GDPR applicant | NRE - Let's Build Together

GDPR applicant

Processing of personal data - Privacy Policy relating to NRE's processing of personal data during recruitment

NRE process personal data about you, when you apply for a job with us. 

We will always process your personal data in a safe and confidential manner in accordance with applicable data protection legislation, and we have implemented appropriate measures to protect the data against the risks involved in the processing.

Below are further details about our processing of personal data about you as a job applicant. 

Who is the data controller? 

The company of the NRE group that you are applying to is the data controller in connection with the processing of your personal data (in the following defined as "NRE").

If you have any questions in relation to the processing of your personal data as an applicant, or if you want to exercise your rights as described below, or if you want to complain or object to our processing then please do not hesitate to contact the person in charge of this Privacy Policy: Jonas Olesen, Director (tel.: +45 23 23 53 77; email: JO@NRE.DK)

When and purpose

NRE collects, records and processes personal data about you when you apply for a position with us - whether your application is solicited or unsolicited. 
This is necessary in order to:

  • assess and find the best-suited candidates for current or future openings;  

  • communicate with you; 

  • draft and conclude a contract of employment with you, if you are the successful applicant; or to 

  • document the recruitment process in case of any claim or dispute brought against us.

Types of personal data

NRE will process various types of personal data provided by you during the recruitment process. In some cases, we may also collect information from elsewhere, e.g. asking former employers for references or checking social media (where this possibility is in accordance with the data protection legislation).

Non-sensitive personal data such as your name, date of birth, address, email, phone number, educational and job history, profile picture, examination certificates, etc. (i.e. ordinary CV information).

Sensitive personal data, such as data concerning your health, may be collected in special recruitment processes, e.g. in connection with section 56 reimbursement agreements or other employment relations eligible for reimbursement, if necessary in order to handle the specific process.

Legal basis

The legal basis of our processing of your non-sensitive personal data is as follows:

  • NRE’s legitimate interest in recruiting new employees for our business, including to ensure documentation of the recruitment process to defend against any subsequent claims or disputes brought against us (GDPR Article 6(1)(f)), and  

  • Contract purposes in relation to a potential contract of employment with you (GDPR Article 6(1)(b)).

NRE may also retain your application for a period of up to one year after the recruitment process has ended or after your filing of an unsolicited application, provided you have given your consent (GDPR Article 6(1)(a)).

Please note that you may withdraw your consent  at any time by simply contacting us (see contact details above). If you choose to do so, NRE will not process personal data about you unless we have other lawful reason to do so, e.g. where continued processing is necessary for the establishment, exercise or defence of a legal claim (GDPR Article 6(1)(f) or Article 9(2)(f)).

NRE’s processing of health data in special recruitment processes (section 56 reimbursement agreements or other employment relations eligible for reimbursement) may be required for the purposes of complying with statutory obligations (GDPR Article 9(2)(b) and (h)).

Storage period

We will retain your application for a period of up to one year after the recruitment process has ended or after your filing of an unsolicited application, if you have given your consent.

If you do not want us to retain your application, you are free to contact us and have us delete it (except where retention is considered necessary for purposes of a potential subsequent legal dispute). 

Where consent is withheld, applications will usually be deleted six months after the recruitment process has ended, but may be retained for longer than that, e.g. if necessary for purposes of a potential subsequent legal dispute.


Your personal data will be accessible only to relevant NRE employees. The data will be disclosed only to the persons who need them for the purposes stated above or where disclosure is required by law.

NRE may disclose your application and accompanying documentation to our consolidated companies if we believe your profile is or soon could be relevant for any of them.

NRE has also engaged data processors to perform work on our behalf. These data processors will get access to your personal data according to NRE's specific instructions. Such data processors are, i.a., IT supporters, suppliers of remote back-up and, to a limited extent, cloud solutions (e.g. Office 365).


Updating of your personal data

We always seek to ensure that your personal data are accurate and updated. In case of changes to your personal data, we kindly ask you to let us know by using the above contact details. If you inform us of any inaccuracies in your personal data, or if we notice such inaccuracies, we will have them rectified or deleted as soon as possible.

Your rights under data protection legislation

As a data subject you have a number of rights which you may exercise by contacting us, using the above contact details.
You have the right to request information about which personal data we process and to receive a copy of the data. You also have the right to object to our processing of your personal data and to request rectification or erasure of any data which you believe are incorrect, outdated, etc. Further, you may request a restriction of the processing of your personal data.
For some of these rights, e.g. the right to erasure, exercising them requires satisfaction of certain concrete conditions set by data protection legislation.


If you disagree with the way in which we process your personal data, you may file a complaint, using the above contact details. If you disagree with a decision made in any complaint proceedings (or do not wish to complain directly to us), you may also file a complaint with the Danish Data Protection Agency, which is the competent supervisor authority in Denmark. Contact details of the Agency are available at

Date: 20.12.2018