This policy explains how OhShip processes personal data when you use our websites (such as ohship.dk and ohship.eu), book a shipment, contact customer service, receive a parcel sent through OhShip, or when we contact your company about our business shipping.
How we use cookies and similar storage in your browser is described in our cookie policy.
1. Who is responsible
OhShip LTD is the controller for the processing described in this policy:
- OhShip LTD, Waterpoint, The Strand, SLM1020 Sliema, Malta
- Company registration number: C 108043 (Malta Business Registry)
- VAT: MT30899303
- E-mail: info@ohship.dk
OhShip is a Danish-owned company registered in Malta. Write to info@ohship.dk with any question about your personal data or to use your rights (section 15).
2. In short
- We use your data to create and deliver your shipments, take payment, give customer service and keep our accounts.
- We share data with the carriers (UPS and DHL Express) and with the service providers listed in section 12, only as far as they need it.
- We use AI (Anthropic's Claude) in the chat on our website, to check parcel contents, to suggest replies to our customer service staff, to sort spam out of the messages to customer service and to research companies for our B2B sales. A person always reads a reply or a sales e-mail before it is sent.
- We do not sell personal data. The website sets no statistics or advertising cookies.
- In "My profile" you can download your data and delete your account.
3. Your customer account
- Data: name, e-mail address, phone number, address, language, your password (stored only as a one-way hash), and the addresses you save in your address book. For business accounts also the company name, VAT number and payment terms. If you sign in with Google, we receive your name, e-mail address and Google account ID from Google.
- Purpose: to give you an account where you can book faster, see your orders and labels, save addresses and cards, and, for business customers, buy on the terms of their agreement.
- Legal basis: the contract with you (GDPR article 6(1)(b)).
- How long: until you delete your account. When you delete it, we anonymise your profile and delete your address book, your saved cards at Stripe and your chat and support history. Orders and invoices are kept (section 4) but are no longer linked to you.
You can create an account, but you do not need one to book.
4. Bookings, labels and payments
- Data: name, company, address, phone number and e-mail address of the sender and the receiver; the parcel's weight, size, contents description and value; customs information for shipments that leave the EU customs area; the carrier and service you choose; insurance; discount codes; the tracking number and tracking events; payment information (amount, status and Stripe's reference). Card details are entered directly with our payment provider Stripe and never reach us.
- Purpose: to calculate the price, create the label with the carrier, take payment, send you the label and the receipt by e-mail, tell the receiver that a parcel is on its way, show tracking, correct mistakes, handle claims against the carrier, and keep our accounts.
- Phone check: when you book, we check the sender's phone number with a code sent by SMS.
- Legal basis: the contract with you (article 6(1)(b)); our legal duty to keep accounting records (article 6(1)(c)); our legitimate interest in handling claims and disputes and in preventing fraud (article 6(1)(f)).
- How long: orders, labels, invoices, receipts and payments are kept indefinitely. We keep them for our bookkeeping and so that we can deal with claims, corrections and questions about a shipment, also long after it was sent.
While you book, the booking in progress (including names, addresses and contact details) is kept in your browser until you close the tab, so that a reload does not lose it.
5. If you receive a parcel
The sender gives us your name, address and phone number, and possibly your e-mail address and company name.
- Purpose: we use them to create the label and any customs papers, to pass them to the carrier that delivers the parcel (UPS or DHL Express), to e-mail you that a parcel is on its way with a link to tracking (only if the sender gave us your e-mail address), and to show the tracking.
- Legal basis: our and the sender's legitimate interest in getting the parcel delivered (article 6(1)(f)).
- How long: as for orders (section 4).
You have the same rights as our customers (section 15). Write to info@ohship.dk.
6. AI check of parcel contents
When you describe the contents of a parcel, an AI service (Claude from Anthropic) checks whether the items may be sent with the carriers, for example because of dangerous goods or battery rules, and writes a short description in English. That English text is printed on the label and the customs papers that go to the carrier.
- Data: the description you type. Please do not write personal data in it.
- Legal basis: the contract with you (article 6(1)(b)) and our legitimate interest in not sending goods the carriers do not accept (article 6(1)(f)).
- How long: the description is part of the order (section 4).
If you think the check is wrong, contact customer service.
7. Customer service and support cases
- Data: name, e-mail address, phone number (if you give it), order or tracking number, your messages and attachments, our replies and the history of the case.
- Purpose: to answer you and solve your case, for example a correction, a delay or a claim against the carrier.
- Contact form: the form is protected against spam by Google reCAPTCHA, which is loaded only when you start filling in the form.
- E-mail: e-mails to our customer service are received through Amazon Web Services in Ireland (EU).
