Privacy policy

‍

Nextway Software A/S

Date: 28 September 2026

1. Introduction

1.1 As a customer, business partner, supplier, guest, applicant for a position at Nextway, etc., Nextway may process your personal data.

1.2 This Privacy Policy specifies how we process your personal data. At the same time, we will also inform you about your rights in connection with our processing.

1.3 At Nextway we process all personal data securely and confidentially. Nextway has established internal procedures for e.g. deletion, storage and transfer of personal data to ensure the integrity, confidentiality and security of the personal data. Our processing of your personal data is done solely for explicitly stated and legitimate purposes. We do not further process your personal data in a manner inconsistent with these purposes.

1.4 Our data protection efforts are based on the risk assessments we conduct for the processing of your personal data.

1.5 All employees at Nextway are bound by confidentiality.

2. Data controller

2.1 Nextway is the data controller of the personal data described in this Privacy Policy. You will find our contact information below:

Nextway Software A/S
CVR-nummer 10104106
Birk Centerpark 40
Birk
DK-7400 Herning

2.2 If you have any questions about our processing of your personal data, please do not hesitate to contact our point of contact:

T: +45 96 600 600
E: mail@nextway.software
W: https://www.nextway.software/

2.3 If Nextway acts as the data processor, you will be informed about this when you contact Nextway. However, the processing of your personal data in this context will still follow the principles of this Privacy Policy.

3. The purposes of and legal basis for the processing of your personal data
3.1 Purpose of the processing:

3.1.1 The purpose of the processing of your personal data depends on your relationship with Nextway. Below you can find the purposes for which we collect personal data:

  • Entering – and fulfilling - an agreement with you
  • Improving our consulting and other services
  • Marketing and educational activities
  • To process and assess your application, CV and other submitted documentation, including, where relevant, a criminal record certificate; to evaluate your professional and personal qualifications and obtain references where applicable; to conduct relevant assessments, such as personality profiling; and to arrange and conduct interviews.
  • Statistics
  • Optimization of website (see also our separate Cookie Policy)
  • Compliance with legislation applicable to Nextway
  • To enable Nextway and third parties to establish, exercise or defend legal claims.
3.2 Legal basis for the processing:

3.2.1 We process your personal data in accordance with the following legal basis:

  • You have given your consent to the processing of your personal data for one or more specific purposes, pursuant to GDPR, Article 6(1)(a) and, where applicable, GDPR, Article 9(2)(a), cf. section 7(1) of the Danish Data Protection Act.
  • The processing is necessary to comply with a legal obligation incumbent on Nextway, see GDPR, Article 6(1)(c) and Article 9(2)(b).
  • The processing is necessary for the fulfilment of a contract to which you are a party, or for the implementation of measures taken at your request prior to the conclusion of a contract, see GDPR, Article 6(1)(b). This may, for example, be Nextway's entering into a license agreement with its customers.
  • The processing is necessary for the establishment, exercise or defence of legal claims, see GDPR, Article 9(2)(f). This includes Nextway's own legal claims and the legal claims of third parties.
  • The processing is necessary for us or a third party to pursue a legitimate interest, unless your interests or fundamental rights and freedoms take precedence over this, see GDPR, Article 6(1)(f). The legitimate interests may be Nextway's own as well as third-party’s legitimate interests. This may, for example, be Nextway's interest in being able to handle general administration of the client or cooperative relations.
  • In connection with a recruitment process, we may ask to see your criminal record certificate. This is because Nextway, in certain cases, be required to screen employees’ criminal records in connection with their employment, or because such information is otherwise considered relevant. In such cases, the processing is carried out pursuant to Article 10 of the GDPR.
4. Categories of personal data

4.1 Nextway only processes personal data that is necessary to fulfil the purpose. The personal data we process about you depends on your relationship with us. Below you may find the categories of personal data that we most often process.

