This privacy policy applies to our processing of personal data and sets out guidelines for s360’s processing of your personal data and provides you with the information you are entitled to receive under applicable data protection legislation. You should read this privacy policy before you provide your personal data to us.
1
This privacy policy covers all entities in the s360 group. For each processing activity below, it is specified which s360 entity is the controller of the processing of your personal data.
The contact information for the different s360 entities (collectively referred to as “s360”) is:
• s360 A/S
Address: Marianne Thomsens Gade 2F, 4., 8000 Aarhus, Denmark
Business reg. no.: 34052697
Email address: contact@s360digital.com
• s360 Norge AS
Address: Calmeyers Gate 12, 0183 Oslo, Norway
Business reg. no.: 995 282 151
Email address: contact@s360digital.com
• search360 OY
Address: Kanavaranta 5 C 15, 00160 Helsinki, Finland
Business reg. no.: 2937883-2
Email address: contact@s360digital.com
• s360 AB
Address: Skeppsbron 38, 111 30 Stockholm, Sweden
Business reg. no.: 556992-7360
Email address: contact@s360digital.com
• s360 Digital NL B.V
Address: Sarphatistraat 10, 1017 WS Amsterdam, The Netherlands
Business reg. no.: 88425975
Email address: contact@s360digital.com
• s360 Digital UK Ltd.
Address: 52-54 Southwark Street, London SE1 1UN, England
Business reg. no.: 07298635
Email address: contact@s360digital.com
• s360 DIGITAL CONSULTANCY, S.L.
Address: MARE NOSTRUM, 15-08039 Barcelona, Spain
Business reg. no.: 38.123.874-V
Email address: contact@s360digital.com
• s360 Digital Doo Beograd-Stari Grad
Address: 30 Makedonska Street, floor nr. 4, Belgrade (Stari Grad), 11000 Belgrade, Serbia
Business reg. no.: 2210010
Email address: contact@s360digital.com
If you are unsure of who the controller of the processing of your personal data is, you may contact us at contact@s360digital.com for assistance.
2
2.1 Cookies
When you visit our website, we use cookies as described in our cookie banner. s360 A/S is the controller for the processing of your personal data in this regard.
Types of personal data
s360 uses cookies on the website www.s360digital.com and, in that connection, processes your personal data. s360 may collect the following personal data about you when you visit our website:
• Online identifiers such as IP address, user ID and cookie ID
• Device information such as MAC address, operating system, browser and browsing history
• Information about your use of our website, including click behavior and timestamps
We use cookies to collect the above personal data. You can read more about the use of cookies in our cookie policy, which you can find via the round cookie icon in the lower-left corner.
Purposes of processing
Your personal data may be processed for the following purposes:
• Marketing of our brand and services
• Remembering your choices and making the website’s functionalities available to you
• Service development, including improving performance of our website
• Making our website available to you and ensuring a sufficient level of security on the site
Legal basis
s360 processes your personal data on the following bases:
• Legitimate interests: We base the processing of your personal data collected by use of necessary cookies on our legitimate interests in making our website available to our visitors and ensuring that the website stays secure and works properly (GDPR Article 6(1)(f)).
• Consent: When you visit our website, we ask for your informed consent to place cookies that are not necessary cookies (GDPR Article 6(1)(a)). You have the right to withdraw your consent at any time by changing your cookie settings, deleting cookies and contacting us. You can read more about how to change your cookie settings in our cookie policy, available via the round cookie icon in the lower-left corner.
Retention period
Cookies are deleted in accordance with our cookie policy, which is available via the round cookie icon in the lower-left corner. Personal data collected through the use of cookies is kept for up to two years. However, information may be stored for a longer period in anonymized form.
Categories of recipients
We may share your personal data with the following categories of recipients:
• Processors who provide cookies to support the maintenance and functionalities on our website, including the cookie banner.
• Processors who provide cookies and IT systems for marketing purposes and/or statistical purposes.
• Third parties if you have accepted third party cookies (GDPR Article 6(1)(a)). You can see which third parties we share your personal data with in our cookie banner.
Please also refer to section 8 below.
2.2 If you use the website contact form or otherwise contact us
When you use our website contact form or otherwise contact us, we collect and process your personal data. s360 A/S is the controller for the collection of your personal data through the website and general email address and shares your personal data, including your inquiry, with other s360 entities, which are each controllers for their processing of your personal data. Section 2.2 describes the processing of your personal data by s360 in this regard.
