When KPMG in Denmark is processing personal information, as data controller, we are dedicated to protecting the confidentiality and privacy of information entrusted to us. As part of this fundamental obligation, KPMG is committed to the appropriate protection and use of personal information, sometimes also referred to as “personal data”, "personally identifiable information", "PII" or simply "data", processed by KPMG. References to the term "GDPR" pertain to the General Data Protection Regulation of the European Union,

This Privacy Statement is applicable for KPMG P/S and KPMG Acor Tax P/S, which are collectively referred to as “KPMG”. KPMG P/S and KPMG Acor Tax P/S are separate legal entities with independent data controller responsibility. This implies that there is no joint data controllership. Whenever "KPMG" is referenced in this Privacy Statement, it pertains to either KPMG P/S or KPMG Acor Tax P/S as contextually relevant.

Please read this privacy statement ("Privacy Statement") to learn more about how we collect, use, share and protect the personal information that we have obtained.

Data controller contact information

KPMG P/S

Att.: Privacy

Dampfærgevej 28, 2100 København Ø, Denmark

CVR: 25578198

Phone: +45 70 70 77 60

E-mail: dk-fmprivacy@kpmg.com
 

KPMG Acor Tax P/S

Att.: Privacy or Tax Quality Risk Management

Tuborg Havnevej 18, 2900 Hellerup, Denmark

CVR: 34082200

Phone: +45 39 45 17 00

E-mail: dk2-fmprivacy@kpmg.com

 

Index

1. Personal information of the data subject(s):

   1.1. Clients, suppliers and third parties

   1.2. Online and Social Media

   1.3. Marketing, newsletters, events, etc.

   1.4. Recruitment

   1.5. Visitors

   1.6. Queries regarding data subject rights

2. Sharing, disclosing and transferring personal information

3. Your rights

4. Personal information about children

5. Data security, integrity and erasure in general

6. Links to other sites

7. Changes to this statement

8. Policy questions and complaints

 

1. Personal information of the data subject(s).

When you register or submit personal information to KPMG we will use this information in the manner outlined in this Privacy Statement. Your personal information is not used for other purposes, unless we obtain your permission, or unless otherwise required or permitted by law or professional standards.

 

1.1. Clients, suppliers and third parties.

We process personal information from our clients, suppliers and other third parties as necessary for us to provide advice and services within our combined Tax, Auditing and Advisory Services.

We will gather personal information directly from the client, supplier, third party, or their designated point of contact(s). 

1.1.1. Categories of personal information

KPMG’s clients, suppliers and other third parties:

• Identification information such as name, e-mail, phone number, job title/position, employer, addresses and other information that the client, supplier or other third party provides to us.
• Passport and/or personal identification number (CPR) and other information when required due to KPMG’s anti-money laundry obligations.
• Information related to invoicing and payment and possibly other financial information if relevant or required due to KPMG’s legal obligations.

Processing personal data related to KPMG’s services:

• KPMG can process personal information of the client’s employees, suppliers, business partners, members, customers, etc.
• Audit services:
  • Non-sensitive personal information such as name, address, phone number, employee number/ID, payroll number, financial information, personal identification number (CPR), etc.
  • In some cases, sensitive personal information, and information about criminal convictions and/or offences can be processed.
• Tax services:
  • In individual matters, we may process data relating to the person’s income including the online tax folder, bank account and pension schemes.
  • If necessary due to e.g. tax deduction, we may process special categories of data such as information about a trade union membership.
• Advisory services:
  • Non-sensitive personal information such as name, e-mail, phone number, employer, job title/position, employee number/ID and IT-related user information (AD).
  • Depending on the nature of the assignment of our services, sensitive personal information may be processed. Protection and processing of sensitive personal information are handled individually in each assignment.

1.1.2. Purpose and legal basis

The purposes of our processing of personal information are:

• Performance and fulfilment of the contract/engagement with our clients, suppliers and/or other third parties or to take steps prior to entering into a contract.
• Management of our engagements related to our combined services regarding Tax, Auditing and Advisory services.
• Provision of our professional services.
• nvoicing, payment, receiving our supplies and ordered services.
• Manage, maintain, and develop our services, business, it-environment, etc.
• Fulfilment of KPMG’s obligation under the Danish Anti-Money Laundering Act, Danish Auditor’s Act and the Bookkeeping Act, which includes a review of our clients (obtaining ID documentation of our clients) and ensuring independence.
   

