Privacy policy

Last updated: 15 October 2026

1. Data controller

Sahari, which runs Bemandix, is the data controller for the processing of the personal data described in this policy.

• Sahari (Bemandix)
• E-mail: kontakt@bemandix.dk
• Telephone: +45 27 26 67 08

If you have any questions about our processing of your personal data, or if you wish to exercise your rights, you are welcome to write to kontakt@bemandix.dk.

2. Who the policy applies to

The policy applies when you:

• visit our website
• order workers or are the contact person for one of our customers
• create a profile as a job seeker, temporary worker or self-employed person
• are the contact person for a company that is applying to become, or is, a partner
• write to us via the contact form
• have an administrator login to Bemandix's administration system

If you are employed by Bemandix, you will receive separate information about how we process your personnel data.

3. What data we process and why

References to articles below are to the EU General Data Protection Regulation (GDPR).

3.1 Customers, orders and requests

Data: name, company, CVR number, telephone number, e-mail address, work address, information about the order (e.g. trade, number of workers, period, working hours and certificate requirements), information about requests for recruitment and contracting (e.g. position, job description and timetable), documents and drawings you attach, as well as our correspondence, quotes and agreements.

Purpose: to process your order, contact you, prepare quotes, deliver and administer the job, invoice and maintain the customer relationship.

Legal basis:

• Art. 6(1)(f) (legitimate interest): our legitimate interest in processing enquiries from companies and administering the collaboration with our customers, when you are the contact person for a company.
• Art. 6(1)(b) (contract): when you yourself are the customer, e.g. as a sole proprietorship, and the processing is necessary to enter into or perform a contract with you.
• Art. 6(1)(c) (legal obligation): when we must retain accounting records under the Danish Bookkeeping Act (bogføringsloven).

Only attach documents that are necessary for the job, and avoid personal data about other people as far as possible.

3.2 Job seekers, temporary workers and self-employed persons

Data: name, telephone number, e-mail address, area of residence and postcode, trades, experience, education, certificates and courses, availability, preferred work area, driving licence and other skills, your CV and the documentation you upload, as well as a profile photo if you choose to upload one yourself. If you are self-employed, we also process your CVR number. In addition, we process notes from our contact with you and information about the jobs you have been proposed for or have carried out.

Purpose: to assess your profile, find jobs and positions that suit you, contact you, present you to customers in connection with specific jobs and administer the jobs you carry out through us.

Legal basis:

• Art. 6(1)(b) (contract): the processing is necessary in order to take steps at your request prior to entering into a contract and to perform a contract with you.
• Art. 6(1)(f) (legitimate interest): our legitimate interest in matching qualified candidates with our customers' jobs and in keeping a register of candidates.
• Art. 6(1)(a) (consent): when we ask for your consent, e.g. before we present your profile to a customer or obtain references.
• Art. 6(1)(c) (legal obligation): when we are obliged to do so by law, e.g. to report pay to the Danish Tax Agency (Skattestyrelsen) if you are employed.

Do not send sensitive data. We ask you not to send your CPR number (Danish civil registration number), health data, data about criminal offences (e.g. a criminal record certificate (straffeattest)) or other sensitive data via the forms on the website. This also applies to your CV and the documents you upload.

If we later need such data, e.g. your CPR number for the payment of wages, or if a position requires a child protection certificate (børneattest), we will obtain it separately, in a secure manner and only to the extent permitted by law. In that case, we process your CPR number under section 11 of the Danish Data Protection Act (databeskyttelsesloven).

3.3 Partners

Data: names of contact persons, telephone number, e-mail address, company name, CVR number, trades, number of available workers, geographical coverage area, hourly rates, special skills, authorisations, certificates, insurance information and uploaded documents, as well as our correspondence and agreements.

Purpose: to process the application, assess and approve the company, contact you about jobs and administer the collaboration.

Legal basis:

• Art. 6(1)(f) (legitimate interest): our legitimate interest in assessing and collaborating with suppliers and in ensuring that they meet the requirements for the jobs they carry out.
• Art. 6(1)(b) (contract): when the partner is a sole proprietorship and the processing is necessary to enter into or perform a contract.
• Art. 6(1)(c) (legal obligation): when we must retain accounting records under the Danish Bookkeeping Act.