- Spam filter: new e-mails and contact-form messages from senders we do not know yet (no account, order or earlier case we have answered), and e-mails that fail the check of the sender's address (DMARC), are checked by an AI service (Claude from Anthropic) for sales pitches, phishing and other spam. A message with the tracking number or order ID of a shipment booked through OhShip is not checked. The check gets the subject, your name, the domain of your e-mail address, for an e-mail the result of the sender check (DMARC), the domains the links go to and the start of the message. A message marked as spam gets no automatic reply and is kept in a separate folder our staff can check; it is deleted after 30 days. Our staff can also block an address, or the domain of a company that keeps sending spam. Legal basis: our legitimate interest in keeping customer service free of spam and fraud (article 6(1)(f)).
- AI reply suggestions: our staff can ask an AI service (Claude from Anthropic) to suggest a reply. The case conversation, and an earlier chat if the case started in the chat, is then sent to the AI. A person always reads and edits the reply before it is sent.
- Legal basis: the contract with you when the case is about your order (article 6(1)(b)); otherwise our legitimate interest in answering enquiries (article 6(1)(f)).
- How long: support cases and their attachments are deleted 3 years after the case was closed. The raw copy of an incoming e-mail is deleted after 30 days; its content stays in the case.
8. AI chat assistant
The chat on our website is answered by an AI assistant (Claude from Anthropic). It is marked as AI in the chat. It can make mistakes.
- Data: your messages and the assistant's answers. If you ask about a shipment: the order and tracking details, and the names and cities of the sender and the receiver. If you are not signed in, the e-mail address and postcode you give so that we can check that the order is yours.
- Talk to a person: if you ask to be handed over to our staff, we save your name, your e-mail address and the conversation as a support case (section 7).
- Legal basis: our legitimate interest in answering customers quickly (article 6(1)(f)); the contract with you when you ask about your order (article 6(1)(b)).
- How long: conversations are deleted 12 months after the last message. In your browser, the conversation is kept until you close the tab.
Do not write card details, passwords or other sensitive information in the chat.
9. Satisfaction survey
About 48 hours after a parcel paid by card has been delivered, we e-mail the sender a short survey with one to five stars. If you click a star, we save the rating with the order.
- Legal basis: our legitimate interest in improving our service (article 6(1)(f)).
- How long: as for orders (section 4).
If you do not want these e-mails, tell us at info@ohship.dk.
10. Business customers and API partners
- Business accounts: we check the VAT number in the EU's VIES register. Business customers with an agreement to pay later receive invoices.
- API partners: business partners book shipments for their own customers through our API. The partner gives us the sender's and receiver's details. We create the labels and send the labels and tracking updates back to the partner's system. Our partner API calls are logged for security.
- Legal basis: the contract with the business customer or partner (article 6(1)(b)); for the people in the shipments, our and the partner's legitimate interest in getting the parcels delivered (article 6(1)(f)).
- How long: as for orders (section 4); logs of partner API calls 12 months.
11. Business contacts we approach (B2B sales)
We look for companies that may benefit from OhShip's business shipping and contact them with an offer. This section is our information to you if we have contacted you or your company.
- Data: about the company: name, CVR number, industry, website, published figures from annual reports and the shipping information on its website. About people whose role relates to shipping, logistics, purchasing or management: name, job title, and the business e-mail address and phone number the company publishes. Our e-mails to you, your replies and notes of our contact.
- Sources: the company's own website, which our AI research tool finds and reads (also through web search), and the Danish Central Business Register (CVR) from the Danish Business Authority (Erhvervsstyrelsen).
- Purpose and legal basis: to offer OhShip's business shipping to companies that may need it. Our legitimate interest in marketing our services to businesses (article 6(1)(f)).
- AI: we use an AI service (Claude from Anthropic) to analyse public company information, find business contact details and draft e-mails. A person at OhShip reads and approves every e-mail before it is sent. No decision with legal or similarly significant effect is made about you.
- How we contact you: by e-mail from sales@ohship.dk, sent through our e-mail provider one.com. We read the replies to that mailbox.
- Recipients: Anthropic (AI), one.com (e-mail) and Amazon Web Services (hosting). We do not sell or share the data with anyone else.
- How long: contact details and the history of our contact are deleted 12 months after our last contact, unless your company becomes a customer. If you ask us not to contact you again, we keep only your e-mail address (or a code made from it) for as long as needed to make sure we respect that.
- Your right to object: you can always say no, free of charge. Reply "unsubscribe" or use the link in our e-mail, and we will not contact you again. You also have the rights in section 15.
