Privacy policy for the ALK employer branding and recruitment
Date of publication: August 2026
ALK-Abelló A/S ("ALK", "we", "us" or "our"), a company incorporated in Denmark with CVR number 63717916 and registered office at Bøge Alle 6, 2970 Hørsholm, Denmark, manages its employer branding and recruitment process through our career site (the “Career Site”) and a related applicant tracking system provided by Teamtailor AB (the "ATS"). In this privacy policy, we explain how we process your personal data if:
You visit our Career Site (you being a “Visitor”)
You connect with us via our Career Site to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”); or
You apply for a position with us via our Career Site or a third-party service (you being an ”Applying Candidate”)
We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)
This privacy policy also describes what rights you have when we process your personal data, and how you can exercise these rights.
When we use the term “Candidate” in this privacy policy, we are referring to both Connecting Candidates and Applying Candidates, unless it is stated otherwise.
1. Contact information
If you have any questions about how ALK processes your personal data, or about your rights please contact us by using the below contact information.
ALK-Abelló A/S is the data controller for the processing described in this privacy policy. Where a specific ALK group entity is the hiring entity for a vacancy, that entity acts as a separate, independent data controller in relation to the recruitment for that vacancy, and is responsible for its own processing of your personal data. ALK-Abelló A/S and the hiring ALK group entity are not joint controllers within the meaning of Article 26 GDPR, and there is no joint-controller arrangement between them. Teamtailor AB and its sub-processors (including OpenAI, L.L.C. for certain AI features) act as our data processors and are only permitted to process your personal data on our documented instructions.
Our contact information:
ALK-Abelló A/S
Address: Bøge Allé 1
2970 Hørsholm
Denmark
Tel.: +45 45 74 75 76
Email: data.protection@alk.net
Data Protection Officer:
Bech-Bruun Advokatpartnerselskab
CVR no.: 38538071
Langelinie Allé 35
2100 København Ø
Denmark
Tel.: +45 72 27 30 02
Email: dpo.alk@bechbruun.com
3. What personal data do we process?
All individuals
Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
Contact details - Such as your name, email address, telephone number and physical address.
Candidates
Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements, video interviews (where you have consented to recording), transcripts generated from such recordings, and AI-generated summaries of your application produced by the ATS in support of the recruitment process.
Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.
Information in your public profile - Meaning the information we may consult from public sources related to your professional experience, such as LinkedIn or the website of your current employer, in the context of assessing your application.
Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.
Contact details - Such as your name, email address, telephone number and physical address.
Communications data - We collect and store your communication with us, including the information you provide in the communication. This may include the content of emails, messages, information you add to your account with us, and responses to surveys.
4. Where do we receive your personal data from?
From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you the information you request to get from us.
References
From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you.
Candidates
From public sources. We may collect personal data about you from public sources and professional networks, such as LinkedIn, other professional-networking or job platforms, and the website of your current employer.
From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
From your references. If you provide us with references, we may collect information about you from them.
Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.
5. For what purposes do we process your personal data?
We process your personal data for the purposes set out in the table below. For each purpose, the table also indicates which categories of individuals are affected, the categories of personal data used, and the legal basis on which we rely under Article 6(1) (and, where applicable, Article 9(2)) of the GDPR.
1. Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims.
Affected individuals: The individual(s) affected by the legal issue - this may include persons from all categories of individuals listed above.
Categories of personal data: All the categories of personal data listed above can be used for this purpose.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR) - our legitimate interest in protecting and enforcing our rights. Where special category data is exceptionally processed for this purpose, Article 9(2)(f) GDPR (establishment, exercise or defence of legal claims).
2. Share your personal data with other recipients, for the purposes mentioned in Section 5 below.
Affected individuals: Varies depending on the purpose of the sharing, see Section 5 below.
Categories of personal data: All the categories of personal data listed above may be used for this purpose.
Legal basis: The same legal basis as the underlying purpose that the sharing supports (see the other points in this overview).
3. Collect information about your use of the Career Site, using cookies and other tracking technologies, as described in our Cookie Policy.
Affected individuals: Visitors.
Categories of personal data: Device information.
Legal basis: Consent (Article 6(1)(a) GDPR) for cookies and similar technologies that are not strictly necessary. For strictly necessary cookies, our legitimate interest (Article 6(1)(f) GDPR) in operating the Career Site.
4. Maintain, develop, test, and otherwise ensure the security of the Career Site.
Affected individuals: Visitors.
Categories of personal data: Device information; Technical and statistical data.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR) - our legitimate interest in operating and securing the Career Site.
5. Analyse how the Career Site and its content is being used and is performing, to get statistics and to improve operational performance.
