Privacy policy

This privacy policy covers all entities in the s360 group. For each processing activity below, it is specified which s360 entity is the controller of the processing of your personal data.

The contact information for the different s360 entities (collectively referred to as “s360”) is:

• s360 A/S
  Address: Marianne Thomsens Gade 2F, 4., 8000 Aarhus, Denmark
  Business reg. no.: 34052697
  Email address: [email protected]

• s360 Norge AS
  Address: Elisabeth von Hübschs gate 6, 1534 Moss, Norway
  Business reg. no.: 995 282 151
  Email address: [email protected]

• search360 OY
  Address: Kanavaranta 5 C 15, 00160 Helsinki, Finland
  Business reg. no.: 2937883-2
  Email address: [email protected]

• s360 AB
  Address: Skeppsbron 38, 111 30 Stockholm, Sweden
  Business reg. no.: 556992-7360
  Email address: [email protected]

• s360 Digital NL B.V
  Address: Sarphatistraat 10, 1017 WS Amsterdam, The Netherlands
  Business reg. no.: 88425975
  Email address: [email protected]

• s360 Digital UK Ltd.
  Address: 52-54 Southwark Street, London SE1 1UN, England
  Business reg. no.: 07298635
  Email address: [email protected]

• s360 DIGITAL CONSULTANCY, S.L.
  Address: MARE NOSTRUM, 15-08039 Barcelona, Spain
  Business reg. no.: 38.123.874-V
  Email address: [email protected]

• s360 Digital Doo Beograd-Stari Grad
  Address: 30 Makedonska Street, floor nr. 4, Belgrade (Stari Grad), 11000 Belgrade, Serbia
  Business reg. no.: 2210010
  Email address: [email protected]

If you are unsure of who the controller of the processing of your personal data is, you may contact us at [email protected] for assistance.

When you subscribe to our newsletter, we collect and process your personal data. s360 A/S is the controller for the collection and processing of your personal data in connection with s360’s general newsletters. s360 A/S also shares your personal data with other s360 entities which are each controllers for their processing of your personal data, to enable other s360 entities to send out local newsletters. This section 3 describes the processing of your personal data by s360 in this regard.

Types of personal data

s360 collects, processes, and stores your personal data for marketing purposes when you subscribe to the newsletter. s360 may collect, process, and store the following types of personal data about you:

• Name and email address
• Your consent
• Your click behaviour regarding the material sent
• Company
• Relationship with s360
• The type of company you work for

Purposes of processing

Your personal data may be processed for the following purposes:

• Promotion of our brand and services
• Analysis and statistics to improve our marketing strategy
• Documenting your consent

Legal basis

s360 processes your personal data on one or more of the following bases:

• Consent: s360 will only use your personal data for direct marketing, including sending newsletters and improving our marketing, if you have given your prior and explicit consent (GDPR Article 6(1)(a)).
• Legitimate interests: We base the processing of your personal data for documentation of your consent on the basis of our legitimate interest in being able to defend ourselves against any claims, complaints or inspections (GDPR Article 6(1)(f)).

Retention period

Your personal data will be stored as long as your consent to receive newsletters is active.

You can always withdraw your consent by clicking the unsubscribe link at the bottom of each email or by contacting us as described below. Withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.

We store documentation of your marketing consent for two years from the date you withdrew your consent to receive direct marketing materials.

Information may also be stored for a longer period in anonymized form.

Categories of recipients

We may share your personal data with the following categories of recipients:

• Processors who provide IT systems for marketing, newsletters and/or statistical purposes.
• Other s360 entities to provide you with local newsletters (GDPR Article 6(1)(f)).

Please also refer to section 8 below.

When you apply for a job at s360, we process your personal data in connection with the recruitment process. We recommend that your application does not contain your national ID number or sensitive personal data, such as data revealing racial or ethnic origin, religion, trade union membership, sexuality, or health information.

s360 A/S is the controller for the collection of your personal data when you apply for a job at s360 and shares your personal data with the s360 entity which you have applied for a job with. s360 A/S and the s360 entity which you have applied for a job with are each controllers for their processing of your personal data in this regard. This section 4 describes the processing of your personal data by s360 in connection with the recruitment process.

Types of personal data

s360 may collect, process, and store the following types of personal data about you:

• Contact details such as name, email address, and telephone number
• Which languages you speak
• If you have a legal right to work in the country we are recruiting for
• Your preferred ways of working (remote or in the office)
• Information contained in your application, CV, and any attachments
• Relevant information publicly available on the internet and social media, particularly information about previous employment, activities, skills, performance, and general presentation
• Results of personality tests, if you take such tests
• Results from completed case assignments
• Criminal record, if necessary for the position you have applied for
• References from previous and/or current employers that you have listed in your application, or for whom you have given consent for us to contact
• Other information you provide to us in connection with the recruitment process

Purpose of processing

Your personal data will be used to assess whether we wish to offer you a position at s360.

