Privacy Notice

We take your privacy seriously

Privacy Notice

Effective Date: August 2026

Your privacy is important to SoftwareOne and its affiliates (collectively referred to as “SoftwareOne”, “we”, “us”, “our”). This Privacy Notice explains what personal data we may use about you, how we may use it, as well as what your data protection rights are.

The type of personal data we use and what we do with that depends on the relationship we have with you. It is therefore possible that some parts of this Privacy Notice may not be relevant for you or more than one part of this Privacy Notice may apply to you.

Please note that this Privacy Notice does not apply where we process personal data as a data processor on behalf of our customers. In such cases, the personal data processing is governed by a separate agreement between us and the customer (who is the data controller).

To the extent that this Privacy Notice includes references that will redirect you to another website not operated or controlled by us, please note that it is the provider of such website that will be responsible for the processing of any personal data that you provide on that website and we recommend that you review their privacy notice accordingly. In such a situation, we will have no control over how your personal data is being used and processed and we will not be responsible for that provider’s use of your personal data.

Who we are

The entity responsible for the processing of your personal data is the SoftwareOne entity (“Data Controller”) with which you have established a relationship, for instance by visiting its website, using its services, signing up for events or applying for a job opportunity. You can find more information about the different SoftwareOne entities here.

When we receive your personal data (either directly from you, from the company that you represent or, in other cases, from third-parties), we may process it for the following purposes and legal grounds.

As a user of our websites, platforms, applications or other products and services

Creation and administration of user accounts

In order to securely access and utilize our websites, platforms, applications or other products and services, you may be required to register for and maintain a user account with us. We process your personal data when you register for these accounts as well as during authentication, administration and maintenance of such accounts.

If you choose to create a demo or trial account to explore our websites, platforms, applications or other products and services, we may collect your personal data, and use it to authenticate your access, provide temporary service functionality, monitor your usage, as well as communicate with you about the demo or trial account.

In instances where our websites, platforms, applications or other products and services reference a different privacy notice, explaining why and how personal data is collected and processed, we encourage you to refer to that privacy notice.

Relevant personal data: contact details (e.g., name, email, phone number, job title, company name), time and date of registration, logins, usage data, activity data.

The legal basis for your personal data processing is the contract we entered with you, so that we can conclude, administer and maintain your account.

Respond to requests

We may collect your personal data in order to communicate with you and process your request addressed to us via chat functions, contact forms or other means.

Relevant personal data: contact details (e.g., name, email, phone number, job title, company name), postal address, country, content of request, date of request, other data you may voluntarily disclose to us.

The legal basis for your personal data processing is, where applicable, fulfillment of our legal obligation or contractual commitments towards you and, otherwise, our legitimate interest in managing our interactions with you, as well as delivering a satisfactory service and experience to you.

Posts and comments

You may post and comment on our websites, platforms, applications as well as other products and services. Your content may be publicly accessible in such a case. Please note that we may still manually review your post or comment before it is published, which may cause a delay before it will be displayed. If you provide a name or alias, this name will be published next to your post or comment.

Relevant personal data: name or alias, content of post or comment, time and date, other data you may voluntarily disclose to us.

The legal basis for your personal data processing is our legitimate interest in managing our interactions with you, as well as improving our products and services.

Newsletters

You can sign up for our newsletters, which provide you with information about current trends and highlights in the IT industry, new products or services, upcoming events, special offers and important dates for IT decision makers.

During sign up we require your email address. In certain regions, we may send you a confirmation email after you have completed the sign up form. In such a case the sign up is not activated until you have clicked on the link in the confirmation email.

If you register to our newsletter, we may include individual tracking technologies in our newsletters, with which we can recognize when the newsletter sent to you was accessed or opened and individualize the links in the newsletter to determine when you clicked on which link.

You can unsubscribe from receiving our newsletters at any time. Simply use the unsubscribe link which is found at the end of our communications or send an email to info.global@softwareone.com.

Relevant personal data: contact details (e.g., name, email, phone number, job title, company name), country, engagement metrics (e.g., opened newsletter or not, date / time of opening, how many times the newsletter was accessed, links clicked).

The legal basis for your personal data processing is your consent for receiving newsletters.

Marketing

For marketing purposes, we collect your personal data when you engage with us on behalf of our customers or partners, including prospective customers. We may also receive personal data from verified third party providers who are legally authorized to share such information for use in our marketing communications. We will process such personal data for marketing purposes including but not limited to informing you about upcoming events, products, services and offerings that may be of interest to you.

Additionally, we may use individual tracking technologies, to automatically collect IP address data and engagement metrics such as email opens and link clicks to help us monitor performance and enhance the relevance and effectiveness of our marketing efforts.

Relevant personal data: contact details (e.g., name, email, phone number, job title, company name), as well as any other data you provide to us.

The legal basis for your personal data processing is your consent or our legitimate interest for sending you marketing communications.

Licenses and Technology Usage Analysis

In the context of our commercial relationship with customers, we may process information relating to software licenses and technology usage environments to better understand, manage and support customer needs across the lifecycle of the relationship.

Where customers have granted us access to their technology environments or onboarded to our or approved third party tools, we may obtain visibility into license types, assignments and usage within the scope of the relevant platform or technology. This may include licenses obtained through us, as well as licenses obtained from other providers, where such access has been authorized.

We use this information to support license and usage optimization, validate service eligibility, administer services that are priced or delivered on a per user or per license basis, and to analyze aggregated trends across our customer base. These analyses may also inform the development of new products and services, improvement of existing offerings and the identification of relevant commercial opportunities.

We does not access or process license or usage data beyond the scope of the access granted by the customer or the applicable contractual arrangements.

Relevant personal data: user or device identifiers, license assignment and usage data, service usage metrics, and related technical metadata.

The legal basis for such personal data processing is our legitimate interest in managing and developing our products and services, supporting our customers throughout the lifecycle of the relationship, and conducting our commercial activities, as well as the performance of contractual obligations where applicable.

Cookies and other similar technologies

We may use cookies and similar technologies when you use our websites, platforms, applications as well as other products and services. Cookies are small text files stored on your device by websites you visit. They help websites remember your preferences, login information and browsing activity to provide a more personalized, efficient and seamless online experience and they are commonly used to analyze website traffic, manage user sessions and tailor content to your interests.

Essential cookies

These cookies are required for the website to function and cannot be disabled.

Functional cookies

These cookies enable additional features and third party content such as fonts, videos, maps, social plugins and embedded services.

Analytics and marketing cookies

These cookies help us understand how users interact with the website and support advertising and marketing activities.

One purpose for which we may use this is to process your usage data in order to analyze how you use and interact with our websites, platforms, applications or other products and services, so that we can improve your online experience. Also, we may use third party tools to create anonymized session recordings that help us analyze website usage and improve functionality. These recordings do not include any personal data, and sensitive fields are masked to ensure your privacy.

We may also use cross device tracking technologies to display targeted advertising outside our website and assess advertising effectiveness. Third party providers listed in our cookie banner (if nonessential cookies are enabled) may access your browser or device, analyze your IP address, store or read recognition characteristics or access tracking pixels. These characteristics may be used to recognize your device across other websites. If you register with a third party provider using your user data, recognition characteristics across different devices (e.g., laptop, smartphone, tablet) may be linked. This enables the provider to manage advertising campaigns across devices.

We may also use web analysis tools to appropriately design our websites and identify returning visitors. These tools generate usage files based in pseudonyms and rely on cookies as described in our Cookie Banner.

We also embed certain services into our websites that are not stored on our servers. For example, you can find out the exact location of a SoftwareOne entity using maps or you can watch videos. In certain regions, we may ensure that access to our websites, platforms, applications or other products and services with embedded content does not automatically provide the third party provider with any information, we only display locally stored thumbnails. In such case, content from third party providers is only loaded after you provide your consent via the Cookie Banner. When you view the content, the third party provider receives the information that you accessed our website as well as the usage data that are required in this regard for their service. We have no influence on the further data processing performed by the third party provider.

