PRIVACY POLICYRECRUITMENT
1. INTRODUCTION
This privacy notice describes how Ørsted (“we”, “us”, “our”, or “Ørsted”) processes your personal
data in connection with our recruitment activities. The purpose of the privacy policy is to fulfill our
obligation to provide you with information about our processing of your personal data inaccordance with the General Data Protection Regulation (“GDPR”).
We always strive to process personal data responsibly, and we take all relevant measures toensure that our processing of personal data is in compliance with applicable legislation, including
the GDPR and other relevant national legislation.
To the extent possible, we follow a uniform recruitment process across the countries where weare present. At the same time, we are aware of national differences in rules and practices, whichin specific cases may imply small differences compared to the general recruitment process.
Where country-specific conditions impact how we process personal data, we have indicated thisseparately. This means that – where relevant – under the description of our processing activities,
we have stipulated specific national legal bases on which the processing of personal data rests.
We encourage you to read the privacy policy thoroughly.

2. DATA CONTROLLER
The legal entity responsible for the processing of your personal data is the company within theØrsted group that is recruiting. The name of the company will either be stated in the job advert orin a separate notification that you receive from Ørsted.
If you are uncertain about which legal entity is responsible for the processing of your personal
data in connection with a recruitment process, please contact us.

3. CONTACT INFORMATION
If you have questions about this privacy policy or if you wish to exercise your rights (section 8), you
can contact us by sending an e-mail to GDPR_Legal@orsted.com.
Ørsted’s German companies have appointed a Data Protection Officer (“DPO”). If you are
involved in a recruitment process handled by one of our German companies, you can also contact
the DPO by sending an e-mail to dataprotectionDE@orsted.de.

4. DESCRIPTION OF PROCESSING ACTIVITIESIn the following, you can read more about how we process your personal data in connection with
our recruitment activities. Your personal data is not subject to automated decisions, including
profiling.

4.1

CANDIDATE PROFILE

When you wish to apply for a position at Ørsted, or wish to be registered in our candidate
database, you must create a candidate profile in our recruitment system. This also applies if you
are contacted by an Ørsted recruitment employee or a recruitment agency with an invitation to
apply for a position or to initiate a recruitment process at Ørsted.
We process your personal data, which you provide when creating a candidate profile, with the
purpose of enabling you to be part of a recruitment process and to support you with theadministration of your candidate profile.
In this context, we can process the following ordinary personal data about you:
Personal details and contact information, including name, address, e-mail address,
telephone number, country of residence, and nationality.
Login details, including verification code upon creation of your profile.
Details of what you consent to in connection with our recruitment activities.
Your indication of whether you have signed up to receive information about new andrelevant jobs (“job alerts”).
We do not share your personal data with third parties in connection with the described purpose.
However, we may allow the data to be accessed by our suppliers (data processors), in particularIT suppliers who assist with technical support.
Legal basis:
We process your personal data on the basis of GDPR, article 6(1)(f) (legitimate interest). Ourlegitimate interest is to enable you to participate in a recruitment process with us.
Specific national legal basis:
Germany: If you wish to apply for a position or be involved in a recruitment process handled by
our German organisation, the legal basis for processing is instead § 26(1) of the German Federal
Data Protection Act (Bundesdatenschutzgesetz (BDSG)).
United Kingdom: If you wish to apply for a position or be involved in a recruitment process
handled by our UK organisation, the legal basis for processing is instead the UK GDPR, article
6(1)(f) (legitimate interest). Our legitimate interest is to enable you to participate in a
recruitment process with us.

