Privacy Policy

ECCO Sko A/S with its registered address at Industrivej 5, 6261 Bredebro, Denmark (hereinafter referred to as ECCO, “we”, “us” and “our”) and the companies within ECCO (“ECCO Affiliates”) respect your privacy and take our responsibility seriously.

This Privacy Policy describes how we collect personal data in connection with your interaction with us, e.g. when you visit our recruitment site, apply for a position at ECCO, participate in job interviews, etc. Additionally, this Privacy Policy describes how we use and share that personal data. Please take the time to read this Privacy Policy.

With this Privacy Policy we want to ensure that you receive adequate information about our collecting and processing of your personal data, including such information we are obliged to inform you about according to applicable personal data protection regulation incl. the EU Regulation No. 2016/679 the “General Data Protection Regulation” (“GDPR”), the Swiss “Federal Act on Data Protection”  (“nFADP”) and the UK General Data Protection Regulation(“UK GDPR”), as amended by the Data Protection Act 2018, when you apply for a position within ECCO.

In this privacy policy we use the term “personal data” synonymously with “personal information” or similar expressions as defined in applicable privacy regulation, which is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.

We will update this Privacy Policy periodically and will post updates on the website.

This Privacy Policy may be supplemented by other information received from us or another ECCO Affiliate.

1. OUR CONTACT DETAILS

1.1. Identity of the Controller(s)

Unless otherwise specified elsewhere, the legal entity responsible for the collection and processing of your personal data described in this Privacy Policy (the “Controller”) is the ECCO Affiliate you apply for a position in (In this Privacy Policy the Controller is also referred to as “we”, “us” and “our”). 

This Privacy Policy concerns the following ECCO Affiliates:

We may share your personal data with ECCO Sko A/S and other ECCO Affiliates for the following purposes:

• Global workforce reporting and analytics
• Succession planning and talent management
• Provision of centralized HR systems and support

When ECCO Sko A/S processes your data for its own purposes (such as group-wide reporting), it does so as a separate data controller. When ECCO Sko A/S provides centralized infrastructure (e.g., hosting an HRIS database) that ECCO Affiliates use, ECCO Sko A/S acts as a processor for those ECCO Affiliates with respect to the provision of the infrastructure.

If you have any questions or require further assistance, please contact the individuals referenced in the job advertisement or use the relevant contact information provided above.

1.2. Contact details for ECCO’s Data Compliance Office

ECCO has established Data Compliance Office responsible for ensuring compliance with applicable data protection regulations. The Data Compliance Office can be contacted either by:

E-mail: datacompliance@ecco.com

Letter: ECCO Sko A/S, Data Compliance Office, Industrivej 5, 6261 Bredebro, Denmark, attn.: Head of Data Compliance Office

2. HOW WE COLLECT AND USE YOUR PERSONAL DATA

When you interact with us we will collect personal data about you, and use it for various purposes, such as operating this Website, assessing your application, contacting you to schedule job interviews, etc. 

If you are asked to provide information, then it is optional for you to disclose such information. The information might, however, be needed for statutory, contractual or practical reasons. We will always clearly indicate whether the information is mandatory. If you refrain from disclosing information which we deem as mandatory, as a consequence it may be that we will not be able to assess your application or be able to take you into account for a position with ECCO.

In this section you can find relevant information about how we collect and use your personal data when you apply for a position within ECCO, including information about i) the purposes for which the personal data is being processed; ii) the source of the personal data that is not obtained directly from you; iii) the general categories of personal data being processed; and iv) the legal basis for the processing.

We strongly believe and are committed to the protection of the personal data in our custody and control, and we have therefore implemented what we believe are appropriate technical and organisational security measures to protect this personal data against unauthorized or unlawful processing and against accidental loss, destruction or damage.

We urge you not to provide us with personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, health data or sex life or sexual orientation or similar, as part of the recruitment process.

If you unfold below sections, you can read more about how we collect and process your personal data in different situations, including the general categories of personal data being processed; the source of the personal data that we do not directly obtain from you; the purposes for which personal data is being processed; and the legal basis for the processing.

For controllers established in the UK the legal basis referenced below are the equivalent provisions in the UK GDPR.

2.1. Visiting our recruitment website

When you visit our recruitment website, enter.ecco.com (“our Website”), our Website uses 1st and 3rd party cookies to optimize your user experience, and for statistical and marketing purposes. Read more about the cookies and how you can administer and reject these in our Cookie Policy.