Our Cookie Banner is provided by a third party and shows you a list of the cookies we use, including their provider. In the default setting, only the essential cookies are enabled. Via the Cookie Banner you can determine whether you allow the setting of additional cookies or not. You can adjust your preferences at any time via the Cookie Banner.

Relevant personal data: IP address, device and browser information, security and bot detection signals, cookie consent preferences, website interaction data (e.g., video views, map usage, embedded content interactions), approximate location derived from IP address, technical request and performance data, pages visited and browsing behavior (e.g., clicks, scrolling, navigation paths), time spent on pages and session duration, cookie identifiers and advertising IDs, conversion and engagement events (e.g., form submissions, interactions) and marketing and campaign performance data.

The legal basis for your personal data processing in respect of the essential cookies is our legitimate interest to display the website, platforms, applications to you. In what concerns the non-essential cookies and similar technologies, the legal basis is your consent.

Use of Artificial Intelligence in our digital products and services

We may also use Artificial Intelligence (“AI”) tools, including generative AI, to support how you interact with our websites, platforms, applications and other products or services (e.g., to power chat assistants, translate or summarize content, personalize what is shown to you, moderate posts and comments and deliver or improve product features), with human review where the output may have a meaningful effect on you.

As a visitor of our social media presence

We may process your personal data, when you visit our main social media pages (the main profiles are listed below):

LinkedIn: https://www.linkedin.com/company/SoftwareOne
X: https://x.com/SoftwareOne, https://x.com/SWO_Careers
Facebook: https://www.facebook.com/Softwareone/, https://www.facebook.com/softwareonecareers
Instagram: https://www.instagram.com/softwareone/, https://www.instagram.com/swocareers/
YouTube: https://www.youtube.com/SoftwareOne-global
Tik Tok: https://www.tiktok.com/@swocareers?_r=1&_t=ZN-94SU63n1PIl

We, together with the provider of the respective social media page, are jointly responsible for the processing of your personal data. The social media page provider in this respect also determines the purposes and means of your personal data processing activities, which we can influence only to a limited extent.

The data entered by you on our social media pages, such as comments, videos, pictures, likes, public messages, etc., are published by the social media page provider and are not used by us for any other purpose. We nevertheless reserve the right to delete content, if necessary. We may share your content on our website if it is a function of the social media feed and communicate with you via the social media page.

If you submit a request to us on one of the social media pages, we may also, depending on your request, refer to other secure communication channels that guarantee confidentiality. You may always send us confidential requests via the other provided channels. If you wish to object to a particular processing activity of your personal data, please contact us as described in section “Contact Information”. We will examine your request and determine whether we are able to respond to you and if we have any influence over such processing activity. Otherwise, you may need to contact the social media page provider directly.

We may use our social media pages for advertisement purposes. In doing so, we may use demographic, interest based, behavior based or location based target group characteristics provided by the provider of the respective social media page. We can influence the data processing only to a limited extent and we cannot disable the statistics that the provider of the respective social media page makes available to us.

We use conversion tracking options for individual social media channels. For this purpose, we have incorporated corresponding pixels or tags on our website in order to collect conversion data. Via the Cookie Banner you can determine whether or not you allow such non-essential cookies, as well as adjust your preferences.

We may use AI tools, including generative AI, to support our social media activities (e.g., to draft or translate captions, generate or adapt visual content, moderate comments on our own pages and analyze engagement in aggregated form), with content reviewed by our team before publication. AI features operated by the social media providers themselves remain governed by their respective privacy notices.

Data processing by the provider of the social media page

The provider of the social media page may use web tracking methods. Web tracking can be performed regardless of whether or not you are logged into an account on the social media platform. As already explained, the web tracking methods of the social media page are beyond our control and we cannot disable these features. Please note that the provider of the relevant social media page may use your profile and behavioral data to evaluate your habits, personal relationships and preferences. We have no influence on the processing of your data by the provider of the relevant social media page.

For more information about the processing of your personal data on the social media pages, please visit the respective providers privacy notices, as listed below:

LinkedIn: https://www.linkedin.com/legal/privacy-policy
X: https://x.com/en/privacy
Facebook: https://www.facebook.com/privacy/explanation
Instagram: https://help.instagram.com/155833707900388
YouTube: https://policies.google.com/privacy?hl=en
TikTok: https://www.tiktok.com/legal/page/us/privacy-policy/en

Relevant personal data: name, company, email address, country, as well as any other information that you voluntarily provide to us.

The legal basis for your personal data processing is our legitimate interest in advertising and promoting our brand, services and products on social media platforms, and enhance effectiveness and relevance of our marketing activities to improve overall marketing performance; similarly, we process your personal data in the interest of our public relations and communication. As well, we rely on your consent for the deployment of non-essential cookies, which you can adjust at any time via the Cookie Banner.

As a customer, business partner and interested party

Purchase and use of our products or services

In order to facilitate the purchase and use of our products or services, we may process your personal data. Such personal data may be provided to us directly by you or by the relevant customer, supplier or business partner.

We process personal data in two distinct capacities, depending on the product or service provided:

For certain products or services, we determine the purposes and means of processing personal data independently;
For other products or services, we act on behalf of our customer as a data processor. In these cases, the specific processing activities are detailed in the applicable data processing agreement executed between us and the customer.

This processing enables us to administer and manage our relationship with you and the company you represent, including negotiating and finalizing agreements, as well as providing pricing information.

Similarly, while delivering some of our products or services, we may process certain data to detect, investigate and respond to cybersecurity threats. This includes monitoring systems, analyzing security events and responding to potential incidents affecting our customer’s environment.

If you choose to create a demo or trial account to explore our products or services prior to making a purchase, we may collect your personal data, and use it to authenticate your access, provide temporary service functionality, monitor your usage of our products or services, as well as communicate with you about the demo or trial account.

Sometimes, we may conduct market research and satisfaction surveys, as we are constantly looking to better understand your experience, interests and feedback about our products or services, but also thriving to improve them, as well as the relationship we manage with our customers, business partners and any other interested party. In such case, you have the right to object to such processing. More information on how to exercise your right can be found in section “Contact information”.

Relevant personal data: contact details (e.g., name, email, phone number, job title, company name), login credentials, time and date of registration, usage data, system and security logs (e.g., authentication logs, network traffic metadata, endpoint telemetry), IP address, device identifiers, device and application data (e.g., hostnames, operating system details, application usage metadata), incident related data (e.g., files, memory data, or logs associated with suspected malicious activity), as well as other data that you voluntarily provide to us while purchasing and using our products or services.

The legal basis for your personal data processing is our legitimate interest in selling our products or services by administering, concluding and fulfilling the agreement we enter with the entity you legally represent. We rely on the same legal basis when we are conducting market research or surveys, as well as when creating your demo account, so that we can offer you (as a legal representative of a prospective customer) a preview of our products or services.

Product and service improvement

While using our products or services, we may process your personal data in order to analyze it for statistical and improvement purposes.

Relevant personal data: name, email, IP address, visited content, date and time of visit, volume of data transmitted, access status, web browser and operating system, referral link that indicates from which website you arrived.

The legal basis for your personal data processing is our legitimate interest in understanding our overall performance and improving our products or services, as well as ultimately your experience with us.

Customer credit verification

We may process personal data to conduct credit checks on customers before entering into an agreement, so that we can manage the financial risk during our ongoing business relationship. This may also include internal validation of customer information and credit limits within our enterprise resource planning (ERP) systems prior to enabling transactions.