If you send us data about your workers, e.g. copies of certificates, you must ensure that the workers have been informed and that you are permitted to disclose the data to us.

Partner agreement and digital signature: When the partner agreement (samarbejdsaftale) is signed digitally – via a personal link sent by e-mail, in the partner portal or with MitID – we process the signatory's name and role in the company, the company and the CVR number for which the person is signing, the e-mail address or account from which the signature was made, the time, and the IP address and browser information at the time of signing. When signing with MitID, we also process information about the person's role in MitID Erhverv (e.g. whether the person is authorised to sign on behalf of the company or is an employee) and a technical ID for the MitID identity with the signing solution provider. We do not store CPR numbers. The proof of signature forms part of the signed agreement. We also record which customers and jobs we assign to the partner, objections from the partner, and when the agreement has been viewed or downloaded.

Purpose: to enter into and document the partner agreement, verify that the signatory represents the company, and be able to establish, exercise or defend legal claims, e.g. in the event of a dispute about customer protection.

Legal basis: Art. 6(1)(f) (legitimate interest): our legitimate interest in being able to document and enforce the agreement. For sole proprietorships, also Art. 6(1)(b) (contract).

3.4 The contact form

Data: name, e-mail address, telephone number, subject and the content of your message.

Purpose: to respond to your enquiry and follow up on it.

Legal basis: Art. 6(1)(f) (legitimate interest): our legitimate interest in responding to the enquiries we receive. If the enquiry leads to an order, a profile or a collaboration, we process the data as described above.

3.5 Administrators

Data: name, e-mail address, login details, two-factor authentication details, user role and a log of important actions in the system, e.g. who changed what and when.

Purpose: to provide secure access to the administration system, manage permissions and be able to document and investigate changes and security incidents.

Legal basis: Art. 6(1)(f) (legitimate interest): our legitimate interest in protecting the system and the personal data it contains.

3.6 Accounts for workers, partners and customers

Data: your e-mail address, an encrypted version of your password (we cannot see it), the time of creation and latest login, and which profiles, orders and requests the account is linked to.

Purpose: to give you access to My account (Min konto), where you can view and correct your own data, upload documents and follow the status of your cases.

Legal basis: Art. 6(1)(b) (contract): the account is necessary to provide the service you have requested.

You can delete your account yourself at any time under My account.

3.7 Visits to the website

When you visit the website, our hosting provider processes technical data such as IP address, browser type, time and the page you visit. This is necessary to provide the website and protect it against misuse.

When you submit a form, Cloudflare Turnstile checks that it has been completed by a human and not by an automated program. For this purpose, technical data about your browser and your connection is processed, including your IP address.

We measure traffic on the website with Plausible, which does not use cookies and does not store your IP address. We only see aggregate figures, e.g. the number of visits and which pages are read, and we cannot see who you are.

Legal basis: Art. 6(1)(f) (legitimate interest): our legitimate interest in running a secure website, protecting the forms against spam and understanding how the website is used.

4. Where the data comes from

As a general rule, the data comes from you. In addition, we may receive data from:

• the company you work for, e.g. when a customer or partner gives your details as contact person or sends data about you as a worker
• public registers, e.g. the Central Business Register (CVR-registret), when we check a company
• referees whom you have given us permission to contact

5. Recipients and data processors

Data processors

We use suppliers that process personal data on our behalf and according to our instructions. We enter into data processing agreements with them.

• Vercel: hosting of the website and the system
• Supabase: database and file storage on servers in the EU
• Idura (formerly Criipto): digital signing of partner agreements with MitID
• Resend: sending e-mails from the website and the system
• Cloudflare Turnstile: spam protection of forms
• Plausible: cookie-free visitor statistics

Other recipients

We only disclose personal data when it is necessary:

• Customers: When you, as a job seeker, are proposed for or assigned to a job, the customer receives the information that is relevant to the job, e.g. name, experience, certificates and CV. This is done by agreement with you.
• Partners: When a partner is to carry out a job, the partner receives the information about the job and the customer's contact person that is necessary to carry it out.
• Authorities and advisers: e.g. the Danish Tax Agency, our auditor or lawyer, when required by law or when necessary to establish, exercise or defend a legal claim.

We do not sell personal data.

