Privacy Policy.

1. Data controller

Copenhagen Management Consulting Club ("CPH MCC", "we", "us") is the data controller for personal data processed through this website. You can reach us at privacy@cphmcc.com.

2. What we collect and why

• Account & membership: name, email, university, member type. Used to manage your membership. Legal basis: contract (Art. 6(1)(b) GDPR).
• CV submissions: name, email, university, uploaded CV file. Shared only with vetted Partner firms who log in to the CV database. Legal basis: consent (Art. 6(1)(a) GDPR), withdrawable at any time.
• Event RSVPs: your user ID and the event you signed up for. Legal basis: contract.
• Membership applications: the information you enter into the application form. Legal basis: contract / pre-contractual measures.
• Authentication logs: IP address and timestamps kept by our auth provider for security. Legal basis: legitimate interest in preventing abuse.

3. Retention

• Membership account data: kept while your account is active and up to 12 months after inactivity, then deleted.
• CV submissions: kept for up to 12 months after upload, then deleted. You may request earlier deletion.
• Membership applications (declined): deleted within 6 months of the decision.
• Event RSVPs: deleted 12 months after the event.

4. Who we share data with (processors)

• Lovable Cloud (Supabase) — hosting, database, authentication and file storage. Data is stored in the EU.
• Partner firms — access to CV submissions only, under a confidentiality arrangement.

We do not sell your data and we do not use it for advertising.

5. International transfers

Our infrastructure is hosted in the EU. If a processor ever transfers data outside the EEA, we rely on the European Commission's Standard Contractual Clauses.

6. Your rights

Under the GDPR you have the right to:

• Access the data we hold about you
• Have inaccurate data corrected
• Have your data deleted ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

Email privacy@cphmcc.com to exercise any of these rights. You can also lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.

7. Cookies

We use only essential cookies required for authentication and session management. No advertising, analytics or tracking cookies are set.

8. Security

Passwords are hashed by our auth provider and are never stored in plaintext. Access to personal data is restricted through role-based permissions and row-level security policies. Uploaded CV files are stored in a private bucket accessible only to admins and vetted partner firms.

9. Changes to this policy

We will post any material changes on this page and update the "last updated" date above.