PRIVACY NOTICE FOR THE PROCESSING OF PERSONAL DATA

Pursuant to Article 13 of the Regulation (EU) 2016/679 containing provisions for the protection of natural persons with regard to the processing of personal data and for the free movement of such data (hereinafter also referred to as the “GDPR”), we hereby provide you with information regarding the processing of your personal data.

1. Data Controller

Your personal data will be processed, depending on the purposes as specified in Section 3 below, “Purposes of the processing of the personal data,” by the following subjects in their capacity of autonomous data controllers:

• MBE France S.a.r.l. -  (RCS de Nanterre ; N° SIRET : 53973639700024 ; N°TVA : FR 37 539736397), with registered office in 37 bis rue Général Leclerc 92130 Issy-les-Moulineaux, Tel.: 01 41 90 12 10 exclusive licensee for France of the brand “Mail Boxes Etc” (hereinafter also referred to as “MBE”);
• MBE Franchisee - that is the entrepreneur to which you have applied for the provision of one (or more) of services offered by the latter, as part of the MBE network, such as shipments, graphics and printing (hereinafter also referred to as “MBE Franchisee Services”).

2. Categories of personal data processed

2.1. Personal data provided by you voluntarily

Please note that personal data you provide directly are subject to processing.

Personal data  means  “any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”, this including photos  (Art. 4.1 of the GDPR).

2.2. Personal data of a third party provided by you voluntarily

You take note that any indication (for example, in case of shipment services, in the filling in of the shipping form (so-called “MOS”) and/or of electronic forms via the Internet by you and/or by the MBE Franchisee) of personal data and of contact of any other subject within the scope of MBE Franchisee Services is a case of processing of personal data where you act as Data Controller with respect to the aforesaid subjects. Therefore, you, in the capacity of Data Controller of personal and contact data shall guarantee that such data is collected and communicated in compliance with the relevant provisions. To that end, you undertake, pursuant to Article 13 of the GDPR, to inform the said subjects whose personal data are collected and communicated in relation to the procedures and purposes of the processing. The personal data of the said subjects shall be communicated solely for the provision of the MBE Franchisee Services.

3. Purpose of the processing of the personal data

Your personal data will be processed, with your prior explicit consent where necessary, by MBE France S.a.r.l. and/or by the MBE Franchisee depending on the purposes pursued by each in the capacity of autonomous Data Controller.

3.1 Purpose of the processing of the personal data by the MBE Franchisee

The MBE Franchisee will process your personal data for:

1. the provision of the MBE Franchisee Services and related management, including payments, whatever complaints and communications with you;
2. marketing purposes in a broad sense, that is to send you, by any means of communication (fax, e-mail, text message, multimedia messaging service, paper-based mail, operator-assisted phone calls), advertising material and literature of a promotional nature or in any case involving commercial solicitation pertaining to services, products or discounts offered by the MBE Franchisee, as well as for conducting studies and surveys of the market, and elaborating related statistics.

3.2. Purpose of the processing of the personal data by MBE France S.a.r.l.

MBE France S.a.r.l. will process your personal data for:

1. marketing purposes in a broad sense, that is to send you, by any means of communication (fax, e-mail, text message, multimedia messaging service, paper-based mail, operator-assisted phone calls), advertising material and literature of a promotional nature or in any case involving commercial solicitation pertaining to services, products or discounts offered by MBE France S.a.r.l., as well as for conducting studies and surveys of the market, and elaborating related statistics;
2. profiling purposes regarding single customers or groups of customers so as to make it possible to evaluate, to analyse or to foresee aspects concerning personal preferences as to the value and type of services purchased, the manner and type of shipping, the reliability, the conduct, the addresses of destination of your shipments, and the services that you most often require for the purpose of offering you additional services, products or discounts (such as stationery articles, graphic work and printing products,  websites, direct debit services, etc.).

4. Legal basis of the processing of personal data

- The legal basis of the processing of personal data for the purposes as per Section 3.1(i) is the agreement to which you are party in order to make possible the provision of the MBE Franchisee Services and the relevant management.