4.2

APPLICATION AND ASSESSMENT PROCESS

If you decide to send us your application for a vacant position or agree to participate in a
recruitment process at our request, we use the information you provide to assess your suitability
for the position in question. Initially, we will process your personal data to evaluate yourapplication material, such as your application and CV.
If, on this basis, we wish to proceed with you in the recruitment process, we can process yourpersonal data when we invite you to a job interview, including during and after the interview itself.
In some cases, the interview may take place via video connection, and we may then process yourpersonal data to conduct the interview in this manner. After each interview round, notes from theinterview are entered into our systems, including our rating of you based on the interview held.
During the first round of interviews, you may also be asked to send us a video where you answer aseries of questions that will be used in our assessment process. If this is the case, we will process
your personal data in relation to this.
If the recruitment process is for a position in our Dutch organisation, you will not be asked to send us
such a video, and no job interviews will be conducted via video connection.
During the recruitment process, you may also be asked to complete a number of case-based
assignments, and your results and solutions will then be processed as part of the assessment of
your competencies and qualifications.
If the position is advertised as part of a recruitment campaign, such as our Graduate campaign,
we can invite you to our “Assessment Days”, where you will participate in job interviews and workon cases at one of our locations together with other job candidates. In this context, we canprocess your personal data to register your participation and assess your competencies,
qualifications and the impression you leave based on your participation.
If we decide to proceed with other job candidates during a recruitment process, we can process
your personal data to inform you of the rejection and, in some cases, provide you with feedback.
We can process the following ordinary personal data about you:
Personal details and contact information, including name, address, e-mail address,
telephone number, country of residence, and nationality.
Details from your application and/or CV such as educational background and job history,
including information about current and previous employers. Positions, work tasks,
experiences, skills, qualifications, achievements, motivation for applying for the position,and similar information that you choose to provide.
Details from other documents, including transcripts, course certificates, statements, andsimilar.
Notes from job interviews and the overall recruitment process, including our rating of you
and any other remarks we may have based on our review of your application material
and/or conducted job interview(s) with you.
Your results and solutions from completed case assignments.
Video recording of you (if you are asked to send us a video, including your statements andactions in the video) – not applicable in the Netherlands.
Details of time and place of the job interview(s) with you.
Any details about participation in our Assessment Days.
Information from correspondence with you, if relevant, for example, if we inform you ofyour rejection.
We generally do not share your personal data with third parties. However, we may allow thedata to be accessed by our suppliers (data processors), in particular IT suppliers who assist withtechnical support.
Legal basis:
We process your personal data on the basis of GDPR, article 6(1)(f) (legitimate interest). Ourlegitimate interest is to assess you in relation to the position that needs to be filled.

Specific national legal basis:
Germany: If we process your personal data in connection with our assessment of you for aposition in our German organisation, the legal basis for processing is instead § 26(1) of theGerman Federal Data Protection Act (Bundesdatenschutzgesetz (BDSG)).
United Kingdom: If we process your personal data in connection with our assessment of you fora position in our UK organisation, the legal basis for processing is instead the UK GDPR, article
6(1)(f) (legitimate interest). Our legitimate interest is to assess you in relation to the position
that needs to be filled.

4.3

REFERENCES

If you are among the final candidates for a position at Ørsted, we may, in special cases, obtainreference information from your previous employer(s) that you have indicated that we cancontact. Through this, we will seek to confirm the information and impressions we have gained ofyou during the recruitment process.
We can process the following of your ordinary personal data that we receive in connection withthe reference check:
Personal details and contact information, including name, e-mail address and telephone
number.
Your indication that we are allowed to contact the references you have provided.
Details about your work, your work tasks, and your previous employer(s)’ perception ofyour professional and personal qualifications.
We do not share the reference information with third parties.
Legal basis:
We process your personal data on the basis of GDPR, article 6(1)(f) (legitimate interest). Ourlegitimate interest is to assess – in conjunction with the other information provided during therecruitment process – whether you are the right candidate for the position.
Specific national legal basis:
Germany: If you are involved in a recruitment process for a position in our German organisation,reference checks will not be made, and reference information will not be obtained.
United Kingdom: If you are involved in a recruitment process for a position in our UK
organisation, we will instead process your personal data on the basis of the UK GDPR, article
6(1)(f) (legitimate interest). Our legitimate interest is to assess – in conjunction with the otherinformation provided during the recruitment process – whether you are the right candidate forthe position.

