1. Introduction
At Homerunner, we are very grateful for the trust you place in us as a customer, recipient, or sender of shipments. We also want you, as a customer or user of our services, to have full confidence in how we handle your personal data. In this privacy policy, you can read how we process the personal data we receive about you when you are a customer, sender, or recipient of parcel shipments, as well as when you use other functions and services on our platforms, including our website and apps.

As part of Homerunner’s day-to-day operations, the company processes a range of personal data about customers, senders and recipients of parcels, business partners, and suppliers. This occurs both when Homerunner sells and delivers services to customers—including delivering parcels on their behalf—when purchasing goods or services for the company, and in relation to collaborations between external parties and the company. In many situations, we also process personal data if you sign up for our newsletter.

Homerunner is highly committed to processing all personal data in a confidential and secure manner. Our processing always complies with the applicable legal requirements, including the security requirements set out in data protection legislation. We have established several deletion procedures to ensure that we continuously delete personal data that is no longer relevant. The same applies to data that a registered individual wishes to have deleted and which we no longer have a legal basis to process.

Under current data protection legislation, Homerunner is, in most cases, considered the data controller for the personal data we process when entering into agreements with customers or partners. When a customer/parcel sender asks us to handle a shipment, we are responsible for the processing of personal data necessary to deliver the parcel to the independent carrier who typically handles the remaining part of the shipment until it reaches the correct recipient.

In special cases, however, our role may instead be to process personal data on behalf of the customer. In such cases, Homerunner is considered a data processor, and a data processing agreement will be entered into between the customer and us.

You are always welcome to contact us if you have questions regarding the processing of your personal data, this policy, or if you wish to exercise your rights under the data protection rules (see more below):
Homerunner ApS
Østerågade 27
9000 Aalborg, Denmark
E-mail: info@homerunner.com

Phone: +45 77 34 05 00
www.homerunner.com

2. Processing of Personal Data
When you contact Homerunner, we process the personal data contained in your inquiry. We therefore encourage you not to submit more personal data than necessary for us to handle your request.

If we enter into an agreement with you, we process the personal data necessary to deliver the agreed service. Typically, this includes contact details such as your name, address, email address, phone number, and a delivery address. The delivery address may belong to another individual; in such cases, we also process the parcel recipient’s name, physical address, and email or phone number. This is necessary to deliver the parcel and to notify the recipient when the parcel is on its way. In some cases, we also receive information about the contents of the parcel. This mainly applies to international shipments, where such information may be needed for the registration of dangerous goods, customs calculation, etc.

If a parcel recipient wishes to return a shipment, this is done through a return portal. In this case, the recipient enters an email address and order number. The system then retrieves details about the shipment, including sender, recipient, and contents (if registered). For return shipments, it is necessary for us to process the parcel contents and the reason for the return, as this forms a natural part of the return process.

We also provide customer service in cases where we have handled part of the shipment and where questions arise about the delivery. We use a support system to handle such inquiries, and this may include personal data about the inquirer, information about events/loss, authorization documents, etc.

We never process sensitive personal data about customers or parcel recipients such as information on race, religion, political beliefs, trade union membership, or health.

If the customer is a business, we only process personal data about the associated contact person, including their name, job title, direct email, and phone number.

We obtain these data directly from you (the customer/contact person) when the agreement is made. If you have been a customer before and order a new service, we may reuse the information already on file, but we always check that it is still correct.

Regarding parcel recipient data, we receive this information from your company or the person who ordered the shipment. This may be directly from the person booking the shipment or from the webshop where the customer placed their order.

3. Purpose and Legal Basis
3.1 Customers, partners, suppliers
Our main purpose in processing personal data is to administer and invoice/settle the agreement entered into with the individual customer/parcel sender, partner, or supplier. The legal basis for this processing is Article 6(1)(b) of the General Data Protection Regulation (GDPR).