Legal basis for our processing of personal information:

• Article 6(1)(a) of the GDPR – consent.
  o   In some cases, KPMG may be processing personal information based on your consent. You can withdraw your consent at any time by contacting your point of contact at KPMG or KPMG’s Privacy Team.
        §  KPMG P/S: dk-fmprivacy@kpmg.com
        §  KPMG Acor Tax P/S: dk2-fmprivacy@kpmg.com
•  Article 6(1)(c) – legal obligation.
  o   When KPMG is acting as an auditor, KPMG is the data controller of the personal information being processed in connection with the delivered audit service.
  o   KPMG has a legal obligation to document our work related to our audit service, cf. the Danish Auditor’s Act (Revisorloven) § 23.
  o   KPMG has a legal obligation to keep accounting records and documentation for the last 5 years, cf. the Danish Accounting Act (Bogføringsloven) § 10.
  o   KPMG has a legal obligation to provide documentation as required pursuant to the Danish Anti-Money Laundering Act (Hvidvaskloven) § 10, § 11 og § 17.
  o   When KPMG provides tax advice, KPMG has a legal obligation to retain documentation of our tax advice, cf. the Danish Tax Administration Act (Skatteforvaltningsloven) § 34 a, and the Statute of Limitation (Forældelsesloven) § 3.
•  Article 6(1)(f) of the GDPR – legitimate interest.
  o   KPMG has a legitimate interest in the performance and fulfilment of the contracts with our clients, suppliers and other third parties, where it can be necessary to process personal information.
  o   KPMG has a legitimate interest in pursuing the above-mentioned purposes.Article 9(2)(f) of the GDPR – processing is necessary for the establishment, exercise or defense of legal claims.
  o   When KPMG is delivering audit services, advisory- or tax advisory services, sensitive personal information may in some cases be processed.
  • Article 10, cf. Article 6(1)(c) – processing personal information about criminal convictions and offences, and legal obligation.
    o   When KPMG is delivering audit services, personal information about criminal offences may in some cases be processed, cf. the Danish Auditor’s Act § 22.
• Article 28 of the GDPR – when KPMG acts as a data processor pursuant to a data processing agreement with a client, general and/or sensitive personal data and/or personal data about criminal offenses may be processed on behalf of the client, provided that the client has a legal basis for the processing of personal data.

1.1.3. Retention and erasure

Personal data collected during a continuous client, supplier and other third-party relationship will be retained. When the relationship ends, we will normally retain the personal information for 5 years until the end of a financial year.

Furthermore, we may retain information for up to 10 years from the end of engagements related to tax advice, under Danish tax legislation.

For engagements related to audit, we may retain data for 5-10 years from the end of the engagement, depending on the filing obligations according to international audit legislation applicable to us in connection with the audit engagement.

 

1.2. Online and Social Media

When you visit a KPMG website or Social Media profiles, we may process your personal information.

1.2.1. Categories of personal information

When you visit our website:

• IP-addresses will be collected via cookies. For more information about cookies see our cookie banners on our websites and our Cookie Policy here .
• If you contact us via our web forms on our websites or via e-mail, we will process your identification information, such as name, e-mail, phone number and other information that you provide to us.

Regarding our use of Social Media (e.g. LinkedIn, Google, Twitter, Facebook, Youtube and Instagram):

• We may process the personal data that you make publicly available on your social media profiles, e.g. name and picture.
• We may use information or content that you have permitted the social media provider to share with us, e.g. your name and potentially email address.
• We can track your activities if you comment or “like” our posts or share our content on social media.
• Additional information we may process will depend on the privacy settings or terms and conditions you have set or accepted from your social media provider. Please review the privacy statement or policy of the applicable service.

1.2.2. Purpose and legal basis

The purposes of our processing of personal information are:

• Delivering the content available on our website, to offer information and/or services to individuals who visit our website.
• Io improve the performance, usability and effectiveness of KPMG's online presence.
• To analyze our marketing activities.
  • We may use tracking and benchmarking of our posts and activities on social media, based on publicly available information.
• Marketing and branding of our business and services.
• To exercise our fundamental rights in the EU under Articles 16 and 17 of the Charter of Fundamental Rights, including our freedom to conduct a business and right to property.