4.4

BACKGROUND CHECKSFor certain positions in the United Kingdom, it is a legal requirement to conduct a government
administered security clearance (“National Security Vetting”) of you. If you are required to undergosuch security clearance in connection with a recruitment process, you will receive a separate privacy
policy describing the processing of your personal data in this regard. In that case, we refer to theseparate privacy policy.
For some positions, it is condition of employment at Ørsted that a background check with asatisfactory outcome is conducted. In very special cases, we may therefore – at the conclusion of
the recruitment process – request your permission to conduct a background check on you. The
purpose is to ensure that the information we have received during the recruitment process iscorrect and to assess whether we believe you are the right person to fill the position in question.
Depending on the nature of the position and the rules that apply in the country where the position
is to be filled, we can process the following ordinary personal data about you:
Personal details and contact information, including name, address, e-mail address,
telephone number, country of residence and nationality.
Details of your education and career, including to verify your information about education,
professional qualifications, and employment history.
Details of work and residence permits to ensure that you have the right to work in the
country in which you are applying for a position in.
Publicly available information about your behaviour on social media and the internet,
including LinkedIn.
Details of any board and/or director positions and any exclusions.
Any registrations on sanctions lists or in international databases on money laundering,
fraud, terrorism, blacklisting and the like.
Publicly available information about any involvement in legal proceedings.
Publicly available information about any bankruptcy and financial matters, including
significant debt.
Our partner’s conclusion on the completed background check, including score and any
remarks.
For recruitments in certain countries (see below under “Legal basis”) we may also – if we deem it
absolutely necessary due to the nature of the position – request that you present your criminal
record. In such cases, we can process information about any criminal convictions and/or offences
appearing on your criminal record.
The information collected in connection with the background check can be collected fromavailable sources on the internet, including your profile(s) on social media, and from various
registers. Additionally, the information may – under certain circumstances – be collected fromeducational institutions, financial institutions, and the police and national authorities.
No employees at Ørsted will at any time come into possession of the personal data collected inconnection with the background check. Ørsted only receives a report with a score and any
remarks from our partner (data processor) who conducts the background check on behalf ofØrsted. Our partner is subject to and limited by our instructions.
The information provided in connection with the background check will not be shared with third
parties.

Legal basis:
We process your ordinary personal data on the basis of GDPR, article 6(1)(f) (legitimate
interest). Our legitimate interest is to ensure as best as possible that our hiring does not pose arisk to the company, including financial or reputational risk.
Any processing of information about work and residence permits will take place on the basis of
GDPR, article 6(1)(c) (legal obligation) as we have obligations to ensure that the people we hire
have the right to work in the countries they are employed in.
Specific national legal basis:
Denmark: If the background check is conducted as part of a recruitment process to a position in
our Danish organisation, and we deem it absolutely necessary in the specific case to requestthat you present your criminal record, we will process your personal data on the basis of § 8(3)of the Danish Data Protection Act (Databeskyttelsesloven), if the criminal record contains
information about criminal convictions and/or offences. Our legitimate interest is to ensure thatyou have not been convicted of relevance to the position you are to be employed in.
Germany: If the background check is conducted as part of a recruitment process to a position in
our German organisation, we will process your personal data on the basis of your consent. The
legal basis for processing is therefore § 26(2) of the German Federal Data Protection Act(Bundesdatenschutzgesetz (BDSG)).
United Kingdom: If the background check is conducted as part of a recruitment process to a
position in our UK organisation, we will process your ordinary personal data on the basis of the
UK GDPR, article 6(1)(f) (legitimate interest). Our legitimate interest is to ensure as best as
possible that our hiring does not pose a risk to the company, including financial or reputationalrisk. Any processing of information about work and residence permits will take place on thebasis of UK GDPR, article 6(1)(c) (legal obligation) as we have obligations to ensure that thepeople we hire have the right to work in the UK.
If, in very special cases, we deem it absolutely necessary to request that you present yourcriminal record, we can process this personal data on the basis of the UK GDPR, article 6(1)(f)with reference to the UK GDPR, article 10. Our legitimate interest is to ensure that you havenot been convicted of relevance to the position you are to be employed in.
Ireland: If in very special cases it is necessary to process information in your criminal record, we
will process the personal data on the basis of the Irish Data Protection Act, article 55(1).
The Netherlands: If the background check is conducted as part of a recruitment process to a
position in our Dutch organisation, and we deem it absolutely necessary in the specific case torequest that you present your criminal record, we will process your personal data on the basisof the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening
gegevensbescherming), article 33(3).

