Privacy notice for customers, vendors, business partners and other external persons – Holding

At PNO Holding A/S (“PNO”, “we”, “us” or “our”) we value your right to privacy. This notice describes how we process personal information about customers, vendors, business partners and other external persons (with the exception of applicants / job candidates for positions at PNO, who are governed by a separate privacy notice that will be made available at commencement of the recruitment process) and contains the information we are obliged to provide in accordance with Regulation (EU) 2016/679 (“GDPR”) and the Danish Act number 502 of 23 May 2018 on supplementary provisions to the regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“DDPA”).

1 Data controller

The data controller for the processing of your personal information is

PNO Holding A/S
CVR-no.: 26101409
Århusgade 118
2150 Nordhavn
Denmark
E-mail: info@pnorental.com

2 Processing activities

2.1 Management of lease contracts

When the company you represent is leasing trailers from a PNO Group company, we process personal information about you as joint controller with the PNO company from which you have leased the trailer. The joint controller arrangement is described in further details here.

The purpose of our processing of personal data is to optimize our business on a group level and to provide administrative support for our group companies. Our processing of personal information about you for these purposes includes:

1. Your name and business contact information, including business address, business email address and business telephone number
2. Your user-ID for the apps and other digital services we provide to support an effective business relationship
3. Information on your checks (i.e. inspection of the trailer and its condition) of trailers

If the company, you represent, is a personally owned business, the following categories of information, which we also process, will also constitute personal information about the owner of the business:

4. Rental history
5. Repairs on leased equipment
6. Fines and other sanctions related to leased trailers in your custody
7. Results of authorities’ technical inspections of leased trailers in your custody
8. Accounting information, including transactions and open balance
9. Correspondence

The legal basis for the processing is

• Specifically in relation to item (f) above, the legal basis is section 8(3) of DDPA.
• Aside from that, the legal basis for the processing is GDPR article 6(1)(f), as the processing is necessary in order for us to pursue our legitimate interest in effectively managing the customer relationship with you.

As a general rule, we retain transaction history for five years from the ending of the year, the individual transaction relates to, in accordance with our obligations pursuant to the Danish Bookkeeping Act.

Information related to equipment is retained for the lifetime of the equipment.

Other information is retained throughout the duration of your customer relation with us and for five years from the end of the year, in which we had the latest transaction with you.

2.2 Telematics

Our trailers have telematics equipment mounted, collecting information on the trailer on a continuous basis.

The purpose of processing this information is to be able to trace the trailer where necessary (typically if the trailer is stolen), as well as to analyze the usage pattern, which may in turn be used to predict the need for (preventive) maintenance and understand wear and tear on the equipment.

This information includes

• the GPS position of the trailer
• technical information such as
  • total weight of loaded cargo
  • speed
  • braking power

For the mere collection and storage of telematics data, we are joint controller with the lessee and the PNO company from which the trailer in question is leased. This joint controller arrangement is described in further detail here.

The legal basis for processing this information is GDPR article 6(1)(f), as the processing is necessary for us to pursue our legitimate interest in protecting our assets and optimizing our business.

The information is stored for current month and the latest 24 preceding months. After 24 months, we anonymize any information that could identify the driver pulling the trailer at any given time, after which the remaining data is no longer personal data.

2.3 Use of VERD

When you are using our digital platform “VERD”, we are processing information about administrators and users of VERD in your organisation. We do so in order to manage our agreement on your use of VERD, as well as to support our operations of the platform, including security. To do so, we process

1. Name and contact information of administrators (for invoicing and other administrative purposes)
2. User-ID and related telephone numbers (to support secure login)
3. Identity of persons performing “checks” (use of the “check” function in VERD)
4. Information in log files (to support operations including error handling)

The legal basis for the processing is GDPR article 6(1)(f), as the processing is necessary for us to (i) manage the agreement on your organisation’s use of VERD, and (ii) to be able to provide the service to you and your users in an effective and secure manner.

We will retain the information for as long as your organisation is actively using VERD. However, after 24 months, we anonymize any information that could identify the driver pulling the trailer at any given time (item (c) above).

2.4 Marketing

When you sign up to receive our newsletters – or if you are an existing customer and have not opted out from receiving marketing materials from us – we process the following categories of personal information about you for the purpose of sending you newsletters and other marketing material:

1. Name
2. E-mail address
3. Your consent to receive marketing (where applicable)

The legal basis for the processing is

• GDPR article 6(1)(f), as the processing is necessary for us to pursue our legitimate interest in communicating with customers and others having indicated an interest in our business and products.

We retain your information for two years from the end of the year where either of the following occur:

• You opt-out / withdraw your consent to receive marketing from us
• We have not been sending you marketing for a period of twelve consecutive months

We will stop sending you marketing as soon as any of the two situations above occurs, but will retain the information to be able to document the basis on which we have been sending you marketing, which may be necessary to establish, exercise or defend a legal claim.

2.5 Vendors, service providers and business partners

If you are the contact person of a company, which is a vendor, service provider or business partner of PNO, we will be processing personal information about you for the purpose of managing our business relationship.