Relevant personal data: contact details (e.g., name, email, phone number, job title, company name), financial history, credit score, payment behavior, outstanding debts, identification numbers (e.g., VAT or company registration number), data received from credit reference agencies (if such relates to you as an individual).

The legal basis for your personal data processing is our legitimate interest in assessing creditworthiness and minimizing our financial exposure.

Due diligence and screening

Before conducting business, we may process your personal data when you liaise with us on behalf of our customers, business partners or any interested party, to enable us to perform due diligence or screenings. Our due diligence or screening activities may encompass security, privacy and integrity checks, to the extent permitted by applicable laws.

Relevant personal data: contact details (e.g., name, email, phone number, job title, company name), other data that you voluntarily provide to us.

The legal basis for your personal data processing is our legitimate interest in ensuring the suitability of your company, as well as effective management of any associated risks.

Use of Artificial Intelligence in customer and partner engagement

We may use AI tools, including generative AI, to support our commercial and operational activities (e.g., to draft and personalize communications, summarize meetings and email exchanges, translate content, analyze account information, triage and respond to support requests and assist in preparing proposals or contracts), with human review of any output that may have a meaningful effect on you. No decisions producing legal or similarly significant effects are taken solely by automated means, except where permitted by applicable law.

As a participant in seminars, webinars, training sessions, virtual meetings and other events

Event registration and management

We may process your personal data in order to communicate with you, organize, as well as conduct seminars, webinars, training sessions, virtual meetings and other events (“Events”) we or any of our partners organize and you decide on attending.

In this process, we may be supported by external third party providers (e.g., videoconferencing, communication providers) with whom we share your personal data.

In certain cases, we may also record our Events. Please see the following section about Audiovisual content for more information.

Sometimes, we might also send you surveys, which you are free to answer, so that it helps us evaluate how we can effectively improve or expand our Events.

Where the Events are not virtual, but require your in person presence, we refer to the event privacy notice which will be made available separately and includes the relevant details on how we processes your personal data in relation to that specific event.

Relevant personal data: contact details (e.g., name, email, phone number, job title, company name), meeting name or alias, IP address, device/ hardware data (e.g., MAC addresses, version), text, audio and video data, connection data (e.g., phone numbers, country names, start and end times), other data you voluntarily provide to us during the registration process or during the event.

The legal basis for your personal data processing is our legitimate interest in managing our events and advertising our activities, as well as in sending you surveys so that we can understand, evaluate and improve our overall event performance.

Audiovisual content

During Events organized by us or any of our partners, we may take pictures or record videos (“Audiovisual Content”) of the participants. Such Audiovisual Content may capture you or a group of people or anyone that is, for example, a speaker or attending on stage. We may publish these materials on our websites, social media platforms or in any other digital or printed media. If you do not wish to appear in such Audiovisual Content, please inform the person recording or taking the pictures or the event organizer. Also, we recommend that you are conscious during in person Events to not walk into the pictures / videos when these are being taken or recorded.

In case of individual Audiovisual Content of the participants, we will separately inform you about the personal data processing and ask for your consent before we take such action.

You have the right to object to such processing or withdraw your consent, where such has been previously obtained from you. While we will make reasonable efforts to comply with your request, it is well known that any information that is posted on the internet, including the social media platforms, becomes accessible worldwide and may be easily copied and distributed by other third parties who are not connected or under our control. Thus, this information may remain available on the internet even after it has been deleted by us. Further deletion requests should then be directed to the respective internet search engine or social media provider.

Where your picture is used in a printed material (e.g., leaflet, magazine, newsletter), if disproportionate effort is associated with removing it from such materials, it may be possible that the printed material will continue to be used until the already printed edition has been used up. Still, your picture will not be used for any new printed materials.

Relevant personal data: pictures, videos, voice recordings, other biometric data that is collected or shared with us.

The legal basis for your personal data processing is our legitimate interest in managing our events and advertising our activities, except for when we perform individual audiovisual content, in which case we rely on your consent.

Use of Artificial Intelligence during our events

To deliver, document and improve our Events, we may use AI enabled features (offered by us or our event and videoconferencing providers) to generate live or post event transcripts, written summaries, notes and highlights, provide live captioning or real time translation, support Q&A and chat, and analyze engagement in aggregated form. Where transcription, summarization or recording is enabled, we will inform you at the start of the event and, where required, ask for your consent.

As an applicant to our job opportunities

We may process your personal data, which we receive directly from you or via publicly accessible sources (e.g., online professional networks, social media sites or job boards) or from third parties (e.g., personnel service providers, universities, employment / recruitment agencies, referrals, tax and social insurance authorities, or other relevant authorities) in the context of job opportunities.

We may process your personal data for the following purposes:

create an account for you in our application system;
evaluate your CV, resumes or other documents you provide to us, as well as assess your skills, experience and qualifications, where applicable, through the use of AI systems;
set up interviews and conduct assessments;
where permitted or required by law, conduct background or public social media checks, as a pre-requisite for being awarded the job offer;
contact you regarding the progress of your application;
where the case might be, reimburse travel expenses incurred during recruitment;
keep your application for the personnel files and establish an employment relationship with you, in case of successful application;
provide you with job opportunities based on your interest and skills and inform you about the latest news on recruitment activities;
conduct surveys in order to improve our recruitment processes, etc.

When applying for one of our job openings, we ask you to only include in your application, data that is relevant for the job opportunity in scope. For certain applications, we may request certain demographic information (such as gender, race / ethnicity and nationality) on a voluntary basis, in order to meet equal employment opportunity and legal reporting requirements. This information does not form part of the selection process and has no impact on hiring decisions.

For some roles, we may use technology enabled assessments and recruitment tools provided by third party providers (e.g., video interviewing platforms, structured assessments, job simulations; AI assisted screening workflows) to support parts of our recruitment process. These tools may help us collect application information in a structured way, schedule and conduct interviews or assessments, validate job related skills and generate structured summaries or insights to support our recruiters’ review. Depending on the role and the tool used, this may include reviewing your CV and application materials, inviting you to respond to structured questions (in text, audio and / or video) and generating a recruiter facing summary, score or confidence indicator. We use these outputs as decision support and our recruiters remain responsible for reviewing relevant information and making hiring decisions. Where a specific assessment step is offered on a voluntary basis, we will make that clear and, where feasible, provide an alternative route.

We may also use AI to help source candidates from public professional networks and job boards, schedule interviews, transcribe and summarize interviews, translate application materials and draft recruiter communications. Outputs are used to support, not replace, our recruiters and no hiring decisions are taken solely by automated means. You may request human review of any AI supported outcome directly to the recruiter or via the details in the section "Artificial Intelligence".

After you have created your account with us, you also have the possibility to make changes to your personal data preferences, as well as your email subscriptions, such functionalities being available in your portal account dashboard. However, at any given time, you can also reach out to us at iCIMS.help@softwareone.com and we will accordingly support you.

If your job application was not successful and you have agreed for us to keep your personal data longer (as it may be of interest to you for potential future opportunities), we shall keep it for another period of two years, after which we will delete it accordingly. If you did not agreed to the extended retention period, we will delete your data within six months after the application process has ended, as required by applicable laws. Of course, at any given moment you can raise a data deletion request with us, as per the “Your rights” section.

Relevant personal data: contact details (e.g., name, email, phone number, job title, company name), CV (including pictures or images provided by you), motivation letter, reference letters, home address, identification data (e.g. date of birth, nationality, identity card or passport, etc.), employment data (e.g., work history employment contract, past employment, current employment status type of employment, function, work or a residence permit, if necessary, etc.), education and qualification data (e.g., degrees, certificates, previous career experience, secondary employment, references, other related documents substantiating your professional expertise and experience), questionnaires and assessment results, health data when permitted and / or required by applicable law, bank account details (e.g., to reimburse travel expenses, if agreed); other data that you provide to us on a voluntary basis.