4.5

EMPLOYMENT OFFER

If we wish to offer you employment at Ørsted after a successful recruitment process, we canprocess your personal data to prepare and send the employment offer and your employment
contract. We can also process your personal data if we communicate with you about mattersrelated to the employment offer or the employment relationship, including matters you inform us
about, such as special conditions related to you that are significant for your ability to work or
your employment in general.
We can process the following personal data about:
Ordinary personal data:
Personal details and contact information, including name, address, e-mail address andtelephone number.
Details of the offered employment terms, including start date, position, working hours,
location of work, salary, pension, any clauses, and other contract terms.
Details about work and residence permits.
Information from correspondence with you of we communicate about matters related tothe employment offer or the employment relationship in general.
Sensitive personal data:
Data concerning health, including information about your current or past illnesses or
diseases, if it is expected to have a significant impact on your ability to work in the job you
are to perform, and we need the information – for example, to make adjustments to theworkplace setup to accommodate your needs.
We can share your personal data with our external advisors who assist with advice on personnel
matters. Additionally, we can pass on your personal data to our system providers (dataprocessors), including providers of HR systems.
Legal basis:
We process your ordinary personal data on the basis of GDPR, article 6(1)(b) (contractual
obligation, including in order to take steps prior to entering into a contract).
If we process data concerning your health in connection with entering into the employment
contract, for example, in order for us to make adjustments to the workplace setup or similar,
we will process your sensitive personal data on the basis of GDPR, article 9(2)(b) (obligation in
the field of employment).
Specific national legal basis:
Denmark: If, in special cases, we process your sensitive personal data in connection with theemployment offer for a position in our Danish organisation, our processing of this data instead
takes place on the basis of § 12(1) of the Danish Data Protection Act (Databeskyttelsesloven),with reference to the Danish Act on the Use of Health Information etc. on the Labour Market.
Germany: If we process your personal data to offer you employment in our Germanorganisation, the processing of your personal data instead takes place on the basis of § 26(1) of
the German Federal Data Protection Act (Bundesdatenschutzgesetz (BDSG)). If, in special cases,
we process your sensitive personal data, our processing of this data instead takes place on thebasis of § 26(3) of the German Federal Data Protection Act ((Bundesdatenschutzgesetz (BDSG)).
United Kingdom: If we process your personal data to offer you employment in our UK
organisation, the processing of your personal data instead takes place on the basis of the UK

GDPR, article 6(1)(b) (contractual obligation, including in order to take steps prior to entering
into a contract).
If we process data concerning your health in connection with entering into the employment
contract, for example, in order for us to make adjustments to the workplace setup or similar,
we will process your sensitive personal data on the basis of UK GDPR, article 9(2)(b) (obligationin the field of employment).

4.6

CANDIDATE SEARCH

As part of our recruitment strategy, we actively search for candidates for vacant positions in ourcompany. In this regard, we can process your personal data, which is available on the internet,
including professional networking sites such as LinkedIn, for the purpose of assessing whether you
are potentially a candidate for a vacant position with us.
If we assess that you are a suitable candidate, we may contact you to encourage you to create acandidate profile in our recruitment system, submit an application, or otherwise initiate a
recruitment process. In special cases, the contact is made through an external recruitment agent.
We can process the following ordinary personal data about you:
Personal details and contact information, including name, address e-mail address andtelephone number.
Details from professional networking sites where you have a profile, such as LinkedIn,
including a description of yourself, information about current and previous positions,educational information, qualifications and certificates, status updates (“posts”), and otherinformation that you publish on your profile.
Information from correspondence with you if we make contact.
Depending on the circumstances, we can share your personal data with our recruitment agent,
with whom we collaborate on recruitment matters, as well as with other Ørsted companies.
Legal basis:
We process your personal data on the basis of GDPR, article 6(1)(f) (legitimate interest). Ourlegitimate interest is – on the basis of publicly available information – to find potential
candidates for our vacancies.
Specific national legal basis:
Germany: If we process your personal data in connection with our search for potential
candidates for a position in our German organisation, the processing of your personal data
instead takes place on the basis of the § 26(1) of the German Federal Data Protection Act(Bundesdatenschutzgesetz (BDSG)).
United Kingdom: If we process your personal data in connection with our search for potential
candidates for a position in our UK organisation, the processing of your personal data instead
takes place on the basis of the UK GDPR, article 6(1)(f) (legitimate interest). Our legitimate
interest is – on the basis of publicly available information – to find potential candidates for ourvacancies.

