Patrade's privacy policy

At Patrade, we give high priority to data security and confidentiality

Data controller and contact

Patrade consists of Patrade A/S and Patrade Legal Advokatanpartsselskab, which are two separate companies. The data controller responsible for the processing of your personal data is therefore either (see below for information on how data controllership is determined):

Patrade A/S
Ceresbyen 75
8000 Aarhus C
Denmark
Company reg. (CVR) no.: 38740571
Tel.: +45 7020 3770
E-mail: info@patrade.dk

Patrade Legal Advokatanpartsselskab
Ceresbyen 75
8000 Aarhus C
Denmark
Company reg. (CVR) no.: 34714770
Tel.: +45 7020 3770
E-mail: info@patrade.dk

In short, Patrade is divided into two companies because lawyers are subject to special rules governing the practice of law which are ultimately aimed at protecting clients to the highest extent possible and ensuring that clients receive independent advice.

Although Patrade consists of two companies, we act and work as a single entity in our relations with our clients. The companies are data controllers in respect of the personal data they each process concerning their respective clients, business partners, job applicants and employees.

Thus, if you apply for a position with Patrade A/S, Patrade A/S will be the data controller in respect of the processing of personal data provided in the documents we receive from you, in connection with the further recruitment process and, if we offer you employment, your future employment relationship (unless, of course, you are employed with Patrade Legal ApS). If both companies serve the same client, Patrade A/S and Patrade Legal ApS each act as data controller for the personal data relating to their respective part of the client relationship.

When Patrade Legal ApS performs services for Patrade A/S involving the processing of personal data, Patrade Legal ApS is the data processor for Patrade A/S and vice versa. For example: Patrade’s Shared Services function is anchored in Patrade A/S and handles invoicing, etc. In this respect, Patrade A/S is data processor for Patrade Legal ApS.

We understand that this may sound very complicated. If you have any doubts as to which entity is the data controller, or if you have any questions about the processing or would like to exercise your rights as described below, feel free to contact our responsible for data protection, Mathias Bartholdy, at mba@patrade-legal.dk or on tel. +45 2485 3211.

Processing activities. In the following, you will find information on the categories of personal data we process, the purpose of the processing, the legal basis of the processing and when data are erased.

Processing activities

Case work and management of client and customer relations

Personal data

Data concerning the client/customer: Identification and contact information for the client and any other personal data forming part of the case. When handling cases referred to us by our international business partners, we have received your personal data from them.

Data concerning other parties: Identification and contact information on the relevant individual and any other personal data forming part of the case.

In some of our cases, it may be necessary to process sensitive personal data, information about criminal offences and/or civil registration numbers, other confidential information or information of a personal nature.

Basis of processing

Generally, we process ordinary personal data in connection with our case work because they are necessary for the performance of our agreement with our client/customer on the case, see article 6(1)(b) of the GDPR. If the client/customer is a company, data are processed pursuant to article 6(1)(f) of the GDPR, because the processing is necessary for safeguarding our legitimate interests and the legitimate interests of our clients.

Moreover, some data are processed because they are necessary for compliance with our legal obligations in connection with the case or the client/customer relationship, see article 6(1)(c) of the GDPR.

Sensitive personal data such as health information are only processed if such processing is necessary for the establishment, exercise or defence of legal claims pursuant to article 9(2)(f) and article 6(1)(c) of the GDPR.

Information on criminal offences is processed only if such processing is necessary for the purpose of safeguarding a legitimate interest and this interest clearly overrides the regard for the data subject, see section 8(3) of the Danish Data Protection Act. Furthermore, the processing may take place in order to pursue a legal claim, see section 8(5), cf. section 7(1), of the Danish Data Protection Act.

Civil registration numbers will be processed if required by law, see section 11(2)(i) of the Data Protection Act. Civil registration numbers may also be processed if the processing is necessary for the establishment, exercise or defence of legal claims, see section 11(2)(iv), cf. section 7(1), of the Danish Data Protection Act.

Storage period

Personal data forming part of our cases are generally erased five years after the case was closed. However, for some cases the storage period will be ten years if necessary for the purpose of complying with legal requirements. In exceptional cases, the storage period may be longer if a claim is subject to an extended limitation period, e.g. personal injury claims which are subject to a limitation period of 30 years, see section 3(3)(i) of the Danish Limitation Act.