3.2 Customers/senders and parcel recipients
For customers and parcel recipients, our purposes include:
• Fulfilling the agreement to deliver a service, including transporting parcels
• Ensuring correct delivery to the intended recipient
• Providing access to shipment information through websites and apps
• Communicating with customers/recipients, handling complaints, and providing customer service
• Developing, improving, and securing our services
• Preventing misuse of our services and ensuring safe operation
• Ensuring compliance with legal obligations
• Preparing statistical analyses regarding the use of our services

The legal basis is Article 6(1)(b) of the GDPR. In some cases, we also rely on Article 6(1)(f), where we assess that we have a legitimate interest that does not override the interests or rights of the data subject. This may include improving and securing our services, preventing misuse, ensuring service operation, and performing customer surveys and statistics. We also consider that this processing ultimately benefits our customers and parcel recipients.

3.3 Newsletter subscribers
If you subscribe to our newsletters, we process your data to send you the relevant emails. The legal basis is Article 6(1)(a) of the GDPR, as you must always provide your consent for receiving newsletters.

4. Retention Period
Homerunner only retains personal data for as long as necessary to fulfil the purpose for which it was collected. We have implemented several deletion procedures to ensure data is not stored longer than necessary.

4.1 Customers, partners, suppliers
Personal data about contact persons at our customers, partners, and suppliers is stored for as long as the business relationship exists.

After the relationship ends, data is stored for as long as necessary to document the agreement and related correspondence, including:

Whether the data is part of documentation we must retain

Whether the data is up to date and correct

Whether new circumstances (e.g., a dispute or complaint) justify continued storage

All accounting records are kept for 5 years after the end of the financial year in accordance with bookkeeping legislation.

4.2 Parcel senders and recipients
If the sender and/or recipient is a private individual, we retain their data for 12 months after the shipping label is created. This ensures we can manage the shipment and handle any subsequent questions or returns, which may occur long after the parcel was delivered.

5. Disclosure and Transfer of Personal Data
In certain cases, your personal data is shared with Homerunner’s suppliers, such as IT providers, payment providers, marketing agencies, etc., who process data on our behalf and according to our instructions. In such cases, we have entered into data processing agreements to ensure proper handling.

We also disclose your personal data and parcel recipient data to independent freight carriers and logistics partners who handle parts of the transport, such as DAO, GLS, Bring, etc. These carriers act as independent data controllers and must comply with data protection rules in the same way as Homerunner.

Homerunner may also share your information with auditors or lawyers when needed for specific accounting or legal tasks.

We do not disclose personal data to other parties unless legally required—for example, by court order, police request, or similar circumstances.

6. Transfers to Third Countries
In most cases, our partners are located within the EU/EEA or in a safe third country such as the UK. If a package recipient lives outside the EU, the parcel will naturally be transported there by the carrier, but we typically do not share data with partners outside the EU.

In rare cases, if a parcel must be delivered to an unsafe third country, we may work with a carrier in that region. If personal data is exchanged for this purpose, the transfer is carried out under GDPR Article 49(1)(b) and (c), as it is necessary for fulfilling the agreement to deliver the parcel.

We also use a newsletter system where data is transferred to the USA based on Standard Contractual Clauses (SCCs) and additional safeguards.

7. Security Measures
The company has implemented several technical and organizational measures to prevent personal data from being lost, compromised, or accessed unlawfully.

All personal data is stored electronically, with controlled access and rules for remote system access. Physical access controls are in place at our office locations. Security measures are regularly reviewed. Daily backups, antivirus software, and firewalls are also used.

We also maintain physical security procedures such as access restrictions and locked premises. All employees are bound by confidentiality regarding any personal data they become aware of through their work.

8. Rights of Data Subjects
As a data subject, you always have the right to:
• Request insight into the personal data we hold about you
• Receive a copy of your data
• Request correction of inaccurate information

Homerunner may be required to delete your personal data before our standard deletion period—for example, if we no longer have a purpose for processing it or if you withdraw consent (and no other legal basis exists).

You may also object to our processing in some cases. If you do so, we will assess whether processing should be restricted while we evaluate your objection. In certain situations, you also have the right to data portability.

If you wish to exercise your rights, please contact us.
Additionally, you can always file a complaint with the Danish Data Protection Agency (Datatilsynet): www.datatilsynet.dk