Legal basis

s360 processes your personal data on one or more of the following bases:

• Legitimate interests: We process your personal data based on our legitimate interest in assessing whether we wish to offer you employment, including based on the information you provide in your CV, application, and any attachments; on relevant information publicly available on the internet and social media; on the results of personality tests; on references from referees you have listed in your application or otherwise provides us with; and on other information you provide to us in connection with the recruitment process. Processing may also be necessary for our legitimate interest in establishing, exercising, or defending legal claims (GDPR Article 6(1)(f)).
• Consent: We may process your personal data in order to contact you for future positions if you have provided your consent to this (GDPR Article 6(1)(a)). You may withdraw your consent at any time by contact us as stated above.
• We may also, where permitted by law, request to see your criminal record as part of our assessment. In such bases, we process the information on the basis of our legitimate interests in ensuring that you are fit for the position and in accordance with local legislation (GDPR Article 6(1)(f) and Article 10).

Retention period

If you are offered a position at s360, your application and any additional relevant personal data collected during the recruitment procedure will be stored in your personnel file with us.

If you are not offered a position, we will store your application and any additional personal data collected during the recruitment procedure for a period of 24 months after our rejection, unless you have given your consent to longer storage of such personal data. If you have applied for a job with s360 in Denmark, Spain or UK, your personal data may be retained for up to 12 months after our rejection. If you apply for a job in Serbia, your personal data may be retained for up to 3 years after our rejection.

Criminal records are deleted immediately after we have reviewed them.

Categories of recipients

We may share your personal data with the following categories of recipients:

• Processors who provide IT systems for recruitment, including personality tests.
• External recruiters and headhunters. Such recruiters and headhunters may act as processors or independent controllers.
• The s360 entity you apply for a job with (GDPR Article 6(1)(f)).

Please also refer to section 8 below.

This section contains the policy for s360’s processing of personal data about sole proprietors or contact persons at customers, suppliers, and other business partners who collaborate with s360.

The s360 entity with which you cooperate is the controller for their processing of your personal data in this regard.

Collection of personal data

s360 may collect, process, and store your personal data in the following cases:

• When your company, or the company you work for, enters into an agreement with s360
• When you have shown interest in s360’s products and services, e.g., by giving s360 your business card
• When you collaborate and communicate with s360

Types of personal data

s360 may collect, process, and store the following types of personal data about you:

• Name, email address, telephone number, and similar contact details
• Individual details, e.g., preferred language
• Organizational information such as company name and address, job title, area of employment, primary place, and country of work
• Contractual information, such as orders, invoices, contracts, and other agreements between your company (or your employer) and s360 that may contain, for example, your contact details
• Financial information, such as payment terms and bank details (if you are a sole proprietor)

We may receive such information directly from you (primarily through emails and other correspondence with you) or from a third party such as your employer.

Purposes of processing

Your personal data may be processed for the following purposes:

• General planning, performance, and administration of collaborations, including contracts
• Administration, such as processing payments, bookkeeping, auditing, as well as providing support
• Newsletters and other marketing communications
• Handling requests from you
• General communication
• Product and service development
• Statistics and analysis to improve our services
• Compliance with applicable laws and regulations, e.g. under applicable bookkeeping legislation
• Handling disputes

Legal basis

s360 primarily processes your personal data on one or more of the following bases:

• Contractual obligations: If you are the owner of a sole proprietorship, the processing your personal data may be necessary for the performance of a contract with you (GDPR Article 6(1)(b)).
• Legitimate interests: We may process your personal data based on our legitimate interests, e.g., in managing day-to-day operations in accordance with lawful and fair business practices, including planning, carrying out, and administering the collaboration, or our legitimate interest in, for example, carrying out statistics, analyses, marketing activities (where consent is not required), providing support, as well as improving and developing our products and services. Processing may also be necessary for our legitimate interest in preventing fraud or in establishing, exercising, or defending legal claims (GDPR Article 6(1)(f)).
• Legal obligation: Processing your personal data may, in some cases, be necessary to comply with legal obligations, such as our obligation to keep bookkeeping material (GDPR Article 6(1)(c)).