Types of personal data
When you use the contact form on the website www.s360digital.com, or otherwise contact us, s360 collects and processes your personal data. s360 collects, processes, and stores the following types of personal data about you:
• Name, email address, telephone number
• The subject of your inquiry
• The date of your inquiry
• Other information you provide in connection with your inquiry. We encourage you not to submit sensitive personal data to us.
Purposes of processing
Your personal data will be processed for the following purposes:
• Handling your inquiry
• Communication with you
• Statistics and analysis to improve our services
Legal basis
s360 processes your personal data on the basis set out below. The basis depends on the nature of your inquiry.
• Legitimate interests: We may process your personal data based on our legitimate interests in handling your inquiry, communicating with you, and developing our services (GDPR Article 6(1)(f)).
• Contractual obligations: If your inquiry relates to (potential) contract formation, we process your information in order to take steps prior to entering into a contract (GDPR Article 6(1)(b)).
Retention period
Your personal data will be stored for 1 year. However, information may be stored for a longer period in anonymized form.
If you are a customer or are employed by one of our customers, suppliers, or other partners, please refer to section 5 below.
Categories of recipients
We may share your personal data with the following categories of recipients:
• Processors who provide IT systems for communication and/or statistical purposes.
• Other s360 entities to provide you with the best possible support and answer to your inquiry (GDPR Article 6(1)(f)).
Please also refer to section 8 below.
3
When you subscribe to our newsletter, we collect and process your personal data. s360 A/S is the controller for the collection and processing of your personal data in connection with s360’s general newsletters. s360 A/S also shares your personal data with other s360 entities which are each controllers for their processing of your personal data, to enable other s360 entities to send out local newsletters. This section 3 describes the processing of your personal data by s360 in this regard.
Types of personal data
s360 collects, processes, and stores your personal data for marketing purposes when you subscribe to the newsletter. s360 may collect, process, and store the following types of personal data about you:
• Name and email address
• Your consent
• Your click behaviour regarding the material sent
• Company
• Relationship with s360
• The type of company you work for
Purposes of processing
Your personal data may be processed for the following purposes:
• Promotion of our brand and services
• Analysis and statistics to improve our marketing strategy
• Documenting your consent
Legal basis
s360 processes your personal data on one or more of the following bases:
• Consent: s360 will only use your personal data for direct marketing, including sending newsletters and improving our marketing, if you have given your prior and explicit consent (GDPR Article 6(1)(a)).
• Legitimate interests: We base the processing of your personal data for documentation of your consent on the basis of our legitimate interest in being able to defend ourselves against any claims, complaints or inspections (GDPR Article 6(1)(f)).
Retention period
Your personal data will be stored as long as your consent to receive newsletters is active.
You can always withdraw your consent by clicking the unsubscribe link at the bottom of each email or by contacting us as described below. Withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.
We store documentation of your marketing consent for two years from the date you withdrew your consent to receive direct marketing materials.
Information may also be stored for a longer period in anonymized form.
Categories of recipients
We may share your personal data with the following categories of recipients:
• Processors who provide IT systems for marketing, newsletters and/or statistical purposes.
• Other s360 entities to provide you with local newsletters (GDPR Article 6(1)(f)).
Please also refer to section 8 below.
4
When you apply for a job at s360, we process your personal data in connection with the recruitment process. We recommend that your application does not contain your national ID number or sensitive personal data, such as data revealing racial or ethnic origin, religion, trade union membership, sexuality, or health information.
s360 A/S is the controller for the collection of your personal data when you apply for a job at s360 and shares your personal data with the s360 entity which you have applied for a job with. s360 A/S and the s360 entity which you have applied for a job with are each controllers for their processing of your personal data in this regard. This section 4 describes the processing of your personal data by s360 in connection with the recruitment process.
Types of personal data
s360 may collect, process, and store the following types of personal data about you:
• Contact details such as name, email address, and telephone number
• Which languages you speak
• If you have a legal right to work in the country we are recruiting for
• Your preferred ways of working (remote or in the office)
• Information contained in your application, CV, and any attachments
• Relevant information publicly available on the internet and social media, particularly information about previous employment, activities, skills, performance, and general presentation
• Results of personality tests, if you take such tests
• Results from completed case assignments
• Criminal record, if necessary for the position you have applied for
• References from previous and/or current employers that you have listed in your application, or for whom you have given consent for us to contact
• Other information you provide to us in connection with the recruitment process
Purpose of processing
Your personal data will be used to assess whether we wish to offer you a position at s360.