  • General personal data, such as: Name, address, e-mail, telephone number, CVR registration, IP address, date of birth, contact details, information about your current and previous employment, education, marital status, leisure interests and photographs, etc.
  • Confidential personal data, such as criminal record certificates and the results of personality and aptitude tests conducted as part of the recruitment process, as well as any other information that may otherwise appear in your application, CV or similar material.
  • Sensitive personal data: As a general rule, Nextway does not ask you to include or submit special categories of personal data in your application, CV or other material you provide to us. You should also remove or redact your CPR number if it appears in any documents or attachments submitted to us. If Nextway requires additional information, we will request it from you.
5. Recipients of personal data

5.1 In certain circumstances, Nextway discloses your personal data to recipients, including independent controllers and data processors.

5.2 Recipients may include external legal advisers, marketing agencies, external auditors, public authorities and the courts. Data processors may include our IT service providers, the provider of our recruitment system and providers of personality tests.

5.3 When Nextway enters into an agreement with a supplier who becomes Nextway's data processor, Nextway enters into a data processor agreement that meets the requirements for data processor agreements in GDPR, Article 28(3). Nextway continuously checks up on the data processor's compliance with the GDPR and the provisions of the data processor agreement.

5.4 You can always be informed about which data processors Nextway uses by contacting our point of contact.

6. Data transfer to third countries

6.1 Nextway's processing of personal data takes place within the EU/EEA.

6.2 If it is necessary to transfer personal data to a third country or an international organisation outside the EU/EEA, we ensure that the transfer is carried out on a lawful basis and subject to appropriate safeguards. This may include an adequacy decision adopted by the European Commission or the European Commission's standard contractual clauses.

7. Sources for collecting personal data

7.1 Personal data is collected directly from you, third parties, public authorities, banks, insurance companies, auditors, the courts, other advisers, former employers, colleagues, clients, your IT units (IP addresses) and from the transactions which you complete with us.

7.2 We screen all clients and parties for sanctions, such as those on the EU's sanctions list, as Nextway does not wish to assist parties subject to sanctions. We are also obligated to report to authorities and cooperate with their measures if a sanctioned party contacts us. Screening is conducted on an ongoing basis.

7.3 For applicants, Nextway primarily process personal data about you that Nextway receives directly from you during the recruitment process. Nextway also processes personal data about you collected in connection with any tests and profile assessments. In addition, Nextway may process relevant personal data obtained from the internet, including social media, and information obtained from references you have provided.

8. Your personal data

8.1 We retains personal data only for as long as necessary to fulfil the purposes for which the data was collected, including to provide our services, comply with legal, accounting, tax, regulatory and documentation obligations, resolve disputes and establish, exercise or defend legal claims.

8.2 For accounting records and related documentation, we retain relevant personal data for five years plus the current financial year, in accordance with applicable bookkeeping legislation.

8.3 For applicants, Nextway retains personal data received as part of a recruitment process for no more than six months. The personal data will be deleted after this period. However, if you have given your specific and separate consent, Nextway retains your personal data for one year from the date of receipt. If you are employed by Nextway, personal data collected during the recruitment process will be retained in your personnel file by HR for the duration of your employment. In this context, the data will be processed in accordance with our privacy policy for the processing of personal data in the employment relationship, which you will receive in connection with entering into your employment agreement.

8.4 For newsletters Nextway retains your personal data for this purpose until you withdraw your consent or otherwise object to receiving such communications. Following withdrawal of your consent, Nextway retains documentation that consent was obtained, including the date and scope of the consent, for two years from the date of withdrawal. This processing is carried out for the purpose of documenting compliance with applicable marketing and data protection legislation.

8.5 The applicable retention period otherwise depends on the nature of the personal data, the purpose of the processing and any applicable statutory limitation or retention requirements. Where personal data is processed on the basis of consent, we will generally delete or anonymise the data when consent is withdrawn, unless continued retention is necessary or permitted under applicable law.

8.6 When personal data is no longer necessary for the relevant purposes, it will be securely deleted, anonymised or otherwise irreversibly de-identified.

9. Newsletters

9.1 If you have provided your consent, Nextway processes your personal data to send you newsletters and other marketing communications, including information about our services, events, seminars and relevant technical developments. The processing is based on your consent, cf. GDPR, Article 6(1)(a). You may withdraw your consent at any time by using the unsubscribe link in each newsletter or by contacting us. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

10. Automatic decisions, including profiling

10.1 At Nextway, we do not use automated decision-making, including profiling in connection with your personal data.

11. Cookies
11.1 What are cookies?

11.1.1 Cookies are small text files that are stored on your device when you visit a website. They enable websites to function properly, remember your preferences, analyse usage and, where relevant, display more relevant advertising.