Affected individuals: Visitors.
Categories of personal data: Device information; Technical and statistical data.
Legal basis: Consent (Article 6(1)(a) GDPR) where analytics are carried out via non-strictly-necessary cookies (see our Cookie Policy). Otherwise, our legitimate interest (Article 6(1)(f) GDPR) in understanding and improving the Career Site.
6. Provide you with updates about vacancies with us.
Affected individuals: Connecting Candidates.
Categories of personal data: Contact details; Communications data.
Legal basis: Consent (Article 6(1)(a) GDPR) - based on the consent you give when you connect with us to receive information about vacancies.
7. Review profiles and applications sent to us, and communicate with you about your application and profile.
Affected individuals: Connecting Candidates; Applying Candidates.
Categories of personal data: All the categories of personal data listed above may be used for this purpose.
Legal basis: Steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) where you have applied for a position; and legitimate interests (Article 6(1)(f) GDPR) in evaluating candidates and running our recruitment process.
8. Collect and evaluate your professional profile on our own initiative, and communicate with you regarding your profile.
Affected individuals: Sourced Candidates; Referred Candidates.
Categories of personal data: All the categories of personal data listed above may be used for this purpose.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR) - our legitimate interest in identifying and approaching potential candidates for current or future vacancies.
9. Contact you directly about specific, future vacancies with us.
Affected individuals: Candidates.
Categories of personal data: All the categories of personal data listed above may be used for this purpose.
Legal basis: Consent (Article 6(1)(a) GDPR) where we contact you about future vacancies after an initial recruitment process has ended; otherwise, legitimate interests (Article 6(1)(f) GDPR) in continuing an ongoing recruitment dialogue.
10. Record the interview(s) with you.
Affected individuals: Candidates.
Categories of personal data: Communications data; Data from interviews, assessments and other information from the recruitment process.
Legal basis: Consent (Article 6(1)(a) GDPR) - we only record an interview where you have given your consent, and you may decline or withdraw that consent without any adverse consequences for your application.
11. Contact you to ask for your participation in surveys.
Affected individuals: Candidates.
Categories of personal data: All the categories of personal data listed above may be used for this purpose.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR) - our legitimate interest in obtaining feedback on our recruitment process and improving it. Your participation in any survey is voluntary.
12. Provide AI-assisted support in the recruitment process, including generating candidate summaries and insights, interview transcripts, and drafting suggested content, using the AI-assisted features of the ATS (Teamtailor Co-pilot). See Section 9 for further information.
Affected individuals: Candidates.
Categories of personal data: Communications data; Data from interviews, assessments and other information from the recruitment process; Information in your application; Information in your public profile.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR) - our legitimate interest in an efficient, consistent recruitment process. Consent (Article 6(1)(a) GDPR) is additionally required for the recording and transcription of interviews (see row 10).
13. Contact you to ask you to provide information about a candidate, and evaluate the information you provide.
Affected individuals: References.
Categories of personal data: Contact details; Communications data.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR) - our legitimate interest in verifying and evaluating information about candidates through references provided to us.
Where a purpose in the table above could rely on more than one legal basis depending on the specific processing activity, the row identifies each basis that may apply. A summary of the balancing test we carried out for our legitimate-interest bases is available on request using the contact details in Section 10 below.
6. Whom do we share your personal data with?
We share your personal data only to the extent necessary for the purposes described in Section 5 above, and only with the following categories of recipients:
(i) our service providers acting as data processors, including the provider of our Career Site and applicant tracking system and its sub-processors;
(ii) ALK group entities involved in the recruitment for a specific vacancy, which act as separate, independent data controllers in relation to that recruitment as further described in the contact section above;
(iii) recruitment service providers and background screening providers we engage in connection with specific vacancies;
(iv) our professional advisers, such as external legal counsel and auditors, acting under duties of confidentiality or professional secrecy;
(v) authorities and other public actors where we are required to share your personal data to comply with a legal obligation, or in connection with actual or potential legal proceedings to protect or defend our rights; and
(vi) counterparties and their advisers in connection with a potential or completed corporate transaction, such as a merger, financing or acquisition of all or part of our business. Cookies and similar technologies on our Career Site may result in personal data being shared with third parties as described in our Cookie Policy.
7. When do we transfer your personal data outside of the EU/EEA, and how do we protect it then?
In cases where another recipient of your personal data (as described in Section 5 above) is based outside the EU/EEA, this will also mean that your personal data is transferred outside the EU/EEA.