The legal basis for your personal data processing is:

our legitimate interest in creating your account, assessing your application, conducting interviews or assessments, background checks and overall managing the recruitment process for filling in our open job positions;
our legitimate interest in sending you surveys, so that we understand and evaluate how best we can improve our recruitment process, as well as our overall performance and efficiency;
our legitimate interest in defending ourselves and exercising any rights to protect ourselves and our brand in case of legal claims;
your consent for securely keeping your personal data for an extended period of time in case you have not been successful for the applied job opportunity;
your consent, where required, for the use of AI tools in your application journey (e.g., AI supported assessment or video interviews);
contractual, in establishing an employment relationship with you;
legal obligation for complying with regulatory requirements, processing complaints or concerns, as well as defending ourselves where needed.

Corporate transactions

As we continue to develop our business, we might undergo various corporate transactions, therefore your personal data may be disclosed or transferred to relevant third parties in the event of any proposed or actual reorganization, sale, merger, consolidation, joint venture, assignment, transfer or other disposition of all or part of our business, assets or stock (including in connection with any bankruptcy or similar proceeding).

Relevant personal data: contact details (e.g., name, email, phone number, job title, company name), account credentials, purchase and transactions records, other data necessary to facilitate the corporate transaction.

The legal basis for your personal data processing is our legitimate interest in conducting the corporate transaction and ensure business continuity.

Disputes resolution

We may process your personal data to protect our legal rights, exercise and defend against claims or participate in legal proceedings (including those involving third parties).

Relevant personal data: contact details (e.g., name, email, phone number, job title, company name), contractual documents, correspondence, usage logs, transaction history, other data relevant to the disputed matter.

The legal basis for your personal data processing is our legitimate interest in defending our legal rights and resolving disputes efficiently.

Regulatory compliance

In order for us to fulfill our obligations under applicable laws and regulations, we may need or be required to process and share your personal data with public authorities, regulatory bodies or law enforcement agencies (e.g., police, courts). We may also engage external auditors or advisors to assist with compliance obligations and personal data will be shared with them to the extent necessary. This may involve maintaining records, submitting reports or disclosing information as required by law. In some cases, providing personal data is mandatory under applicable law or may otherwise follow an official request. In other instances, we may proactively submit required reports for compliance purposes.

Relevant personal data: contact details (e.g., name, email, phone number, job title, company name), transaction records, communication history, account activity, other data necessary to demonstrate compliance.

The legal basis for your personal data processing is our compliance with legal obligations.

Reporting concerns

At SoftwareOne, we are committed to upholding the highest standards of integrity and compliance. To support this commitment we provide the SoftwareOne Integrity Line, a secure and confidential reporting channel to raise concerns related to compliance, ethical conduct or other potential misconduct. The SoftwareOne Integrity Line is available both internally, as well as externally to anyone who wishes to report concerns or suspected violations (also in an anonymous manner, if preferred). All reports are treated with strict confidentiality and personal data shared when submitting a report is processed solely for the purpose of investigating and resolving the concern, in accordance with this Privacy Notice, the privacy policy featured in the Integrity Line and applicable data protection laws.

Relevant personal data: whistleblower / reporter personal data (where their identity has been disclosed), including contact details and any other personal data provided as part of the report. Data contained in the report relating to the individuals impacted by the allegation(s) being made (e.g., names, email, phone number, address, as well as any supporting documentation). Special personal data may also be collected, if included in the report or disclosed during the investigation.

The legal basis for the processing of personal data is:

compliance with legal obligations, including the obligation to provide a secure internal reporting channel;
our legitimate interest to prevent and detect criminal offences, breaches of duty and other violations, and in doing so, verifying the legality of internal processes, safeguarding our integrity and preventing damage and liability risks;
where special categories of personal data are processed, we will process this data only when necessary for handling the report and conducting the investigation and only when permitted under applicable data protection laws.

Security analysis

In order for us to maintain the security of our website, platforms, applications or other products and services, as well as to detect fraud or misuse of such, we may process your personal data. We do this in order to safeguard our digital infrastructure by detecting and preventing unauthorized access, ensuring system integrity and defending against cyber threats. This includes the monitoring of access logs, usage patterns and other technical elements, to uphold the confidentiality, integrity and availability of our website, platforms, applications or other products and services.

Relevant personal data: IP address, login credentials, device identifiers, browser type, operating system, access timestamps, activity logs.

The legal basis for your personal data processing is our legitimate interest in detecting fraud and misuse, and ensuring our website, platforms, applications or other products and services are used for the intended purposes and are protected from intrusion and compromise.

Artificial Intelligence

We use AI, including machine learning and generative AI, in certain parts of our business, for example to facilitate internal processes, improve services and support innovation across the digital products and services we provide. The way we use AI depends on the context. In some cases, AI is used only to provide recommendations or assistance that are reviewed by people; in other cases, AI may help automate certain low risk operational tasks. Where the use of AI may be relevant to individuals, we are committed to being transparent and will provide clear information on a case‑by‑case basis.

If you would like more information about our use of AI or if you encounter any concerns, unsafe outputs or unexpected AI behavior, please contact us at responsible-ai.global@softwareone.com.

Data retention

We retain your data as long as this is necessary to fulfill the purposes for which it has been collected or to comply with legal obligations. This includes, but it is not limited to, contractual period, legal reporting obligations, retention necessary for disputes resolutions and fraud prevention, as well as any other regulatory requirement. Once we no longer have a legitimate business need to retain your personal data, we will either anonymize it so it can no longer be linked to you or securely delete it in accordance with applicable laws.

Data recipients

In order to fulfil the purposes described in this Privacy Notice, we may disclose your personal data to other recipients, as follows:

SoftwareOne affiliates: Due to our international group structure, certain departments and persons require on a need-to-know basis to process your personal data. For all intra group personal data access and transfers, we comply with applicable data protection requirements. Further information regarding the SoftwareOne group companies can be found here.

Service providers, including IT suppliers: We disclose your personal data to service providers we use to support our websites, platforms, applications or other products and services, including IT suppliers. These companies provide services like marketing, mailing or email, tax and accounting, payment or billing processing, auditing, conducting surveys, event management, recruitment processes, customer service, data enhancement services, fraud prevention, sales, web hosting or analytic services. Similarly, to support our systems, as well as for software and data storage purposes, we may share your personal data with IT suppliers. We have dedicated contracts signed with our service providers, with the required safeguards for protecting your personal data. We have dedicated contracts signed with our service providers, with the required safeguards for protecting your personal data.

Public or governmental authorities: We may disclose your data with public entities and institutions, including law enforcement, data protection authorities, tax authorities, credit agencies, debt collectors, banks, courts or other companies insofar as there is a legal basis for such disclosure and we must comply with our legal obligations, regulations or contracts, or to respond to a court order, administrative or judicial process we are legally compelled to.

Legal advisors or similar professionals: Where there is a need to support, provide us with advice or represent us in relation to disputes, claims or court proceedings or to assist with our regulatory compliance, we may also share your personal data with relevant legal professionals.

Joint marketing partners: We may provide your personal data to sponsors of events, webinars or sweepstakes for which you register, or to other parties with whom we may engage in joint marketing activities.

Data transfers

We may transfer your personal data to third countries (e.g., countries that require additional safeguards by applicable data protection regulations) only and insofar as this is necessary or required for the fulfillment of the purposes described in this Privacy Notice, there is a legal basis for the data transfer and appropriate transfer mechanisms are implemented.

When performing these international transfers, we will ensure that appropriate safeguards as required by applicable laws are put in place prior to the transfer of the personal data (e.g., by incorporating standard contractual clauses or data transfer agreements established between the parties transferring the personal data).

