Our privacy policy

1. This data protection and privacy policy (the “Policy”) describes how SOA People A/S (“us”, ”we” or ”our”) collects and processes personal data relating to the purchase of services, membership, products or general use of our website.
2. The Policy is prepared and made available to comply with the general data protection regulation (2016/679 of 27 April 2016) (the ”GDPR”) and the rules included herein on information to be provided to you.

1. We process personal data about you when this is necessary and in accordance with the applicable legislation. Depending on the specific circumstances, the processed personal data may include the following types of personal data: name, address, telephone number, email, IP address, and title. In connection with our physical events, we may also process images and video recordings of participants for the purposes described in this Policy, including communication, documentation, and marketing. On our website, we only collect personal data with your consent.
2. If we need to collect more personal data than specified above, we will inform you about this. Such information may be provided by our updating of this Policy.

We only process personal data for legitimate purposes in accordance with the GDPR. Depending on the circumstances, the personal data is processed for the following purposes:

• To deliver products or services to a user, customer, or newsletter member.
• To answer enquiries or complaints from users, customers, or newsletter members.
• To improve our products, services, or websites.
• To facilitate a sales process.
• To give support and service messages, including answering questions and complaints and sending updates about our products and services.
• To provide service messages and information to users, customers, or newsletter members.
• To store personal data to comply with applicable legislative requirements such as bookkeeping acts.
• To conduct marketing activities, including sending newsletters, product information, event invitations, promotional materials and other relevant marketing communications, when permitted by applicable law or based on your consent.

We only process your personal data when we have a legal basis to do so in accordance with the GDPR. Depending on the specific circumstances, the processing of personal data is done on the following legal basis:

• If we have asked for consent for the processing of specific personal data, the legal basis for such personal data is consent, cf. article 6(1)(a) of the GDPR, as the consent can always be withdrawn by contacting us via the contact details provided at the end of this Policy, and, if the consent is withdrawn, the personal data processed based on consent is deleted, unless it can or must be processed, for example, to comply with legal obligations.
• The processing is necessary to perform a contract to which the data subject is a party, cf. the GDPR, article 6(1)(b), the first indent.
• The processing is necessary in order to take steps at the request of the data subject prior to entering into a contract, cf. the GDPR, article 6(1)(b), last indent. The processing is necessary for the purposes of legitimate interests where such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, cf. the GDPR, article 6(1)(f).
• The processing is necessary for compliance with applicable legislation, cf. the GDPR, article 6(1)(c).

We only pass on personal data to others when the law allows it or requires it. Our organisation is part of a concern/company group where personal data is shared between the group companies, depending on the circumstances.

We transfer personal data to the following recipients from the EU/EEA:

a. Tax authorities (for example, in connection with accounting, etc.)
b. Banks (for example, in connection with payments,etc.)
c. Authorities
d. Data controllers or processors such as:

• WebCRM
• HaloPSA
• SAP
• ActiveCampaign
• Dealfront

We use external companies as suppliers to assist us in delivering our services. The external suppliers will not receive or process personal data unless the applicable law allows for such transfer and processing. Where the external parties are data processors, the processing is always performed based on a data processor agreement in accordance with the requirements hereto under GDPR. Where the external parties are data controllers, the processing of personal data will be performed based on said external parties’ own data privacy policy and legal basis, which the external parties are obligated to inform about unless the applicable legislation allows otherwise.

We do not transfer personal data to countries or international organisations outside the EU/EEA unless you consent or are a SOA People customer. The transfer and processing will apply to the law and on legal grounds such as SCC or EU. U.S data privacy Framework.

The recipient outside EU/EØS is:

• Google, US
• Meta, US
• Hubspot
• Amazon, US
• GetAccept, US
• SurveyMonkey, US
• LinkedIn, US

Our website collects data from our contact form or by cookies. Other personal data are collected through correspondence with you as a user, customer, or potential customer through sales activities such as phone calls, webinars, events or emails. The legal ground for collecting your data is always your consent or a customer relationship with your company.

We ensure that personal data is deleted when it is no longer relevant for the processing purposes described above. This includes situations where, for example, you withdraw your consent, change your job role, or are no longer a customer. We retain your personal data only for as long as necessary to fulfil these purposes. Customer-related data is generally kept for the duration of the customer relationship and for up to 5 years thereafter to comply with accounting and bookkeeping obligations and to manage potential legal claims. Data processed on the basis of consent is deleted if you withdraw your consent, unless a longer retention period is required by applicable law. Technical logs and security-related data are stored for shorter periods, typically 30–180 days, unless a security incident requires longer retention. If you have any questions about how long we retain specific categories of personal data, please contact us using the email address provided in section 11 of this Policy.

You have the right to withdraw your consent at any time. You can do this by contacting us at the contact details in section 11. If you withdraw your consent, it does not affect the lawfulness of our processing of your personal data based on your previously given consent and up to the time of withdrawal. Therefore, if you withdraw your consent, it will only take effect from that point in time.

Data subjects have a number of rights that we can assist with. If a data subject wants to use his or her rights, he or she can contact us. The rights include the following:

• The right of access: Data subjects have a right to ask for copies of the information we process about them, including relevant additional information.
• The right to erasure: In certain circumstances, data subjects have a right to obtain the erasure of personal data concerning him or her before the time when erasure would typically occur.
• The right to correction: Data subjects have the right to get wrongful information corrected.
• The right to restrict processing: Data subjects have, in certain situations, a right to have the processing of his or her personal data restricted. If a data subject has the right to have the processing of his or her personal data restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or the protection of the rights of another natural or legal person or for reasons of substantial public interest in the European Union or of a European member state.
• The right to object: In certain situations, data subjects have a right to object to the legal processing of his or her personal data.
• The right to data portability: Data subjects have, in certain situations, a right to receive his or her personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another data controller without hindrance from the data controller to which the personal data has been provided.

More information about data subject rights can be found in the guidelines of the national data protection authorities at www.datatilsynet.dk.
If a data subject wishes to use his or her rights as described above, the data subject is asked to use the contact details provided at the end of this Policy.
We strive to do everything to meet wishes regarding our processing of personal data and the rights of data subjects. If you or others, despite our endeavors, wish to file a complaint, this can be done by contacting the national data protection authorities.

We reserve the right to update and amend this Policy. If we do, we will correct the date and the version at the bottom of this Policy. In case of significant changes, we will provide notification in the form of a visible notice, for example, on our website or by direct message.

If you have questions or comments about this Policy or if you would like to invoke one or more data subject rights, please contact our DPO at +45 22 69 42 02, kristina.zeemann@nordic.soapeople.com or by letter to Livjaegergade 17, DK-2100 Copenhagen O, att.: Kristina Zeemann.

You have the right to file a complaint with the Danish Data Protection Agency if you are dissatisfied with the way we process your personal data. You can find the Danish Data Protection Agency’s contact information at www.datatilsynet.dk. 

Livjaegergade 17, 2100 Copenhagen
CVR No: 25627261
 +45 35 55 55 75
 info@nordic.soapeople.com