Privacy notice for customers, vendors, business partners and other external persons – Countries

At PNO (“PNO”, “we”, “us” or “our”) we value your right to privacy. This notice describes how we process personal information about customers, vendors, business partners and other external persons (with the exception of applicants / job candidates for positions at PNO, who are governed by a separate privacy notice that will be made available at commencement of the recruitment process) and contains the information we are obliged to provide in accordance with Regulation (EU) 2016/679 (“GDPR”) and supplementary national or regional data protection legislation.

1 Data controller

This privacy notice covers the processing of personal information carried out by the legal entities listed in appendix 1

Unless otherwise stated under the individual processing activities described in section 2 below, the data controller for the personal data concerning you will be the legal entity with which you have entered into an agreement or otherwise interacted.

Regardless which of the entities you have been interacting with, you can always contact us by sending an e-mail to info@pnorental.com.

2 Processing activities

2.1 Management of lease contracts

When the company, you represent, is leasing trailers from us, we process personal information about you in order for us to effectively enter into and fulfill the contract with our customers and provide our services.

Where information, which may include Items (a) – (c) and (e) – (h) below, is processed via the PNO platform for equipment management, we are joint controllers with PNO Holding A/S. The joint controller arrangement is described in further details here.

Our processing of personal information about you for these purposes includes:

1. Your name and business contact information, including business address, business email address and business telephone number
2. Your user-ID for the apps and other digital services we provide to support an effective business relationship
3. Information on your check-out and check-in of trailers at our locations

If the company, you represent, is a personally owned business, the following categories of information, which we also process, will also constitute personal information about the owner of the business:

4. Result of credit checks
5. Rental history
6. Repairs on leased equipment
7. Fines and other sanctions related to leased trailers in your custody
8. Results of authorities’ technical inspections of leased trailers in your custody
9. Accounting information, including transactions and open balance
10. Correspondance

The legal basis for the processing is

• Specifically in relation to item (g) above, see appendix 1.
• Specifically in relation to item (h) and (i) above, the legal basis is GDPR article 6(1)(c), as the processing is necessary for us to ensure compliance with legal obligations, we are subject to, including, in particular, our documentation obligations under national tax and bookkeeping legislation.
• Furthermore, the following legal bases apply for all other categories of information than item (g):
  • GDPR article 6(1)(b), as the processing is necessary for the conclusion or performance of a contract with you
  • GDPR article 6(1)(f), as the processing is necessary in order for us to pursue our legitimate interest in effectively managing the customer relationship with you.

As a general rule, we retain transaction history for ten years from the ending of the year, the individual transaction relates to in order to comply with the statutory requirements for accounting material in all of the jurisdictions in which we provide rental services.

Information related to equipment is retained for the lifetime of the equipment.

Other information is retained throughout the duration of your customer relation with us and for ten years from the end of the year, in which we had the latest transaction with you.

2.2 Telematics

Our trailers have telematics equipment mounted, collecting information on the trailer on a continuous basis.

The purpose of this collection of information is to be able to trace the trailer where necessary (typically if the trailer is stolen), as well as to analyze the usage pattern, which may in turn be used to predict the need for (preventive) maintenance and understand wear and tear on the equipment.

This information includes

• the GPS position of the trailer
• technical information such as
  • total weight of loaded cargo
  • speed
  • breaking power.

For the mere collection and storage of telematics data, we are joint controller with the lessee and PNO Holding A/S. This joint controller arrangement is described in further detail here.

The legal basis for processing this information is GDPR article 6(1)(f), as the processing is necessary for us to pursue our legitimate interest in protecting our assets.

The information is stored for current month and the latest 24 preceding months. After 24 months, we anonymize any information that could identify the driver pulling the trailer at any given time, after which the remaining data is no longer personal data.

2.3 Marketing

When you sign up to receive our newsletters – or if you are an existing customer and have not opted out from receiving marketing materials from us – we process the following categories of personal information about you for the purpose of sending you newsletters and other marketing material:

1. Name
2. E-mail address
3. Your consent to receive marketing (where applicable)

The legal basis for the processing is

• GDPR article 6(1)(f), as the processing is necessary for us to pursue our legitimate interest in communicating with customers and others having indicated an interest in our business and products.

We retain your information for two years from the end of the year where either of the following occur:

• You opt-out / withdraw your consent to receive marketing from us
• We have not been sending you marketing for a period of twelve consecutive months

We will stop sending you marketing as soon as any of the two situations described above occur but will retain the information to be able to document the basis on which we have been sending you marketing, which may be necessary to establish, exercise or defend a legal claim.

2.4 Vendors, service providers and business partners

If you are the contact person of a company, which is a vendor, service provider or business partner of PNO, we will be processing personal information about you for the purpose of managing our business relationship.

This information includes:

1. Name
2. Business contact information (address, e-mail and telephone number)
3. Correspondence and trading history

The legal basis for processing this information is

• GDPR article 6(1)(b), as the processing is necessary for the conclusion or performance of a contract with you (if you are interacting with us as a private person or through a personally owned business)
• GDPR article 6(1)(f), as the processing is necessary in order for us to pursue our legitimate interest in effectively managing the business relationship with you.