Data security

In order to protect your personal data, we will implement appropriate technical and organizational measures. We will ensure that our suppliers, partners and other recipients who have access to your personal data on our behalf will do the same and have similar safeguards implemented. However, you must be aware that no method of electronic transmission and storage is 100% secure and there is no standard guarantee of absolute security. Where you are required to use certain credentials to access our websites, platforms, applications or other products and services, you must ensure that you keep such credentials confidential and you do not share them with anyone else.

In the event that you suspect that your interaction with us is no longer secure and safe or that your personal data might have been compromised, please reach out to us immediately at it.security@softwareone.com.

Your rights

Following our processing of your personal data, you have certain legal rights that you can exercise, namely:

access your personal data as well as receive a copy of your personal data;
ask that we rectify or delete your personal data;
under certain conditions, request the restriction of your personal data processing;
ask for your personal data portability;
object to the processing of your personal data, especially if the personal data is processed pursuant to our legitimate interests;
lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes applicable data protection regulations. We would, however, like to address your concerns before you approach a supervisory authority so please contact us in the first instance.

Please be informed that these rights are not absolute and there might be instances where their exercise is limited. Should that be the case, we will make sure to always inform you and explain why we cannot entirely fulfill your request.

Contact information

In case you have any questions related to this Privacy Notice, our data protection practices or you want to send us requests for further information or complaints, please contact us at:

SoftwareOne | Legal - Data Protection Department
E-Mail: data-protection.eu@softwareone.com

Our Data Protection Officer for the EU / EEA, Switzerland and the UK is:

FIRST PRIVACY GmbH
Konsul-Smidt-Straße 88
28217 Bremen, Germany

For contact details of our Data Protection Officers outside the aforementioned countries and regions, please click here.

Supplements

Supplement for LATAM

This Supplement applies to individuals located in Latin America and the Caribbean (“LATAM”), in addition to the above Privacy Notice, and provides additional clarifications to certain region specific processing activities and legal requirements.

Applicability of Local Data Protection Laws

In Brazil, when personal data is processed or relates to individuals located in Brazil, such processing is carried out in accordance with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais – “LGPD”, Law No. 13.709/2018).

In Mexico, the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) is the key regulation governing data processing by companies and individuals in Mexico. Under the new law of 2025, the Anti-Corruption and Good Governance Secretariat is the entity responsible for supervising and enforcing the law.

In Ecuador we will process and treat your Personal Data in accordance with the provisions of the Organic Law of Personal Data Protection (LOPDP) and other relevant regulations issued by the Superintendence of Personal Data Protection. The consent required by the (LOPDP) will be provided by you in the manner established in the Privacy Notice for each type of relationship.

In Chile, we will process your data in accordance with Law Nº 19.628: Sobre Protección de la Vida Privada.

In Puerto Rico, we process your personal data in accordance with applicable laws of the Commonwealth of Puerto Rico and relevant United States federal privacy and data security laws, including, where applicable, data breach notification and consumer protection regulations. SoftwareOne implements appropriate technical and organizational measures to ensure the security and confidentiality of personal data in line with generally accepted privacy standards.

In the Dominican Republic, we will process and handle your personal data in accordance with the provisions of Law No. 172-13 on the Protection of Personal Data, as well as other applicable regulations. The required consent under Law No. 172-13 will be obtained in the manner described in this Privacy Notice, depending on the nature of the relationship and the processing activities involved.

In Jamaica, when your personal data is processed or if you are located in Jamaica, we will process such data in accordance with the Data Protection Act, 2020, and any applicable regulations issued by the competent authority. SoftwareOne ensures that personal data is processed lawfully, fairly and transparently, and that appropriate safeguards are in place, including for international data transfers.

In Trinidad and Tobago, we will process your personal data in accordance with the Data Protection Act, 2011, and applicable regulations issued by the Office of the Information Commissioner. Personal data will be processed in a manner that ensures its confidentiality, integrity and security, and in line with the purposes described in this Privacy Notice.

Legal Basis – Regular Exercise of Rights (Brazil)

Where applicable, personal data may be processed for the regular exercise of rights in judicial, administrative or arbitration proceedings, in accordance with Article 7, item VI of the LGPD, including proceedings governed by the Brazilian Arbitration Law (Law No. 9,307 / 1996).

Communications (Brazil)

Individuals located in Brazil may submit privacy‑related requests and receive responses in Portuguese.

In accordance with ANPD Resolution No. 18 / 2024, SoftwareOne ensures that communications with data subjects and the Brazilian Data Protection Authority (ANPD) are carried out clearly and precisely in Portuguese.

Local Social Media Presence (Brazil)

In addition to global social media channels, SoftwareOne maintains local social media presences, as follows:

LinkedIn: https://www.linkedin.com/company/softwareone-latam/
X: https://x.com/softwareone_br
Facebook: https://www.facebook.com/SoftwareOneBrasil/
Instagram: https://www.instagram.com/softwareone_br/
YouTube: https://www.youtube.com/@softwareonebrasil

Processing of personal data in this context is subject to the respective platforms’ local privacy policies:

LinkedIn: https://br.linkedin.com/legal/privacy-policy
X: https://x.com/pt/privacy
Instagram: https://help.instagram.com/155833707900388
YouTube: https://policies.google.com/privacy

International Data Transfers (Brazil and Ecuador)

Personal data may be transferred to third countries, provided that international treaties have been signed with those countries that allow the transfer of data and do not contravene local legislation.

International transfers of personal data originating from Brazil are conducted in accordance with the LGPD and ANPD Resolution CD/ANPD No. 19 of December 18, 2024 (Regulation of the International Transfer of Personal Data) and SoftwareOne relies on legal mechanisms that ensure an adequate level of protection for your personal data.

International Transfers of personal data originating from Ecuador will comply with the provisions of the LOPDP and SoftwareOne will only transfer personal data to countries and territories that comply with the standards of protection required by Ecuadorian laws and regulations.

Data Protection Rights (Brazil)

Individuals subject to the LGPD have the following rights:

confirmation of the existence of processing;
access to their data;
rectification of incomplete, inaccurate or outdated data;
anonymization, blocking or deletion of unnecessary or excessive data or data processed in noncompliance with the LGPD;
data portability upon express request;
deletion of personal data processed with consent, to the extent permitted by law;
information about public and private entities with which their personal data has been shared;
information about the possibility of denying consent and its consequences;
revocation of consent;
upon request, obtain the full text of the clauses used to carry out an international data transfer, subject to trade and industrial secrets;
lodge a complaint with a supervisory agency if they believe that the processing of their personal data infringes applicable data protection regulations.

In Brazil, the supervisory agency is the National Data Protection Agency (Agência Nacional de Proteção de Dados - ANPD).

Contact for data protection requests (Brazil and Ecuador)

In accordance with the LGPD and ANPD Resolution No. 18/2024, SoftwareOne has appointed a Data Protection Officer for Brazil. You may contact our DPO for any inquiries related to the processing of your personal data or to exercise your rights under the LGPD:

Vanessa Siqueira
data-protection.br@softwareone.com

The Data Protection Officer appointed for Ecuador (Encargado):

Nombre: Paul S Harris
Dirección: Ave. Naciones Unidas E699, Oficina 501. – Quito Ecuador
Teléfono: +593998325618

Supplement for Japan

This Supplement applies to the handling of personal information of individuals located in Japan which is collected in Japan by SoftwareOne Japan K.K. or any other SoftwareOne entity with which you have established a relationship, as the case may be (individually or collectively, “SoftwareOne” or “we”) or a third party acting as a data processor on behalf of SoftwareOne, and supplements the above Privacy Notice. We comply with the Act on the Protection of Personal Information of Japan (Act No. 57 of 2003; the “APPI”).