Your personal information is not used for other purposes, unless we obtain your permission, or it is otherwise required or permitted by law or professional standards.

Legal basis for our processing of personal information:

• Article 6(1)(a) of the GDPR – consent.
  o   You can withdraw your consent to cookies at any time via the banners on our websites
  o   Or you are welcome to contact KPMG’s Privacy Team.
        §  KPMG P/S: dk-fmprivacy@kpmg.com 
        §  KPMG Acor Tax P/S: dk2-fmprivacy@kpmg.com
• Article 6(1)(f) of the GDPR – legitimate interest.
  o   KPMG has a legitimate interest in pursuing the above-mentioned purposes.

1.2.3. Retention and erasure

For cookie information, see the cookie banners on our websites.

Personal information collected via the web form or e-mail is deleted within 6 months. If circumstances require us to retain the information for documentation reasons or to comply with legal obligations, we may retain the information for up to 2 years.
 

1.3. Marketing, newsletters. events, etc.

If you would like to or have signed up to receive marketing material from KPMG, such as newsletters, annual reports, invitations for events and webinars, questionnaires, competitions, etc., we are processing the personal information that you have provided to us.

1.3.1. Categories of personal information

Newsletters:

• Name, e-mail, job title/position, employer.
• News preferences.

Events, webinars, courses, networks, etc.:

• Name, e-mail, potentially phone number, job title/position and employer.

Competitions, tournaments, surveys, questionnaires and other marketing activities:

• Name, e-mail, potentially phone number, age, city and other relevant information.
   

1.3.2. Purpose and legal basis

The purposes of our processing of personal information are:

• Promotion of our brand, businesses and services (e.g. via our annual report and other branding material).
• Branding, improvement of our performance, usability and effectiveness of KPMG's marketing efforts and material.
• To conduct and analyze our marketing activities.
• The attraction of new clients and talents.
• Information sharing and educational experiences, networking.
• Arranging, facilitating, hosting, paying for and evaluating events, webinars, courses, lectures, networks, etc.

Legal basis for our processing of personal information:

•  Article 6(1)(a) of the GDPR – consent.
  •  You can withdraw your consent at any time
  • Depending on what you have signed up for:
    §  Via a link in the newsletter, invitation, e-mail confirmation, or
    §  Via our webforms at www.kpmg.dk or on our other websites, or
    §  You can send us an e-mail to:

•                  KPMG P/S:
                   o   Markets: dk-newsletter@kpmg.com
                   o   Privacy: dk-fmprivacy@kpmg.com
                   KPMG Acor Tax P/S:
                   o   Markets: taxmatters@kpmg.com
                   o   Privacy: dk2-fmprivacy@kpmg.com 
• Article 6(1)(b) – contract.
  • If you have purchased an event, webinar, course, network, etc. that we offer.

1.3.3. Retention and erasure

You can withdraw your consent at any time. The withdrawal of your consent does not affect the lawfulness of the processing based on your consent before its withdrawal.

If you withdraw your consent, we will delete your personal information in accordance with KPMG’s deletion policy, which in this case is within 1 month from the date you unsubscribe or inform us that you withdraw your consent.

In some cases, once you have subscribed to certain services, we will temporarily store your email address until we receive confirmation of your details by email, i.e. when we send an email to the email address you have provided to confirm your subscription request. If you have purchased an event, webinar, course, network, etc. we will delete your personal information 3 months after the event, last course or lecture. Due to accounting obligations payment information is deleted after 5 years.
 

1.4. Recruitment

If you have applied for a position with KPMG, we are processing the personal information that you provided.

If you have been contacted by one of our recruitment partners, we will have received your personal data from that recruitment partner, who will have informed you in advance of the exchange and processing of your personal data in connection with our recruitment. We are also using LinkedIn as a recruitment tool.

 

1.4.1. Categories of personal information

In our recruitment process, we will be processing your personal information:

• Identification information such as name, address, e-mail, phone number, date of birth, nationality, gender, job title/position and current employer (if relevant).
• Relevant publicly available information, e.g. LinkedIn profile information.
• Educational information and application, CV, diplomas, and letter of recommendation.
• Video presentation of the candidate, if provided to us.
• Test results, when tested during the recruitment.
• Salary information, if relevant to determining compensation or salary considerations for a recruitment partner.
• If you are offered a position with us, our internal Privacy Statement will apply.

