Privacy Policy

Introduction

This Privacy Policy (“Policy”) explains how Moxso processes your personal data — including how Moxso uses, stores, and protects it. It also outlines the rights you have in connection with Moxso’s processing of your personal data.

Who is processing your data

We are Moxso, the company responsible for processing your personal data in accordance with this Privacy Policy. When you use our platform as an employee or user of one of our customers, Moxso processes your personal data as a data processor on behalf of that customer (your employer or service provider), who is the data controller. Please refer to their privacy policy for information about how they use your data. For questions about that processing, contact the relevant customer directly.

Our details

Moxso ApS,
Overgaden Oven Vandet 58A,
1415 København K,
Denmark

Company registration no: 42774529

Email: help@moxso.com

We use “we”, “us”, and “our” when referring to Moxso. When we mention our “website”, we mean moxso.com and any other websites or applications we own and operate.

When we refer to “you”, we mean you as a user of our website, our app, or as a customer of our online services or products.

Moxso ApS acts as a Data Controller and/or Processor with respect to the personal data you provide to us.

This policy does not apply once you leave our site. Any third-party sites linked from our site operate under their own privacy policies, which we encourage you to review.

The personal data we process

Personal data is any information that can be used to identify a specific person. Moxso processes personal data in two distinct capacities - as a data controller and as a data processor — and the data we collect depends on which role applies to you.

When Moxso is the data controller

When you visit our website, sign up for marketing communications, request a demo, or enter into a direct agreement with Moxso as a customer, Moxso determines the purposes and means of processing your personal data. In this context, the types of information we process about you may include:

• Your contact information such as name, email address, job title, phone/mobile number and/or social media
• The company you work for, including its domain, address, and country
• Purchase history
• Details of your requests, e.g., signing up and using our product, accepting our terms and conditions, requesting a demo, or contacting us for support
• The content of any emails you send us
• Payment details, such as your billing information
• Login credentials and verification information
• Your account setup choices, user role, and login activity
• Your interactions with us and our services, such as customer support, account and product setup, user interviews, UX research, and customer feedback
• Information on how you use our product and which services you or your company subscribe to
• Web traffic data such as IP address, device information, session data, referral source, click behavior, and cookie identifiers

When Moxso is the data processor

If you access the Moxso platform as an employee, user, or representative of one of our business customers, Moxso processes your personal data on behalf of that customer, who acts as the data controller. In this context, Moxso only processes the data necessary to deliver the contracted services, which typically includes:

• Full name and email address
• Test results and history of completed training courses
• IP address and browser information (User-Agent)

In this capacity, the customer — your employer or the organisation that has licensed Moxso — is responsible for the lawfulness of that processing and for providing you with information about how your data is used. Please refer to their privacy policy for details, and direct any data subject requests to them in the first instance. If you are unsure who your data controller is, please contact us at help@moxso.com and we will help direct your enquiry.

How we collect your personal data

Personal data collected directly from you

We collect and process personal data that you provide to us directly when you interact with and use our websites. This may be, for example, when you sign up for a webinar, contact our support, or ask us to contact you.

When you create an agreement with Moxso, we collect information you provide us. This information is used to create an account for you and to manage our relationship with you, for example to send you invoices and service notifications related to your use of Moxso.

Personal data collected automatically

Moxso uses cookies and other tracking technologies when you interact with our website and platform. You can withdraw or adjust your cookie consent at any time via the cookie banner on our website. Withdrawing consent does not affect the lawfulness of processing carried out prior to withdrawal.

Our Data Processing Purposes

General

We only collect and use your personal information when we have a legitimate reason for doing so. In which instance, we only collect personal information that is reasonably necessary to provide our services to you.

Delivering Our Services and Products

In accordance with our contract with you, we process your personal data to provide our services and products, contact you about our platform, and carry out demos and other services that can be ordered through our website. We also use your data to ensure you can log into your account (as a Company or User), send you notifications, register and identify you as a customer or user, process your payments, enable account and product features, save your actions while using our product and website, respond to your inquiries, and provide customer service and support — including sending you service-related messages and product updates.

Delivering a consistent experience across our website, online services, and apps.

We use cookies and similar tracking technologies to improve, optimise, and personalise your experience across our website, online services, and apps.