The provision of your personal data and/or those of the recipient of the shipment for the above-mentioned purpose is optional; however, failure to do so will entail the impossibility of carrying out and managing the related MBE Franchisee Services.

• The legal basis of processing for purposes as per Section 3.1(ii) is your specific consent.

The provision of your personal data for the said purpose is optional and failure to do so will have the sole consequence of making it impossible for the MBE Franchisee to send you advertising and promotional messages, and to conduct market research. The provision and management of the MBE Franchisee Services instead the remains unprejudiced.

- The legal basis of processing for purposes as per Section 3.2(i) and (ii) is your specific consent.

The provision of your personal data for the said purposes is optional and failure to do so will have the sole consequence of making it impossible for MBE France S.a.r.l. i) to send you advertising and promotional messages and to conduct market research and/or ii) to proceed with the mentioned profiling. The provision and management of the MBE Franchisee Services instead remains unprejudiced.

We further point out that, if you have given consent authorizing the MBE Franchisee and MBE France S.a.r.l. to pursue the purposes, respectively, as per Sections 3.1(ii) and 3.2 (i) and (ii) above, you will remain in any case free to revoke it at any time and/or to object to the processing of the data for the aforesaid purposes, by sending without any formalities a clear written communication to that effect to the addresses as specified in Section 10 below, “Contacts for the exercise of the rights of the data subject and for further information.”

As for the exercise of the right to object for purposes of marketing, we inform you that if exercised by you, it will regard all means of contact whether electronic, automated or traditional, but you have the power to exercise your right to object to the limited extent of just some contact channels. For example, at any time by contacting the relevant Data Controller at the addresses as specified in Section 10 below, “Contacts for the exercise of the rights of the Data Subject and for further information,” you may object to just the sending of promotional communications by automated means (that is, contact by e-mail, text message, multimedia messaging service, etc.) and thus give your consent solely to receiving communication by traditional means (that is, paper-based mail or operator-assisted phone calls).

Following receipt of such application for revocation and/or expression of objection, the MBE Franchisee and/or, depending on the circumstances, MBE France S.a.r.l. will proceed timely to the deletion and erasure of your personal data from the database and inform, where possible, any third parties to whom or which the data have been communicated for the same purpose of cancellation.

5. Modalities of processing of personal data  

The processing of your personal data will be done by means of manual and IT devices, as well as paper.

The personal data provided by you will not be subject to automated decision-making processes, with the exception of profiling as per Section 3.2 (ii) above.

6. Recipients of personal data

Your personal data, which will not disseminated by either the MBE Franchisee or MBE France S.a.r.l., may be communicated:

- by the MBE Franchisee to:

1. employees, agents or collaborators of the MBE Franchisee who are located within the territory of the European Union;
2. employees, agents or collaborators of MBE France S.a.r.l. who are located within the territory of the European Union;
3. subjects that engage in activities of assistance and consultation on behalf of the MBE Franchisee in accountancy, administrative, legal, tax and financial matters that are located within the territory of the European Union;
4. subjects, bodies or authorities to whom or which the communication of your personal data is mandatory by virtue of provisions of law or orders issued by authorities;

- from MBE France S.a.r.l. to:

(i) employees, agents or collaborators of MBE France S.a.r.l. who are located within the territory of the European Union;

(ii) subjects located within the territory of the European Union of whom or which MBE France S.a.r.l. avails itself for profiling and marketing activities;

(iii)        subsidiaries or associated countries, which currently include MBE Worldwide S.p.A., Sistema Italia 93 S.r.l, Jonathan & Assist S.r.l, PonyZero S.r.l., Eurocubia S.r.l., DireFareStampare S.r.l. and Buy-me S.r.l.;

(iv) third parties, located within the territory of the European Union, with which - from time to time - commercial partnership agreements and/or common initiatives, campaigns and projects will be developed;

(v) persons, companies or professional offices located within the territory of the European Union that engage in activities of assistance and consultation in accountancy, administrative, legal, tax and financial matters;

(vi) subjects, bodies or authorities to whom or which the communication of your personal data is mandatory by virtue of provisions of law or orders issued by authorities.