Legal basis
s360 processes your personal data on one or more of the following bases:
• Legitimate interests: We process your personal data based on our legitimate interest in assessing whether we wish to offer you employment, including based on the information you provide in your CV, application, and any attachments; on relevant information publicly available on the internet and social media; on the results of personality tests; on references from referees you have listed in your application or otherwise provides us with; and on other information you provide to us in connection with the recruitment process. Processing may also be necessary for our legitimate interest in establishing, exercising, or defending legal claims (GDPR Article 6(1)(f)).
• Consent: We may process your personal data in order to contact you for future positions if you have provided your consent to this (GDPR Article 6(1)(a)). You may withdraw your consent at any time by contact us as stated above.
• We may also, where permitted by law, request to see your criminal record as part of our assessment. In such bases, we process the information on the basis of our legitimate interests in ensuring that you are fit for the position and in accordance with local legislation (GDPR Article 6(1)(f) and Article 10).
Retention period
If you are offered a position at s360, your application and any additional relevant personal data collected during the recruitment procedure will be stored in your personnel file with us.
If you are not offered a position, we will store your application and any additional personal data collected during the recruitment procedure for a period of 24 months after our rejection, unless you have given your consent to longer storage of such personal data. If you have applied for a job with s360 in Denmark, Spain or UK, your personal data may be retained for up to 12 months after our rejection. If you apply for a job in Serbia, your personal data may be retained for up to 3 years after our rejection.
Criminal records are deleted immediately after we have reviewed them.
Categories of recipients
We may share your personal data with the following categories of recipients:
• Processors who provide IT systems for recruitment, including personality tests.
• External recruiters and headhunters. Such recruiters and headhunters may act as processors or independent controllers.
• The s360 entity you apply for a job with (GDPR Article 6(1)(f)).
Please also refer to section 8 below.
5
This section contains the policy for s360’s processing of personal data about sole proprietors or contact persons at customers, suppliers, and other business partners who collaborate with s360.
The s360 entity with which you cooperate is the controller for their processing of your personal data in this regard.
Collection of personal data
s360 may collect, process, and store your personal data in the following cases:
• When your company, or the company you work for, enters into an agreement with s360
• When you have shown interest in s360’s products and services, e.g., by giving s360 your business card
• When you collaborate and communicate with s360
Types of personal data
s360 may collect, process, and store the following types of personal data about you:
• Name, email address, telephone number, and similar contact details
• Individual details, e.g., preferred language
• Organizational information such as company name and address, job title, area of employment, primary place, and country of work
• Contractual information, such as orders, invoices, contracts, and other agreements between your company (or your employer) and s360 that may contain, for example, your contact details
• Financial information, such as payment terms and bank details (if you are a sole proprietor)
We may receive such information directly from you (primarily through emails and other correspondence with you) or from a third party such as your employer.
Purposes of processing
Your personal data may be processed for the following purposes:
• General planning, performance, and administration of collaborations, including contracts
• Administration, such as processing payments, bookkeeping, auditing, as well as providing support
• Newsletters and other marketing communications
• Handling requests from you
• General communication
• Product and service development
• Statistics and analysis to improve our services
• Compliance with applicable laws and regulations, e.g. under applicable bookkeeping legislation
• Handling disputes
Legal basis
s360 primarily processes your personal data on one or more of the following bases:
• Contractual obligations: If you are the owner of a sole proprietorship, the processing your personal data may be necessary for the performance of a contract with you (GDPR Article 6(1)(b)).
• Legitimate interests: We may process your personal data based on our legitimate interests, e.g., in managing day-to-day operations in accordance with lawful and fair business practices, including planning, carrying out, and administering the collaboration, or our legitimate interest in, for example, carrying out statistics, analyses, marketing activities (where consent is not required), providing support, as well as improving and developing our products and services. Processing may also be necessary for our legitimate interest in preventing fraud or in establishing, exercising, or defending legal claims (GDPR Article 6(1)(f)).
• Legal obligation: Processing your personal data may, in some cases, be necessary to comply with legal obligations, such as our obligation to keep bookkeeping material (GDPR Article 6(1)(c)).
Retention period
The retention period varies across s360 entities:
• Denmark, Sweden, Finland and Serbia: Your personal data will be stored for 3 years from the end of the collaboration.
• Norway: Your personal data will be stored for up to 3,5 years from the end of the collaboration
• UK: Your personal data will be stored for up to 6 years from the end of the collaboration
• Spain: Your personal data will be stored for up to 5 years from the end of the collaboration
• In case of non-payment, your personal data is kept until your debt has been paid or for as long as we have a basis for enforcement of our receivable.