11.1.2 We may also use similar technologies, such as pixels, tags, local storage and software development kits (“SDKs”). For simplicity, these are referred to collectively as “cookies” in this Privacy Policy.

11.2 Categories of cookies we use

11.2.1 We use the following categories of cookies:

  • Strictly necessary cookies
    Purpose: Enable core Website functions, including security, network management, accessibility, load balancing, cookie-preference storage and session management.
    Legal basis: Necessary for the Website to function properly. Consent is not required.
  • Preference cookies
    Purpose: Remember choices and settings, such as language, region and display preferences, to provide a more personalised user experience.
    Legal basis: Your consent.
  • Statistics and analytics cookies
    Purpose: Help us understand how visitors use the Website, including which pages are visited, how users navigate the Website and whether technical errors occur.
    Legal basis: Your consent.
  • Marketing cookies
    Purpose: Track browsing behaviour across websites and devices in order to measure campaigns, build audiences and display advertising that is more relevant to you.
    Legal basis: Your consent.
  • Unclassified cookies
    Purpose: Cookies that are undergoing classification, including where the provider or purpose has not yet been identified.
    Legal basis: Your consent, where required.
11.3 First-party and third-party cookies

11.3.1 Cookies may be set by us (“first-party cookies”) or by third parties whose services are integrated into the Website (“third-party cookies”), such as analytics, advertising, social media, video or other service providers.

11.3.2 Third parties may process information collected through cookies for their own purposes. Where this involves the processing of personal data, please consult the relevant third party’s privacy policy for further information.

11.4 Information collected through cookies

11.4.1 Depending on the type of cookie, cookies may collect information such as:

  • IP address and approximate location;
  • device, browser and operating-system information;
  • unique online identifiers;
  • Website usage, including pages visited, clicks, time spent and navigation patterns;
  • referral source and campaign information;
  • preferences and consent choices; and
  • interactions with advertisements, embedded content or social media features.

11.4.2 Some of this information may constitute personal data.

11.5 Consent and managing your preferences

11.5.1 When you first visit our website, you may accept, reject or manage non-essential cookies through our cookie banner or preference centre.

11.5.2 Strictly necessary cookies will be placed regardless of your choice, as they are required for the Website to operate. Preference, statistics, marketing and unclassified cookies will only be placed where you have provided consent.

11.5.3 You may withdraw or change your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

11.6 Managing cookies through your browser

11.6.1 You may also manage or delete cookies through your browser settings. Please note that blocking or deleting certain cookies may affect the functionality, security or user experience of the Website.

11.6.2 Instructions are generally available through your browser provider’s help pages.

11.7 Cookie list

11.7.1 A current overview of the individual cookies used on the Website, including their provider, purpose, category and retention period, is available in the cookie declaration below.

12. The right to withdraw consent

12.1 If we have based all or part of the processing of your personal data on a consent, you have the right to withdraw this consent at any time. Please see contact information in Section 2.

12.2 If you choose to withdraw your consent, it does not affect the legality of our processing of your personal data based on your previously given consent and up to the time of the withdrawal. Therefore, if you withdraw your consent, it will only take effect from this time.

13. Your rights
13.1 The right of access

13.1.1 As set out in GDPR, Article 15, you have the right to be informed of which personal data about you is being processed and, if so, to access or receive a copy of this personal data.

13.1.2 In addition, you have the right to receive the following information:

  • The purposes of the processing and information about the affected categories of personal data, including where the personal data comes from if these data are not collected from you.
  • The recipients or categories of recipients to whom the personal data are or will be passed on, in particular recipients in third countries or international organizations.
  • If possible, the intended period during which personal data will be stored, or, if this is not possible, the criteria used to determine this period.
  • The right to request Nextway to correct or delete your personal data or to limit the processing of your personal data or object to such processing.
  • The right to lodge a complaint with a supervisory authority, including the Data Protection Authority.
  • You also have the right to receive information about relevant security if we have transferred personal data to third countries.