Recipients and transfer of data to third countries

If necessary for the purpose of our work on a case, we may disclose certain information to public authorities relevant to the case, e.g. the Danish Patent and Trademark Office, appeals and complaints bodies such as the Danish Board of Appeals for Patents and Trademarks, the courts of law, etc.

We use Microsoft Outlook as our e-mail software. However, we host the exchange server ourselves, in this way preventing data included in e-mails from being transferred to Microsoft.

Furthermore, all case management systems have been developed by us, so we do not share your personal data with any parties other than as set out above.

Newsletter

Personal data

Contact information, including e-mail address, name, the name of the company you work for and telephone number.

Basis of processing

The data are processed for the purpose of performing our agreement with you on distributing our newsletter, see article 6(1)(b) of the GDPR, the receipt of which you have accepted pursuant to the Danish Marketing Practices Act. We disclose your e-mail address or telephone number to LinkedIn Ireland Unlimited Company in a format which is not readable (one-way encrypted) for the purpose of targeting our marketing efforts on those media at others with the same interests or profile as yours. We do this based on our legitimate interest in marketing our services, see article 6(1)(f) of the GDPR. It is our assessment that your interests, rights and freedoms does not override our legitimate interests in the processing because your personal data is one-way encrypted prior to disclosure, because you are made explicitly aware of the disclosure, because the data are not used for direct electronic marketing and because you can opt out of those functions with the media here: LinkedIn (under “Third-party data”). It is further our assessment that we are joint data controllers with LinkedIn for this processing activity. In that regard, we refer to LinkedIn’s joint data controller addendum (https://legal.linkedin.com/pages-joint-controller-addendum) setting out the data protection responsibilities between us and LinkedIn.

Storage period

We erase your data when you unsubscribe from our newsletter or if we have not sent you any newsletters for an uninterrupted period of more than 12 months. We retain documentation of the withdrawal of your consent for up to two years after the withdrawal for the purpose of defending ourselves against any claims for violation of the Danish Marketing Practices Act, see section 37(3) of the Act, and section 93(1)(i) of the Danish Penal Code.

Recipients and transfer of data to third countries

We use an external supplier, processing data in the EU, for obtaining consent and distributing newsletters.

Website, including analysis of traffic and interaction with content on the website or social media

Personal data

Identification data, including unique IDs, IP addresses, data on the device and browser used to access the website and data on behaviour on the website. Name, e-mail address, telephone number, company or position, etc. to the extent you provide personal data in connection with downloads or interaction with our content on the website or via social media.

Basis of processing

We process data on how visitors use our website based on our legitimate interest in improving our website and advisory and other services, see article 6(1)(f) of the GDPR. In our assessment, our legitimate interest is not overridden by the visitors’ interests, as the data are not directly personally identifiable, they are of a general nature, not of a personal or intrusive nature and are only disclosed to third parties to a limited extent and/or in encrypted form.

If you have consented to cookies, we will process personal data collected through the use of cookies for the purposes to which you have consented, e.g. statistical or marketing purposes, see article 6(1)(a) of the GDPR. You may withdraw your consent at any time in your browser, delete cookies by following the instructions in our cookie policy or by contacting us.

If you provide personal data in connection with your interaction with the content on our website or via social media, e.g. downloading of whitepapers, we process your data for the purpose of sending you the content requested, see article 6(1)(b) of the GDPR, and for the purpose of analysing who interacts with our content, where you interacted with the content (on social media or on our website) and your behaviour on our website, see article 6(1)(f) of the GDPR, as such data are of a non-intrusive nature and are not shared with third parties.

Storage period

Personal data contained in cookies are erased when the cookie expires or is deleted by the user (see our cookie policy). We use Google Analytics 4, and data at user and event level are anonymised according to the strictest possible settings (https://support.google.com/analytics/answer/7667196?hl=en), i.e. currently two months. Furthermore, analysis data in personally identifiable form are stored only to a limited extent and for a limited time only, as the data are automatically aggregated (anonymised) when statistics are generated.

Recipients and transfer of data to third countries

Certain analysis data will be disclosed to our providers, in particular Google, Facebook and Sleeknote, if you have consented to statistics and marketing cookies. This also appears from the cookie which popped up when you first visited our website and is also described in our cookie policy.

