Privacy Policy of BHS Logistics

Handling of personal data in customer relationships

In order to deliver/pick up goods to or from you, we register the information we need. The information will not be used in other contexts. All information we/you register electronically and/or manually with BHS Logistics is treated confidentially and in accordance with the General Data Protection Regulation. The information is not transferred to third parties – except for this, where information is passed on to freight forwarders and hauliers in our transport network for the performance of the transport task.

BHS Logistics A/S is the data controller for the processing of the personal data that we have received about you. According to Articles 13 and 14 of the General Data Protection Regulation, we must provide you with a number of information when we process personal data about you.

We will need to provide you with the following information:

1. Contact information

2. Purposes and legal basis for the processing

3. Categories of personal data

4. Recipients or categories of recipients

5. Transfer to beneficiaries in third countries or international organizations

6. Sources

7. Storage

8. Automated decision-making and profiling

9. Your rights

10. Complaint to the Data Protection Authority

1. Contact information

We typically record the following data:

Name, address, telephone number, email address, CCTV surveillance material, photos of delivered goods and any CVR. number.

We do not process sensitive information about you. However, if you provide sensitive personal data to us yourself, we consider it your consent for us to store the data. The information will not be used in other contexts.

If you have any questions about our processing of your personal data, you are welcome to contact BHS's Compliance Officer by e-mail lbd@bhslogistics.dk or phone +45 93 1523

2. Purposes and legal basis for the processing

We process your personal data for the following purposes:

· Agreement on the transport or storage of goods

· Operational and safety reasons

· Crime prevention

· Customer advice

· Customer care

· Customer management

· Credit rating

· Internal risk management

· Marketing

· Compliance with obligations under the law

The legal basis for our processing of your general personal data is based on:

ü Article 6(1)(a) of the General Data Protection Regulation, from which it follows that we may process your ordinary personal data if you have consented to this.

ü Article 6(1)(b) of the General Data Protection Regulation, from which it follows that we may process your general personal data if it is necessary as a result of an agreement you have entered into with us.

ü Article 6(1)(c) of the General Data Protection Regulation, from which it follows that we may process your ordinary personal data if it is necessary to comply with a legal obligation.

ü Article 6(1)(f) of the General Data Protection Regulation, from which it follows that we may process your general personal data if it is necessary for the pursuit of a legitimate interest and that your interests, fundamental rights or freedoms do not take precedence over this.

Legitimate interests pursued by the processing

As mentioned above, our processing of your personal data is partly based on the balancing of interests rule in Article 6(1)(f) of the General Data Protection Regulation.

The legal basis is used in connection with CCTV surveillance at our locations. You will be informed about the CCTV, including through clear signage, and you can therefore reasonably expect the treatment to take place. As a customer of ours, the requirement for a relevant and appropriate relationship is met. The processing is carried out for crime prevention purposes as well as for operational and safety reasons, including the tracking of goods and the prevention of accidents, which are considered legitimate interests. The legal basis is also used in connection with the processing of personal data about driving license or passport number. You will be informed of this in connection with the collection of the goods, and you can therefore reasonably expect the processing to take place. As a customer of ours, the requirement for a relevant and appropriate relationship is met. The processing takes place for operational and safety reasons, including documentation that the goods have been handed over to the correct recipient, which is considered legitimate interests.

Finally, we use the legal basis in connection with the recording of photos of delivered goods, where the goods may be delivered without a receipt. You will be informed of this in connection with the establishment of the contractual relationship, and you can therefore reasonably expect the processing to take place. As a customer of ours, the requirement for a relevant and appropriate relationship is met. The processing is carried out to document that correct delivery has taken place. This may be relevant in connection with the establishment, exercise, or defense of a legal claim, which is considered a legitimate interest.

3. Categories of personal data

We process the following categories of personal data about you:

· Address information

· Email Information

· Information about photos of delivered goods

· Name information

· Phone number information

· Information on CCTV footage

4. Recipients or categories of recipients

We disclose or disclose your personal data to the following recipients:

· Lawyers

· Injuries

· External carriers

· Insurance companies

· Internal companies in the group

· Public authorities

· Data processors

5. Transfer to beneficiaries in third countries or international organizations

We do not disclose or entrust your personal data to recipients outside the EU or EEA.

6. Sources

In some cases, we have received the personal data from the sender of the goods. The sender is typically the supplier from whom you have purchased the goods to be transported or stored. If you are the sender of the goods yourself, you will have provided us with the information yourself.

7. Storage

Data is stored for a minimum of 5 years and a maximum of 6 years. The Bookkeeping Act requires storage of accounting records for 5 years and Pharma customers require storage for 6 years. We store CCTV surveillance material for up to 30 days.

App data and app images are only used to service BHS' customers. Information is not disclosed and cannot be accessed by third parties. Data is stored for 10 years.

In the event of a specific case, and after a specific assessment, the information may be stored for a longer period.

8. Automated decision-making and profiling

We do not use automated decision-making or profiling.

9. Your rights

According to the General Data Protection Regulation, you have several rights in relation to our processing of your personal data.

You can exercise your rights by contacting us using the contact details set out above.

Right of access: You have the right to access the information we process about you, as well as a range of additional information.

Right to rectification: You have the right to have incorrect information about yourself corrected.

Right to erasure: In special cases, you have the right to have information about you deleted before the time of our general deletion occurs.

Right to restriction of processing: In certain cases, you have the right to have the processing of your data restricted. If you have the right to have the processing restricted, we may in future only process the data, except for storage, with your consent, or for the purpose of establishing, exercising, or defending legal claims, or for the protection of a person or important public interests.

Right to object: In certain cases, you have the right to object to our otherwise lawful processing of your information. You can also object to the processing of your data for direct marketing purposes.

Right to data portability: In certain cases, you have the right to receive your data in a structured, commonly used, and machine-readable format and to have this data transferred from one data controller to another without hindrance.

The right to withdraw consents: You have the right to withdraw consents at any time.

You can read more about your rights in the Danish Data Protection Agency's guidance on the rights of data subjects, which you can find at the address https://www.datatilsynet.dk.

10. Complaint to the Data Protection Authority

You have the right to lodge a complaint with the Danish Data Protection Agency if you are dissatisfied with the way we process your personal data. You will find the Danish Data Protection Agency's

Contact information at: https://www.datatilsynet.dk.

The document was last updated on 09.02.2023.