Below you can read more about the types of personal data and the legal basis for the different purposes that we use data for when you have consented to our placement of cookies:

Optimizing your user experience on our Website:

The personal data we process for this is:

• IP address
• Data on your behaviour on our website
• Compilation of visited pages

The legal basis for this processing is GDPR art. 6(1)(a), namely the consent you have granted, when accepting our placement of functional, statistical and/or marketing cookies.

The legal basis for the processing of personal data in relation to strictly necessary cookies used to make our Website work properly is GDPR arti. 6(1)(f). This means we have assessed that we have a valid business or operational reason to process your personal data, and that this processing is necessary and proportionate to achieve that purpose of providing a fully functional website. We have also carefully balanced our interests against your rights and freedoms to ensure that your interests are not overridden.

Sharing of data with third party advertising and analytics companies to show you ads on other websites and to understand our advertising effectiveness

We may contract with third party advertising or analytics companies to serve you online ads on other websites. These companies use cookies or similar technologies to collect information about your interactions with our Website and interactions with other websites. These advertising companies may use and share the information gathered to deliver ads more tailored to your interests. We receive aggregate information from these third parties to understand our advertising effectiveness. Any information collected by us or by third parties through the use of cookies or similar technologies may be linked with other information we collect about you. The personal data we process for this is:

• IP address
• Data on your behaviour on our website
• Compilation of visited pages

The legal basis for this processing is GDPR art. 6(1)(a), namely the consent you have granted, when accepting our placement of marketing cookies.

2.2. Graduate Newsletter

If you sign up to receive our ECCO Graduate Newsletter, we will collect and process personal data about you for the purpose of sending you communications about the ECCO Graduate Programme, including notifications about when applications open and close, and news about the programme.

The personal data we process about you includes:

• name, and
• email address

The legal basis for this processing is GDPR art. 6(1)(a), namely the consent you have granted when signing up to receive the Graduate Newsletter. You can withdraw your consent at any time by unsubscribing from the newsletter using the link provided in each communication or by contacting us as described in SECTION 1.

2.3. Applying for a position

If you apply for a position within ECCO we will collect and process personal data about you for the purpose of managing our recruitment process, which includes processing your application, assessing your qualifications for positions within ECCO and eventually offering you a contract, if we would like to hire you etc.

We use your personal data to assess your suitability for the role, conduct interviews, verify information you have provided, and make hiring decisions. Access to your application is restricted to personnel involved in the recruitment process.

The personal data we process about you may include;

• all such personal data you have provided to us including your name, e-mail, other contact details and all other information included in or enclosed with your application, such as resumes, CV, information about educational level, grades, previous work experience, references from former employers, diplomas and certificates etc.,
• publicly available information we may have found on internet and social media (e.g. on LinkedIn (and through the use of LinkedIn Recruiter), Facebook, Twitter, Google etc.), and
• personal data you have provided to us through any interviews and similar you may have participated in.

The legal basis for this processing is GDPR art. 6(1)(f), namely our interest in recruiting suitable employees to support our organisation. We have conducted a Legitimate Interests Assessment and concluded that our interest in evaluating candidates to fill vacancies is legitimate, necessary, and does not override your rights as an applicant, particularly given that you voluntarily submit your personal data with the expectation that it will be used for this purpose.

If we have used a recruitment agency in connection with your recruitment process, we receive the abovementioned personal data about you from the recruitment agency.

2.4. Personality and cognitive assessments

Depending on the role for which you apply, you may be asked to complete personality and cognitive assessments as part of the recruitment process. These assessments are used for certain positions where specific competencies, cognitive abilities, or personality traits are particularly relevant to the requirements of the role. The results are used in conjunction with other application materials and interviews to inform hiring decisions.

The personal data we process about you may include;

• personality and cognitive profiles based on psychometric tools. 

We typically use psychometric tools such as PI, Cubiks or similar as part of our recruitment process. The logics involved in such psychometric tools depends on the specific tool used. Details about the psychometric tools and the profiles they generate can be provided by the HR partner involved. It is always optional, whether you want to participate in such profiling, however it might influence our final assessment whether you are the right candidate for a position within ECCO. Please be informed that we only use these profiles as general guidance, and you always have the right to object against the outcome hereof and the conclusions ECCO draws upon it.

The legal basis for this processing is GDPR art. 6(1)(f), namely our legitimate interest in conducting a thorough and fair recruitment process that enables us to identify candidates who are well-suited to the role, thereby supporting effective hiring decisions and reducing the risk of poor role fit. We have conducted a Legitimate Interests Assessment and concluded that this processing does not override your rights and freedoms, particularly given that testing is limited to relevant roles, assessments are professionally administered, and results are treated confidentially.

