Data Protection Information for Business Partners

The protection of your personal data is of particular importance to us. We process your personal data exclusively in accordance with the relevant legal provisions. In the following, we provide you with information, in accordance with Articles 13 and 14 of the GDPR, regarding the processing of your personal data and the rights and entitlements to which you are entitled under data protection law.

This notice covers processing in the context of our business relationships — as a customer, supplier, service provider or other business partner. What happens when you merely visit this website is set out separately in our privacy policy at cherrys-logistics.com/datenschutz.

1. Data controller

The data controller within the meaning of data protection law is

Cherry's Logistics Group GmbH, Zitadellenstraße 14, 21079 Hamburg, Germany

comprising the two companies

Cherry's Logistics Hamburg GmbH, Zitadellenstraße 14, 21079 Hamburg, Germany
Cherry's Logistics Frankfurt GmbH, Rudolf-Diesel-Straße 22, 64331 Weiterstadt, Germany

2. Contact details of the Data Protection Officer

We have appointed an external data protection officer for all companies within the group. You can contact them as follows:

Frommel Datenschutz GmbH, Akazienstraße 6a, 61352 Bad Homburg, Germany
Telephone: +49 6172 1710179, E-Mail: info@frommel.com

3. Type of data processing

The following personal data may be processed during our business relationships:

• Master and contact data, e.g. name, company, role, address, telephone number and email address
• Communication and correspondence data
• Contract, quotation and order data
• Transport, dispatch, delivery and recipient data
• Freight and customs data
• Invoice, payment and bank details
• Documentation and supporting evidence data
• Data relating to business transactions and business relationships
• Data from meetings, meeting notes, transcripts and summaries
• Technical data, insofar as this is generated during the use of our IT and communications systems

Which data is processed in each individual case depends on the relevant business relationship and the specific service provided.

4. Purposes and legal bases

We process personal data for the following purposes:

• Initiating, conducting and managing business relationships
• Preparing and processing quotations and orders
• Organising and carrying out transport, freight forwarding, warehousing and logistics services
• Carrying out import, export and customs procedures
• Communicating with customers, suppliers, service providers and other business partners
• Coordination with carriers, agents, customs offices and international logistics partners
• Invoicing and payment processing
• Documentation and traceability of business transactions
• Compliance with legal and regulatory requirements
• Ensuring IT and information security
• Optimisation, digitalisation and automation of our business processes

Processing is carried out based on:

• Article 6(1)(b) of the GDPR, insofar as it is necessary for the performance of a contract or pre-contractual measures
• Article 6(1)(c) of the GDPR, insofar as we are subject to a legal obligation
• Article 6(1)(f) of the GDPR, insofar as the processing is necessary to safeguard our legitimate interests or those of third parties

Our legitimate interests consist of the efficient and timely handling of business transactions, the optimisation and automation of operational processes, the documentation of business transactions, the safeguarding of IT and information security, and the assertion, exercise and defence of legal claims.

5. Use of artificial intelligence and automated processes

We use automated and AI-supported systems to ensure the efficient and rapid processing of our business processes. These systems assist our staff with preparatory, repetitive and time-consuming tasks. This may include, for example:

• Classifying and categorising incoming messages and documents
• Extracting and structuring information from documents
• Processing of transport, dispatch and recipient data
• Preparing correspondence and business transactions
• Translations
• Drafting and summarising documents
• Appointment and task management
• Documentation and follow-up of business transactions
• Transcription and summarising of online meetings
• Other preparatory and standardisable process steps

AI-based virtual assistants or AI agents may also be used to carry out defined work steps automatically or to prepare them for our staff. As part of these processes, personal data — such as names, contact details, delivery addresses or recipient details — may also be processed by AI systems. The following principles apply to the use of our AI systems:

• The processing of personal data by the AI systems used takes place exclusively within the European Union.
• Personal data is not used for the training or further development of the AI models in use.
• No personal data is transferred to third countries in connection with AI-based process steps.
• The AI systems are designed to support our staff and carry out preparatory, standardisable and repetitive tasks.
• The results of AI-supported processing are reviewed by an employee, insofar as they are relevant to further business measures or decisions.
• The subsequent decision is made by a human being and not by the AI system.

There is no purely automated decision-making with legal or similarly significant effects within the meaning of Article 22 of the GDPR.