Depending on your cookie preferences, we may collect information such as your device type, IP address, operating system, browser type and version, pages visited, time and date of your visit, and time spent on each page.

We use this information to operate our services effectively, enhance security, ensure reliable performance, and improve the content we display through analytics. We may also combine automatically collected data with information from trusted third-party sources — such as marketing research — to further improve our platform and your experience.

Where errors occur during your use of our site, we may automatically collect technical data about the error and the circumstances surrounding it. This information is used solely to diagnose and resolve technical issues.

For full details on the cookies we use, their purpose, and how to manage your preferences, please refer to our Cookie Policy.

We use cookies for the following purposes, each described in detail in our Cookie Policy:

• Necessary cookies — required for the website and platform to function
• Analytical cookies — to understand how visitors use our website
• Marketing cookies — to deliver relevant content and measure campaign performance

Marketing

We process your personal data for marketing purposes, including sending you newsletters, hosting demos and webinars, tailoring our communications to your interests and focus areas, and sharing relevant product and service promotions and offers.

The data Moxso processes for marketing purposes includes your contact information (name, email, job title, phone/mobile number), details about the company you work for (domain, address, country), purchase history, areas of interest, use of digital services, information about newsletter subscriptions, email marketing requests, demo requests, the time and manner of your consent, and details of events you have participated in or signed up for.

Business and Product Development

We process your personal data to conduct data analysis and audits, develop new products and services, identify usage trends, evaluate the effectiveness of our marketing campaigns, and manage and grow our business operations.

Your contact information such as name, email address, job title, and phone/mobile number, the company you work for including its domain, address, and country, information about how you use Moxso's products and services, and your purchase history, areas of interest, and use of Moxso's digital services are processed for Business and Product Development.

Complying with Legal Obligations

We process your data to comply with legal obligations and requirements, respond to requests from public and government authorities, adhere to relevant industry standards and internal policies, and protect our operations and legal rights.

For this purpose we process your contact information, such as name, email address, job title, and phone number, the company you work for, including its domain, address, and country, information required to comply with public and government authorities, purchase history and your use of our digital services, The data retention period is determined by applicable legal and statutory requirements.

Additional Information

We do not sell or rent your personal data to third parties. Multiple legal bases may apply to some processing activities. Where we use your data for additional purposes, we will inform you at the time of collection. For further information on our legal bases, please contact us using the details above. Note that specific legal requirements may result in shorter or longer retention periods than those described in this policy.

Keeping Your Data Safe

We protect your personal data using commercially appropriate technical and organisational measures. However, no electronic transmission or storage method is entirely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of any passwords used to access your account. Note that emails sent over the internet may not be encrypted — please avoid including sensitive information in emails to us. We maintain ISO 27001-certified information security controls, including encryption of personal data in transit and at rest, access controls, audit logging, and regular penetration testing. For details, see our Trust Center at https://trust.moxso.com.

Transfers to Countries Outside the EU/EEA

The personal information we collect is stored and/or processed in Germany, or where we or our partners, affiliates, and third-party providers maintain facilities. In some cases, we may transfer your personal data to countries outside the European Union (EU) or the European Economic Area (EEA).

Where personal data is transferred to processors outside the EU/EEA, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs), participation in the EU–U.S. Data Privacy Framework, or other GDPR-recognised mechanisms such as adequacy decisions or approved certification schemes.

Third Parties and Processors

We use vendors (processors) to help us deliver our services to you, e.g. to provide the hosting environment for our product, send out newsletters, to help us run our website etc. When we use a processor we ensure to have a DPA in place that includes appropriate security measures in place to safeguard your data. For a list of our sub-processors, please visit our Trust Center: https://trust.moxso.com/subprocessors.

We share your personal data with suppliers and vendors that support our operations (including service providers, technical support, logistics, and financial institutions), Group entities, Public authorities.

For information about the suppliers we use for cookie-related services, please see our Cookie Policy.

If Moxso is acquired or undergoes a merger, insolvency, or similar transaction, your personal data may be transferred to the acquiring party as part of that transaction. Any such party will be required to honour this Privacy Policy in their continued use of your data.

Legal Basis for Processing Personal Data

We process your personal data on the following legal grounds under GDPR Article 6. Multiple legal bases may apply to a single processing activity.

Consent — Article 6(1)(a)

This basis applies to: analytical and marketing cookies; Marketing communications and analytics; newsletter subscriptions and email marketing.

