Createx ApS is the data controller for processing activities that relate solely to Createx ApS, including the technical operation of createx-onstage.com, unless a specific processing activity is covered by the joint controllership described below.

CVR no.: 39608944 / Email: info@createx-onstage.com

For selected customer, sales, supplier and project-related processing activities, the following companies are joint controllers:

• Createx ApS, CVR no. 39608944
• CreaNova ApS, CVR no. 40979352
• Crea Nova AS, organisation no. 923938230

The joint controllership covers processing activities for which the companies jointly determine the purposes and essential means, including joint sales, customer service, quotations, order processing, project delivery and relevant B2B communications. Each company remains an independent controller for its own employee data, accounting and other company-specific processing activities.

The companies have entered into a joint controllership arrangement under Article 26 of the GDPR. The arrangement describes the companies’ internal allocation of responsibilities. The essential content of the arrangement is set out in this Privacy Policy.

The common contact point for questions and requests concerning access, rectification, erasure, restriction or objection is info@createx-onstage.com. You may also exercise your rights against each of the companies.

Createx ApS administers the website and the shared social media profiles. Personal data collected through these channels may fall within the joint controllership where the data is processed as part of the companies’ joint customer, sales, marketing or project activities. Processing for which Createx ApS alone determines the purposes and essential means is not covered by the joint controllership.

When you use the contact form or send us an email, we may process:

• your name, email address and telephone number
• your company, job title and other business contact details
• your message and subsequent correspondence
• information about enquiries, quotations, projects, orders and deliveries

Do not send national identification numbers, health information or other sensitive personal data through the contact form. If it is exceptionally necessary to exchange such information, we will agree a separate and appropriate communication channel with you.

When you visit the website:

The website may process technical information such as your IP address, date and time, device and browser information, cookie identifiers, and operational and security logs. CookieYes is used to manage cookie choices and consent. Google Site Kit is connected to Google Search Console, Google Analytics and PageSpeed Insights. Identified cookies mainly originate from Google Analytics and embedded YouTube videos.

Images and external communications:

Createx may use employee photographs and images from trade fairs, events and customer visits on the website and social media. Createx may also occasionally send relevant information emails to selected customers and business partners, for example information about suppliers, products or holiday periods.

We usually receive information directly from you, for example when you contact us, request a quotation or participate in a project. We may also receive ordinary business contact details from your employer, one of the other joint controllers, business partners, suppliers or publicly available business sources.

• to respond to enquiries and provide customer service
• to prepare quotations and follow up on projects, orders and deliveries
• to maintain customer history and documentation of previous communications and deliveries
• to operate, secure and improve the website
• to communicate about Createx, suppliers, products and relevant industry matters
• to comply with legal obligations and handle possible legal claims

Depending on the circumstances, processing is based on:

• Article 6(1)(f) GDPR, where processing is necessary for the legitimate interests of Createx ApS or the relevant joint controllers in B2B communications, customer service, relationship management, quotation and order work, project delivery, documentation, operations and security
• Article 6(1)(b) GDPR, where processing is necessary to enter into or perform a contract with an individual contracting party
• Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation
• Article 6(1)(a) GDPR, where consent is required, for example for non-essential cookies or in specific situations involving photographs

Providing personal data is generally voluntary. However, certain contact, order and delivery details may be necessary for us to respond to an enquiry, prepare a quotation, enter into or perform a contract, or deliver goods or services. If the necessary information is not provided, we may be unable to carry out the requested activity.

We do not use automated individual decision-making or profiling that produces legal effects or similarly significantly affects the data subject.

CookieYes displays and manages the website’s cookie choices. Non-essential cookies and analytics technologies are only used when valid consent has been obtained, where consent is required. You may change or withdraw your cookie choices through the website’s cookie settings.

The current overview of cookies, purposes, providers and expiry periods is available in the CookieYes banner or the related cookie overview. The cookie banner, rejection option, consent categories and cookie overview were verified on 15 September 2026. The information is kept up to date when the website’s tools change.

Createx may share or make personal data available to relevant service providers and recipients where necessary for the stated purposes. These may include:

• Createx ApS, CreaNova ApS and Crea Nova AS, where processing is covered by the companies’ joint controllership
• Microsoft 365 for email, documents and communications
• WPMU DEV for hosting, operations, backups and technical logs
• CookieYes for consent and cookie management
• Google Search Console, Google Analytics and PageSpeed Insights through Google Site Kit, and YouTube for embedded videos
• LinkedIn and Instagram/Meta when images or posts are published
• relevant advisers, public authorities or other recipients where required by law or necessary to handle a legal claim

The relevant controllers use data processing agreements where a provider processes personal data on their behalf.

Some global providers may process personal data outside the EU/EEA, for example in connection with support, security, social media or technical subprocessors. In such cases, the provider’s documented transfer mechanism is used, such as the European Commission’s Standard Contractual Clauses or a relevant adequacy decision, together with supplementary measures where necessary.

You may contact us at info@createx-onstage.com if you would like further information about the applicable transfer mechanism or safeguards.

CRM data, email history and website enquiries are retained for as long as there is a documented legitimate business purpose, including customer relationship management, order history, project documentation and records of previous communications and deliveries. The companies have long-term customer relationships in which historical information may remain relevant for many years after the initial contact.

Personal data is reviewed on an ongoing basis in connection with operations, updates to contact details, data security and routine data clean-up. Irrelevant or unnecessary data is erased or anonymised. Cookie and log data follows the retention periods stated in the current cookie overview and the providers’ documented settings.

Before publishing images, Createx assesses the purpose, context and reasonable expectations of the people concerned. Consent is obtained where necessary or most appropriate. If you would like an image removed, please contact Createx at info@createx-onstage.com. Createx will assess the request and remove the image where there is no longer a lawful basis for its use.

Createx distinguishes between service messages and marketing. Order confirmations, delivery information, project information and operational or service information are treated as service messages. Product news, supplier news and newsletters are treated as marketing. Consent is obtained and documented where required under applicable marketing rules. Recipients may unsubscribe from marketing easily and free of charge at any time, or object by writing to info@createx-onstage.com.

The controllers use appropriate technical and organisational measures, including access controls, mandatory multi-factor authentication for Microsoft 365, Microsoft Defender, device encryption, automatic security updates, backups in the cloud systems used, and access restrictions based on work-related need.

Depending on the circumstances, you may have the right to:

• access the personal data processed about you by the relevant controllers
• have inaccurate information corrected
• have personal data erased
• have processing restricted
• object to processing based on legitimate interests or to direct marketing
• receive personal data in a structured, commonly used and machine-readable format where the rules on data portability apply
• withdraw consent with effect for future processing

These rights are not absolute and may be limited by, for example, legal obligations or the need to establish, exercise or defend legal claims. Requests concerning your rights should be sent to info@createx-onstage.com. You may also exercise your rights against each of the joint controllers.

If you are dissatisfied with Createx’s processing of your personal data, you are welcome to contact Createx first. You may also lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, telephone +45 33 19 32 00, email dt@datatilsynet.dk, www.datatilsynet.dk.

Createx ApS coordinates updates to this Privacy Policy when the processing activities, website tools, cooperation model or applicable requirements change. The current version is published on createx-onstage.com.