1.4.2. Purpose and legal basis

The purposes of our processing of personal information are:

• Recruitment of new employees.
• To match relevant candidates with available KPMG job opportunities.

Legal basis for our processing of personal information:

• Article 6(1)(f) of the GDPR – legitimate interest.
  • We have a legitimate interest in finding and assessing applicants for the purpose of possible employment.

1.4.3. Retention and erasure

We will delete your personal information 6 months after the recruitment process has been completed.

If you would like to be considered for future job opportunities, you are welcome to give KPMG consent to continue the processing of your personal information for additional 6 months.

• If you have applied via our recruitment system:
  • An e-mail will automatically be sent to you, informing you about the expiration and deletion of your information.
  • If you still wish to be considered for relevant opportunities, you can give us consent via the recruitment system for an additional 6-month period.
• If you do not give consent to an additional 6-month period, we will delete your personal information.
  
  

1.5. Visitors

When you are physically visiting us at our locations, we are processing the personal information that you provide to us including the information you provide when accessing  KPMG’s guest network (Wi-Fi).

When you are participating in an online meeting with us, e.g. via Microsoft Teams, we will also be processing your personal information related to the meeting invitation.

1.5.1. Categories of personal information

When you are visiting us at our locations:

• Identification information such as name, e-mail, phone number and signature.
• Potentially job title/position and employer.
• Video surveillance footage (CCTV) – there are signs at KPMG’s offices.

If you use our guest network (Wi-Fi):

• Name, e-mail, phone number, employer and e-mail of the person at KPMG you are visiting.

Online meetings:

• Name, e-mail, employer, IP-address.
• In some cases, recording of the online meeting, which you will have been informed about and consented to
   

1.5.2. Purpose and legal basis

The purposes of our processing of personal information are:

• Expedition of reception inquiries.
• Handing out access cards for guests, providing access to the guest Wi-Fi, etc.
• Control, security and crime prevention.
• Planning, arranging and executing meeting activities, recording of meeting for later use/reuse.
• Ad hoc tasks.

Legal basis for our processing of personal information:

• Article 6(1)(a) of the GDPR – consent.
  • KPMG may process your personal information based on your consent. You can withdraw your consent at any time by contacting our Privacy Team.
  • Your consent related to a recorded meeting: you can decline the meeting invitation or send an e-mail to your KPMG point of contact or to our Privacy Team.
          §  KPMG P/S:
              Privacy: dk-fmprivacy@kpmg.com
          §  KPMG Acor Tax P/S:
              Privacy: dk2-fmprivacy@kpmg.com
• Article 6(1)(e) of the GDPR – legitimate interest.
  • KPMG has a legitimate interest in handling and accommodating our reception inquiries.
  • Keeping track on who is visiting our locations and using our guest network.
  • Holding meetings physically and online.
  • Pursuing the above-mentioned purposes.
• The Danish Television Surveillance Act (TV-overvågningsloven) § 3 – tv surveillance of places or locations with general access or workplace.
  • We have signs at the entrance of our locations and in our offices showing that we have CCTV.

1.5.3. Retention and erasure

Personal information obtained by our reception is deleted after 3 months.

Access cards for guests used for a longer period are deleted after 6 months.

CCTV footage is securely stored, and access to this information is restricted to a select group of employees with specific business-related requirements.The video surveillance footage is automatically deleted after 30 days.

Information provided to us in connection with the use of KPMG’s guest network is deleted after 5 days.

Meeting invitations in Microsoft Outlook are deleted in accordance with KPMG’s deletion policy. Meeting recordings are deleted as stated in the specific meeting invitation of the recorded meeting. 

 

1.6. Queries regarding data subject rights.

If you contact us to exercise your right(s) under the GDPR, we are processing your personal information.
 

1.6.1.  Categories of personal information

We are processing your personal information:

• Identification information such as name, e-mail, phone number and the information in your e-mail signature.
• Other information that you provide to us in connection with your request or exercising of your right(s).
• Potentially ID-documentation can be requested.

1.6.2. Purpose and legal basis

The purposes of our processing of personal information are:

• KPMG’s identification of you and the information related to your request.
• Handling, administering and accommodating your request.
• Documentation of handling and responding to your request.

