In the table below, we set out what types of personal data we process, the purposes for doing so, and the legal grounds upon which we base the processing. 

We cannot provide our services to our clients unless the contact information and AML information are provided to CO:PLAY. Regarding the registration to our events, it is most likely that you have provided us with this information yourself, but it is also possible that a colleague of yours has given us your contact information. You have the right to recall your prior given consent. The withdrawal of your consent does not affect the lawfulness of the Processing based on the consent before its withdrawal, and in some cases, we may continue processing your Personal Data based on other legal grounds, except for direct marketing. If you object to the Processing of your Personal Data conducted on the basis of our legitimate interests, we may cease processing your data for those purposes. 

The personal data may be transferred to the following categories of recipients:

- Courts, and similar judicial entities;

- Recipients whom CO:PLAY has been directed by the client to transfer information to;

- Public authorities, such as “SKAT” (the Danish tax authorities) and the State Prosecutor for Serious Economic and International Crime;

- Companies that provide services upon which CO:PLAY relies for its core activities (such as data management services, digital infrastructure and other service providers). 
‍
CO:PLAY does not transfer personal data to countries outside of the EU/EEA unless this is necessary to carry out the assignment given by a client. If this is the case, and there is no decision from the European Commission that the country which the personal data will be transferred to provides adequate data protection legislation to ensure the safety of the personal data, CO:PLAY will use relevant safeguards to ensure the safety of the personal data. If you want to know more about the safeguards we may use, please contact us. 

CO:PLAY uses encryption to the extent necessary. If we transfer sensitive personal data or confidential information, we will use encryption in the transport layer as a starting point. If, given the circumstances of a specific transfer, we find that encryption is also required in the data layer, we will contact you to agree on how the transfer will be done. If you wish to transfer personal data to us encrypted in both the transport and data layer, please contact us before the transferring. 

CO:PLAY stores all client related information, and personal data therein, for as long as there are legitimate purposes. There is no general duration of this storage, but we base our assessment on i.a. the guidance from the Danish Bar and Law Society about this issue, which as a main rule can entail storage for up to ten (10) years, after completion of the relevant assignment.

Personal data collected only within the purpose of sending marketing to you will be stored up to two (2) years after we have used the personal data in accordance with this purpose unless we have other legitimate purposes.

CO:PLAY uses professional services to destroy physical documents that ensure the integrity and confidentiality of the information contained in the documents. For handling digital information, we use professional service providers that are specialised in accommodating the needs for digital integrity and confidentiality. 

CO:PLAY is a law firm and is as such subject to rules of professional secrecy. This means that CO:PLAY as the main rule is not allowed to disclose information relating to the clients’ matters to anyone but the client.

The rights that a person has in regards of their personal data which is being processed by CO:PLAY are not absolute, meaning that certain criteria must be at hand for the right to be exercised. Also, there are exceptions to some of the rights. CO:PLAY will accommodate requests to the extent that we are obliged under data protection laws.

A person has the following rights regarding personal data concerning them:

- Access: meaning that you have the right to information about the processing, access to the personal data in question, and the right to obtain a copy of your personal data.

- Rectification: meaning that CO:PLAY must correct the personal data if it is incorrect.

- Erasure: meaning that CO:PLAY must erase the personal data in certain circumstances, such as if there is no purpose for processing it any longer.

- Object to processing: meaning that you have a right to object to CO:PLAY’s processing of personal data, for example, if we are marketing ourselves directly to you, we must stop doing so if you object to it.

- Restriction of the processing: meaning the right to have CO:PLAY restrict the processing of personal data, but not delete it.

- Data portability: meaning that if you want CO:PLAY to transfer the personal data to another personal data controller, we can help accommodate this request.
‍
Also, you have the right to lodge a complaint at the supervisory authority, if you believe that CO:PLAY’s processing of personal data infringes applicable data protection laws. The supervisory authority in Denmark is Datatilsynet. If you are not based in Denmark, you may contact the supervisory authority that is relevant to you. 

NEWBANKING IDENTITY
We use NewBanking Identity as a third party service provider of a solution to store your personal information. All data is stored while encrypted and cannot be accessed or processed by anyone other than those you explicitly give permission to access your data. You can administer the information you share when you are using NewBanking by logging into your account here.

You can also download the information associated with your NewBanking account through www.NewBanking.com. Here you can read NewBankings Privacy Policy