In accordance with GDPR art. 13(2)(e), we inform you that participation in personality and cognitive testing is not a statutory or contractual requirement. However, where such testing is part of the recruitment process for the role you have applied for, your decision not to participate may affect our ability to fully assess your suitability for the position. In such cases, we may be unable to proceed with your application or may need to make a hiring decision based on incomplete information, which could disadvantage your candidacy relative to other applicants who have completed the assessments.

2.5. References

As part of the recruitment process, we may collect and process personal data relating to your previous employment through references. During the job application process, you may be asked to provide contact details for one or more references from your prior employers. Alternatively, we may obtain references directly from the contact persons you have provided.

The primary purpose of collecting and processing reference data is to verify the accuracy of the information you have provided in your application and to assess your suitability for the position. Reference checks allows us to make informed recruitment decisions by obtaining an objective evaluation of your professional background, work history, and competencies from individuals who have previously supervised or worked closely with you.

The personal data we process about you may include;

• name and contact details
• employment history
• information about 
  • professional performance 
  • competencies and skills
  • professional conduct and behaviour
  • rehire eligibility and recommendations

The legal basis for this processing is GDPR art. 6(1)(f), namely our legitimate interest in verifying the accuracy of information provided during the application process, and making informed recruitment decisions that serve our organisational interests in hiring qualified, reliable personnel.

In accordance with GDPR art. 13(2)(e), we inform you that providing reference contact details is not a statutory requirement, but it may be a necessary part of our recruitment process for certain positions. Providing reference information is voluntary, however, if you choose not to provide references or do not permit us to contact the individuals you have nominated, this may affect our ability to fully assess your application. In such circumstances, we may be unable to verify your employment history and qualifications, which could result in your application not being progressed or considered further in the recruitment process.

2.6. Criminal Records

For certain positions, we may need to verify that you do not have a criminal history that is incompatible with the role for which you are applying. Criminal record checks are conducted only where necessary and proportionate to the nature of the position, for example where the role involves access to sensitive information, financial responsibilities, work with vulnerable individuals, or other circumstances where a criminal background check is warranted. We will only request criminal record certificates from candidates who have reached the final stages of the recruitment process.

The purpose of processing criminal record information is to assess your suitability for the position and to ensure a safe and secure working environment. Depending on the nature of the role, verification of your criminal record may be necessary to comply with legal or regulatory requirements, to protect our legitimate business interests, or to safeguard the rights and safety of employees, customers, or other third parties.

The personal data we process about you may include;

• name and contact details,
• social security number, and
• information about recorded offences.

The legal basis for processing criminal record information depends on the content of the certificate:

Criminal record certificates without recorded offences: If your criminal record certificate does not contain any information about criminal offences (i.e., a clean record), the legal basis for processing is GDPR art. 6(1)(f), as we have a legitimate interest in processing ordinary personal data about you as part of the recruitment process to verify your suitability for the position. In this assessment, we have taken into account that a clean criminal record certificate does not contain special categories of personal data and that criminal record certificates are only requested from final candidates. The processing is therefore considered necessary and proportionate.

Criminal record certificates with recorded offences: If your criminal record certificate contains information about criminal offences, such data constitutes personal data relating to criminal convictions and offences within the meaning of GDPR art. 10. Processing of such data is only permitted where authorised by Union or Member State law providing appropriate safeguards for the rights and freedoms of data subjects. Accordingly, the legal basis for processing criminal record data containing information about offences is the applicable national implementing legislation in the relevant jurisdiction.

In accordance with GDPR art. 13(2)(e), we inform you that providing a criminal record certificate is not a general statutory requirement, but it may be a contractual requirement or a necessary condition for your application to be considered for certain positions. The provision of a criminal record certificate is voluntary, however, if you choose not to provide the requested certificate, we may be unable to complete the assessment of your suitability for the role. In such circumstances, your application may not be progressed, and you may not be considered further for the position.

3. HOW WE SHARE YOUR PERSONAL DATA WITH OTHERS

As part of the recruitment process we might have to disclose and transfer your personal data to other ECCO Affiliates and other third parties. We will only do this to the extent it is necessary for the recruitment process. Our legal basis for the disclosure of your personal data is the respective legitimate interests listed under sections 2.1 – 2.4 above. We will not disclose personal data related to criminal records under section 2.5.