Legal basis for our processing of personal information:

• Article 6(1)(e) of the GDPR – legitimate interest.
  • KPMG has a legitimate interest in pursuing the above-mentioned purposes.
     

1.6.3. Retention and erasure

Depending on which right(s) you want to exercise, we delete the personal information related to your request at the latest after 5 years.

 

2. Sharing, tranferring and disclosure of personal information.

If you would like to know more specifics about our sharing and/or disclosure of personal information about you, you are most welcome to contact KPMG’s Privacy Team.

• KPMG P/S:
  • Privacy: dk-fmprivacy@kpmg.com
• KPMG Acor Tax P/S:
  • Privacy: dk2-fmprivacy@kpmg.com
    
    

2.1. Sharing of personal information with data processors.

When KPMG processes personal information, we may share the information with our data processors (third-party service providers) who are processing the personal information on our behalf.

We use data processors such as third-party service providers, for example, IT system providers, hosting providers, payroll companies, consultants (for example legal advisors) and other product and service providers.

KPMG uses only those data processors that can meet our high standards for data protection and IT security. We only share the personal data necessary for the data processor to provide the agreed service to us with our data processors. In addition, we have entered into data processing agreements with all our data processors to ensure that the personal data for which we are responsible is processed securely and in accordance with data protection laws.

 

2.2. Sharing and transfer of personal information within the network of KPMG member firms.

We may share your personal information with other member firms of the KPMG network as part of international engagements, and with KPMG International and/or other member firms where required or necessary to meet our legal and regulatory obligations around the world. Therefore, personal information can be transferred outside the EU/EEA to KPMG firms located outside the EU/EEA, for example, KPMG International located in the United Kingdom.

Other parts of the KPMG network are also used as data processors to provide services to us and you. For example hosting and supporting IT applications, provision of certain forms of insurance for member firms and its clients, performing client conflicts checks and Anti-Money Laundering checks, assisting with client engagement services and otherwise as required in order to continue to operate KPMG’s business.

 

2.3. Disclosure of personal information at KPMG to third parties.

We refrain from sharing personal information with third parties, unless it is essential for our legitimate professional- and business needs, to carry out your request(s), and/or as required or permitted by law or professional standards.

As part of providing our Tax, Audit and/or Advisory services and advice, we may disclose personal information to e.g. tax authorities, other public authorities, financial institutions, pension companies or other third parties. 

Situations where we may disclose personal information to third parties:

• If we are reorganized or sold to another organization:
  • KPMG will typically also disclose personal information in connection with the sale, assignment, or other transfer of any element of KPMG’s business to which the personal information relates.
• Courts, tribunals, law enforcement or regulatory bodies:
  • KPMG will disclose personal information in order to respond to requests of courts, tribunals, government or law enforcement agencies or where it is necessary or prudent to comply with applicable laws, court or tribunal orders or rules, or government or professional regulations.
• Audits:
  • Disclosure of personal information will also be needed for data privacy or security audits and/or to investigate or respond to a complaint or security threat.
• Insurers:
  • Our professional rules and our business requirements necessitate that we carry significant insurance coverage in respect of business activities (our ‘insurance programme’). This is required to assist each member firm of the KPMG network in covering the costs linked to potential claims that may arise should allegations of service-related issues occur during their client engagements.o   To make the insurance programme work effectively, the insurance programme involves a number of different participants in the insurance market (e.g. brokers, insurers and reinsurers, as well as their professional advisors and other third parties involved should there be a claim).
  • Some of these insurance market participants will require that we disclose personal information about you to them.
  • The information will be used by the insurance market participants in the underwriting and ongoing administration of the insurance programme, where there is a claim that you are relevant to and to allow the insurance market participants to comply with their legal and regulatory obligations.
  • Certain participants in the insurance market will manage this information on our behalf, acting as data processors, similar to the service providers mentioned earlier. However, some may also process information about you independently, functioning as separate and autonomous data controllers.

 

3. Your rights

3.1. Rights

If KPMG processes personal information about you, you are entitled to certain rights.

Before providing personal information to you, we may ask for proof of identity and sufficient information about your interactions with us, to locate the personal information you are requesting from us. 