4.7

CANDIDATE DATABASE

You can choose to register in our candidate database if you are interested in us contacting you
regarding vacancies that we believe you may be interest in applying for. You can register in thecandidate database when you apply for a vacant position or independently of this. You must
create a candidate profile (see above under section 4.1), and in the candidate profile you can
upload documents and information that we can use to assess whether we should contact you
regarding an open position.
We can process the following ordinary personal data about you:
Personal details and contact information, including name, address, e-mail address,
telephone number, country of residence, and nationality.
Details on your CV such as educational background and job history, including information
about current and previous employers, positions, tasks, experiences, competences,qualifications, results, and similar information that you choose to include.
Any information about vacancies that you have applied for at Ørsted.
Details of your consent to the storage of your information in the candidate database.
We can share the personal data with other Ørsted companies, and we may allow the data to beaccessed by our suppliers (data processors), in particular IT suppliers who assist with technicalsupport.
Legal basis:
We process your personal data on the basis of GDPR, article 6(1)(a) (consent).
Specific national legal basis:
Germany: If you register in the candidate database for the purpose of being considered for avacant position in our German organisation, your personal data will instead be processed on
the basis of § 26(2) of the German Federal Data Protection Act (Bundesdatenschutzgesetz(BDSG)).
United Kingdom: If you register in the candidate database for the purpose of being considered
for a vacant position in our UK organisation, your personal data will instead be processed on
the basis of the UK GDPR, article 6(1)(a) (consent).

4.8

SURVEY

Following a completed recruitment process, we can – if you are among the candidates who got
far in the process or if you have been offered the position in question – invite you to take part in asurvey with the aim of receiving feedback about the experience with our recruitment process.
Your survey response is sent to us in anonymized form, and we can therefore not identify whether
a given survey response was made by you. In connection with the survey, we therefore only
process the following ordinary personal data to be able to send you the invitation to the survey:
Personal details and contact information, including name and e-mail address.

Details of the position you have applied for, including the reference number of theposition.
Details of whether you have been offered the position applied for or whether you havebeen rejected.
We may pass on your personal data to our supplier of the survey system, and we may share
aggregated data from the surveys (which does not constitute personal data about you) withother Ørsted companies.
Legal basis:
We process your personal data on the basis of GDPR, article 6(1)(f) (legitimate interest). Ourlegitimate interest is to be able to receive feedback about experiences with our recruitment
process for the purpose of continuous evaluation of the process.

5. CONSEQUENCES OF PROCESSING
The processing of your personal data generally takes place solely for the purpose handling a
recruitment process that you are a part of, including with the aim of entering into an employment
contract. Our processing of your personal data will therefore generally not have negative
consequences for you, unless it is established that you have provided incorrect information ofsuch a nature that it leads to a police report, prosecution or the like.

6. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEAØrsted is an international company with presence and activities in several places around theworld, and this also impacts the way we recruit. Depending on the circumstances of the individual
recruitment and what you specifically consent to, your personal data may therefore betransferred to other Ørsted companies within the Ørsted group and to other recipients incountries outside the EU/EEA (“third countries”) in connection with our recruitment activities.
Our legal basis for such transfers to third countries is outlined below.

6.1•

TRANSFERS TO OTHER ØRSTED COMPANIES
If, in connection with a job application, you consent to your candidate profile and yourapplication information being made available to our recruitment teams globally, in order
to be contacted in relation to other vacancies that we believe are relevant for you toapply for, or if – independently of an application process – you consent to us storing yourinformation in our global candidate database, transfers to other Ørsted companies for the
purposes mentioned will take place on the basis of the following transfer basis:oTransfers to other Ørsted companies in United Kingdom, South Korea, Japan andIsle of Man: These countries have been deemed by the Commission of theEuropean Union as countries that ensure an adequate level of protection of
personal data. Transfers to Ørsted companies in these countries will therefore
take place on the basis of GDPR, article 45(1).

o

•

6.2

Transfers to other Ørsted companies in the USA, Malaysia, Taiwan, Vietnam andAustralia: Ørsted’s US companies have not self-certified under the EU-US Data
Privacy Framework (“DPF”). Transfers to Ørsted’s US companies as well astransfers to Ørsted companies in Malaysia, Taiwan, Vietnam and Australia will
therefore take place on the basis of your consent in accordance with GDPR, article
49(1)(a).

