Bear & Wolf Advokatanpartsselskab, company reg. no. (CVR): 41868406, (‘we’ or ‘us’) process personal data about you for different purposes depending on context. In this respect, we are considered a data controller under the EU General Data Protection Regulation (GDPR) since we determine the purpose and means of the processing.

If you have any questions or wish to exercise your rights (see further below), you can contact us at simon@bearandwolf.com. 

Aside from processing of personal data in relation to clients and case work, which we will inform you about during client onboarding, the contexts where we process personal data are described below.

If you are thinking of becoming a client and want to know how we process personal data in this regard, please reach out to us at the e-mail above.

Website visitors

Which data do we process, for what purpose and on which legal basis?

We collect your IP-address, Google Analytics ID as well as information about your behaviour on our website through the Google Analytics tool. 

This processing is carried out according to Article 6(1)(f) GDPR because it is our legitimate interest to obtain information about use of our website to market and improve our services and since the information is not sufficiently intrusive that consent is required. 

As for cookies set and information obtained through use of cookies and similar technologies, information is provided consent is obtained in accordance with section 3 of the Danish Cookie Order (BEK no. 1148 of 09/12/2011) and Article 6(1)(a) GDPR.

Storage period

Personal data contained in cookies is deleted when the cookie expires or is deleted by the user (see our cookie policy: https://www.bearandwolf.dk/cookie-policy/). 

We anonymize user and event level data according to the strictest possible settings available in Google Analytics (https://support.google.com/analytics/answer/7667196?hl=en), i.e. currently within two months. 

Recipients and transfer of data to third countries

There is a risk that Google Ireland Ltd. transfers personal data to the United States even if the data is hosted on EU servers as Google Ireland Ltd. is a subsidiary of Google LLC and that this company discloses personal data to the United States in connection with law enforcement requests for information. However, Google is certified under the UK Extensions to the EU-U.S. Data Privacy Framework, which is why such potential transfer under our assessment is subject to the appropriate safeguards in article 45 GDPR.

Job applicants

Which data do we process, for what purpose and on which legal basis?

Identification and contact information, information provided in applications, CVs and related documents, e.g. diplomas, and other personal data relevant to the assessment of a candidate, to the extent the job applicant has transmitted the material to us or necessary for evaluation for the job in question. The processing is carried out on the basis of Article 6(1)(b) GDPR since it is necessary in order to take steps at the request of the data subject prior to entering into an employment contract with that person.

Storage period

Personal data received in connection with speculative applications are erased after review of the application if the candidate is not relevant for a current or soon upcoming relevant job opening unless consent is obtained for longer storage.

Personal data received in connection with applications for advertised jobs are deleted after the final stage of the recruitment process unless the candidate is relevant for a current or soon upcoming relevant job opening or unless consent is obtained for longer storage.

Recipients and transfer of data to third countries

Job applications sent to us will be transferred to our UK company, Bear & Wolf (UK) LLP since the people responsible for assessing candidates for employment in our Danish company is employed with our UK company.

Furthermore, we use Microsoft Outlook as our e-mail software when receiving and handling job applications. E-mails are processed on an Exchange server hosted within the EU. Microsoft Ireland Operations Ltd. provides the software and is under control by its parent company, Microsoft Corporation, located in the United States. There is therefore a risk of transfer of personal data to third countries, however, since Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework, it is our assessment that the eventual transfer of personal data from Microsoft Ireland Operations to Microsoft Corporation ensures an adequate level of protection compared to that of the EU in accordance with Article 45(1) GDPR.

Non-client communications, e.g. suppliers and business partners

Which data do we process, for what purpose and on which legal basis?

We process identification and contact information on the relevant individual for the purpose of purchasing goods and services in the day-to-day course of business or to establish or maintain business relations or similar. 

The processing is based on either Article 6(1)(b) or 6(1)(f) GDPR depending on which capacity the person is acting in.

Storage period

Personal data on suppliers in relation to the purchase of goods and services figuring on invoices are kept for 5 years for the purpose of section 10 of the Danish Bookkeeping Act. 

Otherwise, personal data processed for the same purpose, for instance correspondence, is deleted or anonymised continuously, but sometimes only after three years or longer if necessary to exercise or defend legal claims which are limited to three years or more.

As for business partners, contact information is kept unless the relationship between us and the business partner is inactive, when we do not foresee contacting the business partner to be relevant in the future and when there has been no contact for a continuous period of one year between us and the business partner in question.

Recipients and transfer of data to third countries

Read more about potential transfers to Microsoft Corporation in the U.S. in connection with email correspondence under the same subsection of the description of our processing activities in relation to job applicants.

Your individual rights

You have the rights outlined below which you can exercise by contacting us using the details provided above. Your request will be processed free of charge and as quickly as possible, and no later than one month after we receive it, except if the request is complex or numerous, then it may take up to two months.

• Access. You have the right to obtain access to the personal data we process about you as well as to certain information on how the processing takes place.
• Rectification. You have the right to request rectification of inaccurate personal data concerning you and to have incomplete personal data about you completed.
• Erasure. Under certain circumstances, see Article 17 GDPR, you have the right to have personal data concerning you erased. For example, if the data are no longer necessary for meeting our obligations and exercising our rights, or if the data are processed on the basis of your consent and you withdraw your consent.
• Restriction. In the circumstances referred to in Article 18 GDPR, you have the right to request restriction of processing of your personal data, e.g. if the accuracy of the data is contested, for a period enabling us to verify the accuracy of the personal data, or if we no longer need the personal data for the purposes of the processing, but they are required for the establishment, exercise or defence of legal claims.
• Objection. On grounds relating to your particular situation, you have the right to object to our processing of personal data based on article 6(1)(f) of the GDPR (the balancing of interests). You may, however, at any time (i.e. not only on grounds relating to your particular situation) object if the personal data are processed for direct marketing purposes (e.g. in connection with newsletters).
• Data portability. If the processing is based on your consent or on a contract, you have the right to receive the data in a commonly used and readable format, and you have the right to transmit those data to another data controller. We will transmit the data directly to such other controller if you request us to do so and if technically feasible.
• Automated decision-making. You have the right not to be subject to a decision solely based on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. If you suspect such a decision to have taken place, do reach out to us.
• Right to lodge a complaint. You can complain about the processing at any time by contacting us. Furthermore, you always have the right to lodge a complaint with the Danish Data Agency (datatilsynet.dk, dt@datatilsynet.dk, +45 33 19 32 00), or the supervisory authority in the country in which you reside or in the country in which you believe that the processing of personal data in violation with the GDPR or the Danish Data Protection Act took place.