The subjects or categories of subjects to whom or which your personal data will be communicated by the MBE Franchisee and/or by MBE France S.a.r.l. may process your personal data in the capacity of data processors, autonomous data controllers or joint data controllers.

The complete list of the data processors:

- of the MBE Franchisee is available at its registered office; for more information you may apply in writing at the addresses specified in Section 10 below, “Contacts for the exercise of the rights of the data subject and for further information.”

- of MBE France S.a.r.l. is available at its registered office; for more information you may apply in writing at the addresses specified in Section 10 below, “Contacts for the rights of the data subject and for further information.”

7. Transfer of personal data extra UE

Your personal data and those of the consignees will not be transferred outside the European Union by either MBE France S.a.r.l. or the MBE Franchisee.

8. Retention of personal data

In application of the principle of proportionality, we inform you that:

1. the MBE Franchisee, for the purpose as per Section 3.1(i) above (provision and management of the MBE Franchisee Services), will retain your personal data for the time necessary for the execution and management of the related services, without prejudice to any specific legal obligations with regard to the retention of accountancy documents;
2. the MBE Franchisee, for the purpose as per Section 3.1(ii) above (marketing), will retain your personal data for a period no longer than twenty-four months from the time of their recording, save for anonymization which prevents, even indirectly or in aggregate with other databases, the identification of the data subject;
3. MBE France S.a.r.l., for the purposes as per Section 3.2(i) (marketing) and 3.2(ii) (profiling) above, will retain your personal data for a period no longer, respectively, than twenty-four and twelve month from the time of their recording, save for anonymization which prevents, even indirectly or in aggregate with other databases, the identification of the data subject.

MBE France S.a.r.l. and the MBE Franchisee have implemented suitable mechanisms for automatic erasure of personal data, including to any third party to whom or which such data might have been communicated.

9. Exercise of rights by the data subject

Pursuant to Articles 13(2)(b) and (d) as well as Articles from 15 to 22 of the GDPR, we inform you that:

a) you have the right to apply to the Data Controller for access to the personal data, the rectification or deletion of the same or restriction on the processing as concerns you, and to object to such processing, or to revoke consent, in addition to the right to portability of the data;

b) you have a right to lodge a complaint with the “[•]” (national privacy authority) following the procedures and instructions published on the official website of the same national privacy authority at [•];

c) any rectification or deletion or restriction on processing done at your request, unless it proves to be impossible or entails a disproportionate effort, will be communicated by the Data Controller(s) to each of the recipients to whom or which your personal data have been transmitted. The Data controller(s) may communicate such recipients to you should you expressly so request.

Your applications for the exercise of such rights shall be addressed in writing to the Data Controller(s) at the addresses as specified in Section 10 below, “Contacts for the exercise of the rights of the data subject and for further information.”

The exercise of the rights is not subject to any formal restriction and is free of charge.

For more information about the provisions contained in Articles from 15 to 22 of the GDPR, click on the following link:

http://eur-lex.europa.eu/legal-content/IT/TXT/PDF/?uri=CELEX:32016R0679&from=it

10. Contacts for the exercise of the rights of the data subject and for further information

- Toward the exercise of your rights in relation to the purposes as per section 3.1 above and/or to obtain any type of information you may need in relation to the MBE Franchisee pursuant to this Privacy Notice, you may send a written communication to its registered office.

- Toward the exercise of your rights in relation to the purposes as per Section 3.2 above and/or to obtain any type of information you may need in relation to MBE France S.a.r.l. pursuant to this Privacy Notice, you may send a written communication to MBE France S.a.r.l (N° SIRET: 53973639700024 ; N°TVA : FR 37 539736397) with registered office in 37 bis rue du Général Leclerc 92130 Issy-les-Moulineaux or an email to privacy@mbefrance.fr.