360ContentMatrix

Privacy policy

Who is responsible

BGS Crossmedia SARL, which trades as 360Crossmedia, 4 rue de l'Eau, L-1449 Luxembourg, registered with the Luxembourg Trade and Companies Register under number B 75892 ("360Crossmedia", "we"), is the controller of the personal data processed through this site and through the 360ContentMatrix service, within the meaning of Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), and of the Luxembourg Law of 1 August 2018 on the organisation of the National Commission for Data Protection and the general data protection framework.

For the content that a customer submits to the service, and for any personal data that content contains, the customer is the controller and 360Crossmedia acts as its processor, under the data processing terms set out in the terms of use.

We have not appointed a data protection officer, as the law does not require one for our activity. For any question about your personal data, write to contact@360crossmedia.com or to BGS Crossmedia SARL, 4 rue de l'Eau, L-1449 Luxembourg, with "Personal data" in the subject.

Scope

This policy applies to the public pages of the site, to the contact form, and to the 360ContentMatrix service used by the professionals who hold an account.

It explains which personal data we process, for which purposes and on which legal bases, who receives it, where it goes, how long we keep it, how we protect it, and the rights you have over it.

What we process, and why

  • Your email address, to send you sign in links and to identify your account. Legal basis: the performance of the contract between your organisation and us (article 6(1)(b) GDPR) and our legitimate interest in securing access to the service (article 6(1)(f) GDPR).
  • Your name as signer, the name of your workspace and its settings, to run the service and produce your certificates. Legal basis: the performance of the contract.
  • Your account's offer and the number of repurposings made each month, to apply the limits of your offer and to answer your questions about your usage. Legal basis: the performance of the contract.
  • The content you submit (texts, links, images, audio and video files) and the pieces written from it, to produce, show and export your pieces. Legal basis: the performance of the contract; where that content contains personal data of other people, we process it on the customer's instructions, as its processor.
  • Your signatures (date, signer name, version of the terms, fingerprint of the signed content), as the record of what you approved. Legal basis: the performance of the contract, and our legitimate interest, and that of the customer, in proving what was approved and by whom.
  • Usage records (which steps ran and what they cost), to run, secure and bill the service. Legal basis: the performance of the contract, and our legal obligations as to accounting.
  • The feedback you choose to give on a repurposing (a rating, and a comment when you write one) or through the Report a problem button (your words and the address of the screen you were on), with what the repurposing on screen was (its formats, languages and visual style, and how many pieces were changed before signing), to fix what does not work and improve the service. Our team reads it, an artificial intelligence model helps sort it, and when you report a problem we may write to you once it is fixed. Legal basis: our legitimate interest in improving the service (article 6(1)(f) GDPR).
  • Technical data in our server logs (IP address, browser, pages requested, date and time, errors), to keep the service secure, to limit abuse and to investigate incidents. Legal basis: our legitimate interest in the security of the service.
  • What you send through the contact form of the public pages (your name, your email address and your message), to answer you. It reaches our team by email. Legal basis: our legitimate interest in answering, or the steps you ask for before a contract.
  • Your acceptance of the terms of use (date and version), to show that the terms in force were accepted. Legal basis: the performance of the contract and our legitimate interest in proving that acceptance.

We do not use your content or your personal data to train artificial intelligence models, and we do not sell, rent or trade personal data.

We do not use any analytics, audience measurement, advertising or tracking tool on the site or in the service.

Artificial intelligence

The service uses artificial intelligence models, provided by processors, to read your sources, to write the pieces and to describe or draw the visuals. The models process your content only to produce what you ask for.

No decision producing legal effects concerning you, or similarly significantly affecting you, is taken by automated means within the meaning of article 22 GDPR. Every piece is read, corrected where needed and signed by a person before it can be exported.

The pieces written by the service are proposals. The person who signs them, and the organisation on whose behalf they are published, hold the editorial responsibility for them, including under Regulation (EU) 2024/1689 on artificial intelligence.

Where the data comes from

We collect the data you give us directly, the data your organisation gives us when it asks us to open your account, the content you submit, and the technical data your browser sends when you use the site.