Participation in trade fairs, presentations, courses, networking events and competitions

Personal data

Identification and contact information, information about position, industry/sector and interests.

Basis of processing

If you have signed up for our newsletter at a trade fair or in connection with a presentation, competition or similar, we will process your personal data as described in the section “Newsletter” above. Moreover, if we have received your details in connection with a trade fair, a presentation, a course, a networking event or similar (including a simple ‘exchange of business cards’), we process your data based on our legitimate interest in establishing or maintaining existing business relations, see article 6(1)(f) of the GDPR.

Storage period

In connection with sign-up for our newsletter, see “Newsletter” above. Furthermore, we erase your personal data when our business relationship is “cold”, i.e. if we have not been in contact for more than three years.

Recipients and transfer of data to third countries

In connection with sign-up for our newsletter, see “Newsletter” above. Other than as described above, we do not share your personal data with any third parties.

Recruitment and processing of applications

Personal data

Identification and contact information, information provided in applications, CVs and related documents, e.g. diplomas, and other personal data relevant to the assessment of a candidate. Furthermore, we collect publicly available information via the candidate’s social media, particularly Facebook and LinkedIn.

Basis of processing

We obtain criminal record certificates for candidates applying for positions involving the management of trusted funds (e.g. head of finance), see section 8(3) of the Danish Data Protection Act. Criminal record certificates are not obtained until the final recruitment stages, when the number of candidates has been reduced to a maximum of three persons.
Other data are processed based on our legitimate interests, e.g. because the candidate has independently chosen to apply for the position, see article 6(1)(f) of the GDPR.

Storage period

Data received in connection with speculative applications are erased after review of the application if the candidate is not relevant for a current opening or an opening coming up within the next two months, unless consent is obtained for a longer storage period.

Data received in connection with applications for advertised jobs are erased after the final stage of the recruitment process, unless the candidate is relevant for a current opening or an opening coming up within the next two months, or unless consent is obtained for a longer storage period.

Recipients and transfer of data to third countries

We do not share your personal data with any third parties.

Your rights

We have listed your rights below, and you can exercise your rights by contacting us. See above for our contact details. Your request will be answered free of charge, as soon as possible and not later than one month after receipt. However, where necessary out of regard for the complexity of the request or the number of requests, two months may pass before you receive an answer. In the event of manifestly unfounded or excessive requests, we have the right to refuse to act on your request or charge a reasonable fee for answering the request.

Access. You have the right to obtain access to the personal data we process about you as well as to certain information on how the processing takes place. It is not possible to obtain access to information found to be overridden by considerations of private or public interests, including the consideration for you.
Rectification. You have the right to request rectification of inaccurate personal data concerning you and to have incomplete personal data about you completed.
Erasure. Under certain circumstances, see article 17 of the GDPR, you have the right to have personal data concerning you erased. For example, if the data are no longer necessary for meeting our obligations and exercising our rights, or if the data are processed on the basis of your consent and you withdraw your consent.
Restriction of processing. In the circumstances referred to in article 18 of the GDPR, you have the right to request restriction of processing of your personal data, e.g. if the accuracy of the data is contested, for a period enabling us to verify the accuracy of the personal data, or if we no longer need the personal data for the purposes of the processing, but they are required for the establishment, exercise or defence of legal claims.
Objection. You have the right to object to our processing of personal data based on article 6(1)(f) of the GDPR (the principle of balancing of interests), and you may object at any time if the personal data are processed for direct marketing purposes (e.g. in connection with our newsletters).
Data portability. If the processing is based on your consent or on a contract, you have the right to receive the data in a commonly used and readable format, and you have the right to transmit those data to another data controller. We will transmit the data directly to such other controller if you request us to do so and if technically feasible.
Automated decision-making You have the right not to be subject to a decision solely based on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Right to lodge a complaint. You may complain about the processing at any time by contacting us. Furthermore, you have the right to lodge a complaint with the Danish Data Agency (http://datatilsynet.dk, dt@datatilsynet.dk, +45 33 19 32 00), or the supervisory authority in the country in which your reside or in the country in which you believe that the infringement of the GDPR or Danish Data Protection Act took place.

Contact