When using service providers and contractors to process your personal data on our behalf (also referred to as “data processors”) we require, that they only process your personal data in accordance with our instructions. We also require that the data processors sign relevant contracts providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the data processing will meet the requirements of the applicable data protection regulation and ensures an appropriate protection of your rights.

In case we disclose your personal data to third parties, who will not be acting as a data processor under our instructions, but as independent data controllers, then we do our outmost to ensure that they are trustworthy and have implemented appropriate technical and organisational measure to protect your data.

3.1. Categories of Recipients

The main categories of potential recipients of your personal data are:

A. Service Providers

We may disclose your personal data to our trusted third party service providers, who, on our behalf, operate, maintain, and/or support our IT systems and IT infrastructure, communication platforms, our websites, provides us with recruitment services, psychometric tools, legal and tax advisors and perform other important services for us.

B. Other ECCO Affiliates

We may disclose your personal data to other companies, which are owned or controlled by ECCO Sko A/S or owns or controls ECCO Sko A/S (“ECCO Affiliates”) in order for them to provide us with relevant services or in case it is necessary due to the organizational setup within the ECCO Group. The legal basis for disclosing your personal data to ECCO Affiliates is GDPR Art. 6(1) f), as we and our ECCO Affiliates have a legitimate interest in sharing recruitment-related personal data within the ECCO Group for the purposes of efficient and effective recruitment administration, coordination of hiring decisions across group entities, and identification of suitable candidates for positions throughout the ECCO group.

C. Third party advertising partners

We use third party advertising partners to collect information about your use of our Website in order to measure the performance of our advertising campaigns. The third party partners we use may collect this information using tracking technologies, such as pixels, cookies, APIs and SDKs. Vendor names and privacy policies of the third party advertising partners that we use from time to time will always be listed in our Cookie Banner available on the Website under the section “Show Details”.

D. Legal Successors

A transfer of your personal data to another legal entity may occur as part of a transfer of our business or parts thereof in form of a reorganization, sale of assets, consolidation, merger or similar. The legal basis for disclosing your personal data to Legal Sucessors is GDPR Art. 6(1) f), as we have a legitimate interest in ensuring business continuity, which includes the orderly transfer of personal data necessary to maintain ongoing business operations, employment relationships, and recruitment processes.

E. Other disclosures

In addition to where you have consented to a disclosure of the personal data or where disclosure is necessary to achieve the purpose(s) for which, it was collected, personal data may also be disclosed in special situations, where we have reason to believe that doing so is necessary to identify, contact or bring legal action against anyone damaging, injuring, or interfering (intentionally or unintentionally) with our rights or property, users, or anyone else who could be harmed by such activities, or otherwise where necessary for the establishment, exercise or defence of legal claims.

3.2. Transfer of data to third countries

We may transfer your personal data outside the European Economic Area in two situations: (i) to ECCO Affiliates located in various countries and as part of our global operations and (ii) to service providers (data processors) in various third countries or using sub processors in such third countries. The third countries include the United States, Canada, China, Hong Kong, Macau, India, Australia, Singapore, Brazil, the United Kingdom, Taiwan, the Philippines, Vietnam, Thailand, Malaysia, Japan, South Korea, Russia, UAE, Turkey, Indonesia and New Zealand.

Where transfers are made to countries not covered by an EU adequacy decision, we rely on appropriate safeguards under GDPR article 46(2), including Standard Contractual Clauses. For transfers to the United States, we may also rely on the EU-U.S. Data Privacy Framework where recipients are certified under that framework. For more information about Standard Contractual Clauses, please visit this site. If you have any questions, please contact us in accordance with SECTION 1.1 (OUR CONTACT DETAILS).

4. HOW WE RETAIN AND DELETE YOUR DATA

Your personal data will be held by us in a form that permits your identification only for as long as is necessary for the purposes for which it was collected. Once the applicable retention period has expired, we will either delete your personal data or anonymise it so that it can no longer be used to identify you. 

As a main rule we apply the following retention periods to personal data collected during recruitment:

A. Applications and related documentation

As a general rule, your application and all accompanying documents (including CVs, cover letters, references and certificates) will be deleted six months after the recruitment process has ended. However, if special circumstances during the recruitment process warrant it - for example, where a legal dispute has arisen or may reasonably be anticipated - we may retain this material for up to three years to allow us to establish, exercise or defend legal claims before the statute of limitations expires.

B. Personality and cognitive tests

If you are not offered a position, your test results will be automatically deleted 180 days after the recruitment process has ended. If you are employed, your test results will be transferred to your personnel file and retained for the duration of your employment as described in the Employee Privacy Policy.

