DANX is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you in accordance with the General Data Protection Regulation (GDPR). Please read it carefully.

The GDPR says that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

This notice is separated into the following sections for ease of use. If you have any questions about this notice or how we collect and use personal information about you please contact us.

1. The DANX Carousel Group
2. Objective and purpose
3. How and why do we use your information?
4. What personal information do we collect and how do we collect it?
5. Consent for processing personal data
6. Where we store your information
7. Data security measures
8. Data transfers
9. How long will we retain your data for?
10. Data subject rights
11. Changes to this privacy notice
12. Contact details

1. The DANX Carousel Group

The DANX Carousel Group of companies (hereafter “The Group,” “We,” “Our”) consists of DANX, DANX ILS, UT, TBS, FOMAB, TLS Group, LPR Group, Carousel, Alltrans and Logik, and is a comprehensive partner for logistics and supply chain services such as time-critical spare parts distribution, warehousing, battery logistics, customs clearance, and more. We operate in the UK, EU – Ireland, Benelux, DACH, Iberia, Nordics, Baltics, Poland and EEA – Norway.

2. Objective and purpose

The objective of this privacy notice is to describe how we collect and use, store and protect users’ personal information via our website in accordance with General Data Protection Regulation (GDPR) in line with EU, UK and EEA regulations, and National and International applicable laws.

The GDPR legislation says that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
• Relevant to the purposes we have told you about and limited only to those purposes
• Accurate and kept up to date
• Kept only as long as necessary for the purposes we have told you about
• Kept securely using robust security measures (e.g. encryption)

3. How and why do we use your information?

We use your personal data to help us run our website, provide our services, and improve your overall experience. We only collect and use your information when we have a lawful reason to do so, or through your consent and we always aim to be transparent about what we do with it.

To operate our website: We process information such as your IP address, device details, and browsing behaviour to:

• Load pages correctly
• Keep the site secure
• Ensure it works across different devices and browsers

This processing is necessary for the legitimate interest of operating a functional and secure website.

To improve our website and services: We use analytics tools as outlined in our Cookie Notice to understand:

• How visitors use our website
• Which pages are most popular
• Where we can improve usability

This is based on your consent (for non-essential cookies) or our legitimate interests in improving our services.

To respond to your enquiries: If you contact us using our contact us form, we use your details to email the message to the appropriate department and to be able to respond to your message and administer your request. This processing is necessary for our legitimate interests in communicating with you or to take next steps at your request.

To send you updates, newsletters, or marketing (optional): If you sign up or consent, we use your email or contact details to:

• Send you news
• Share updates
• Provide marketing tailored to your interests

This is based on your consent, and you can opt out at any time by clicking the “Consent Preferences’ within the Cookie Notice and unsubscribe.

To maintain security and prevent fraud: We may process data to:

• Detect suspicious activity
• Protect our website from cyber‑attacks
• Ensure the integrity of our systems

This is necessary for our legitimate interests in keeping our services safe and secure and to comply with legal obligations.

To meet legal or regulatory requirements: We may process your data to:

• Respond to lawful requests from authorities
• Maintain business records
• Comply regulatory obligations

This processing is required by law.

What we will never sell your personal information, use your data for unrelated purposes without telling you or collecting more information than we need

Consent preferences/ Cookie Notice: We reference the use of cookies within our Cookie Notice (available to view on our websites) and the user has the option to change consent preferences at any time.

4. What personal information do we collect and how do we collect it?

Personal data is any information relating to an identified or identifiable natural person to whom data relates. (e.g. name, address), we collect personal data from you in the following ways.

Contact form information: This is information about you (such as your name, address, email address, telephone number), that you provide when filling in forms whether on our website or forms on another website (e.g. LinkedIn). This could include, for example, forms which you complete to register for a service, place an order, sign up for a newsletter or enter a competition

Content: This is information about you which you provide when you post content on our website. This may include status updates, photographs, videos, blog posts, discussion board posts, survey responses and other content which you post on our website.

Emails and records of other contact: This is information you provide when you contact us (for example by email, post or SMS) or when you respond to correspondence from us. This may include enquiries about our services or products, reviews, follow-up comments or complaints.

Technical information: This is information about you which is collected via technical means such as cookies, webpage counters and other analytics tools.

In addition, we may also receive personal information about you or your interaction with our website and other websites from external sources, third parties or other channels. (e.g. advertising networks, marketing companies, analytics providers or search information providers).