Performance of a contract — Article 6(1)(b)

This basis applies to: Delivering Our Services and Products, including providing quotes, processing orders, managing payments and agreements, delivering and maintaining products and services, creating user accounts, and sending service-related communications. It also applies to Business and Product Development.

Legal obligation — Article 6(1)(c)

This basis applies to: Complying with Legal Obligations, including obligations under the Danish Marketing Practices Act, the Danish Bookkeeping Act, and the ePrivacy Directive. It also applies to certain Marketing and analytics activities.

Legitimate interests — Article 6(1)(f)

This basis applies to: necessary cookies; Delivering a Consistent Experience Across Our Website, Online Services, and Apps (including service improvement, optimisation, and analytics); service updates and notifications; Business and Product Development; Marketing; and general legitimate business interests related to operating and improving our website and services.

Establishment, exercise, or defence of legal claims — Article 9(2)(f)

This basis applies to processing activities under Delivering a Consistent Experience Across Our Website, Online Services, and Apps and Marketing where legal claims may be relevant.

Retention Periods

We retain your data for as long as necessary to fulfill the purposes for which it was collected. Generally, we keep your data for as long as you use our products or services or have an account with us, plus five (5) years after your account or relationship with us ends. Certain legal obligations or special circumstances may require shorter or longer retention periods. The table below summarises retention periods by processing purpose.

Deletion of Personal Data

If you terminate or delete your account, we will delete your personal data within 90 days. If you request deletion of your personal data, we will inform you of any impact on your use of our services. Certain legal exceptions may apply. Note that search engines and similar third parties may retain copies of publicly available information even after deletion from our services.

Your Rights

You have the following rights regarding your personal data. Depending on the circumstances, certain exceptions or limitations to the rights mentioned above may apply. In such cases, we will provide you with detailed information about the applicable exception or limitation and assist you in exercising your rights to the fullest extent possible in accordance with applicable laws and regulations.

Right of Access and Rectification: You may request details of the personal information that we hold about you. While certain exemptions may apply, you generally have the right to contact us at any time to access your information.

Right to Erasure: You can request that we delete your personal data in certain circumstances.

Right to Withdraw Consent: If we process your personal data based on your consent, you have the right to withdraw that consent at any time. Your withdrawal will not affect the lawfulness of processing carried out before the withdrawal. You can withdraw your consent by sending an email to help@moxso.com.

Right to Restrict: You have the right to request that we restrict the processing of your personal information if (i) you are concerned about the accuracy of your personal information; (ii) you believe your personal information has been unlawfully processed; (iii) you need us to maintain the personal information solely for the purpose of a legal claim; or (iv) we are in the process of considering your objection in relation to processing on the basis of legitimate interests.

Right to Object to Processing: You have the right to object to processing of your personal information that is based on our legitimate interests or public interest. If this is done, we must provide compelling legitimate grounds for the processing which overrides your interests, rights, and freedoms, in order to proceed with the processing of your personal information.

Right to Data Portability: You may have the right to request a copy of the personal information we hold about you. Where possible, we will provide this information in CSV format or other easily readable machine format. You may also have the right to request that we transfer this personal information to a third party.

Response times We will respond to rights requests within one month. This may be extended by up to two months for complex requests. Please note that rights may be subject to conditions or limitations depending on the circumstances. Contact us with any questions about exercising your rights.

Marketing preferences You may withdraw consent to direct marketing at any time by contacting us using the details below.

Your choice You are not obliged to provide personal data to us, but failure to do so may limit your use of our website or services.

Third-party information Personal data received from third parties will be protected in accordance with this policy. If you are providing data on behalf of another person, you confirm you have their consent to do so.

Correction If you believe data we hold about you is inaccurate or incomplete, please contact us and we will take reasonable steps to correct it.

Non-discrimination We will not discriminate against you for exercising your data rights.

Data breaches In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and inform the relevant supervisory authority within 72 hours of becoming aware of the breach. In cases where we act as data processor, we shall notify the data controller, if possible, within 48 hours after becoming aware of the personal data breach to enable the data controller to comply with the obligation to notify the personal data breach to the competent supervisory authority.

Assistance and Additional Information

You can exercise your rights by contacting us using the information provided in this policy.