C. Criminal records

Where criminal record certificates are required and obtained as part of the recruitment process, they are reviewed and then deleted immediately, whether received electronically or in physical form. We do not retain copies of criminal record certificates after completing our review.

D. Cookies

Personal data collected through cookies placed on enter.ecco.com is retained for the duration specified for each cookie. The specific session time and retention period applicable to each cookie is stated in the cookie banner displayed on the website. Please refer to the cookie banner for detailed information about the retention period of each cookie.

If you accept a position with us, the personal data that formed part of the recruitment process will be stored in your personnel file and retained for the duration of your employment. Upon employment, you will receive our Employee Privacy Policy, which provides further information about how your personal data is processed during and after the employment relationship.

If you provide us with a written request, we will also erase or anonymize your personal data without undue delay, unless we have a valid legal ground to continue to keep your personal data. Please also refer to SECTION 5 (YOUR RIGHTS).

5. YOUR RIGHTS

You have certain rights according to the applicable data protection regulation. Some of the rights are rather complex and include exemptions, accordingly you are recommended to read relevant laws and guidance from the regulatory authorities for full explanation of these rights. However, you can find a summary of your rights below in this section.

5.1. The right to access

You have a right to obtain the confirmation as to whether or not your personal data are being processed by us. In addition, you have a right to obtain more detailed information about the personal data kept and the processing undertaken by us and under certain circumstances the right to receive a copy of this personal data.

5.2. The right to rectification

You have the right to have inaccurate personal data about you rectified, and, taking into account the purpose of the processing, to have incomplete personal data completed.

5.3. The right to erasure

In some cases, you have the right to erasure of your personal data without undue delay. Those circumstances include; i) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; ii) you withdraw consent to consent-based processing; iii) the processing is for direct marketing purposes and iv) the personal data has been unlawfully processed. However, there are certain general exclusions of the right to erasure. Those general exclusions include where processing is necessary; i) for the exercising the right of freedom of expression and information; ii) for compliance with legal obligation; or iii) for the establishment, exercise or defence of legal claims.

5.4. The right to restriction of processing

In some cases, you have the right to restrict the processing of your personal data. Where processing has been restricted, we may continue to store your personal data. However, we will only otherwise process it i) with your consent; ii) for the establishment, exercise or defence of legal claims; iii) for the protection of the rights of another natural or legal person; or iv) for reasons of important public interest.

5.5. The right to data portability

To the extent the legal basis for the processing is your consent, and such processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format. However, this right does not apply where it would adversely affect the rights and freedoms of others.

5.6. The right to object

You have the right to object to the processing of your personal data on grounds relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is necessary for i) the performance of a task carried out in the public interest or in the exercise of any official authority vested in ECCO; or ii) the purpose of legitimate interests pursued by us or a third party. In such case we will cease processing the personal data, unless we can demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms or the processing is for the establishment, exercise or defence of legal claims.

5.7. The right to withdraw consent

To the extent that the legal basis for the processing is your consent, you have the right to withdraw from that consent at any time.

In case you withdraw from a consent given, then we will cease to process your personal data, unless and to the extent the continued processing is permitted or required according to the applicable personal data regulation or other applicable laws and regulations. The withdrawal from your consent will in no event effect the lawfulness of processing based on consent before its withdrawal.

5.8. The right to complaint to data protection supervisory authority

You may always lodge a complaint with your local data protection supervisory authority.

We do our best to ensure that we protect your personal data, keep you informed about how we process your personal data and comply with the applicable data protection regulation. In case you are not satisfied with the processing and protection of your personal data or the information you have received from us, then we urge you to inform us in order for us to improve. Please also do not hesitate to contact us if you want to make use of your rights.

Please contact us through the points of contact listed in SECTION 1.1 (OUR CONTACT DETAILS). Please also provide us with relevant information to take care of your request, including your full name and email address so that we can identify you. We will respond to your request without undue delay.

6. CHANGES TO THIS PRIVACY POLICY

We reserve the right, at our discretion, to add, modify or remove portions of this Privacy Policy in the future to ensure that the information herein provides relevant and adequate information about our collecting and processing of your personal data.

This Privacy Policy may be supplemented by other information received from us or another ECCO Affiliates and other terms and conditions applicable to this Website or which you have agreed to as part of interacting with us or another ECCO Affiliate.

You can always find the updated version of our Privacy Policy at enter.ecco.com.

Version 03/2026