1)(b). We delete messages no later than 12 months after our last contact, unless the inquiry becomes an ongoing relationship.

When you visit our website, our hosting provider processes technical data such as your IP address and browser type to deliver the pages and keep the site secure. We do not use this to identify you. Our website sets no cookies and uses no tracking or advertising tools.

Marketing

Purpose

The purpose is to launch marketing initiatives, including targeted communication to our relations.

Data subject

The relation.

Categories of personal data

Level processes non-sensitive personal data, including names, job positions, company names, telephone numbers and email addresses.

Legal basis for processing

Processing is necessary for us to pursue our legitimate interest, including our interest in marketing our firm and our interest in targeting the material distributed by Level, see Article 6(1)(f) of the General Data Protection Regulation.

Processing of personal data as part of the delivery of our newsletters and other similar communication is based on the consent of the relation, see Article 6(1)(a) of the General Data Protection Regulation.

Source

The relation, employees of Level or via publicly available sources, such as the central business register (cvr.dk) or LinkedIn.

Period of retention

Level retains personal data if the data is necessary for the purpose for which the personal data are processed.

If the subscriber has signed up to our newsletter, Level will process his/her personal data until consent is revoked.

Level retains documentation of the consumer’s consent if Level wants to contact the consumer and until two years after the company has last contacted the consumer or sent marketing. This is because a possible criminal liability expires after two years.

It is the opinion of the Consumer Ombudsman that a consumer is not entitled to have the personal data about the consent deleted, which is necessary for the company to document that it has had a valid consent from the consumer to receive marketing.

Recipients

Level does not disclose personal data, but we engage data processors, including IT suppliers, marketing agencies, etc., to whom we make personal data available. Level enters into data processing agreements with all data processors to ensure appropriate security.

Events and network

Purpose

The purpose is to administer registration, arrange events and courses, sending invitations, lists of participants, surveys regarding the event and to keep in touch with participants before, during and after the events and courses.

The purpose is also to administer and manage the network activities, including identifying participants, distribute invitations and conduct events.

Data subject

The participant and the client.

Categories of personal data

Level processes non-sensitive data, including names, job titles and positions, company names, addresses, telephone numbers and email addresses.

Legal basis for processing

The processing of personal data is necessary in order for us to perform an agreement with the participant and client and to implement measures at the client’s request prior to the conclusion of the agreement, see Article 6(1)(b) of the General Data Protection Regulation.

Furthermore, the processing is necessary in order to pursue our legitimate interest in carrying out events and subsequently evaluating them and administering and managing the network activities, see Article 6(1)(f) of the General Data Protection Regulation.

Source

The participant and the client.

Period of retention

Level retains personal data as long as the data is necessary for the purpose for which the personal data are processed. Level assesses whether special circumstances require shorter or longer periods of storage.

Recipients

Level does not disclose information to third parties except lists of participants which are disclosed to other network participants.

Supplier and business partner administration

Purpose

The purpose is to carry out contract management, receive goods and services from our suppliers and business partners.

Data subject

The supplier or business partner, including any contacts employed with them.

Categories of personal data

Level processes non-sensitive personal data, including names, addresses, email addresses and phone numbers, as well as any bank account information on suppliers and business partners.

In addition, Level processes names, job titles, email addresses and telephone numbers of any contacts employed with suppliers and business partners.

Legal basis for processing

The processing of personal data is necessary in order for us to perform the agreement with the supplier and the business partner, see Article 6(1)(b) of the General Data Protection Regulation.

The processing of personal data relating to the contacts of a supplier and its business partners is necessary to enable us to pursue our legitimate interest in administering and performing the agreement with the business partner, see Article 6(1)(f) of the General Data Protection Regulation.

Source

The supplier, business partner or their contacts.

Period of retention

Level retains personal data for five years, counting from termination of the supplier relationship or business partnering, unless special circumstances require shorter or longer periods of storage.

Recipients

We disclose personal data to the auditor in connection with the audit, but we engage data processors, including IT suppliers, to whom we make personal data available. Level enters into data processing agreements with all data processors to ensure appropriate security.

Recruitment

Purpose

The purpose is to be able to recruit, including to process and assess candidates in relation to current or future positions with Level.

Data subject

The candidate and any references specified by the candidate.

Categories of personal data

Level processes non-sensitive personal data forwarded by candidates or any external recruitment agencies, including names, telephone numbers and email addresses, curriculum vitae, references, exam papers, photos, information about salary, and other supporting documents.

If a candidate is invited to an interview, Level collects and processes personal data in connection with personality and proficiency tests and any references.

