Man–frekl. 08–18
KontorHedelykken 2-4, Hedehusene
1. Data controller and contact
Sourcing IT ApS is the data controller for the personal data we receive about you. We process your data in accordance with the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.
- Company: Sourcing IT ApS
- CVR no.: 43251325
- Address: Hedelykken 2-4, 2640 Hedehusene, Denmark
- Phone: +45 3020 7660
- Email: hello@sourcingit.dk
If you have questions about how we process your data, or want to exercise your rights, you are always welcome to contact us.
2. Who the policy covers and what data we process
This policy applies to four groups: consultants and candidates, contact persons at clients and partners, visitors to sourcingit.dk, and people who contact us.
| Who | Data we typically process | Where it comes from |
|---|---|---|
| Consultants and candidates | Name, contact details, CV, education, work experience, skills, certifications, languages, availability, hourly rate or salary expectations, references and notes from conversations | You (e.g. via our CV form or email), publicly available professional profiles (e.g. LinkedIn) and references you have given us |
| Consultants on assignment | The above, plus contract and invoicing details, CVR no. and bank details for payment | You and your company |
| Contact persons at clients and partners | Name, title, company, work email, phone and correspondence | You, your employer or public sources |
| Website visitors | IP address, browser and device information, and cookies if you have given consent | Your browser |
We do not ask for sensitive data (e.g. health, religion or ethnic origin), and we encourage you not to include it in your CV. If a client requires a background check or criminal record certificate, we only obtain it with your explicit consent and only for the specific assignment.
3. Purposes and legal basis
We only process your data when we have a lawful basis under GDPR Article 6, and only for the purposes listed below.
| Purpose | Legal basis (GDPR) |
|---|---|
| Assessing your profile and matching you with relevant assignments and positions | Legitimate interest, Art. 6(1)(f) – our interest in placing consultants and candidates, which is also in your interest |
| Presenting your CV to a client for a specific assignment | Consent, Art. 6(1)(a) – we never send your CV to a client without agreeing it with you first |
| Entering into and managing contracts, time registration and invoicing | Performance of a contract, Art. 6(1)(b) |
| Complying with bookkeeping and tax rules | Legal obligation, Art. 6(1)(c) |
| Background checks or criminal record certificates when a client requires them | Explicit consent, Art. 6(1)(a), and section 8 of the Danish Data Protection Act |
| Communication and collaboration with clients and partners | Legitimate interest, Art. 6(1)(f) |
| Newsletters and marketing | Consent, Art. 6(1)(a) |
| Operation, security and statistics on the website | Legitimate interest (necessary cookies) and consent (other cookies) |
If you have given consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before the withdrawal.
4. Who we share your data with
We never sell your data. We only share it in these cases:
- Clients: when you have agreed to be presented for a specific assignment or position. The client becomes an independent data controller for the data they receive.
- Supplier platforms (MSP/VMS): some clients receive candidates through a supplier platform, e.g. Magnit. In that case we upload your CV to the platform on the client’s behalf.
- Partners: other consultancy and recruitment firms we work with on a specific assignment, and only after agreeing it with you.
- Data processors: IT suppliers that process data on our behalf, e.g. our candidate database, email and office software, website hosting and accounting system. They may only use the data on our instructions, and we have data processing agreements with them.
- Authorities: when required by law, e.g. the Danish Tax Agency.
Transfers outside the EU/EEA: Some of our data processors may store data in data centres outside the EU/EEA. This only happens with the safeguards GDPR requires: an adequacy decision from the European Commission (e.g. the EU-U.S. Data Privacy Framework) or the European Commission’s standard contractual clauses. Contact us if you would like a copy of the safeguards.
5. How long we keep your data
We only keep your data for as long as we need it for the purpose. After that, we delete or anonymise it.
| Data | Retention period |
|---|---|
| Candidate and consultant profile (CV, notes, contact details) | 3 years after our most recent contact with you. We contact you before the period expires and delete the profile if you do not wish to remain in our network |
| Contracts, timesheets and invoices | 5 years from the end of the financial year, under the Danish Bookkeeping Act |
| Criminal record certificates and background checks | Deleted no later than 6 months after the assignment starts or is declined |
| Contact persons at clients and partners | For as long as the collaboration is active and 3 years after the most recent contact |
| Enquiries via contact form or email | 1 year after the matter is closed, unless it leads to a collaboration |
| Newsletter | Until you unsubscribe |
| Cookies | See the cookie overview on the website |
6. Website, cookies and forms
Cookies: We use necessary cookies to make the website work and to remember your cookie choice. We only set statistics, functional and marketing cookies if you have given consent in our cookie banner. You can change or withdraw your consent at any time via “Cookie settings” on the website. Among other things, we use Google services for statistics.
CV form and contact form: When you upload your CV or write to us via the website, the data is stored in our candidate database or inbox and processed as described in sections 2–5.
Embedded content: Pages on the website may contain content from other services, e.g. videos or LinkedIn posts. These services may collect data about you under their own privacy policies.
Links: We are not responsible for the content or data processing on other websites we link to.
7. Security
We protect your data with technical and organisational measures appropriate to the risk. These include:
- access to the candidate database only for employees who need it for their work
- personal logins and two-factor authentication on our systems
- encrypted connections (HTTPS) on the website and in our systems
- data processing agreements with all suppliers that process data for us
If a personal data breach occurs, we report it to the Danish Data Protection Agency (Datatilsynet) within 72 hours where the law requires it. If there is a high risk to you, we will also notify you.
8. Your rights
Under GDPR you have the following rights. Contact us at hello@sourcingit.dk and we will reply within 1 month.
- Access (Art. 15): you can find out what data we hold about you and get a copy.
- Rectification (Art. 16): you can have incorrect data corrected or outdated data updated, e.g. a new CV.
- Erasure (Art. 17): you can ask us to delete your data. We will delete it unless the law requires us to keep it, e.g. invoices under the Danish Bookkeeping Act.
- Restriction (Art. 18): you can ask us to temporarily restrict the processing.
- Data portability (Art. 20): you can receive the data you have given us in a commonly used, machine-readable format.
- Objection (Art. 21): you can object to processing based on our legitimate interest, and always to marketing.
- Withdrawal of consent (Art. 7): you can withdraw your consent at any time.
We do not make decisions about you based solely on automated processing or profiling.
Complaints: If you are unhappy with how we process your data, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk. We would appreciate it if you contact us first so we can try to resolve the matter.
9. Changes to this policy
We update this policy when our processing or the law changes. The latest version is always available at sourcingit.dk/en/privacy-policy. In the event of significant changes, we will notify the consultants and candidates in our network.
Last updated: 1 October 2026.