The content you submit may contain personal data of other people (for example names, quotes or photographs). The customer who submits it is responsible for having a legal basis to do so and for informing the people concerned where required.

Who receives it

Within 360Crossmedia, only the people who need it to run, support, secure or bill the service have access to your data, and they are bound by confidentiality.

We work with processors bound by contract under article 28 GDPR, who act only on our instructions and offer sufficient guarantees of security and confidentiality: our hosting providers, the providers of the language, image and transcription models that write and illustrate your pieces, and our email delivery provider. The list of our processors is available on request.

Within your workspace, the members of your organisation who have an account can see the repurposings, pieces, signatures and certificates of that workspace.

We may disclose data where the law requires it, to comply with a court order or a request from a competent authority, or to establish, exercise or defend legal claims.

If 360Crossmedia were to take part in a merger, acquisition or sale of assets, the data could be transferred to the entity concerned, which would remain bound by this policy.

Transfers outside the European Economic Area

Some of our processors may process data outside the European Economic Area. Any such transfer relies on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified recipients, or on the standard contractual clauses adopted by the European Commission, with additional measures where needed. A copy of the relevant safeguards is available on request.

How long we keep it

  • Account data: for as long as the account is active, then deleted within three months after the end of the account, unless a longer period is required by law.
  • Content and pieces: for as long as the account is active; a repurposing removed from the Library is deleted. At the end of the account, they are deleted after the period during which the customer may export them, as set out in the terms of use.
  • Signatures and certificates: kept as the record of what was approved, never modified, for the life of the account and then for ten years, the period during which claims between traders may be brought under article 189 of the Luxembourg Commercial Code.
  • Usage and billing records: ten years, as required for accounting documents by article 16 of the Luxembourg Commercial Code.
  • Feedback: for as long as the account is active, then deleted with the account data.
  • Server logs: for the time needed to detect and investigate incidents, then deleted or made anonymous.
  • Contact form messages: as long as needed to answer and follow up, and at most three years after our last exchange.
  • Proof of acceptance of the terms: for the life of the account and then for ten years.

How we protect it

We apply technical and organisational measures appropriate to the risk, in line with article 32 GDPR, including: encryption of data in transit; sign in by single use links sent by email, without passwords to steal; sessions that expire; access to data limited to the people who need it; records of signatures that cannot be modified; backups; and the monitoring of our systems.

If a personal data breach is likely to result in a risk to your rights and freedoms, we notify the National Commission for Data Protection within 72 hours of becoming aware of it and, where the risk is high, we inform the people concerned without undue delay, as articles 33 and 34 GDPR require.

Your rights

Under the GDPR, you have the right of access to your data, the right to have it rectified, the right to have it erased, the right to restrict its processing, the right to data portability, and the right to object to a processing based on our legitimate interest. Where a processing is based on your consent, you may withdraw it at any time, without affecting what was done before.

Some rights have limits set by law: for example, the records of signatures cannot be erased while they are needed as evidence of what was approved.

To exercise your rights, write to contact@360crossmedia.com. We may ask you to prove your identity. We answer within one month of receiving your request; this period may be extended by two further months where needed, in which case we tell you why within the first month.

Where we process personal data on behalf of a customer, as its processor, we pass your request on to that customer and help it to answer.

You also have the right to lodge a complaint with the National Commission for Data Protection (Commission nationale pour la protection des données, CNPD), 15 Boulevard du Jazz, L-4370 Belvaux, Luxembourg, cnpd.public.lu, or with the supervisory authority of the country where you live or work.

Children

The service is intended for professionals. It is not directed at children, and we do not knowingly collect data about people under 16.

Cookies

We only set the cookies the service needs: the one that keeps you signed in, and the one that remembers the theme you chose. No advertising or audience measurement cookie is set. The cookie policy describes each of them.

Changes to this policy

We may update this policy to reflect changes in the law, in our practices or in the service. The date of the last update is shown below. Where a change is significant, we inform the account holders by email or in the service before it applies.

Last updated: 28 October 2026.