Privacy Policy

We collect personal data only when it is necessary for a specific and legitimate purpose. The categories of data we may process include:

• Identity data: First name, last name, job title, company name
• Contact data: Email address, phone number, business address
• Transaction data: Details of equipment or parts enquiries, purchase orders, and invoices
• Communication data: Records of email correspondence, phone call logs, and support tickets
• Technical data: IP address, browser type, device type, pages visited, and session duration (collected automatically via cookies and server logs)
• Marketing data: Your preferences regarding receiving marketing communications from us

We do not collect sensitive personal data (such as health, financial account, or biometric data) as part of our normal business operations.

We process personal data only where we have a lawful basis to do so under GDPR Article 6. The following table summarises our processing purposes and their legal bases:

• Responding to enquiries and providing quotations — Legal basis: Legitimate interests / Pre-contractual steps
• Processing and fulfilling purchase orders — Legal basis: Performance of a contract
• Sending transactional communications (order confirmations, dispatch notices, invoices) — Legal basis: Contract performance
• Sending marketing emails and newsletters — Legal basis: Consent (you may withdraw at any time)
• Improving our website and services — Legal basis: Legitimate interests (balanced against your rights)
• Complying with legal and regulatory obligations (e.g., tax records, export documentation) — Legal basis: Legal obligation

Our website uses cookies and similar tracking technologies. A cookie is a small text file stored in your browser. We use the following categories of cookies:

We do not sell, rent, or trade your personal data. We may share your data with trusted third parties only where necessary:

• Freight and logistics providers (DHL, FedEx, freight brokers) — to fulfil equipment and parts shipments
• Payment processors — for secure bank transfer verification and invoice management
• IT and software service providers — hosting, CRM, and email delivery platforms operating under GDPR-compliant data processing agreements
• Legal and professional advisors — where required to protect our legal interests
• Regulatory and tax authorities — where required by Danish or EU law (e.g., SKAT, customs documentation)

All third-party processors are required to handle your data in compliance with GDPR and are bound by written data processing agreements (DPAs).

NOVO Imaging is based in Denmark (EU) and processes data primarily within the European Economic Area (EEA). Where data is transferred outside the EEA — for example, when fulfilling orders in the Middle East, Asia, or Africa — we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfers to countries covered by an EU adequacy decision
• Binding corporate rules, where applicable

Buyer contact details shared with international freight partners are limited to what is strictly necessary for customs and delivery purposes.

We retain personal data for as long as necessary to fulfil the purpose for which it was collected, or as required by law:

• Enquiry and pre-sale data: Retained for up to 2 years from last contact if no order is placed
• Customer and transaction records: Retained for 5 years following the transaction date, in compliance with Danish bookkeeping law (Bogføringsloven)
• Marketing consent records: Retained until consent is withdrawn, plus 1 year for compliance audit purposes
• Website analytics data: Anonymised after 14 months (Google Analytics default)

When data is no longer required, it is securely deleted or anonymised so that it can no longer be linked to an individual.

NOVO Imaging implements appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. Measures include:

• TLS encryption for all data transmitted via our website
• Access controls limiting data access to personnel who need it to perform their job functions
• Secure cloud infrastructure with regular backups and access logging
• Employee training on data protection practices
• Prompt internal review procedures in the event of a suspected data breach

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the Danish Data Protection Agency (Datatilsynet) within 72 hours, and affected individuals without undue delay.

We may send you marketing communications (such as our blog newsletter, product availability alerts, or industry news) only if you have provided your explicit consent, or — where permitted by law — if you are an existing customer and the communication is relevant to products or services similar to those you have previously purchased.

• Every marketing email includes a clearly visible unsubscribe link
• You can also opt out by emailing [email protected] with the subject “Unsubscribe”
• Transactional emails (order confirmations, invoices, service notices) are not marketing and cannot be opted out of while a business relationship exists

We take your privacy rights seriously and encourage you to contact us first if you have a concern about how we handle your data — we will endeavour to resolve it promptly.

If you are not satisfied with our response, you have the right to lodge a complaint with the Danish supervisory authority:

• Datatilsynet (The Danish Data Protection Agency)
• Carl Jacobsens Vej 35, 2500 Valby, Denmark
• Website: datatilsynet.dk
• Phone: +45 33 19 32 00

If you are based in another EU member state, you may also contact your local national supervisory authority.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or by a prominent notice on our website.

Continued use of our website or services after the effective date of a revised policy constitutes your acknowledgement of the changes. We encourage you to review this policy periodically.