If, in connection with a job application, you give consent that your candidate profile andyour application information can only be used in relation to the position you are applying
for, including that it can only be accessed by the specific employees who take part in the
recruitment process, transfers to other Ørsted companies in third countries will only takeplace if the position you are applying for is to be part of a globally working department inØrsted, and if the employee(s) who take part in the recruitment process therefore work(s)for an Ørsted company in a third country. Transfers to other Ørsted companies will in suchcases be made on the basis of the following transfer basis:oTransfers to other Ørsted companies in United Kingdom, South Korea, Japan andIsle of Man: These countries have been deemed by the Commission of theEuropean Union as countries that ensure an adequate level of protection of
personal data. Transfers to Ørsted companies in these countries will therefore
take place on the basis of GDPR, article 45(1).

oTransfers to other Ørsted companies in the USA, Malaysia, Taiwan, Vietnam andAustralia: Ørsted’s US companies have not self-certified under the DPF. Transfersto Ørsted’s US companies as well as transfers to Ørsted companies in Malaysia,
Taiwan, Vietnam and Australia will therefore take place on the basis of yourconsent in accordance with GDPR, article 49(1)(a).

TRANSFERS TO OTHER RECIPIENTSTransfers to other recipients in third countries, including our partners and suppliers who assistØrsted’s recruitment activities (e.g., recruitment partners and IT providers), will take place on thebasis of the following transfer basis:•

Transfers to recipients in Andorra, Argentina, Canada, Faroe Islands, Guernsey, Isle of Man,
Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, United Kingdom and
Uruguay: These countries have been deemed by the Commission of the European Union as
countries that ensure an adequate level of protection of personal data. Transfers torecipients in these countries will therefore take place on the basis of GDPR, article 45(1).

•Transfers to recipients in the USA:o

If the recipients in the USA have self-certified under the DPF, there will be reliabletransfer mechanisms in place for the transfer of personal data, ensuring protectionof your personal data in accordance with the GDPR and EU legislation. Transfers
to recipients who have self-certified under the DPF will therefore take place on thebasis of GDPR, article 45(1).

oIf the recipients in the USA have not self-certified under the DPF, transfers to theserecipients will – depending on the specific circumstances of the individual transfers– take place on the basis of the Commission of the European Union’s standard

contractual clauses as published by the Commission of the European Union, in
accordance with GDPR, article 46(2)(c), or in special cases on the basis of GDPR,
article 49(1)(a) (consent), article 49(1)(b) (performance of a contract), or article
49(1)(e) (establishment, exercise or defence of legal claims).
•

Transfers to recipients in other third countries: Transfers to recipients in other third
countries will – depending on the specific circumstances of the individual transfers – takeplace on the basis of the Commission of the European Union’s standard contractual
clauses as published by the Commission of the European Union, in accordance with GDPR,
article 46(2)(c), or in special cases on the basis of GDPR, article 49(1)(a) (consent), article
49(1)(b) (performance of a contract), or article 49(1)(e) (establishment, exercise or defenceof legal claims).

You can obtain a copy of Ørsted’s standard contract for transfers that take place on the basis of
GDPR, article 46(2)(c) by sending an e-mail to GDPR_Legal@orsted.com.

7. RETENTION
We adhere to the general principles of data minimization and storage limitation, and we will
therefore only retain your personal data for as long as necessary to fulfill the purpose(s) for which
the personal data was collected, and as required to comply with applicable law. Subsequently,
we will anonymize or delete your personal data.
Your candidate profile, which you create in connection with a recruitment process, isautomatically deleted if you have not been logged in – and the profile has thus been inactive –for 6 months. Your personal data contained in your application, your CV and other material we
receive and process in connection with the recruitment process is stored until 6 months after theend of the recruitment process, after which time the personal data is deleted.
If you consent to us storing the candidate profile and your application information for a longer
period, we can store the candidate profile and application information beyond the 6 months inaccordance with what you consent to.
Information that we may collect in connection with a background check is deleted immediately
after the background check is completed. Details of your criminal record, which we may in very
special cases ask you to show in some countries, will not be stored at all. We only keep a notethat a background check has been conducted. If you are not employed, the note is retained until
6 months following the end of the recruitment process, after which time the note is deleted.
If you are employed, relevant information can be transferred to your personnel file, including
application material and documentation of a satisfactorily completed background check. The
information is then stored in accordance with our retention periods for employee information.
If you participate in a survey, your anonymized response will be deleted after 2 years.
In extraordinary cases, we may retain your personal data beyond the mentioned retention
periods, including if necessary to comply with an authority order, or if it is necessary for theestablishment, exercise or defence of legal claims.
When we establish our retention periods, we generally apply the following criteria:

