Privacy policy

1. Data controller

Referencepas is operated by Grønlund Investments EMV, CVR 42292028, which is the data controller for the personal data processed on the platform. Contact us at kontakt@referencepas.dk.

2. What data do we process?

• Candidates: name, email, title if provided, your name from MitID and an anonymous fingerprint of your MitID (so one MitID can only confirm one passport) if you choose to confirm your identity, the requests you create, and your IP address when creating requests (for fraud checks).
• Referees: name, work email, title, company, your standardised ratings, your name and the company's name and CVR from MitID Erhverv if you choose to confirm with it, and – only if you tick the box yourself – that the agency that invited the candidate may contact you about recruitment (you can withdraw this consent at any time by writing to us), and your IP address when answering (for fraud checks).
• Company users: name, email, title if provided, company name, CVR, subscription and payment status and a log of viewed passports. If you confirm the company or sign in with MitID Erhverv, we store your name, the company's name and CVR and an anonymous fingerprint of your MitID Erhverv.
• Enquiries: name, email, topic and message when you write to us through the contact form or request a demo.

We never ask for or store CPR numbers (Danish personal ID numbers). If you sign in for a company with MitID, MitID may ask for your CPR number to find the company – it is not stored by us. We do not process sensitive data. References consist mostly of fixed choices – including whether the role and period are correct and why the working relationship ended (you can always choose “Prefer not to say”). The manager may also write a few sentences in their own words (max 600 characters), advice for the candidate's next manager (max 300 characters), a short note on the development area (max 200 characters) and – for a low answer – an explanation (max 300 characters). All free text is optional, and the manager is asked not to write sensitive information. If something sensitive is written anyway, we delete it when we are made aware of it.

3. Purposes and legal basis

• Providing the reference passport to the candidate – performance of a contract (GDPR art. 6(1)(b)).
• Sharing references with companies – the candidate's consent (art. 6(1)(a)), which can be withdrawn at any time.
• The referee's answer – consent given on submission (art. 6(1)(a)).
• Fraud checks and security – legitimate interest in trustworthy references (art. 6(1)(f)).
• Answering enquiries and confirming companies with MitID Erhverv – legitimate interest (art. 6(1)(f)).
• Bookkeeping of payments – legal obligation (art. 6(1)(c)).

4. Who do we share data with?

References are only shared with companies the candidate has given their link to, and only if they unlock the report. A recruitment agency can share a report it has unlocked with the company it is recruiting for. The candidate is notified, and the sharing ends when the agency's access expires or is closed. We use the following data processors (see the full list with agreements at referencepas.dk/en/data-processors): Supabase (database and login, EU), Resend (email, EU), Vercel (hosting, EU), Stripe (payments), Idura (MitID confirmation, EU) and Anthropic (AI reading of your CV if you choose to upload one – the CV is not stored by us and is not used to train AI – AI assessment of whether a referee's email domain belongs to the company – only the domain, company name and public information are sent, no names or ratings – and the chat assistant on the website, where your messages are sent to Anthropic to generate the answer; we do not store the conversation, only an anonymous count of how many messages have been sent from your connection today). Where data is transferred to the USA, this is based on the EU Commission's standard contractual clauses or the EU-US Data Privacy Framework. We never sell data.

5. Retention and deletion

• Companies' access to a passport expires after 6 months.
• Unanswered requests expire after 30 days.
• The view log is deleted after 6 months.
• Invitations a company sends to candidates are deleted after 6 months.
• When a candidate deletes their account, the passport and all references are deleted immediately.
• Accounts that have not been used for 2 years are deleted. We send an email 30 days before – sign in once to keep your account. Companies with an active subscription are not deleted.
• Payment information is kept for 5 years under the Danish Bookkeeping Act.
• When we delete data, we only note the date and what was deleted – without your name, and with your email as an unreadable fingerprint. The note is deleted after 3 years and is only used to document that we have deleted (GDPR art. 5(2)).

7. Cookies

We only use necessary cookies for login. We use no tracking or marketing cookies, and therefore we do not ask for cookie consent.