Level may also ask candidates to present their criminal records, if relevant to the current position.

We do not need to process the candidate’s CPR number and therefore request that such information not be sent to Level. In exceptional cases, we may process sensitive personal data received from the candidate if these are relevant to the candidate’s position with Level.

Legal basis for processing

The processing of personal data is necessary in order for us to pursue our legitimate interest in processing and assessing the candidate, filling the position with an appropriate candidate and storing the personal data for subsequent recruitment processes, see Article 6(1)(f) of the GDPR.

Level processes data from tests, collection of references and criminal records on the basis of the candidate’s consent, see Article 6(1)(a) of the GDPR.

Level processes sensitive data, including health data, on the basis of the candidate’s consent, see Article 9(2)(b) of the GDPR, and section 12(1) of the Danish Act of the Processing of Personal Data.

Source

The candidate, external recruitment agencies and any references.

During the selection process, Level may search for relevant information published on the Internet, for example LinkedIn, Facebook and similar social media.

Period of retention

If the candidate is not offered a position, we delete the information six months after the candidate has been informed that he or she was not selected, unless the candidate has consented to us storing it for a longer period of time, for example in connection with the recruitment for other or future positions, or if special circumstances warrant a longer period of storage.

If a candidate wants to have data concerning him or her erased sooner the candidate may request Level to do so at dpo@levelconsulting.com

Recipients

Level does not disclose the candidate’s personal data to third parties, but in some cases, Level makes them available to data processors, such as test providers, recruitment agencies, etc., which provide services to us in connection with a recruitment process. In that case, we will enter into the necessary agreement to ensure, inter alia, that personal data are processed properly and securely in accordance with the obligations set out in the GDPR.

If the candidate consents to Level collecting references, the declaration of consent will be forwarded to the enterprise(s) and contact person(s) provided by the candidate as references in order to serve as documentation of the candidate’s consent to Level obtaining reference information about the candidate.

Individuals’ rights

As an individual, you have certain rights over your personal data, which Level as data controller is obligated to fulfill.

You have a right of access to personal data held by us as a data controller. Similarly, you are entitled to have any inaccurate or incomplete personal data rectified. Please contact Level if you want to have your personal data deleted, to have Level’s processing of such data restricted, to exploit your right to data portability or object to Level’s processing of such data.

When we process personal data based on consent, individuals have a right to withdraw consent at any time. To withdraw consent to our processing of your personal data please contact us. If you no longer wish to receive emails with information or marketing material about Level, please notify us at dpo@levelconsulting.com

In case you are an employee of a client, or have a relation to one of our clients, who we process personal data on behalf of, we advise you to contact the client in order to exercise your rights as a data subject. This is because the client is the data controller of the processing of personal data concerning you.

Below you can read more about your rights as a data subject if you want to exercise your rights regarding one or more processing activities carried out by Level as the data controller.

Right to access

You have the right to obtain from us confirmation as to whether personal data concerning you are being processed.

Right to rectification

You have the right to have inaccurate personal data concerning you rectified and to have incomplete personal data completed.

Right to erasure

In certain situations you have the right to have personal data concerning you erased.

Right to restriction of processing

In certain situations you have the right to obtain from us restriction of processing of personal data concerning you. Level does not carry out automated individual decision-making, including profiling.

Right to object

You have the right to make objections against our processing of personal data concerning you which is based on our legitimate interests. We do not continue the processing of personal data concerning you, unless we are able to demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of you or for the establishment, exercise or defense of legal claims.

Right to data portability

You are welcome to contact us if you want to learn more about your right to data portability.

Right to withdraw your consent

In case our processing of personal data concerning you is based on your consent, you have the right to withdraw your consent at any time.

The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Security of processing

Information security is the business risk given top priority at Level. We take the security of all the data we hold very seriously, and we adhere to internationally recognized security standards. We have security measures in place to ensure data protection of client information, personal data and other confidential information. We regularly perform internal follow-up in relation to the appropriateness of and compliance with policies and measures.

Complaints

We hope that you won’t ever need to, but if you do want to complain about our use of personal data, please send an email with the details of your complaint to dpo@levelconsulting.com. We will review the complaint and respond.

You also have the right to lodge a complaint with the Danish Data Protection Agency in relation to your rights and to Level’s processing of personal data. For further information about how to complain to the Danish Data Protection Agency, please refer to the Danish Data Protection Agency website https://www.datatilsynet.dk/borger/klage.

Changes to this privacy notice

We recognize that transparency is an ongoing responsibility so we will keep this privacy notice under regular review.

This privacy notice was last updated on 27 October 2026.