We receive information directly from you or through clients, employers, project owners, suppliers, advisers and authorised project data rooms. Where relevant, we may also consult public registers, official publications and other lawfully accessible professional sources.

Please provide only information relevant to your enquiry or engagement. Do not send sensitive personal information, identification documents or confidential project files through an ordinary website enquiry unless suitable arrangements have been agreed with CEP.

3. Why we process information

Where CEP acts as a data controller, we process personal data for the following purposes:

A contract with a corporate client does not automatically provide a contractual legal basis for processing its employees’ personal data.

We assess the necessity and proportionality of processing based on legitimate interests. Special-category information and criminal-record information require additional legal conditions and safeguards.

Providing information is generally voluntary. However, we may be unable to respond or provide an agreed service without the information necessary for that purpose.

Visiting this website does not constitute consent to marketing, non-essential tracking or the submission of personal data to external AI services.

4. CEP’s role in project engagements

CEP is a data controller for its own business administration, client relationships and legal obligations. For project information, our role depends on the engagement. Where CEP processes personal data solely on a client’s documented instructions, CEP acts as a data processor under a data processing agreement. Where CEP independently determines why and how information is processed, CEP may act as an independent controller. The actual activities determine these roles. Engagement documents record the applicable responsibilities, confidentiality requirements and processing arrangements. Where CEP acts as a processor, we assist the client controller with relevant privacy requests and other applicable obligations.

5. Due Diligence with AI assistance

CEP’s proposed AI-assisted workflow combines controlled information preparation, AI-supported analysis and human subject-matter expert review. Its use and the permitted data-handling arrangements are established for the relevant engagement. The process comprises seven stages:

Identity protection

Replacing names is pseudonymisation, not a guarantee of anonymity. Individuals or projects may remain identifiable from contextual information. Where CEP can reconnect information to an individual, we continue to protect it as personal data. We do not assume that using aliases removes confidentiality requirements or data protection obligations.

External AI services

Before project material is released to an external AI service, the applicable arrangements must address confidentiality, processing roles, permitted use, retention, access, subprocessors and international transfers. Where required, client authorisation and a data processing agreement must be in place. The intended standard for this workflow is to use service arrangements that prohibit client project content from being used to train or improve general-purpose models. A provider’s brand name alone does not establish that protection. The actual product, contractual terms and configuration must be assessed. Where the necessary safeguards cannot be established, the affected material must remain within the approved environment or be reviewed through another agreed method. The informational pages on this website do not, by themselves, submit project documents to external AI providers.

Human responsibility

AI can produce inaccurate, incomplete or unsupported output. Human validation is therefore an essential part of the proposed service. The workflow is not intended to make solely automated decisions about individuals that produce legal or similarly significant effects. The investor remains responsible for the investment decision.

6. Who may receive information

Where necessary and lawful, information may be shared with:

Access is limited according to the purpose and responsibilities of the recipient. Appropriate confidentiality and data processing arrangements apply where required.

Information about relevant recipients and engagement-specific AI arrangements can be requested using the contact details above.

7. International transfers

Some service providers may process information outside the European Economic Area, including through remote support access.

Where GDPR international-transfer requirements apply, transfers must be supported by an applicable mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with any required assessment and supplementary safeguards.

EU hosting alone does not establish that all processing remains within the EEA. Pseudonymisation and client permission do not replace a legally required transfer mechanism.

You may contact us for information about relevant transfer safeguards and how to obtain a copy, subject to the protection of confidential information and other individuals’ rights.

8. Retention

We retain personal data only for as long as needed for its purpose or an applicable legal requirement.

The relevant period depends on the information, the engagement, documented client instructions, contractual obligations and any justified need to establish or defend claims.

External-provider retention and backup arrangements must be considered when selecting and configuring services. Relevant information may be retained longer where necessary for a specific dispute, investigation or legal obligation.

9. Security

We apply technical and organisational measures appropriate to the information and the risks associated with its processing. Project-specific measures are determined by the engagement and may include restricted access, confidentiality obligations, secure transfer arrangements, separation of identity keys and controlled release of information.

No electronic system or transmission method is completely risk-free. Where a personal data breach occurs, CEP will assess the incident and notify relevant parties where required by law.

10. Cookies and similar technologies

Cookies and similar technologies may store information on, or access information from, your device. They can support essential functions, remember preferences or enable optional analytics, embedded content and advertising.

Strictly necessary technologies may be used without cookie consent where permitted by law. Non-essential technologies require prior consent.

Where optional technologies are offered, the consent interface must identify their purposes and provide the applicable provider and duration information before activation. You must be able to reject optional technologies and withdraw consent as easily as it was given.

Your browser also provides controls to delete or block cookies. Blocking necessary technologies may affect functions you request. Browser controls do not replace CEP’s obligation to obtain consent where required.

For questions about technologies used on this website or assistance with your choices, contact info@copenhagenenergypartners.dk.

11. Your rights

Depending on the circumstances and applicable legal conditions, you may have the right to:

You may object to processing for direct marketing at any time. To exercise your rights, contact info@copenhagenenergypartners.dk. We may request proportionate information to verify your identity.

We normally respond within one month. If a permitted extension is necessary, we will explain this within the initial month. Where a request cannot be fulfilled, we will explain the applicable reason and available remedies.

You may complain to the Danish Data Protection Agency, Datatilsynet, at www.datatilsynet.dk, or another competent supervisory authority. You do not need to contact CEP first.

Where we obtain personal data from another source, we provide the information required by law within the applicable time limits unless a specific lawful exception applies. Publishing this policy does not replace any required individual notification.

12. Confidentiality and engagement terms

Project-specific confidentiality agreements, engagement terms and data processing agreements apply alongside this policy.

This policy does not expand the scope of an engagement, permit otherwise prohibited disclosures or limit statutory data protection rights. It does not constitute investment advice, a guarantee of project outcomes or acceptance of a limitation of liability.

13. Changes to this policy

We may update this policy to reflect changes in our activities, services or legal obligations. The date above identifies the current version.

Where required, we will provide additional information or obtain consent before implementing a relevant change.

An update does not retrospectively authorise unrelated use of personal data.