Corporate Information

Under this Supplement, the entity responsible for handling your personal information is as follows:

Name: SoftwareOne Japan K.K.
Address: Hulic JP Akasaka Building 8F, 2-5-8 Akasaka, Minato-ku, Tokyo 107-0052
Representative: Kenji Hasegawa, CEO

Personal Information

“Personal information”, “personal data” and other related terms in this Supplement are to be interpreted as used in the APPI, unless otherwise defined herein; accordingly:

“personal information” means information relating to a living individual which falls under any of the following items:

information containing a name, date of birth, or other identifier or the equivalent (meaning all items (excluding individual identification codes) made by writing, recording, sound or motion, or other means, in a document, drawing, or electronic or magnetic record (this includes a record created in electronic or magnetic form (meaning electronic form, magnetic form, or any other form that cannot be perceived with the human senses; the same applies in the following item (ii)) which can be used to identify a specific individual (this includes any information that can be easily collated with other information and thereby used to identify that specific individual); and
those containing an individual identification code; and

“personal data” means personal information compiled in a personal information database or the equivalent.

Purposes of Use

We handle personal information solely within the scope necessary to achieve the purposes of use specified in the above Privacy Notice, except where otherwise permitted by the APPI or with your prior consent.

Proper Acquisition

We collect personal information in an appropriate manner and will not acquire any personal information through deception or other improper means.

Security Control Measures

We implement necessary and appropriate security control measures, including organizational, personnel, physical and technical safeguards, in order to prevent the leakage, loss or damage of any personal data we handle.

Joint Use

We may share and jointly use your personal data among our group companies.

Items of Personal Data: As described in the “Relevant personal data” paragraph in each situation set forth in the above Privacy Notice.
Scope of Joint Users: SoftwareOne AG and its consolidated subsidiaries.
Purposes of Use: As described in Section 3 “Purposes of Use” above.
Responsible Party for managing the personal data: SoftwareOne Japan K.K. (as identified in Section 1 above).

Cross Border Transfers

If we transfer your personal data to a third party outside Japan (excluding the EU and the UK), we will obtain your prior consent unless the recipient ensures an APPI-adequate level of protection or another legal exception under the APPI applies. Before seeking to obtain your prior consent, we will provide you with information on the name of the relevant foreign country, the personal information protection system of the foreign country, and the measures taken by the relevant third party to protect personal information.

Provision to Third Parties & Record-Keeping

We will not provide your personal data to any third party without your prior consent, except where permitted by the APPI or otherwise provided in this Supplement. When providing or receiving personal data from a third party, we will create and retain records in accordance with the APPI.

Your Rights under the APPI

In accordance with the APPI, you may request us for:

notification of the purposes of use of the personal data we hold;
disclosure of the content of your personal data we hold and the records we retain, or correction, addition or deletion of the content of your personal data we hold, if the content of such personal data is factual;
suspension of use or erasure of your personal data we hold if the personal data has been obtained or is being handled in violation of the APPI; or
cessation of third-party provision of your personal data we hold if the personal data is being provided to a third party in violation of the APPI.

You may also make a complaint about our handling of your personal data we hold, in accordance with the APPI. Such request or complaint must be made by submitting an inquiry to our contact point which can be found in Section 11. We will respond to such request or complaint in accordance with the APPI. Please note that we may collect the actual costs from you for taking the relevant measures in responding to your request for notification of the purposes of use of the personal data we hold or your request for disclosure of the content of the personal data we hold.

Sensitive Personal Information

We will not acquire any “sensitive personal information” as specified in the APPI (e.g., race, creed, social status, medical history, criminal record, the fact of having suffered damage by a crime) unless permitted under the APPI or with your prior consent.

Contact Point

To exercise your rights or for inquiries regarding our handling of personal data in Japan, please contact:

SoftwareONE Japan K.K.
Hulic JP Akasaka Building 8F, 2-5-8 Akasaka, Minato-ku, Tokyo 107-0052
+81 3 5005 2801
info.jp@softwareone.com

Supplement for UAE

This Supplement applies where personal data is processed in the United Arab Emirates (“UAE”) or where the UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data (“UAE PDPL”) is applicable. This Supplement shall be read together with the above Privacy Notice. Where any conflict arises, the provisions of this Supplement prevail for processing activities subject to the UAE PDPL.

Overseas Transfers (Articles 22–24 UAE PDPL)

SoftwareOne may transfer personal data outside the UAE only in accordance with the requirements of the UAE PDPL. Such transfers may take place where:

The destination country appears on the UAE Data Office’s approved adequacy list;
Appropriate contractual safeguards or legally recognized transfer mechanisms are implemented; or
An exception under the UAE PDPL applies.

SoftwareOne ensures that all cross border transfers are supported by appropriate protection measures consistent with the UAE PDPL and the internal data protection standards.

Personal Data Breach Notification (Article 9 UAE PDPL)

In the event of a personal data breach that may pose a risk to the confidentiality, privacy, security or rights of individuals, SoftwareOne will:

Notify the UAE Data Office without undue delay, and
Notify affected individuals where the breach is likely to cause significant harm or impact.

SoftwareOne may maintains internal incident response processes to ensure timely detection, assessment, reporting, and mitigation of personal data breaches.

Data Protection Officer Requirement (Articles 10–11 UAE PDPL)

SoftwareOne appoints a Data Protection Officer (“DPO”) where required under the UAE PDPL, including scenarios involving:

High risk processing operations, or
Large scale processing of sensitive personal data.

The DPO supports ongoing compliance with the UAE PDPL, monitors internal controls, advises on data protection obligations and acts as a liaison with the UAE Data Office.

Rights of Individuals (Articles 13–20 UAE PDPL)

In addition to the rights outlined in the above Privacy Notice, individuals subject to the UAE PDPL may exercise the following rights:

Right of access to personal data;
Right to request correction or erasure;
Right to restrict or stop processing;
Right to data portability;
Right to object to automated processing or automated decision making.

Requests may be submitted through the contact channels specified in the above Privacy Notice, and SoftwareOne will respond within the timelines mandated by the UAE PDPL.

Legal Basis for Processing (Article 4 UAE PDPL)

SoftwareOne processes personal data based on one or more legal bases recognized under the law, including:

Consent;
Necessity for performance of a contract;
Compliance with legal obligations;
Protection of public interest;
Legitimate interests, to the extent permitted under the UAE PDPL.

Retention (Article 21 UAE PDPL)

Personal data subject to the UAE PDPL is retained only for the duration necessary to fulfil the purposes for which it was collected or as required by applicable legislation. SoftwareOne applies internal retention schedules aligned with the UAE PDPL’s data minimization and storage limitation principles.

Contact for UAE PDPL Requests

Individuals seeking to exercise their rights or raise concerns under the UAE PDPL may contact SoftwareOne at data-protection.me@softwareone.com.

Supplement for Qatar

This Supplement applies where personal data is processed within the State of Qatar or where the Qatar Personal Data Privacy Protection Law – Law No. 13 of 2016 (“Qatar PDPL”) is applicable. This Supplement shall be read together with the above Privacy Notice. Where any conflict arises, the provisions of this Supplement prevail for processing activities subject to the Qatar PDPL.

Overseas Data Transfers (Articles 15 & 16 Qatar PDPL)

SoftwareOne may transfer personal data outside the State of Qatar only in accordance with the requirements of the Qatar PDPL. Transfers may take place where:

The receiving country provides an adequate level of protection;
Explicit consent of the individual is obtained; or
Appropriate safeguards or legally recognized transfer mechanisms are implemented.

SoftwareOne ensures that all cross border transfers follow the protection standards mandated under the Qatar PDPL.

Personal Data Breach Notification (Article 14 Qatar PDPL)

In the event of a personal data breach, SoftwareOne will:

Notify the Ministry of Communications and Information Technology (MCIT) immediately, as required under the Qatar PDPL; and
Notify affected individuals where the breach is likely to result in harm or adverse impact.