In this case you will be informed when we collect that data if we intend to share this internally and combine it with data collected on this website and the purpose.

We obtain information from the following publicly available sources:

• LinkedIn and other social media platforms
• Freely available online resources and websites
• Companies House

5. Consent for processing personal data

We process certain personal data based on your consent, as required under GDPR. This means you have a genuine choice and control over whether we use your information for these purposes.

What are you consenting to?
When you provide consent, you agree that we may process your personal data for the 5. specific purposes described at the point of collection, such as:

• Receiving marketing communications
• Participating in surveys or research
• Sharing data with named third parties for agreed purposes

Your rights

• Voluntary: Giving consent is entirely optional
• Withdrawal: You can withdraw your consent at any time without affecting the lawfulness of processing before withdrawal. To withdraw, please email us at gdpr@danxcarousel.com, update your preferences in your account settings, or click the unsubscribe link in our communications

Granular choices: Where we ask for consent for multiple purposes, you will be able to choose which purposes you agree to and which you do not.

Record keeping
We maintain records of:

• Who consented
• When and how consent was given
• The wording presented at the time
• Any withdrawal of consent

6. Where we store your information

Contact form information: Website CRM or Microsoft Dynamics CRM

Content: Website Media Library

Emails and records of other contact: Microsoft 365 – stored in the Cloud

Our head office is based in Ishoj, Denmark, and we have several other offices located throughout Europe, the UK and within the EEA where we have on-prem servers.

7. Data security measures

We maintain an information security and privacy management framework proportionate to risk, designed to ensure confidentiality, integrity, availability, and resilience of personal data processing.

Organisational measures include governance and accountability structures (roles, policies, training), risk and DPIA processes, access control and least privilege, vendor and transfer controls, incident response and breach notification procedures, data lifecycle and retention management, regular testing and assurance (audits, vulnerability management, exercises), and business continuity/disaster recovery. Measures are reviewed, tested, and improved on an ongoing basis in line with GDPR Article 32 and the principle of privacy by design and default. We support information security through our international standards 27001: 2022 and NIS2, this ensures our technical, organisational and security measures (e.g. encryption, access controls) are compliant.

8. Data transfers

We may on occasion transfer personal data to countries outside the UK/EU/EEA when this is necessary for the purposes described in this notice. Whenever we do so, we ensure that the information remains protected to the same standards required under the UK GDPR and EU GDPR.

We only transfer data where one of the following applies:

• the country has been recognised as providing an adequate level of data protection;
• we have put in place appropriate safeguards, such as Standard Contractual Clauses or the UK International Data Transfer Agreement; or
• an approved exception (derogation) applies in specific situations, such as when you have given explicit consent or the transfer is necessary for a contract.

Before making any international transfer, we assess the legal and security risks and apply measures such as encryption and strict access controls to keep your data safe.

You can contact us if you would like more information about international transfers or to request a copy of the applicable safeguards via gdpr@danxcarousel.com 

9. How long will we retain your data for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

Details of typical retention periods for different aspects of your personal information can be found below:

Data Category	Examples	Retention Period	Rationale / GDPR Basis
Customer Account & Contact Information	Name, email, phone, address	Duration of customer relationship + 6 years	GDPR requires defined, justified periods for customer/client data.
Communications & Support Queries	Emails, chat logs, support tickets	2 years from last contact	Communications logs require documented retention and deletion processes.
Marketing Data	Preferences, consent logs	Until consent withdrawn + 2 years	Need proof of consent and storage limitation compliance.
Website Analytics & Server Logs	IP addresses, cookies, device identifiers	12–24 months	Analytics data must have justified retention periods.
Processor / Third‑Party Data Handling	Any data processed externally	Only retained for period specified by controller	Processors must follow controller-defined retention schedules.

10. Data subject rights (DSR)

Individuals have the right to access, rectify, erase (“right to be forgotten”), restrict, or object to the processing of their personal data, by contacting the Group Data Controller Officer, they also have the right to data portability and to withdraw consent and to be able to lodge a complaint if resolution can’t be found, directly with the relevant supervisory authority.

For further details please refer to our Data Subject Request Policy and Procedure.

11. Changes to this privacy notice

Any changes we make to this privacy notice in the future will be posted on this page.

12. Contact details

For any queries relating to this privacy notice or for further information; email gdpr@danxcarousel.com or write to the Data Controller Officer at DANX Carousel, Vejleåvej 9, 2635 Ishøj, Denmark.

Version control: 2026.1_V1.0.0_EN