Retention period

The retention period varies across s360 entities:

• Denmark, Sweden, Finland and Serbia: Your personal data will be stored for 3 years from the end of the collaboration.
• Norway: Your personal data will be stored for up to 3,5 years from the end of the collaboration
• UK: Your personal data will be stored for up to 6 years from the end of the collaboration
• Spain: Your personal data will be stored for up to 5 years from the end of the collaboration
  • In case of non-payment, your personal data is kept until your debt has been paid or for as long as we have a basis for enforcement of our receivable.

Personal data contained in bookkeeping material is kept in accordance with statutory retention periods in local bookkeeping legislation:

• Denmark and Norway: 5 years from the end of the financial year which the material concerns
• Sweden: 7 years from the end of the financial year which the material concerns
• Finland and Serbia: 10 years from the end of the financial year which the material concerns
• UK: 6 years from the end of the financial year which the material concerns
• Spain: 6 years.
  • However, information may be stored for a longer period in anonymized form.

Categories of recipients

We may share your personal data with the following categories of recipients:

• Processors who provide IT systems for customer relationship management, communication, financial administration etc.
• Other s360 entities if relevant to provide you the best possible service (GDPR Article 6(1)(f)).
• Debt collectors in case of non-payment (GDPR Article 6(1)(f)).
• Legal advisors in case of a dispute (GDPR Article 6(1)(f)).

Please also refer to section 8 below.

This section contains the policy for s360’s processing of personal data collected via s360’s profiles or pages on social media.

S360 A/S is the controller for personal data processed in connection with direct messages received from you, as well as comments and interactions you leave on our profiles and posts.

s360 A/S and the providers of the social media platforms are joint controllers for the advertisement activities, which entail processing of personal data collected in connection with your visit to s360’s profile or page on the respective social media platform. s360 complies with the Danish Data Protection Agency’s guidelines on joint controllership and seeks, using available tools and means, to ensure as far as possible that you receive information about the processing of your personal data when you visit s360’s profiles or pages on social media.

s360 has profiles or pages on the following social media:

• Facebook (Meta Platforms Ireland Ltd.)
  Facebook’s privacy policy is available here
  You can adjust your privacy settings on Facebook here
• LinkedIn (LinkedIn Ireland Unlimited Company)
  LinkedIn’s privacy policy is available here
  You can adjust your privacy settings on LinkedIn here
• Instagram (Meta Platforms Ireland Ltd.)
  Instagram’s privacy policy is available here
  You can adjust your privacy settings on Instagram here

Collection of personal data

When you visit or interact with our social media profiles, s360 and the provider of the relevant social media platform may collect, process, and store the following types of personal data about you:

• Information available on your profile, including your name, gender, marital status, workplace, interests, and your city
• Whether you “like” or have used other reactions on our profile
• Comments you leave on our posts
• That you have visited our profile
• IP address and other online identifiers

Purposes of processing

s360 processes your personal data for the following purposes:

• Improving our products and services, including our social media profiles and pages
• Statistics and analysis
• To communicate with you if you comment on a post, leave a review, or send us a message
• General marketing

The providers of the social media platforms process, among other things, your personal data for the following purposes:

• Improving their advertising systems
• Providing s360 with statistics, which the social media providers prepare, among other things, on the basis of your visit to our profiles and pages
• Advertising and customization of activities on the page

Legal basis

The processing of your personal data is based on the following legal bases:

• Legitimate interests: s360 bases the processing of your personal data on our legitimate interests in being able to communicate with you and market ourselves to you on our social media profiles, as well as our legitimate interest in improving our products and services (GDPR Article 6(1)(f)). The social media providers base the processing of your personal data on their legitimate interests, including their interest in improving their advertising systems and providing statistics to s360, which the provider of the social media platform prepares, for example, on the basis of your visit to s360’s profile or page on the social media platform. In addition, the social media providers have a legitimate interest in providing an innovative, individually tailored, secure, and profitable service (GDPR Article 6(1)(f)).
• Consent: The social media providers process certain of your personal data in accordance with your consent, which you can withdraw at any time via your privacy settings on the social media platform (GDPR Article 6(1)(a)).

Retention period

Your direct messages to us will be stored for 1 year. If you no longer want your likes, comments, and reviews to appear on our social media profiles or pages, you must delete this information yourself. However, information may be stored for a longer period in anonymized form.

Please see the privacy policy of the respective social media provider for information on how long they store your personal data.

Categories of recipients

In connection with our social media profiles we share your personal data with the provider of the social media in question.

