Last updated: 7th of February, 2023
2 Compose’s Relationship to You
- A “User” is an individual providing personal data to us via our website or other services, products or platforms, such as by signing up for our newsletter or making an account and posting on the Forums. Compose is in a “data controller” relationship with Users.
- A “Customer” is a specific type of User that has engaged us to act as an agent (or, as a “Data Processor”) by obtaining our Services. Compose is in a “data processor” relationship with Customers.
- Compose does not have a direct relationship with Customers’ End Users. A “Customer End User” is an individual that provides their Personal Information to our Customers. We do not control the purposes nor the means by which this Personal Information is collected, and we are not in a direct relationship with Customer End Users.
3 Personal Data, Purpose and Legal Basis for Processing
Compose processes, among others, personal data relating to contact persons at its customers, service providers and business partners, potential candidates and others who contact Compose or visit our webpage. The personal data may be provided by the data subject itself, from publicly accessible sources or third parties such as service providers, partners etc.
We may process your personal data in connection with the following processing activities:
- Contractual relationship: In a contractual relationship between Compose and individuals, personal data may be necessary to the execution or the performance of the contract (GDPR Article 6 (1) (b)), such as contact information, portfolio of work, skills, freelance availability and other personal data necessary to fulfil the contract.Compose may also process optional social media account information, e.g. if logging in through your Google account.
- Complete transactions: In order to complete transactions in relation to your use of the Service, Compose will process financial and transactional data (GDPR Article 6 (1) b)), such as bank account information, payment card information, information about transactions you make through our Service, etc.
- Contract management and business relationship:In connection with the administration and management of contracts with Compose’s customers, business partners etc. and for business and partner relationship purposes, Compose may process personal data such as contact information of contact persons at such customers, business partners, in addition to personal data contained in contracts, ongoing commercial correspondence, invoices, minutes of meeting etc. The legal basis is Compose’s legitimate interest in entering into business relationships, fulfilling contracts and administrating such relationships (GDPR Article 6 (1) (f)).
- Respond to inquiries:Compose may process personal data in order to follow-up inquiries from potential candidates, website users, and others who contact Compose. Compose may process personal data such as contact information and other personal data provided in connection with the inquiry. The legal basis for such processing is Compose’s legitimate interest in providing support to answer and manage inquiries and other communication (GDPR Article 6 (1) (f)).
- Marketing, newsletters etc.; If you have signed up for marketing or our newsletter, we may process your name, contact information etc. in order to submit such materials to you. Such processing is based on your consent (GDPR Article 6 (1) (a)).
- Recruitment:If you apply to a position in Compose, Compose may process your personal data in order to assess your application such as CV, application, certificates, references and other information you may provide or which we need to verify to assess your application. The legal basis for such processing is that it is necessary in order to take steps at the request of the candidate prior to (potentially) entering into an employment contract. The processing may also be based on our legitimate interest in finding the best candidate for the position (GDPR Article 6 (1) (f)), or your consent (GDPR Article 6 (1) (a)).
- Ensure compliance and legitimate interests:Compose may also process personal data in order to comply with statutory obligations to which Compose is subject, and to safeguard own or third parties’ legitimate interests, e.g. in relation to establishing a legal claim or preventing unauthorized access to or disclosure of personal data GDPR Article 6 (1) (f)).
- Legal obligations: Compose may process personal data due to legal obligations applicable to the operation of Compose (GDPR Article 6 (1) (c)), such as accounting obligations.
Compose may, on a case-by-case basis, process personal data for other purposes and rely on different legal grounds, such as consent or legitimate interest or, in accordance with applicable data protection law, as set forth in an applicable privacy notice.
Please note that we, in order to be able to enter into agreements or fulfil our obligations according to agreements entered into with you or someone you act on behalf of, depend on receiving a variety of information, such as contact information. The consequences of not providing such information are that Compose cannot fulfil the contract entered into with you or be able to enter into agreements with you.
4 Retention Period
Compose will retain your personal data for as long as it is necessary to fulfil the purposes for processing as defined above. Please note that continued storage may be necessary due to statutory obligations to which Compose is subject to e.g. statutory rules related to storage for accounting purposes, or due to Compose’s legitimate interests, e.g. for the purpose to establish, exercise or defend a legal claim.
5 Disclosure to Third Parties
We will only disclose your personal data to third parties to the extent we have a legal basis for such disclosure.
We use data processors to collect, store and otherwise process personal data on our behalf. The relationship to such suppliers is governed by a data processor agreement, which inter alia ensures information security for your personal data.
Compose may process and store your personal data outside the EU/EEA. All processing in a third country will be subject to mechanisms ensuring sufficient security for your personal data, such as EU Standard Contractual Clauses or an adequacy decision from the EU Commission, in addition to all necessary required steps under applicable law in order for such transfer of your personal data to be compliant with applicable law, including additional technical and organizational measures.
You may opt out of having your personal data shared with third-parties. However, if you limit the way Compose uses your personal data, certain features of the Service may not be available to you.
You can read more about our sub-processors and other third-parties in our list of sub-contractors.
Compose values your privacy rights and has taken reasonable steps to protect the users’ privacy, including by implementation of physical, technical and organizational measures, to prevent loss, alterations, theft and unauthorized access to information stored and otherwise processed.
7 Third Party Websites and Social Media
When you “like” or join any of our social media accounts, this will be shared with the relevant platform. The same applies to any activities on our social media accounts, such as content posted by you or posts that you like. The relevant social media platform has its own privacy policies, in which you can find more information about the processing of personal data in relation to such social media platforms.
8 Your Rights
As a data subject, you are entitled to request access to the personal data we process about you, request that Compose updates or corrects your personal data and/or withdraw any consent to processing. In some circumstances, you are also entitled to request that your personal data is erased, request restriction of processing or object to processing and/or request data portability. In order to utilize your rights, you may contact Compose by using the contact information stipulated in section 1 above.
You are also entitled to lodge a complaint with a supervisory authority if you believe that Compose’s processing of your personal data is contrary to relevant data protection laws.
If Compose makes changes in the processing of personal data, this policy will be updated, and the change will be notified on the webpage or by use of your contact information. We encourage you to periodically review this page for the latest information on our privacy practices.