SoftwareOne maintains internal procedures to detect, assess and report breaches in accordance with statutory obligations.

Consent Requirements (Article 4 Qatar PDPL)

SoftwareOne obtains consent in accordance with the Qatar PDPL, ensuring that:

Consent is explicit and informed;
Consent is obtained prior to the processing of personal data;
Additional safeguards are applied when processing sensitive personal data.

Where consent is withdrawn, SoftwareOne will cease processing activities unless another lawful basis under the Qatar PDPL applies.

Rights of Individuals (Articles 7–10 Qatar PDPL)

Individuals whose personal data is processed under the Qatar PDPL may exercise the following rights:

Right of access to personal data;
Right to request correction or erasure;
Right to object to processing;
Right to withdraw consent at any time.

Such rights can be exercised by reaching SoftwareOne at data-protection.me@softwareone.com. Replies will be received within the timelines specified under the Qatar PDPL.

Supplement for Australia

This Supplement applies where personal data is processed within Australia or where the Privacy Act 1988 (Cth) (“Privacy Act”) is applicable. This Supplement shall be read together with the above Privacy Notice. Where any conflict arises, the provisions of this Supplement prevail for processing activities subject to the Privacy Act.

The type of personal data we use and what we do with that depends on the relationship we have with you. Therefore, some parts of this Supplement, as well as of the above Privacy Notice may not be relevant for you or more than one part of this Supplement, as well as of the above Privacy Notice may apply to you.

The meaning of the term “personal data” in this Supplement, as well as in the above Privacy Notice, has the same meaning as set out in the Privacy Act.

This Supplement, as well as the above Privacy Notice may be replaced or supplemented in order to fulfil legal requirements, as well as to provide you with all necessary information on how we process your personal data.

Why we collect personal data

We collect personal data so that we can provide our services to you and your service provider, as well as reasonable associated purposes. These purposes include but are not limited to the purposes already reflected in the above Privacy Notice.

We may also collect your personal information for a purpose which is additional to the original purpose pursuant to which we originally received or collected the personal data.

Personal data we collect

The types of personal data we may receive or collect include the following:

Name or alias;
Contact details (such as address, postal address, email, phone number);
Date of birth;
Sex, gender, or gender identity;
Nationality or proof of residence (such as residence permits, work right permits or visa);
Employment data (such as current employment, past employment or other work history);
Educational qualifications (such as degrees, accreditations, occupational permits or occupational licences);
Identification documents (such as passport, driver’s licence, identity card or other similar documentation);
Pictures (such as head shots);
Transaction and bank account details;
Any personal information that is inherently disclosed when you or your service provider communicate with us (such as metadata); and
Criminal history.

In limited circumstances we may need to obtain health information from you. In such circumstances we will make an express request and will treat any information as strictly confidential.

Further details about the personal data we collect and how it is processed or used depending on our relationship with you can be found in the above Privacy Notice.

How we collect personal data

We receive or collect personal data directly from your or your service provider’s in interactions with us, such as when you create a user account, sign up for our services, submit queries or engage with the services we provide. In addition to this, any personal data that you provide to us will constitute the collection of personal data for the purposes of this Supplement, as well as the above Privacy Notice.

Personal data may also be collected via our website, forms, phone calls, emails or through third-party providers with your consent or to the extent necessary to provide the services to you.

How we hold and protect personal data

We will only retain your personal data only so long as is necessary to provide our services, after which time we will destroy it, unless we:

are required by law to retain it; or
are required to preserve it for the purposes of providing services to another customer; or
have agreed to a request by you or your service provider to preserve that personal information; or
have a legitimate purpose for retaining it.

We take all reasonable steps to protect all information we hold, including personal data.

Cookies and other similar technologies

We may use cookies and similar technologies (for simplicity reasons, hereinafter referred to as “Cookies”), when you use our websites, platforms, applications as well as other products and services.

Our Cookie Banner and consent management system show you a list of the Cookies we use, including their provider, purpose, description and other relevant information. In the default setting, only the essential Cookies are enabled. Via the consent management system, you can determine whether you allow the setting of additional Cookies or not. You can adjust your preferences at any time via the consent management system.

Further information about the ways that we may track your personal information including on social media (e.g., Facebook) can be found in the above Privacy Notice.

Disclosure to third parties

We may disclose your personal data to parties to fulfil the purposes described above, including to provide services to you or your service provider. Due to SoftwareOne’s international group structure, personal data will be disclosed to certain departments and persons on a need-to-know basis to process personal data so that we can provide our services. For all intragroup personal data access and transfers, we comply with the provisions of the Privacy Act.

Third party service providers contracted by SoftwareOne may also receive personal data to provide or facilitate the provision of our services. These include, service providers who support us with order fulfilment, payment / billing, customer service, finance, auditing, fraud detection, IT services, communication, hosting, logistics, email delivery, marketing, sales, data analysis, event management, training, surveys, printing, archive, advisory and consulting services.

We may disclose your personal data to further recipients, such as private as well as public entities and institutions, including law enforcement, data protection authorities, tax authorities, credit agencies, debt collectors, banks, courts, hotels or other companies insofar as there is a legal basis for such disclosure.

Disclosure overseas

As we operate in a number of countries it is possible that your personal data may need to be transferred outside of Australia to countries in which we operate including the European Union, the United Kingdom and Switzerland, in order to provide our services. We will take reasonable steps to ensure that such recipients comply with the Privacy Act and maintain the confidentiality and security of your personal information.

Accessing or correcting personal data

You may contact us to access your personal data we hold about you and to request corrections if any details are inaccurate or incomplete. We may refuse to provide access you with to your personal data if:

we are legally permitted to do so and consider it appropriate; or
are required by law to deny the request.

Questions and complaints

If you have any requests, comments, queries or complaints in relation to your personal data, our handling of your personal data or how we handle personal data generally, please contact our information officer at data-protection.apac@softwareone.com.

We will respond to any requests or complaints within a reasonable period (usually 30 days).

If you disagree with our response or any decision that we make in respect of your personal data, including in respect of any complaint that you have made, you may refer your complaint to the Office of the Australian Information Commissioner by visiting www.oaic.gov.au, calling 1300 363 992 or by emailing enquiries@oaic.gov.au.

Supplement for New Zealand

This Supplement applies where personal data is processed within New Zealand or where the Privacy Act 2020 (“Privacy Act”) is applicable. This Supplement shall be read together with the above Privacy Notice.

The meaning of the term “personal data” in this Supplement, as well as in the above Privacy Notice has the same meaning as set out in the Privacy Act.

Why we collect personal information

We collect personal data so that we can provide our services to you and your service provider, as well as reasonable associated purposes. These purposes include but are not limited to the following:

communicate with you and your service provider, process requests and respond to requests;
process comments or posts;
register and send newsletters to you which you subscribe to;
marketing purposes;
registration, authentication and administration of user accounts;
license monitoring purposes;
provision of demo products and services as well as trials (also from third parties);
analysis purposes in order to improve our products and services;
tailor our website content and experience to your interests;
maintain the security of our websites, platforms, applications as well other products and services;
comply with legal and regulatory requirements and requests; and
establish, exercise and defend legal claims.

We may also collect your personal data for a purpose which is additional to the original purpose pursuant to which we originally received or collected the personal data.

You are not required to give us your personal data, however, if you choose not to we may be unable to provide, in whole or in part, our services to you and your service provider.

Further details about the personal data we collect and how it is processed or used depending on our relationship with you can be found in the above Privacy Notice.