If you have any questions about this Privacy Policy or how we handle your personal data, please feel free to reach out to us using the contact details included here.

Unsubscribing from Marketing Emails

To unsubscribe from our email database or opt-out of communications (including marketing communications), please contact us using the details provided in this Privacy Policy, or opt-out using the opt-out facilities provided in the communication. We may need to request specific information from you to help us confirm your identity.

Children and Our Services

We do not aim any of our products or services directly at children under the age of 13, and we do not knowingly collect personal information about children under 13.

Additional Disclosures for Australian Privacy Act Compliance (AU)

International Transfers of Personal Information

Where the disclosure of your personal information is solely subject to Australian privacy laws, you acknowledge that some third parties may not be regulated by the Privacy Act and the Australian Privacy Principles in the Privacy Act. You acknowledge that if any such third party engages in any act or practice that contravenes the Australian Privacy Principles, it would not be accountable under the Privacy Act, and you will not be able to seek redress under the Privacy Act.

Additional Disclosures for California Compliance (US)

Under California Civil Code Section 1798.83, if you are a California resident whose relationship with us is primarily personal or household in nature may request details of personal information disclosed to third parties for marketing purposes. You may make one such request per calendar year by contacting us with "Request for California privacy information" in the subject line. Not all shared information is covered by this provision.

Do Not Track

Some browsers have a “Do Not Track” feature that allows you to select that you do not want to have your online activities tracked. At this time, we do not respond to browser “Do Not Track” signals.

We adhere to the standards outlined in this Privacy Policy, ensuring we collect and process personal information lawfully, fairly, transparently, and with legitimate, legal reasons for doing so.

Cookies and Pixels

You may decline cookies at any time through your browser settings. Please refer to the Cookies section of this policy for more information.

In accordance with your right to non-discrimination, we may offer financial incentives permitted under the CCPA that result in different prices or service levels. Any such incentive will reasonably reflect the value of your personal data, and written terms will be provided. Participation requires prior opt-in consent, which may be withdrawn at any time.

California Notice of Collection

In the past 12 months, we have collected the following categories of personal information enumerated in the California Consumer Privacy Act:

• Identifiers, such as name, email address, phone number, account name, IP address, and an ID or number assigned to your account.
• Customer records, such as billing and shipping address, and credit or debit card data.
• Commercial information, such as products or services history and purchases.
• Internet activity, such as your interactions with our service.

For more information on information we collect, including the sources we receive information from, review the “Information We Collect” section. We collect and use these categories of personal information for the business purposes described in the “Collection and Use of Information” section, including to provide and manage our Service.

Right to Know and Delete

If you are a California resident, you have the right to have the personal information we collected and know certain information about our data practices in the preceding 12 months. In particular, you have the right to request the following from us:

• The categories of personal information we have collected about you;
• The categories of sources from which the personal information was collected;
• The categories of personal information about you we disclosed for a business purpose or sold;
• The categories of third parties to whom the personal information was disclosed for a business purpose or sold;
• The business or commercial purpose for collecting or selling the personal information; and
• The specific pieces of personal information we have collected about you.

To exercise any of these rights, please contact us using the details provided in this privacy policy.

Shine the Light

If you are a California resident, in addition to the rights discussed above, you have the right to request information from us regarding the manner in which we share certain personal information as defined by California’s Shine the Light with third parties and affiliates for their own direct marketing purposes.

To receive this information, send us a request using the contact details provided in this privacy policy. Requests must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code.

Changes to This Policy

At our discretion, we may change our privacy policy to reflect updates to our business processes, current acceptable practices, or legislative or regulatory changes. If we decide to change this privacy policy, we will post the changes here at the same link by which you are accessing this privacy policy.

If the changes are significant, or if required by applicable law, we will contact you (based on your communication preferences) and all our registered users with the new details and links to the updated or changed policy.

If required by law, we will get your permission or give you the opportunity to opt in to or opt out of, as applicable, any new uses of your personal information.

Complaints

If you believe we have breached applicable data protection law, please contact us with full details. We will investigate and respond in writing. You also have the right to lodge a complaint with your relevant data protection authority, such as the Danish Data Protection Agency.

Website: https://www.datatilsynet.dk\ Email: dt@datatilsynet.dk
Address: Borgergade 28, 5th Floor, 1300 Copenhagen K, Denmark
Telephone: +45 33 19 32 00