6. Online meetings and AI-assisted summaries

During online meetings, transcriptions and AI-assisted summaries may be created for documentation and follow-up purposes. These serve to document the outcomes of discussions, agreements, tasks and decisions in an efficient and traceable manner. Processing is generally carried out based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the efficient documentation and follow-up of business meetings, as well as in reducing the effort involved in manual minute-taking.

Participants are informed about the use of these functions before or at the start of the meeting.

7. Source of the data

We generally receive personal data directly from you or from the company or organisation for which you work. In addition, we may receive personal data from the following sources:

• Customers and clients
• Suppliers and service providers
• Carriers and freight forwarders
• Agents and international logistics partners
• Customs and other authorities
• Other companies involved in a transport or business transaction

This includes, for example, contact details of points of contact as well as sender or recipient details provided to us for the purpose of carrying out a transport order.

8. Recipients of personal data

Personal data is only disclosed to the extent that this is necessary for the respective purpose or required by law. Recipients may include:

• Customers and clients
• Carriers and freight forwarders
• Shipping lines and airlines
• Warehousing and logistics service providers
• Customs agents and authorities
• Insurance companies
• Banks and payment service providers
• IT, hosting, cloud and communications service providers
• Providers of AI and automation solutions
• Tax advisers, auditors and legal advisers
• Other entities involved in the execution of a transport or business transaction

Where service providers process personal data on our behalf, they are engaged in accordance with the statutory requirements, in particular Article 28 of the GDPR.

9. International data transfers

Due to the international nature of our logistics services, personal data may be transferred to recipients outside the European Union or the European Economic Area. This may be necessary where carriers, agents, shipping companies, airlines, customs authorities, public authorities or other logistics partners in countries of origin, transit or destination are involved in the execution of a transport operation. Such transfers take place exclusively where the conditions set out in Articles 44 et seq. of the GDPR are met.

As part of our AI-based process steps, personal data is, as a rule, processed exclusively within the European Union. No transfer of personal data to third countries takes place via the AI systems used.

Where, in individual cases, a transfer to a third country is necessary for a specific business transaction, this is not carried out automatically by the AI system but is initiated by a member of staff and carried out in compliance with the applicable data protection requirements.

10. Retention period

We store personal data only for as long as is necessary for the respective purpose of processing.

In addition, data may be stored due to statutory retention obligations. Once the relevant retention period has expired, the data will be deleted, provided that no other legal basis justifies further storage.

Data required for the assertion, exercise or defence of legal claims may be retained until the conclusion of the relevant proceedings or until the expiry of the relevant limitation periods.

The specified deletion and retention rules also apply to interim and working results generated in the context of AI-supported processes.

11. Obligation to provide data

The provision of certain personal data may be necessary for the establishment or performance of a business relationship or due to legal requirements. Without the necessary information, certain services — in particular transport, customs or logistics operations — may not be carried out at all or may not be carried out in full.

12. Your data protection rights

Subject to the statutory requirements, you have the right to:

• Access to data pursuant to Article 15 of the GDPR
• Rectification pursuant to Article 16 of the GDPR
• Erasure pursuant to Article 17 of the GDPR
• Restriction of processing in accordance with Article 18 of the GDPR
• Data portability in accordance with Article 20 of the GDPR
• Objection pursuant to Article 21 of the GDPR

Where processing is based on your consent, you may withdraw this consent at any time with future effect in accordance with Article 7(3) of the GDPR.

13. Right to object

Where we process personal data based on Article 6(1)(f) of the GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.

We will then no longer process the personal data in question, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

14. The data protection supervisory authority responsible for us

You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of personal data. The authority responsible for us is:

The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany
Telephone: +49 40 42854-4040
Fax: +49 40 42854-4040
E-Mail: mailbox@datenschutz.hamburg.de
Website: datenschutz-hamburg.de

15. Updates to this privacy notice

This privacy notice regarding our data processing in accordance with Articles 13, 14 and 21 of the GDPR may change from time to time. We will publish any changes on this website. We make older versions available for you to view in an archive.

Date: 22.09.2026 — Version 1.0

This version is also available as a PDF (German and English): Data Protection Information for Business Partners, version 1.0 (PDF)

Language

This English text is a courtesy translation. The German version of this privacy notice is the binding one.