We retain the information throughout the business relationship and for ten years from the end of the year, where we had the latest financial transaction with the company.

2.5 Visitors to website

We use cookies and similar tracking technology on our website, and in this connection we collect information about your use of the website. The purpose of the processing is to be able to offer a well-functioning and relevant website.

For this purpose, we collect information about your IP address, the equipment – both hardware and software – you use to access the website, as well as information about how you use the website, including which links you click on.

You can read more about the individual cookies, including the purpose of the individual cookie and how long the individual cookie is stored by clicking the icon in the bottom left corner of our website. Here you can also find links to the privacy policies of third parties we use for certain services by placing their cookies on our website and who, together with us, are joint data controllers of the information collected through these cookies.

2.6 General business administration

If you are in contact with us for any other reason than described in sections 2.1 – 2.5 above, we may process personal information about you as necessary for the specific purpose, typically to handle queries or other reasons for being in contact with you.

This information includes:

1. Name
2. Contact information, including address, e-mail address and telephone number
3. Any information included in correspondence between you and us or created as a result of the relationship

The legal basis for processing this information is GDPR article 6(1)(f), as the processing is necessary in order for us to pursue our legitimate interest in effectively managing the relationship with you, including responding adequately to queries.

Where the relationship involves financial transaction, the information will be stored for five years from the end of the year, to which the latest transaction relates. Otherwise, the information will be retained for two years from the end of year, where we had the latest interaction with you.

3 Retention and deletion of information

The retention periods described in sections 2.1 – 2.6 above are the default retention periods. However, information may be retained for longer if necessary to comply with legal obligations or if necessary for PNO to establish, defend or exercise legal claims.

4 Recipients of personal data

We may disclose your personal information to auditors and external advisors supporting our business and to law enforcement authorities or other public authorities if we are required to do so through a court order or similar measures, or if such disclosure is necessary in order for us to establish, defend or exercise legal claims.

Furthermore, we may make personal information available for companies supporting our business in the role of data processors – typically suppliers of IT-systems or IT-operations and other types of business services.

5 Transfer of personal data to countries outside EU/EEA

Our platform for equipment management is based on Amazon Web Services. Thus, we cannot preclude that information processed through the platform is transferred to countries outside EU, including USA and any other country where affiliates or other sub-processors of Amazon may be located.

Furthermore, as we are using third party cookies from – among others – Google, information collected through the use of cookies must also be considered transferred to countries outside EU, including USA.

Where possible, the transfer is based on an adequacy decision pursuant to Article 45 of GDPR in the form of the EU/US Data Privacy Framework, which applies to both Amazon Web Services and Google.

We have taken the necessary steps, including steps to ensure that our data processors and/or their sub-processors have taken the necessary steps to ensure that a valid transfer mechanism is in place for all transfers to countries outside EU, as well as we have assessed the need for supplementary measures and – where relevant – implemented such measures or made sure that our data processors have implemented appropriate supplementary measures to ensure the lawfulness of transfers.

You may obtain information on the transfer mechanism in place, including a copy of the standard contractual clauses, where these form the transfer mechanism, by contacting us, using the contact information in section 1.

6 Your rights

You have the following rights as a data subject:

• Access: You have the right to obtain access to the data we process about you and a number of additional data.
• Rectification: You have the right to have personal data about you rectified.
• Erasure: In special circumstances, you have the right to have personal data about you erased, before the time for our ordinary erasure.
• Restriction: In certain cases, you have the right to have the processing of your personal data restricted. If the right applies, we may then only process the data – except for retention – with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another person or for reasons of important public interest.
• Data portability: In certain cases, you have the right to receive a copy of the personal data you have provided in a structured commonly used and machine-readable format.
• Right to object to processing of personal data: Where the processing of your personal data is based on GDPR article 6(1)(f), you have the right to object to the processing on grounds relating to your particular situation. If you do so, we will cease the processing, unless we can justify that our legitimate interests override your interests, rights and freedoms, even after duly taking your particular situation into consideration, or the processing can be based on an alternative legal basis. You have a particular and unconditional right to object to your personal data being processed for the purpose of direct marketing.

If you wish to exercise your rights, please contact us, using the contact information in section 1 above. Your request will be processed in accordance with the legislation in force at the given time. To the extent necessary, we will contact you and ask for additional information required to handle your request correctly.

Please be aware that certain limitations and exemptions to apply to some of the rights. Therefore, we are not necessarily obliged to meet your request in all situations.

You do, however, have an unconditional right to file a complaint with a supervisory authority if you believe that our processing of your personal data is in conflict with applicable data protection legislation.

For further information on your rights, please visit the website of the competent authority in your jurisdiction (see list in appendix 1).

7 Updating our privacy Notice

We may update this privacy Notice on an ongoing basis when this is necessary to provide a fair description of our processing of personal data.

In the event of material changes to our processing of your personal data already in our possession, you will be notified directly of the update (e.g. by email).

This privacy Notice was last updated in February 2026

Appendix 1: Country specific information for entities covered by this privacy notice