Personal data contained in bookkeeping material is kept in accordance with statutory retention periods in local bookkeeping legislation:
• Denmark and Norway: 5 years from the end of the financial year which the material concerns
• Sweden: 7 years from the end of the financial year which the material concerns
• Finland and Serbia: 10 years from the end of the financial year which the material concerns
• UK: 6 years from the end of the financial year which the material concerns
• Spain: 6 years.
• However, information may be stored for a longer period in anonymized form.
Categories of recipients
We may share your personal data with the following categories of recipients:
• Processors who provide IT systems for customer relationship management, communication, financial administration etc.
• Other s360 entities if relevant to provide you the best possible service (GDPR Article 6(1)(f)).
• Debt collectors in case of non-payment (GDPR Article 6(1)(f)).
• Legal advisors in case of a dispute (GDPR Article 6(1)(f)).
Please also refer to section 8 below.
6
This section contains the policy for s360’s processing of personal data collected via s360’s profiles or pages on social media.
S360 A/S is the controller for personal data processed in connection with direct messages received from you, as well as comments and interactions you leave on our profiles and posts.
s360 A/S and the providers of the social media platforms are joint controllers for the advertisement activities, which entail processing of personal data collected in connection with your visit to s360’s profile or page on the respective social media platform. s360 complies with the Danish Data Protection Agency’s guidelines on joint controllership and seeks, using available tools and means, to ensure as far as possible that you receive information about the processing of your personal data when you visit s360’s profiles or pages on social media.
s360 has profiles or pages on the following social media:
• Facebook (Meta Platforms Ireland Ltd.)
Facebook’s privacy policy is available here
You can adjust your privacy settings on Facebook here
• LinkedIn (LinkedIn Ireland Unlimited Company)
LinkedIn’s privacy policy is available here
You can adjust your privacy settings on LinkedIn here
• Instagram (Meta Platforms Ireland Ltd.)
Instagram’s privacy policy is available here
You can adjust your privacy settings on Instagram here
Collection of personal data
When you visit or interact with our social media profiles, s360 and the provider of the relevant social media platform may collect, process, and store the following types of personal data about you:
• Information available on your profile, including your name, gender, marital status, workplace, interests, and your city
• Whether you “like” or have used other reactions on our profile
• Comments you leave on our posts
• That you have visited our profile
• IP address and other online identifiers
Purposes of processing
s360 processes your personal data for the following purposes:
• Improving our products and services, including our social media profiles and pages
• Statistics and analysis
• To communicate with you if you comment on a post, leave a review, or send us a message
• General marketing
The providers of the social media platforms process, among other things, your personal data for the following purposes:
• Improving their advertising systems
• Providing s360 with statistics, which the social media providers prepare, among other things, on the basis of your visit to our profiles and pages
• Advertising and customization of activities on the page
Legal basis
The processing of your personal data is based on the following legal bases:
• Legitimate interests: s360 bases the processing of your personal data on our legitimate interests in being able to communicate with you and market ourselves to you on our social media profiles, as well as our legitimate interest in improving our products and services (GDPR Article 6(1)(f)). The social media providers base the processing of your personal data on their legitimate interests, including their interest in improving their advertising systems and providing statistics to s360, which the provider of the social media platform prepares, for example, on the basis of your visit to s360’s profile or page on the social media platform. In addition, the social media providers have a legitimate interest in providing an innovative, individually tailored, secure, and profitable service (GDPR Article 6(1)(f)).
• Consent: The social media providers process certain of your personal data in accordance with your consent, which you can withdraw at any time via your privacy settings on the social media platform (GDPR Article 6(1)(a)).
Retention period
Your direct messages to us will be stored for 1 year. If you no longer want your likes, comments, and reviews to appear on our social media profiles or pages, you must delete this information yourself. However, information may be stored for a longer period in anonymized form.
Please see the privacy policy of the respective social media provider for information on how long they store your personal data.
Categories of recipients
In connection with our social media profiles we share your personal data with the provider of the social media in question.
The social media providers may share your personal data with, among others, the following categories of recipients:
• Other entities within the group to which the social media provider belongs
• External partners that provide analytics and research services
• Advertisers
• Other individuals who visit our profile or page on the social media platform (to the extent your information is publicly available)
• Researchers and other academics
You can find more information about with whom the social media providers share your personal data in each provider’s privacy policy.