Transfers to countries outside the EU/EEA

Our database and file storage are located on servers in the EU. However, some of our suppliers are established in, or use subcontractors in, countries outside the EU/EEA, e.g. the USA. If personal data is transferred to a country outside the EU/EEA, this is done on the basis of the European Commission's standard contractual clauses or an equivalent valid transfer basis, e.g. a decision by the European Commission that the recipient ensures an adequate level of protection. Contact us if you would like to know more about the transfer basis.

6. How long we keep the data

We only keep personal data for as long as is necessary for the purposes for which it was collected, or for as long as the law requires. After that, we delete or anonymise it.

• Candidate profiles: 24 months after the latest activity, e.g. when you have updated your profile or been in contact with us about a job.
• Information about jobs you have carried out through us: for as long as is necessary for pay, invoicing and accounting, and as a general rule 5 years after the end of the financial year to which the job relates.
• Orders that do not lead to an agreement: 12 months after the latest contact.
• Customer agreements, quotes and invoices: for as long as the Danish Bookkeeping Act requires, as a general rule 5 years from the end of the financial year to which the material relates. Other information about the customer's contact persons: 24 months after the collaboration has ended.
• Applications from partners that are not approved: 6 months after the decision.
• Approved partners: for as long as the collaboration lasts and 24 months thereafter, although longer for accounting records and signed partner agreements as described here.
• Signed partner agreements, proof of signature, assigned customers and jobs and the associated log: for as long as the collaboration lasts and 5 years after the end of the collaboration and the latest assigned job, so that the agreement can be documented in the event of a dispute. They are then deleted automatically.
• Enquiries via the contact form: 12 months after the enquiry has been closed.
• Accounts on My account: for as long as you have the account. You can delete it yourself.
• Administrator accounts: for as long as the user has access and 3 months thereafter. Log of administrative actions: 12 months.
• Technical logs at our hosting provider and spam protection: 30 days, unless they are needed to investigate a security incident.

7. How we protect your data

We have taken technical and organisational measures to protect your data against loss, misuse and unauthorised access:

• All traffic between your browser and the website is encrypted (HTTPS).
• Only staff with a work-related need have access to personal data, and access is controlled with roles and permissions.
• Administrators log in with two-factor authentication.
• Important administrative actions are logged.
• CVs and other uploaded documents are stored in closed file storage that is not publicly accessible.
• Signed partner agreements are locked: they can be neither changed nor deleted in the system, and any change can be detected using cryptographic fingerprints (SHA-256) and an audit log.
• The forms are protected against spam and misuse.
• Data is backed up regularly.

If a personal data breach nevertheless occurs, we will notify the Danish Data Protection Agency (Datatilsynet) and you when the rules require it.

8. Your rights

Under the General Data Protection Regulation, you have a number of rights:

• Right of access: You can find out what data we process about you and obtain a copy of it.
• Right to rectification: You can have incorrect data corrected.
• Right to erasure: In certain cases, you can have data erased before our ordinary erasure takes place.
• Right to restriction of processing: In certain cases, you can have the processing restricted, so that as a general rule we may only store the data.
• Right to data portability: In certain cases, you can receive the data you have provided to us yourself in a structured, commonly used and machine-readable format.
• Right to object: You can object to processing carried out on the basis of our legitimate interest.
• Right to withdraw your consent: If you have given your consent, you can withdraw it at any time. This does not affect the lawfulness of the processing carried out before you withdrew your consent.

You exercise your rights by writing to kontakt@bemandix.dk. We will respond without undue delay and no later than within one month. If your request is particularly extensive, the time limit may be extended, and you will then be told why.

Your rights may be limited by other legislation, e.g. when we must retain accounting records under the Danish Bookkeeping Act. You can read more about your rights on the Danish Data Protection Agency's website.

9. Complaints to the Danish Data Protection Agency

If you are dissatisfied with the way we process your personal data, you can lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk.

However, we would like the opportunity to resolve the matter with you first, so please feel free to contact us at kontakt@bemandix.dk.

10. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling.

11. Cookies

Read about our use of cookies on the page about cookies.

12. Changes to the policy

We update the policy when there are changes to our processing of personal data. The latest version can always be found on this page, and the date at the top shows when it was last updated.