12. Who receives data
We share personal data only as far as each recipient needs it for the purpose described:
| Recipient | Data | Purpose |
|---|---|---|
| UPS and DHL Express | Names, addresses, phone numbers and e-mail addresses of sender and receiver; contents, value and customs information | Transport, pickup, prices and tracking. The carriers use the data as independent controllers under their own privacy notices. |
| Stripe | Name, e-mail address and phone number of the payer; the payment; the card details you enter with Stripe | Card payments, saved cards, refunds and fraud prevention |
| Anthropic | Chat messages and shipment details in the chat; contents descriptions; support cases when staff ask for a reply suggestion; new customer-service messages from unknown senders and e-mails that fail the DMARC sender check (spam filter); public company information and business contact details for B2B sales | AI chat, AI contents check, reply suggestions, spam filter, B2B sales research and drafts |
| Twilio | Phone number and the SMS code | Checking your phone number |
| Addresses you type and postcodes (sent from our server, for address suggestions and location lookup); contents descriptions to be translated (sent from our server); your Google account if you sign in with Google; reCAPTCHA when you start filling in the contact form; Google Maps after you click "Show map" | Address suggestions, translation, Google sign-in, spam protection and maps | |
| Amazon Web Services | All data we store | Hosting: servers, database, file storage and e-mail. In the EU (Stockholm, Sweden; incoming customer-service e-mail in Ireland). |
| one.com | E-mails to and from sales@ohship.dk | E-mail provider for B2B sales |
| Business partners that book through our API | Labels and tracking updates for the shipments they booked | API partners (section 10) |
| EU VIES | VAT numbers of business customers | Checking VAT numbers |
We also disclose data to public authorities when the law requires it, for example customs information through the carriers.
13. Transfers outside the EU/EEA
Stripe, Anthropic, Twilio and Google are based in the USA, and personal data may be processed there. We use their standard data processing terms, which include the EU standard contractual clauses, and for providers that are certified under the EU-US Data Privacy Framework, that framework. You can ask us for more information at info@ohship.dk.
When you send a parcel to a country outside the EU, the carrier has to process the data in that country to deliver the parcel.
14. How long we keep data
| Data | How long |
|---|---|
| Orders, labels, invoices, receipts and payments | Indefinitely (bookkeeping and claims, section 4) |
| Customer account and address book | Until you delete your account |
| AI chat conversations | 12 months after the last message |
| Support cases and attachments | 3 years after the case was closed |
| Messages in the customer-service spam folder | 30 days |
| Raw copies of incoming customer-service e-mails | 30 days |
| Unused e-mail and phone verification codes | 30 days |
| Error and request logs of our system (IP address, request, error) | 90 days |
| Logs of our requests to the carriers | 12 months |
| Logs of partner API calls | 12 months |
| Background jobs (for example sending an e-mail) | 7 days, 30 days if the job failed |
| Backups of the database | 7 days |
| B2B sales contacts and contact history | 12 months after the last contact, unless the company becomes a customer |
| B2B opt-out list (e-mail address or a code made from it) | As long as needed to respect the opt-out |
| Your cookie choice | 365 days (cookie policy) |
15. Your rights
You have the right to:
- get access to the personal data we have about you and a copy of it,
- have wrong data corrected,
- have data deleted, unless we must keep it (for example orders and invoices, section 4),
- have the processing restricted,
- receive the data you have given us in a machine-readable format (data portability),
- object to processing based on our legitimate interest, and always to direct marketing,
- withdraw a consent at any time, for example your cookie choice, without affecting what happened before.
We do not make decisions about you based only on automated processing that have legal or similarly significant effects.
How: in "My profile" you can download a copy of your data and delete your account. For everything else, write to info@ohship.dk. We answer within one month. We may ask you to confirm who you are before we act.
16. Complaints
If you are not satisfied with how we handle your personal data, please contact us first. You can also complain to a data protection authority. OhShip LTD is established in Malta, so our lead authority is the Information and Data Protection Commissioner (idpc.org.mt). You can also complain to the authority in the country where you live, for example:
- Denmark: the Danish Data Protection Agency, Datatilsynet (datatilsynet.dk)
- Finland: the Data Protection Ombudsman, Tietosuojavaltuutettu (tietosuoja.fi)
17. Security
All traffic to our websites is encrypted (HTTPS). Passwords are stored only as one-way hashes, card details only at Stripe, and your sign-in is kept in cookies that scripts on the page cannot read. Only staff who need it have access to customer data.
18. Changes
We update this policy when our processing changes. The version and the date at the top show which version applies. If we make important changes, we tell you on the website and, where it is appropriate, by e-mail.