Personal data we collect

The types of personal data we may receive or collect include the following:

Name or alias;
Contact details (such as address, postal address, email and phone number);
Date of birth;
Sex, gender or gender identity;
Nationality or proof of residence (such as residence permits, work right permits or visa);
Employment data (such as current employment, past employment or other work history);
Educational qualifications (such as degrees, accreditations, occupational permits or occupational licences);
Identification documents (such as passport, driver’s licence, identity card or other similar documentation);
Pictures (such as head shots);
Transaction and bank account details;
Any personal data that is inherently disclosed when you or your service provider communicate with us (such as metadata); and
Criminal history.

During the course of providing services to you or your service provider we may create information about you which constitutes personal data including things such as emails, letters or other internal records.

Further details about the personal data we collect and how it is processed or used depending on our relationship with you can be found in the above Privacy Notice.

How we collect personal data

Information which we create as a result of providing services to you or your service provider which constitutes personal data will also constitute the collection of personal data for the purposes of this Supplement, as well as the above Privacy Notice.

Personal data may also be collected via our website, forms, phone calls, emails or through third-party providers with your consent or to the extent necessary to provide the services to you.

How we hold and protect personal data

We will only retain your personal data only so long as is necessary to provide our services, after which time we will destroy it unless we:

are required by law to retain it; or
are required to preserve it for the purposes of providing services to another customer; or
have agreed to a request by you or your service provider to preserve that personal data; or
have a legitimate purpose for retaining it.

We take all reasonable steps to protect all information we hold, including personal data.

Cookies and other similar technologies

Further information about the ways that we may track your personal data including on social media (e.g., Facebook) can be found in the above Privacy Notice.

Disclosure to third parties

We may disclose your personal data to parties to fulfil the purposes described above including to provide services to you or your service provider. Due to SoftwareOne’s international group structure, personal data will be disclosed to certain departments and persons on a need-to-know basis to process personal data so that we can provide our services. For all intragroup data access and transfers, we comply with the provisions of the Privacy Act.

We may disclose your personal data to further recipients to the extent required to fulfil the purpose, such as private as well as public entities and institutions, including law enforcement, data protection authorities, tax authorities, credit agencies, debt collectors, banks, courts, hotels or other companies insofar as there is a legal basis for such disclosure.

Disclosure overseas

As we operate in a number of countries it is possible that your personal data may need to be transferred outside of New Zealand to countries in which we operate including the European Union, the United Kingdom and Switzerland, in order to provide our services. We will take reasonable steps to ensure that such recipients comply with the Privacy Act and maintain the confidentiality and security of your personal data.

Accessing or correcting personal data

we are legally permitted to do so and consider it appropriate; or
are required by law to deny the request.

Questions and complaints

We will respond to any requests or complaints within a reasonable period (usually 30 days).

If you disagree with our response or any decision that we make in respect of your personal data including in respect of any complaint that you have made, you may refer your complaint to the Privacy Commissioner (Te Mana Matapono Matatapu) by visiting www.privacy.org.nz, calling 0800 803 909 or by emailing enquiries@privacy.org.nz.

Supplement for India

Applicability

This Supplement forms an integral part of the above Privacy Notice and applies solely to Data Principals located in India.

This Supplement governs the processing of digital personal data by SoftwareOne in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made thereunder ("DPDP Rules"), including:

personal data collected in digital form within India;
personal data collected in non-digital form and subsequently digitized; and
processing of digital personal data carried out outside India in connection with the offering of goods or services to Data Principals within India, in accordance with Section 3 of the DPDP Act.

In the event of any inconsistency between this Supplement and the above Privacy Notice, the provisions of this Supplement shall prevail to the extent of such inconsistency for processing governed by Indian law.

Definitions

Unless otherwise defined herein, capitalized terms used in this Supplement shall have the meanings ascribed to them under the DPDP Act and the DPDP Rules.

For the purposes of this Supplement:

"Board" means the Data Protection Board of India established under the DPDP Act;
"Data Principal" means the individual to whom the personal data relates and where such individual is

a child, includes the parents or lawful guardian of such child; or
a person with disability, includes her lawful guardian acting on her behalf.

"SoftwareOne" means the relevant SoftwareOne entity acting as a Data Fiduciary in relation to the processing of personal data under Indian law.

Notice to Data Principals

Consent to the processing of personal data by SoftwareOne shall be obtained only upon the Data Principal’s acceptance of this Supplement and the above Privacy Notice.

Contact for Data Protection Requests

Any request for withdrawal of consent, request for access to information, correction, erasure, grievance or any other communication under the DPDP Act may be addressed to:

Designation / Department: Regional General Counsel
Email ID: data-protection.apac@softwareone.com

Alternately, the Data Principal may communicate his request at: Shweta.Sinha@softwareone.com.

Grievance Redressal Mechanism

SoftwareOne has established an effective grievance redressal mechanism to address grievances raised by Data Principals in relation to the processing of their personal data.

A Data Principal may submit a grievance by contacting the Grievance Officer at:

Name: Regional General Counsel
Designation: Grievance Officer – India
Email ID: data-protection.apac@softwareone.com
Postal Address: 7th Floor, Tower 1A, International Tech Park, Near Sector 59, Behrampur, Gurugram, Haryana-122101.

SoftwareOne shall acknowledge the grievance and endeavor to resolve it within 30 days from the date of receipt.

A Data Principal shall exhaust the grievance redressal mechanism provided herein before approaching the Board, in accordance with Section 13 of the DPDP Act.

Nomination

A Data Principal may nominate one or more individuals to exercise her rights under the DPDP Act in the event of her death or incapacity.

Such nomination may be made by:

submitting a request through the user account or digital interface made available by SoftwareOne; or
submitting a written request to SoftwareOne using the contact details provided in this Supplement, along with such information and verification details as may be reasonably required by SoftwareOne.

Processing and Transfer of Personal Data Outside India

SoftwareOne may transfer personal data outside the territory of India only in accordance with:

any restrictions notified by the Central Government on the transfer of personal data to specified countries or territories; and
the conditions and safeguards specified by the Central Government through general or special orders.

Where such transfers occur, SoftwareOne shall ensure compliance with all applicable requirements under the DPDP Act, the DPDP Rules, and other applicable Indian laws.

Updates to this Supplement

This Supplement may be updated from time to time to reflect changes in applicable law, including amendments to the DPDP Act or the DPDP Rules, or guidance, directions or orders issued by the Government of India or the Data Protection Board of India. Material changes shall be notified to Data Principals through appropriate and reasonable means.

Children’s Personal Data

SoftwareOne does not knowingly process personal data of children, as defined under the DPDP Act.

Where processing of personal data of a child becomes necessary under applicable law, SoftwareOne shall ensure compliance with the requirements relating to verifiable parental consent and other safeguards prescribed under the DPDP Act and the DPDP Rules.

Additional DPDP-Specific Disclosures

Right to Withdraw Consent: Withdrawal of consent shall not affect the legality of processing carried out prior to such withdrawal.

Data Retention: SoftwareOne shall retain personal data only for such period as is necessary to fulfil the specified purpose or to comply with applicable law, after which such data shall be erased in accordance with the DPDP Act and the DPDP Rules.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in applicable laws, our practices and services, legal requirements or to improve transparency. When we make significant changes, we will notify you by updating the Effective Date at the top of this Privacy Notice. Therefore, we encourage you to review this Privacy Notice periodically to stay informed about how we collect, use and protect your personal data.

Following the merger between SoftwareOne and Crayon, please note that legacy privacy notices of both companies may continue to apply in respect of the personal data collected prior to the Effective Date of this Privacy Notice.

For personal data collected by SoftwareOne prior to the Effective Date, please refer to the legacy Privacy Notice available here.
For personal data collected by Crayon prior to the Effective Date, please refer to the legacy Privacy Notice available here.

Version history

Version	Date
1.0	June 2020
2.0	September 2021
3.0	August 2026