Effective date: 17 October 2025

This Privacy Policy explains how SP Medical A/S ("SP Medical", "we", "us", or "our") collects and processes personal data when you visit sp-medical.dk, contact us, request a quote, or otherwise interact with us.

We process personal data lawfully, fairly, and transparently; only for specified purposes; limited to what is necessary; kept accurate and no longer than needed; and protected with appropriate security measures. These principles reflect the approach used by leading industrial companies and align with GDPR requirements.

1) Who we are (Controller) & how to contact us

Controller: SP Medical A/S

Registered address: Møllevej 1, DK-4653 Karise

Email: info@sp-medical.dk   Phone: +45 56 76 60 00

If you are part of a contract or project with another SP Group company, that company may act as controller for that specific processing.

Privacy contact: info@sp-medical.dk

2) Scope of this notice

This notice covers personal data we process about website visitors, prospective and existing customers/suppliers, event attendees, and other business contacts. A separate notice may apply to job applicants and employees.

3) What data we collect

We collect and process the following categories when you interact with us online or offline:

• Identification & contact data (e.g., name, company, role, email, phone, country/region)
• Inquiry & quote details (project description, technical requirements, files you upload via forms)
• Customer/supplier records (contract, order, invoice, delivery, service communications)
• Marketing preferences (subscriptions, consent/opt-in/opt-out)
• Technical & usage data (IP address, device, browser, pages viewed, time on page, referrer URLs, cookie identifiers)
• Event information (registrations, badge scans)
• Recruitment data (if you apply; CV, cover letter, interview notes. Covered by a separate notice if applicable)

We do not intentionally collect special category data (e.g., health data) via our website, and we ask that you do not include such information in free-text fields.

4) Sources of data

• Directly from you (forms such as Contact on our website, emails, calls, meetings)
• From your organization (when you are a designated contact)
• Public and professional sources (company websites, trade registers, LinkedIn)
• Cookies and similar technologies on our website (see Cookies below)

5) Purposes and legal bases

We process personal data only when there is a valid legal basis under GDPR/EU/UK law:

Purpose	Examples of processing	Legal basis
Respond to inquiries & provide quotes	Handling forms, emails, phone requests, follow-ups	Contract or pre-contract steps; Legitimate interests (B2B service)
Provide products & services; manage accounts	Order management, delivery, support, invoicing	Contract; Legal obligation (e.g., bookkeeping); Legitimate interests
Customer relationship & supplier management (CRM)	Contact administration, business development	Legitimate interests
Marketing & communications	News, product updates, event invites	Consent where required; otherwise Legitimate interests with opt-out
Website operation, security & analytics	Load balancing, logs, security monitoring, usage analytics	Legitimate interests; Consent for non-essential cookies
Compliance & risk	Sanctions screening, dispute handling	Legal obligation; Legitimate interests
Recruitment	Processing applications and interviews	Consent, Contract, or Legitimate interests (separate notice if applicable)

6) Cookies and similar technologies

We use cookies and similar technologies to operate our site, understand usage, and (if enabled) improve marketing effectiveness. Categories include:

• Strictly necessary (site security, form submission)
• Functional (preferences)
• Analytics (site usage, performance)
• Advertising (if implemented; for retargeting/measurement)

Where required, we obtain your consent before setting non-essential cookies. You can withdraw consent anytime via Cookie Settings.

7) Disclosures of personal data

We may share personal data, on a need-to-know basis, with:

• SP Group companies that help deliver proposals or projects (e.g., capacity, quality, logistics), and for consolidated reporting and governance.
• Service providers acting on our instructions (hosting, IT/CRM, analytics, security, email delivery, event platforms, advisers).
• Business partners involved in a specific project (with your knowledge/expectation).
• Authorities, regulators, and courts where legally required or to establish/defend legal claims.
• Successors in the event of a merger, acquisition, or similar corporate transaction.

We require processors to safeguard data and use it only per our instructions.

8) International data transfers

We are headquartered in Denmark and operate internationally with group companies and providers in several countries. When we transfer personal data outside the EEA/UK where no adequacy decision applies, we use appropriate safeguards such as the EU Standard Contractual Clauses (and UK Addendum, where relevant). You can request more information about these safeguards via the contact details above.

9) Retention

We keep personal data only as long as needed for the purposes above and to comply with legal, accounting, or reporting obligations. For example, Danish bookkeeping rules generally require storage of accounting records for five (5) years from the end of the financial year to which the records relate. Project correspondence and contractual documents may be retained to protect our legal interests. Specific retention schedules are available on request.

10) Security

We apply appropriate technical and organizational measures to protect personal data, including access controls, encryption in transit (TLS), logging, backup, and staff confidentiality obligations. While no system is 100% secure, we continually assess and improve our safeguards.

11) Your rights

Depending on your location and the circumstances, you may have the right to:

• Access your personal data and receive a copy
• Rectify inaccurate data
• Erase data (in certain cases)
• Restrict or object to processing (including direct marketing)
• Data portability (where applicable)
• Withdraw consent at any time (this does not affect prior processing)

To exercise your rights, contact us at info@sp-medical.dk. We may need to verify your identity. We aim to respond within one month, subject to lawful extensions for complex requests.

Complaints: You can always contact us first. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, DK-2500 Valby, dt@datatilsynet.dk, +45 33 19 32 00, or via their online guidance/forms.

12) Region-specific information (summary)

• EEA/UK: Our legal bases are described in Section 5. We rely on consent for non-essential cookies and certain marketing, and legitimate interests for B2B relationship management (with an easy opt-out).
• United States (e.g., California/Colorado/Connecticut/Virginia): We do not sell personal information. If we use advertising or analytics cookies that could be considered "sharing" for cross-context behavioral advertising, you can opt out via Cookie Settings and browser-level Global Privacy Control signals where supported. You may also request access, correction, deletion, and opt-outs using the contact details above.
• Brazil (LGPD), Canada (PIPEDA), and other jurisdictions: We honor local rights to access, correction, and deletion where applicable. Contact us to exercise these rights.

13) Children's privacy

Our website and services are intended for business use and are not directed to children. We do not knowingly collect personal data from children.

14) Links to other sites

Our website may include links to third-party websites and services. Those sites are governed by their own policies, which we encourage you to review.

15) Changes to this policy

We may update this policy from time to time. When we make material changes, we will post a prominent notice on our website and update the "Effective date" above.

16) How to reach us

SP Medical A/S
Møllevej 1, DK-4653 Karise
Email: info@sp-medical.dk   Phone: +45 56 76 60 00