When we, or one of our processors or sub-processors, transfer your personal data outside the EU/EEA (for example, where we use OpenAI, L.L.C. as a sub-processor in the United States for certain AI-assisted features of the ATS), we will ensure that a safeguard recognised by the GDPR is used to enable the transfer. We use the following safeguards:
A decision by the EU Commission that the country outside of the EU/EEA to which your personal data is transferred has an adequate level of protection, which corresponds to the level of protection afforded by the GDPR. In particular, we rely on the EU Commission’s adequacy decision for the US via the so-called EU-US Data Privacy Framework, and the adequacy decision for the UK.
Entering into the EU Commission’s standard clauses with the recipient of the personal data outside the EU/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the GDPR still applies, and that your rights are still protected.
You can request more information about the safeguards implemented for a specific transfer, or a copy of the relevant safeguards, using the contact details in Sections 1.
8. For how long do we keep your personal data?
Candidates
For other types of Candidates, we keep your personal data for as long as necessary to decide whether you are a suitable candidate for the relevant vacancy(ies) with us and, in any event, no longer than six (6) months after the recruitment process for that vacancy has been finally concluded.
If you do not succeed in the initial recruitment process, we will keep your personal data for six (6) months following the end of the process for the purpose of considering, and potentially contacting you, in relation to future openings that may be of interest. We will keep your personal data for a longer period only where you have expressly consented to this.
If you are hired, we will keep your personal data during your employment for the purposes described in our separate employee privacy notice, which will be provided to you at or before the start of your employment.
9. Automated decision-making and AI-assisted processing
Our applicant tracking system is provided by Teamtailor AB and includes optional AI-assisted features (the "Co-pilot" features) that are powered by third-party generative AI models supplied by OpenAI, L.L.C. as a sub-processor of Teamtailor. Depending on how we have configured the ATS at the time of your application, one or more of the following AI-assisted features may be applied to information about you:
· summarising CVs and application information;
· generating candidate insights and answering questions about candidate data;
· suggesting interview questions, skills and traits;
· drafting or editing candidate communications (for example, rejection messages);
· generating transcripts, summaries or insights from interviews where you have consented to the interview being recorded; and
· detecting potentially discriminatory interview questions.
No solely automated decisions with legal or similarly significant effect.
We do not use AI-assisted features to take decisions about you that are based solely on automated processing and that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. All shortlisting, interview and hiring decisions are taken by a human recruiter or hiring manager, who is responsible for reviewing and, where appropriate, overriding any AI-generated output before acting on it.
Your rights in relation to AI-assisted processing.
You have the right to obtain further information about the AI-assisted features that have been applied to your application, to express your point of view, and to request that a decision affecting you is reviewed by a human decision-maker. You can exercise these rights using the contact details in Sections 9 and 10 below. Where the use of a particular AI-assisted feature depends on your consent (for example, the recording and transcription of an interview), we will ask for that consent separately and you can decline or withdraw it at any time without any adverse consequences for your application.
10. What rights do you have, and how can you exercise them?
Under the GDPR, you have the following rights in relation to our processing of your personal data. Some rights only apply where we rely on a particular legal basis. To exercise any of these rights, contact us using the details in Section 10, log in to your account with us, or visit the Data & Privacy page on the Career Site.
Right to be informed:
You have the right to be informed about how we process your personal data. We provide this information through this privacy policy and by answering questions from you.
Right of access:
You have the right to know whether we process personal data about you and to receive a copy of that data, together with information about how we process it.
Right to rectification:
You have the right to have inaccurate personal data rectified and incomplete personal data completed.
Right to erasure (“right to be forgotten”):
You have the right to have your personal data deleted in certain cases, for example where it is no longer necessary for the purposes for which we collected it or where you have withdrawn your consent.
Right to restrict processing:
You have the right to request that we restrict our processing of your personal data, for example while we assess an objection or a claim of inaccuracy.
Right to data portability:
Where we process your personal data based on your consent or for the performance of a contract, you have the right to receive it in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to object:
You have the right to object to processing based on our legitimate interests on grounds relating to your particular situation. You also have an absolute right to object to processing for direct-marketing purposes, including where we contact you about vacancies on that basis.
Right to withdraw consent:
Where our processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Right to raise a complaint:
If you have complaints about our processing of your personal data, you can raise a complaint with the Danish Data Protection Authority (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark. You can find their contact details on their website at www.datatilsynet.dk.
You can also lodge a complaint with your national data protection authority, which you can find listed here if you are based in the EU. If you are based in the UK, you can lodge a complaint with the Information Commissioner’s Office, here.
11. Where can you turn with comments or questions?
If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can contact us using the details in section 1.
12. Updates to this Privacy policy
We update this privacy policy when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws.
We encourage you to regularly check this page for any changes. You can always check the top of this page to see when this privacy policy was last updated.