PRIVACY POLICY

This Privacy Policy applies to all collected and processed personal data that you have provided to us, or we have collected as part of delivering our services and operating our tender management platform (the “Platform”). “Personal Data” means any information relating to an identified or identifiable natural person.

This Privacy Policy provides supplementary information on how Coobix ApS processes personal data when acting as a data controller.

Where Coobix processes personal data on behalf of its customers in connection with the provision of the Platform, Coobix acts as a data processor, and such processing is governed by the applicable data processing agreement entered into with the relevant customer.

If there are any questions regarding this Privacy Policy, you may contact us using the information below.

Coobix ApS
Reg. no.: 46179250
Ewaldsgade 7
2200 Copenhagen N
Denmark

Attn: Sebastian Brun Jørgensen
Sebastian@coobix.com
+45 27 82 31 95

We are processing your personal data in accordance with the General Data Protection Regulation (GDPR) and any national regulations applicable to us.

Non-sensitive personal data

We may collect and process the following non-sensitive personal data about you in connection with our business relationship, your use of the Platform, or your contact with us:

• Name
• Work email
• Work phone number
• Company name
• Company address
• Country
• Title / position
• User role and login details
• Correspondence and support enquiries
• Billing and payment information
• Technical data, including IP address, browser type, log data and usage data

We process non-sensitive personal data under Article 6 in the GDPR, more specifically, our legal basis for collecting and processing personal data is for each service outlined below:

• Processing necessary for the creation and administration of customer accounts and access to the Platform is based on GDPR Article 6(1)(b) (performance of a contract).
• Processing related to customer communication and support is based on GDPR Article 6(1)(b) and Article 6(1)(f) (performance of a contract and legitimate interests).
• Processing related to billing and payment administration is based on GDPR Article 6(1)(b) and Article 6(1)(c) (performance of a contract and legal obligations).
• Processing for IT security, logging, and prevention of misuse is based on GDPR Article 6(1)(f) (legitimate interests).
• Processing for product development and improvement of the Platform is based on GDPR Article 6(1)(f) (legitimate interests). This does not include personal data processed by Coobix on behalf of its customers under a data processing agreement.
• Processing for sending service-related updates and operational notices is based on GDPR Article 6(1)(b) and Article 6(1)(f).
• Processing for marketing communications, where permitted by law, is based on GDPR Article 6(1)(f) and, where required, Article 6(1)(a) (consent).
• Processing for generating recommendations to the customer based on the customer’s own data is based on GDPR Article 6(1)(b) or Article 6(1)(f), depending on the specific service configuration. The processing does not involve storing data for model training and does not include automated decision-making under GDPR Article 22.
• We process contact information of subcontractors and other business partners (such as name, email address, and phone number) for the purpose of administering collaboration, providing access to project materials, and enabling participation in tender processes. This processing is based on GDPR Article 6(1)(f) (legitimate interests) or, where applicable, Article 6(1)(b) (performance of a contract).

If the processing is based on your consent, you may at any time withdraw your consent by contacting us.

Sensitive personal data

Coobix does not intentionally collect or process sensitive personal data as part of its ordinary provision of the Platform or related services.

If sensitive personal data is exceptionally included in materials uploaded to the Platform by a customer, such data is processed by Coobix solely as data processor on behalf of the relevant customer and under the customer’s instructions, as set out in the applicable data processing agreement.

We do not share or transfer your personal data to a country or territory outside the EU/EEA.

We will not share your personal data with any third party without your consent, unless it is specifically stated or required by law that we do so.

Our processing activities do not include profiling or automated decision-making.

In the event of an actual or contemplated transfer of our company or our assets, or if we discontinue our business or enter into bankruptcy proceedings, we will include data, including your personal information, among the assets transferred to any parties who acquire us or such assets may be the subject of review (due diligence) by such parties (or their representatives). You acknowledge that such transfers may occur, and that any parties who acquire, or contemplate to acquiring us may, to the extent permitted by applicable law, continue to use your personal information according to this policy, which they will be required to assume as it is the basis for any ownership or use rights we have over such information.

We only process your personal data as stated in this privacy policy and we do not use your personal data for any other purpose than explicitly described above or communicated directly to you elsewhere.

We process your personal data in a lawful, fair and transparent manner. The data we collect is solely used for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

All use of your personal data is limited to what is relevant and necessary in relation to the purposes for which they are processed.

When we store and process personal data that we have received from you, we always take every step possible to store it in a secure manner. However, we cannot guarantee that your data is 100% secure as we cannot guarantee that the data will not be accessed or otherwise misused as a result of an unlawful act or similar. We do take all necessary precautions to keep your data safe.

The following security measures are in place to keep your data safe:

• Encryption
• Firewalls
• Internal policies & password protection

We retain personal data only for as long as necessary for the purposes for which it was collected and processed, unless a longer retention period is required by law.

Personal data processed for customer and user administration is generally retained for the duration of the customer relationship and for a reasonable period thereafter. Accounting and invoice documentation is retained for the period required by applicable bookkeeping legislation.

Right to access
GDPR Article 15: You have the right to obtain a confirmation from us as to whether personal data concerning you are being processed, including information on the purpose-, categories-, recipients-, and time of storage of the processing.

Right to rectification
GDPR Article 16: If you find that the data that is being processed about you is inaccurate or incomplete, you have the right to get that data rectified. We will communicate any rectification or erasure of personal data to any recipient to whom the personal data has been originally disclosed, unless it proves impossible according to Article 19.

Right to erasure and restriction of processing
GDPR Article 17: You also have the right to get your personal data erased, if the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed. Please see Article 17 for the full list of reasons for your right to erasure.

Right to restriction of processing
GDPR Article 18: You have the right to restrict the processing of your personal data if it is (i) inaccurate; (ii) unlawful; (iii) the purpose of the processing has changed; or (iv) you have objected to the processing according to Article 21.

Right to data portability
GDPR Article 20: You have the right to receive the personal data concerning you which you have provided to us, in a structured, commonly used, and machine-readable format. You can also request that we transmit your data to another party.

Right to object
GDPR Article 21: You have the right to object to the processing of your personal data if it is being used for profiling or direct marketing purposes.

We use trusted data processors, service providers, and suppliers to deliver our services and run our business. This includes providers related to hosting, storage, communication, and technical operation of the system.

Where personal data is processed by third parties on our behalf, this is done in accordance with applicable data protection laws.

We ensure that all processors handling personal data provide appropriate technical and organizational safeguards and process personal data in compliance with GDPR and applicable data protection legislation.

Further information regarding specific sub-processors may be made available to customers upon request or through separate contractual documentation where relevant.

If you want to exercise any of your above rights, please contact us at info@coobix.com. We will handle your request in accordance with applicable data protection legislation.

If you find that your personal data has been processed in a way that does not meet the requirements of the GDPR, and if you want to file a complaint, you have a specific right to lodge a complaint with the relevant supervisory authority. The supervisory authority will guide you through the process. See contact information below:

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Denmark

dt@datatilsynet.dk
+45 33 19 32 00