•
•
•
•

As long as there is an ongoing recruitment process that you are part of.
As required by legal obligations to which we are subject or become subject.
As advisable in light of our legal position in order to establish, exercise and defend legal
claims.
As necessary to fulfill our legitimate business needs (e.g., documentation needs).

8. YOUR RIGHTS
You have the following rights in relation to the processing of your personal data:a. Right of access
You have the right to request confirmation as to whether or not Ørsted processes personal data
about you, and, if so, request access to (a copy of) such personal data. This will provide you withan insight into what personal data we process about you as well as information about how weprocess your personal data.
b. Right to rectification
You have the right to request that we rectify inaccurate personal data or complete personal data
about you that you consider inaccurate or incomplete.
c.

Right to erasure

You have the right to request that we erase your personal data, for example if (1) the personal
data is no longer needed in relation to the purpose(s) for which it was collected, or if (2) the
personal data that we process is based on your consent and you withdraw your consent.
In certain situations, we will be unable to erase your personal data upon your request. This could
be the case, for example, if the personal data is still necessary to process for the purposes forwhich it was collected, including when Ørsted’s interest in processing the personal data exceeds
your interest in having the personal data erased, or when Ørsted has a legal obligation tocontinue to store it.
d. Right to restriction of processing
If you believe that your personal data is inaccurate, that our processing of your personal data isunlawful, or that we do not need the data for the purpose(s) described, you have the right torequest that we restrict the processing of this personal data. You also have the right to requestthat we halt our processing of your personal data while we assess your request. If you object toour processing of your personal data in accordance with what is described under point f., you canalso request that we limit our processing of your personal data while we make our assessment.
e. Right to withdraw consent
If we process your personal data on the basis of your consent, you have the right to withdraw
your consent at any time. If you withdraw your consent, we will stop our processing of yourpersonal data that is based on your consent. The withdrawal of your consent will not affect thelawfulness of the processing that took place prior to your withdrawal of consent.

You can withdraw your consent by sending an e-mail to GDPR_Legal@orsted.com.
f.

Right to object

You have the right to object to the processing of your personal data as follows:
If the processing of your personal data takes place on the basis of GDPR, article 6(1)(f)(see section 4), you have the right to object at any time to our processing of your personal
data by referring us to reasons relating to your particular situation.
If your personal data is processed for direct marketing purposes, you have the right toobject at any time to our processing of your personal data for such marketing.
g. Right to data portability
You have the right to request a copy of the personal data that we process about you to fulfill acontract with you or based on your consent, in a structured, commonly used, and machinereadable format, and to require that we transfer this personal data to another data controller
where this is technically feasible. This will enable you to use the personal data elsewhere.
h. Right to lodge a complaint with a data protection supervisory authority
If you are dissatisfied with our processing of your personal data, you can lodge a complaint with adata protection supervisory authority. In Denmark, this authority is the Danish Data Protection
Agency (Datatilsynet). You can find the contact information for Datatilsynet and the procedure
for lodging a complaint at www.datatilsynet.dk.
You can exercise your rights (a.-g.) by sending an e-mail to GDPR_Legal@orsted.com.
There may be conditions or limitations in relation to the exercise of your rights. Therefore, it is notcertain, for example, that you have the right to data portability in the specific case. It depends on
the specific circumstances in connection with the processing activities.

9. CHANGESThis privacy policy replaces all previous versions. We regularly review this privacy policy, and wereserve the right to update and change it. In the event of significant changes, we will inform you in
an appropriate manner.
Last updated: 10 May 2024-0-