13.1.3 The right of access may be restricted where this is necessary to protect the rights and freedoms of others or where another applicable legal restriction applies.

13.2 Data portability

13.2.1 As set out in GDPR, Article 20, you have the right to receive a structured, commonly used and machine-readable format of the personal data you have provided to us about yourself.

13.2.2 You also have the right to transmit this information to another data controller without hindrance from us when the processing is based on consent or a contract, and the processing is performed automatically. If you exercise this right of data portability, you also have the right to have personal data transmitted directly from one data controller to another, if technically possible.

13.2.3 The access to data portability which may particularly be relevant in the event of a change of legal representation only includes information that you have provided yourself and will only include processing that is performed automatically and which is based on a consent or contract with you.

13.3 Right to rectification

13.3.1 According to GDPR, Article 16, you have the right to have incorrect personal data about yourself corrected without undue delay. In addition, taking the purposes of the processing into account, you have the right to have incomplete personal data completed

13.3.2 This right complements our obligation to continuously ensure that only correct and up-to-date information is processed, see Article 5(1)(d) of the GDPR.

13.3.3 However, the right to rectification only apply to objective personal data and not subjective assessments.

13.4 The right to be forgotten

13.4.1 As set out in GDPR, Article 17, you have the right, in certain cases, to have your personal data, that is registered, deleted.

13.4.2 You may e.g. demand deletion if the personal data are no longer necessary to process in order to fulfil the purposes for which they were collected if your legitimate interests in objecting to the processing exceed our legitimate interests in storing personal data, or if personal information has been processed illegally.

13.4.3 As set out in GDPR, Article 17(3), you cannot require deletion if the processing is necessary to comply with a legal obligation, or for legal claims to be established, asserted or defended.

13.4.4 Where we are required to erase personal data under GDPR, Article 17, we will communicate the erasure to recipients to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort, see GDPR, Article 19.

13.5 Right to object as well as the right not to be subject to automated decisions

13.5.1 It is stated in GDPR, Articles 21 and 22, that you have the right at any time to object to the processing of your personal data if the processing is based on GDPR, Article 6(1)(e) (performance of tasks in the interests of society) or GDPR, Article 6(1)(f) (legitimate interests) or on automatic processing, including profiling.

13.5.2 If you object, we may no longer process the personal data in question unless we can demonstrate compelling legitimate reasons for the processing that take precedence over your interests or if the processing is necessary for legal claims to be established, asserted or defended.

13.5.3 This right does not apply if the processing is necessary for the conclusion or fulfilment of a contract between you and Nextway if the processing is based on law, or if the processing is based on your expressly given consent.

13.6 Right to restrict processing activities

13.6.1 According to GDPR, Article 18, you have the right to have the processing of personal data restricted if:

  • the accuracy of personal data is disputed by you, but only in the period until we have had the opportunity to determine whether personal data is correct,
  • the processing is illegal, and you oppose the deletion of personal data and instead request that its use is restricted,
  • Nextway no longer needs personal data for the processing, however, which does not apply if they are necessary for a legal claim to be established, asserted or defended, and
  • you have objected to the processing pursuant to GDPR, Article 21 (1), but only during the period in which it is checked whether Nextway's legitimate interests take precedence over the data subject's legitimate interests.

13.6.2 It is stated in GDPR, Article 21(2), that if processing has been restricted, such personal data, other than storage, may still be processed e.g. if you give consent to this, or if the processing is necessary for a legal claim to be established, asserted or defended.

14. Case procedure

14.1 If you wish to exercise your rights, your request will be processed within a maximum of 30 days. If the case processing unexpectedly exceeds this time, we will contact you about this. If your request cannot be met, we will give a reasoned explanation for the refusal.

15. Change in this Privacy Policy

15.1 We may change this Privacy Policy at any time and without notice with effect for the future. The applicable Privacy Policy is available at https://www.nextway.software/privacy-policy.

16. The Danish Data Protection Agency

16.1 If you have any complaints regarding our processing of your personal data, you can direct your complaint to the Danish Data Protection Agency.

Datatilsynet
Carl Jacobsens Vej 35 2500 Valby
Telefon: +45 33 19 32 00
dt@datatilsynet.dk
www.datatilsynet.dk