The social media providers may share your personal data with, among others, the following categories of recipients:

• Other entities within the group to which the social media provider belongs
• External partners that provide analytics and research services
• Advertisers
• Other individuals who visit our profile or page on the social media platform (to the extent your information is publicly available)
• Researchers and other academics

You can find more information about with whom the social media providers share your personal data in each provider’s privacy policy.

The social media providers may transfer your personal data to recipients outside the EU/EEA in accordance with applicable data protection legislation. You can read more in each provider’s privacy policy.

You can read more about with whom s360 shares your personal data in section 8 below.

When you register for our events, we collect and process your personal data. s360 A/S is the controller for the collection of your personal data through the registration form and shares your personal data with other s360 entities, which are each controllers for their processing of your personal data. Section 7 describes the processing of your personal data by s360 in this regard.

Types of personal data

When you register for an event, we process your personal data. s360 may collect, process, and store the following types of personal data about you:

• Name, email address, telephone number
• Company
• Payment information if you register for a paid event
• Which events you register for and attend
• Whether you subscribe to our newsletter (for information about our processing of your personal data in relation to our newsletters, please refer to section 3 above)

Purpose of processing

s360 processes your personal data for the following purposes:

• Administration of the event
• Completion of your registration
• Communication with you regarding the event, and thereafter for the purpose of sending relevant material from events
• Statistics and analytics with a view to improve our services
• Documentation of your registration and payment

Legal basis

s360 processes your personal data on one or more of the following bases:

• Contractual obligations: For paid events, the processing is necessary to perform our agreement with you regarding your participation in the event (GDPR Article 6(1)(b)).
• Legitimate interests: s360 bases the processing of your personal data on our legitimate interests in communicating with you regarding the event in question, including sending relevant material from the event afterwards, our legitimate interest in improving our services, as well as our legitimate interest in keeping track of participants for events that do not require payment (GDPR Article 6(1)(f)).
• Legal obligation: Processing your personal data may, in some cases, be necessary to comply with legal obligations, such as our obligation to keep bookkeeping material (GDPR Article 6(1)(c)).

Retention period

Your personal data will be stored for 2 years from your participation.

Personal data contained in bookkeeping material is kept in accordance with statutory retention periods in local bookkeeping legislation:

• Denmark and Norway: 5 years from the end of the financial year which the material concerns
• Sweden: 7 years from the end of the financial year which the material concerns
• Finland and Serbia: 10 years from the end of the financial year which the material concerns
• UK: 6 years from the end of the financial year which the material concerns
• Spain: 6 years.

Categories of recipients

We may share your personal data with the following categories of recipients:

• Processors who provide IT systems for customer relationship management, communication, financial administration, event planning etc.
• Other s360 entities (GDPR Article 6(1)(f)).

Please also refer to section 8 below.

As described under each processing activity above, s360 may grant third parties who act as processors access to your personal data. Such processors will only process your personal data in accordance with our instructions under concluded data processing agreements.

In connection with s360’s development, the company structure may change, e.g., by a partial or complete sale of the company. In the event of a partial transfer of assets that include personal data, the legal basis for the related disclosure of personal data will, as a rule, be GDPR Article 6(1)(f), as s360 has a legitimate interest in transferring parts of its assets and in making commercial changes.

Furthermore, in certain circumstances, it may be necessary to disclose your personal data to:

• The police
• Lawyers
• Auditors
• Courts
• Public authorities
• Potential buyers

As described above, personal data may be shared with other entities in the s360 group. This includes our entity in Serbia. Such transfers are subject to the EU Commission’s standard contractual clauses, which you may request a copy of.

In addition to this, s360 relies on certain processors and sub-processors in third countries that do not have an adequate level of protection. Such transfers will be based on the EU Commission’s standard contractual clauses which you may obtain a copy of by contacting us as described in section 1 above.

• You have the right to access the personal data we process about you.
• You have the right to object to our collection and further processing of your personal data.
• You have the right to rectification and deletion of your personal data, subject to certain statutory exceptions, including local bookkeeping legislation.
• You have the right to request that we restrict the processing of your personal data.
• In certain circumstances, you may also request to receive a copy of your personal data and to have the personal data you have provided to us transmitted to another data controller (data portability).
• You may withdraw any consent(s) you have given at any time. We will then delete your personal data unless we can continue processing on another basis. You can unsubscribe from our newsletter by clicking the link at the bottom of the newsletter.

If you have questions about this privacy policy or if you wish to complain about the way we process your personal data, you are welcome to contact us as described in section 1 above.

You may also lodge a complaint with your local data protection agency. You may find EU/EEA supervisory authorities’ contact information here and the UK Information Commissioner’s Office’s contact information here.