Privacy Policy

1.1At Firma360 ApS ("Firma360", "we", "us" or "our") we process personal data as an inevitable part of delivering our services. We are committed to processing your data responsibly, transparently and in accordance with the General Data Protection Regulation (GDPR), the Danish Data Protection Act, the ePrivacy Directive and — to the extent relevant — the EU Artificial Intelligence Act.

1.2This privacy policy describes what personal data we collect, how we use it, who we share it with and what rights you have as a data subject.

1.3The policy applies when you:

• visit firma360.dk, firmaapps.dk or any of our other websites
• are a customer, supplier, partner or prospective customer of ours
• contact us via form, email, phone, chat or social media
• receive newsletters or marketing from us
• apply for a job with us
• use applications or systems we have developed in which we act as data controller

1.4This policy does not apply to processing in which we act as a data processor on behalf of our customers — for example for hosting, operations, app and web development or marketing carried out on behalf of the customer. Such processing is governed by our Data Processing Agreement (DPA v2.0) and the customer's own privacy policy.

2.1Firma360 ApS is the data controller for the processing of personal data described in this policy. We are not required to appoint a Data Protection Officer (DPO) under GDPR Article 37, but we have internally designated a contact person for all enquiries regarding personal data.

3.1We primarily process ordinary personal data (GDPR Article 6) and only to a limited extent sensitive data. We never process special categories of personal data (Article 9) or data relating to criminal convictions and offences (Article 10), unless this is expressly agreed in writing and has a clear legal basis.

5.1We use cookies and similar tracking technologies on our websites to ensure proper functionality, measure usage, improve content and — subject to consent — display targeted marketing. Cookies are small text files stored on your device.

5.2We use four categories of cookies:

• Necessary cookies — required for the basic functionality of the website. Used without consent (Danish Cookie Order §3(2)).
• Preferences — remember language, region and your choices.
• Statistics — anonymous/pseudonymous measurement of visits and behaviour.
• Marketing — targeted advertising, retargeting and cross-site tracking.

Cookies in categories 2–4 are set only if you have given active consent via our cookie banner.

5.3Consent and withdrawal. Your consent is managed via Cookiebot, our Consent Management Platform (CMP). You can change or withdraw your consent at any time by clicking "Cookie settings" at the bottom of the website, or by deleting cookies in your browser.

6.1We do not disclose your personal data to third parties unless this is necessary to deliver our services, perform an agreement with you, comply with legislation or pursue a legitimate interest that overrides your rights.

6.2We may disclose personal data to the following categories of recipients:

• Sub-processors acting on our instructions — see section 7.
• Bank, auditor and advisors — in connection with invoicing, accounting and legal advice, where necessary.
• Public authorities — the Danish Tax Agency, the Danish DPA, police etc., where we are legally obliged.
• Acquired or divested business units — in case of merger, acquisition or divestment, cf. section 18 of our Terms of Service.

6.3We do not sell your personal data to third parties, nor do we use it for purposes you have not been informed about.

7.1We use a number of suppliers for hosting, operations, automation, communication, analytics and AI services. They act as sub-processors for us when we act as data processor for customers — and as data processors for us when we process data for our own purposes (for example our own CRM, email system and newsletter).

7.2The complete and up-to-date list of sub-processors is set out in Appendix B of our Data Processing Agreement. The list is publicly available at firma360.dk/databehandleraftale.

8.1Some of our sub-processors are established outside the EU/EEA — primarily in the United States. Whenever personal data is transferred to a third country, it always takes place on a lawful transfer basis under GDPR Chapter V:

• EU-U.S. Data Privacy Framework (DPF) — for US companies certified under the framework (Commission decision of 10 July 2023).
• EU Standard Contractual Clauses (SCC) — for suppliers without DPF certification, supplemented with appropriate technical and organisational measures.

8.2Where relevant, we carry out a Transfer Impact Assessment (TIA) to assess whether the level of protection in the third country is equivalent to the European one, and we implement supplementary measures (encryption, pseudonymisation, data minimisation) where necessary.

8.3You may obtain a copy of the transfer basis for a specific sub-processor by contacting dba@firma360.dk.

9.1We use AI-based tools as an integral part of our work — including for content production, code generation, analysis, translation and customer dialogue. The primary tools are Claude (Anthropic), ChatGPT (OpenAI) and Gemini (Google), which we access via APIs or business versions with a signed data processing agreement.

9.2In accordance with the EU AI Act (Regulation 2024/1689) we disclose the following:

• The AI systems we use are classified as "general-purpose AI systems" (GPAI) — not as high-risk systems under Article 6 of the Regulation.
• We do not use AI for purposes prohibited under Article 5 — e.g. social scoring, manipulative techniques, biometric remote identification or exploitation of vulnerabilities.
• We do not use AI to make decisions that produce legal effects or similarly significantly affect you (cf. GDPR Article 22).

9.3Transparency. Where AI plays a significant role in content, communication or deliverables (e.g. AI-generated text, translations or suggestions), we work on the principle of human oversight and review (human-in-the-loop). Final approval is always given by an employee before content is published or used towards customers.

9.4Data sent to AI services. We actively minimise the data we send to AI services. As a rule, we do not send:

• Special categories of personal data (Article 9 data, health data etc.)
• Personal identification numbers (CPR) or other national identifiers
• Login credentials, codes, financial details
• Customer data from data-processor tasks where the customer has not given explicit consent

When we do send data, it takes place via paid APIs or business plans where the provider has signed a data processing agreement and does not use data for training their models (Anthropic, OpenAI and Google all offer this as standard for their enterprise products).

9.5Labelling of AI-generated content. When we publish AI-generated content on our own platforms — e.g. blog articles, marketing material or visualisations — we will, in accordance with Article 50 of the AI Act, label the content where relevant and be transparent about its use.

11.1We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage — in accordance with GDPR Article 32 and DPA Appendix C.

12.1As a data subject you have a number of rights under GDPR. You may exercise these rights at any time by contacting us at dba@firma360.dk. We will respond to your request without undue delay — and at the latest within one month.

13.1If you are dissatisfied with our processing of your personal data, we encourage you to contact us first at dba@firma360.dk, so we have the opportunity to investigate and resolve the matter.

13.2You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet):

14.1We reserve the right to update this privacy policy to reflect changes in our practices, new technology, case law or legislation. The version in force at any given time is available at firma360.dk/privatlivspolitik.

14.2Material changes — e.g. new purposes for processing or changed legal bases — are notified directly to the affected data subjects by email or by a visible notification on our websites with at least 30 days' notice before the changes take effect.

14.3Version history.

• v2.0 — May 1, 2026 · Full revision. Added the AI Act, updated sub-processor list, integration with Cookiebot, alignment with DPA v2.0 and Terms of Service v2.0.
• v1.x — 2023 · Previous version of privacy and cookie policy.