The social media providers may transfer your personal data to recipients outside the EU/EEA in accordance with applicable data protection legislation. You can read more in each provider’s privacy policy.
You can read more about with whom s360 shares your personal data in section 8 below.
7
When you register for our events, we collect and process your personal data. s360 A/S is the controller for the collection of your personal data through the registration form and shares your personal data with other s360 entities, which are each controllers for their processing of your personal data. Section 7 describes the processing of your personal data by s360 in this regard.
Types of personal data
When you register for an event, we process your personal data. s360 may collect, process, and store the following types of personal data about you:
• Name, email address, telephone number
• Company
• Payment information if you register for a paid event
• Which events you register for and attend
• Whether you subscribe to our newsletter (for information about our processing of your personal data in relation to our newsletters, please refer to section 3 above)
Purpose of processing
s360 processes your personal data for the following purposes:
• Administration of the event
• Completion of your registration
• Communication with you regarding the event, and thereafter for the purpose of sending relevant material from events
• Statistics and analytics with a view to improve our services
• Documentation of your registration and payment
Legal basis
s360 processes your personal data on one or more of the following bases:
• Contractual obligations: For paid events, the processing is necessary to perform our agreement with you regarding your participation in the event (GDPR Article 6(1)(b)).
• Legitimate interests: s360 bases the processing of your personal data on our legitimate interests in communicating with you regarding the event in question, including sending relevant material from the event afterwards, our legitimate interest in improving our services, as well as our legitimate interest in keeping track of participants for events that do not require payment (GDPR Article 6(1)(f)).
• Legal obligation: Processing your personal data may, in some cases, be necessary to comply with legal obligations, such as our obligation to keep bookkeeping material (GDPR Article 6(1)(c)).
Retention period
Your personal data will be stored for 2 years from your participation.
Personal data contained in bookkeeping material is kept in accordance with statutory retention periods in local bookkeeping legislation:
• Denmark and Norway: 5 years from the end of the financial year which the material concerns
• Sweden: 7 years from the end of the financial year which the material concerns
• Finland and Serbia: 10 years from the end of the financial year which the material concerns
• UK: 6 years from the end of the financial year which the material concerns
• Spain: 6 years.
Categories of recipients
We may share your personal data with the following categories of recipients:
• Processors who provide IT systems for customer relationship management, communication, financial administration, event planning etc.
• Other s360 entities (GDPR Article 6(1)(f)).
Please also refer to section 8 below.
8
As described under each processing activity above, s360 may grant third parties who act as processors access to your personal data. Such processors will only process your personal data in accordance with our instructions under concluded data processing agreements.
In connection with s360’s development, the company structure may change, e.g., by a partial or complete sale of the company. In the event of a partial transfer of assets that include personal data, the legal basis for the related disclosure of personal data will, as a rule, be GDPR Article 6(1)(f), as s360 has a legitimate interest in transferring parts of its assets and in making commercial changes.
Furthermore, in certain circumstances, it may be necessary to disclose your personal data to:
• The police
• Lawyers
• Auditors
• Courts
• Public authorities
• Potential buyers
As described above, personal data may be shared with other entities in the s360 group. This includes our entity in Serbia. Such transfers are subject to the EU Commission’s standard contractual clauses, which you may request a copy of.
In addition to this, s360 relies on certain processors and sub-processors in third countries that do not have an adequate level of protection. Such transfers will be based on the EU Commission’s standard contractual clauses which you may obtain a copy of by contacting us as described in section 1 above.
9
• You have the right to access the personal data we process about you.
• You have the right to object to our collection and further processing of your personal data.
• You have the right to rectification and deletion of your personal data, subject to certain statutory exceptions, including local bookkeeping legislation.
• You have the right to request that we restrict the processing of your personal data.
• In certain circumstances, you may also request to receive a copy of your personal data and to have the personal data you have provided to us transmitted to another data controller (data portability).
• You may withdraw any consent(s) you have given at any time. We will then delete your personal data unless we can continue processing on another basis. You can unsubscribe from our newsletter by clicking the link at the bottom of the newsletter.
10
If you have questions about this privacy policy or if you wish to complain about the way we process your personal data, you are welcome to contact us as described in section 1 above.
Index
Data controller and contact details
1
If you visit the website
2
If you subscribe to our newsletter
3
If you apply for a job at s360
4
If you are a customer, supplier, business partner, etc.
5
If you visit our social media profiles
6
If you register for our events
7
Disclosure to other controllers and engagement of processors
8
Your rights
9
Questions and complaints
10