This information includes:

1. Name
2. Business contact information (address, e-mail and telephone number)
3. Correspondence and trading history

The legal basis for processing this information is

• GDPR article 6(1)(b), as the processing is necessary for the conclusion or performance of a contract with you (where you are acting as a natural person or the owner of a personally owned business)
• GDPR article 6(1)(f), as the processing is necessary in order for us to pursue our legitimate interest in effectively managing the business relationship with you.

We retain the information throughout the business relationship and for five years from the end of the year, where we had the latest financial transaction with the company.

2.6 Visitors to website

We use cookies and similar tracking technology on our website, and in this connection we collect information about your use of the website. The purpose of the processing is to be able to offer a well-functioning and relevant website.

For this purpose, we collect information about your IP address, the equipment – both hardware and software – you use to access the website, as well as information about how you use the website, including which links you click on.

You can read more about the individual cookies, including the purpose of the individual cookie and how long the individual cookie is stored by clicking the cookie settings icon in the bottom left corner of our website. Here you can also find links to the privacy policies of third parties we use for certain services by placing their cookies on our website and who, together with us, are joint data controllers of the information collected through these cookies.

2.7 General business administration

If you are in contact with us for any other reason than described in sections 2.1 – 2.6 above, we may process personal information about you as necessary for the specific purpose, typically to handle queries or other reasons for being in contact with you.

This information includes:

1. Name
2. Contact information, including address, e-mail address and telephone number
3. Any information included in correspondence between you and us or created as a result of the relationship

The legal basis for processing this information is GDPR article 6(1)(f), as the processing is necessary in order for us to pursue our legitimate interest in effectively managing the relationship with you, including responding adequately to queries.

Where the relationship involves financial transaction, the information will be stored for five years from the end of the year, to which the latest transaction relates. Otherwise, the information will be retained for two years from the end of year, where we had the latest interaction with you.

3 Retention and deletion of information

The retention periods described in sections 2.1 – 2.7 above are the default retention periods. However, information may be retained for longer if necessary to comply with legal obligations or if necessary for PNO to establish, defend or exercise legal claims.

4 Recipients of personal data

We may disclose your personal information to auditors and external advisors supporting our business and to law enforcement authorities or other public authorities if we are required to do so through a court order or similar measures, or if such disclosure is necessary in order for us to establish, defend or exercise legal claims.

Furthermore, we may make personal information available for companies supporting our business in the role of data processors – typically suppliers of IT-systems or IT-operations and other types of business services.

5 Transfer of personal data to countries outside EU/EEA

Our platform for equipment management is based on Amazon Web Services. Thus, we cannot preclude that information processed through the platform is transferred to countries outside EU, including USA and any other country where affiliates or other sub-processors of Amazon may be located.

Furthermore, as we are using third party cookies from – among others – Google, information collected through the use of cookies must also be considered transferred to countries outside EU, including USA.

Where possible, the transfer is based on an adequacy decision pursuant to Article 45 of GDPR in the form of the EU/US Data Privacy Framework, which applies to both Amazon Web Services and Google.

We have taken the necessary steps, including steps to ensure that our data processors and/or their sub-processors have taken the necessary steps to ensure that a valid transfer mechanism is in place for all transfers to countries outside EU, as well as we have assessed the need for supplementary measures and – where relevant – implemented such measures or made sure that our data processors have implemented appropriate supplementary measures to ensure the lawfulness of transfers.

You may obtain information on the transfer mechanism in place, including a copy of the standard contractual clauses, where these form the transfer mechanism, by contacting us, using the contact information in section 1.

6 Your rights

You have the following rights as a data subject:

• Access: You have the right to obtain access to the data we process about you and a number of additional data.
• Rectification: You have the right to have personal data about you rectified.
• Erasure: In special circumstances, you have the right to have personal data about you erased, before the time for our ordinary erasure.
• Restriction: In certain cases, you have the right to have the processing of your personal data restricted. If the right applies, we may then only process the data – except for retention – with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another person or for reasons of important public interest.
• Data portability: In certain cases, you have the right to receive a copy of the personal data you have provided in a structured commonly used and machine-readable format.
• Right to object to processing of personal data: Where the processing of your personal data is based on GDPR article 6(1)(f), you have the right to object to the processing on grounds relating to your particular situation. If you do so, we will cease the processing, unless we can justify that our legitimate interests override your interests, rights and freedoms, even after duly taking your particular situation into consideration, or the processing can be based on an alternative legal basis. You have a particular and unconditional right to object to your personal data being processed for the purpose of direct marketing.

If you wish to exercise your rights, please contact us using the contact information provided in section 1 above. Your request will be processed in accordance with the legislation in force at the given time. To the extent necessary, we will contact you and ask for additional information required to handle your request correctly.

Please be aware that certain limitations and exemptions apply to some of the rights. Therefore, we are not necessarily obliged to meet your request in all situations.

You do, however, have an unconditional right to file a complaint with a supervisory authority – in Denmark that would be Datatilsynet – if you believe that our processing of your personal data is in conflict with applicable data protection legislation.

If you would like to learn more about your rights, please visit the website of the Danish Data Protection Agency, www.datatilsynet.dk, where you can also find further information on how to file a complaint.

7 Updating our privacy Notice

We may update this privacy Notice on an ongoing basis when this is necessary to provide a fair description of our processing of personal data.

In the event of material changes to our processing of your personal data already in our possession, you will be notified directly of the update (e.g. by email).

This privacy Notice was last updated in January 2026