When we are processing your personal information:

• You have the right to access and to receive a copy of your personal information in electronic form. If the information we have about you is incorrect, you are entitled to ask us to correct any inaccuracies  the personal information.
• If you want to have your personal information deleted, to have our processing of that information restricted, to exercise your right to data portability or to object to KPMG’s processing of your personal information, please contact us.
• You have the right to object at any time when your personal information is processed for direct marketing.

Please send us an e-mail and we will make all reasonable and practical efforts to accommodate your request, as long as it is consistent with applicable law.

• KPMG P/S:
  • Privacy: dk-fmprivacy@kpmg.com
• KPMG Acor Tax P/S:
  • Privacy: dk2-fmprivacy@kpmg.com
     

3.2. Consent

If we are processing your personal information based on your consent, you have the right to withdraw your consent at any time. For your information, the withdrawal of your consent does not affect the lawfulness of our processing (of your personal information that is) based on your consent before the withdrawal of your consent.

Depending on the situation where we are processing your personal information, there can be different options for how to withdraw your consent, e.g. in our recruitment system, at our website in the cookie banner, in our newsletters, invitations, etc. 

Otherwise, you can always send us an e-mail:

• KPMG P/S
  • Privacy: dk-fmprivacy@kpmg.com
• KPMG Acor Tax P/S
  • Privacy: dk2-fmprivacy@kpmg.com
    
    

4. Personal information about children.

KPMG understands the importance of protecting children's privacy, especially in an online environment, and therefore are KPMG’s sites not intentionally designed for or directed at children under the age of 13.

We do not intend to process personal information about anyone under the age of 13 unless it becomes necessary in connection to providing our professional services. Otherwise, we will obtain consent from the parent(s) in accordance with the data protection legislation.

 

5. Data security and integrity

KPMG has reasonable security policies and procedures in place to protect personal information from unauthorized loss, misuse, alteration, or destruction. Despite KPMG's best efforts, however, security cannot be guaranteed against all threats. To the best of our ability, access to your personal information is limited to those who have a need to know. Those individuals who have access to the information are required to maintain the confidentiality of such information.

We also make reasonable efforts to retain personal information only:

a) for so long as the information is necessary to comply with an individual's request,

b) as necessary to comply with legal, regulatory, internal business or policy requirements, or

c) until that person asks that the information be deleted. The period for which data is retained will depend on the specific nature and circumstances under which the information was collected.
 

6. Links to other sites.

Please be aware that KPMG websites will typically contain links to other sites, including sites maintained by other KPMG member firms that are not governed by this Privacy Statement, but by other privacy statements that will often differ somewhat from ours. Therefore, we encourage users to review the privacy statement or policy of each website visited before disclosing any personal information.

 

7. Changes to this Privacy Statement.

KPMG may modify this Privacy Statement from time to time to reflect our current privacy practices. When we make changes to this statement, we will revise the "updated" date at the top of this page. Any changes to the processing of personal information as described in this Privacy Statement affecting you will be communicated to you through an appropriate channel, depending on our standard methods of communication with you.

 

8. Privacy questions and complaints.

8.1. Privacy questions and complaints.

KPMG is committed to protecting the online privacy of your personal information. If you have questions or comments about our administration of your personal information, please contact us via e-mail:

• KPMG P/S:
  • Privacy: dk-fmprivacy@kpmg.com
• KPMG Acor Tax P/S
  • Privacy: dk2-fmprivacy@kpmg.com

You may also use this address to communicate any concerns you may have regarding compliance with our Privacy Statement.

 

8.2. KPMG International

If you are not satisfied with the response you receive, you may escalate your concern to our Global Privacy Officer by sending an email to GlobalPrivacyOfficer@kpmg.com.

Our Global Privacy Officer will confirm receiving your email within 14 days and seek to resolve your concern within one month of receipt. Where the concern is complex or we have a large volume of concerns, we will notify you that the concern will take longer than one month to resolve, and we will seek to resolve your concern within three months of the concern being first raised.

We may either accept your concern and in that case, we will implement appropriate measures to mitigate your concern, or we may reject your concern on legitimate grounds.

 

8.3. Supervisory authority

In every case, you have the right to file a complaint with the Danish Data Protection Agency (Datatilsynet), who is responsible for personal data protection.

You can find more information about the Data Protection Authority at www.datatilsynet.dk or send an e-mail to dt@datatilsynet.dk.