Privacy Policy
How Exo360 ApS collects, uses and protects your personal data on exo360.org.
Last updated: 10 November 2026
1. Who we are
Exo360 ApS is the data controller for personal data processed through exo360.org (the “Website”).
Exo360 ApS
Vesterbrogade 26, 1620 København V, Denmark
CVR: 40431721
Email: info@exo360.org
We have not appointed a data protection officer, as we are not required to. Send any question about your data to info@exo360.org.
2. What we collect and why
We only collect what we need. The table below shows each situation where we process personal data.
You sign up for The Monthly 360°
What we collect: Email address, and your name if you give it. Date, time and source of your signup, as proof of consent. Whether you open emails and click links.
Why: To send you our newsletter and see which content is useful
Legal basis: Your consent (GDPR Art. 6(1)(a))
How long we keep it: Until you unsubscribe. We keep proof of your consent for 2 years after that, in case we need to document it.
You email us or use a contact form
What we collect: Name, email, organisation, role, your message and anything you choose to include
Why: To answer your enquiry and follow up on it
Legal basis: Our legitimate interest in replying to people who contact us (Art. 6(1)(f)). If you contact us about entering a contract, Art. 6(1)(b).
How long we keep it: Up to 12 months after our last exchange. If the enquiry leads to an agreement, records are kept for 5 years from the end of the financial year, as required by the Danish Bookkeeping Act (bogføringsloven).
You visit the Website
What we collect: IP address, browser and device type, pages requested, date and time
Why: To deliver the Website securely and keep it working
Legal basis: Our legitimate interest in running a working, secure website (Art. 6(1)(f))
How long we keep it: Server logs are kept by our hosting provider for a limited period under its own retention rules.
You visit the Website
What we collect: Aggregated statistics without cookies (pages viewed, referrer, country)
Why: To understand which pages are useful
Legal basis: Our legitimate interest (Art. 6(1)(f))
How long we keep it: Aggregated only
You accept analytics cookies
What we collect: Pages viewed, time on page, approximate location, device and browser, a random identifier stored in a cookie
Why: To understand how the Website is used and improve it
Legal basis: Your consent (Art. 6(1)(a)), see our Cookie Policy
How long we keep it: 14 months in Google Analytics, then deleted
Please do not send us health information about yourself or a patient through email or forms on the Website. If you are a clinician interested in a clinical partnership, contact us first and we will agree a secure way to share any data.
We do not use your data for automated decision-making or profiling, and we never sell it.
3. Who we share it with
We use a small number of service providers who process data on our behalf as data processors. Each one is bound by a data processing agreement and may only use your data to provide its service to us.
Framer B.V. (Netherlands)
What they do for us: Hosts the Website, receives form submissions, provides cookieless visitor statistics
Where data is processed: EU, with some sub-processors in the United States
Brevo (France)
What they do for us: Sends The Monthly 360° and stores the subscriber list
Where data is processed: EU
Google Ireland Limited
What they do for us: Google Analytics, only if you accept analytics cookies
Where data is processed: EU and the United States
Google Workspace
What they do for us: Our email inbox, where enquiries to info@exo360.org arrive
Where data is processed: EU and the United States
We may also share data with our professional advisers or with authorities when the law requires it.
4. Transfers outside the EU/EEA
Some providers above use servers or sub-processors in the United States. Where that happens, we rely on the EU-U.S. Data Privacy Framework (for certified companies, including Google) or on the European Commission’s Standard Contractual Clauses, as allowed by GDPR Chapter V. You can ask us for a copy of the relevant safeguards.
5. Your rights
Under the GDPR you have the right to:
Access the personal data we hold about you
Correct data that is wrong
Delete your data
Restrict how we use it
Object to processing based on our legitimate interests
Data portability, meaning receiving your data in a common format
Withdraw consent at any time, without affecting processing that happened before
To unsubscribe from The Monthly 360°, use the link at the bottom of any newsletter. For anything else, email info@exo360.org. We reply within one month.
6. Complaints
If you are unhappy with how we handle your data, you can complain to the Danish Data Protection Agency:
Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
dt@datatilsynet.dk · www.datatilsynet.dk
We would appreciate the chance to sort it out with you first.
7. Children
The Website is not aimed at children. We do not knowingly collect data from anyone under 13, the age of consent for online services in Denmark.
8. Security
We protect personal data with access controls, two-factor authentication on the systems that hold it, and encrypted connections (HTTPS) across the Website.
9. Changes to this policy
We update this policy when our Website or the law changes. The date at the top shows the latest version. If a change affects something you consented to, we will ask you again.
10. Applicable law
We process personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Danish Data Protection Act (databeskyttelsesloven).