PRIVACY NOTICE
At GFS (Global Freight Solutions), respecting your data privacy rights is a top priority. This notice explains why and how we collect personal data about you, how we may process such data, and what rights you have regarding your personal data.
This notice is laid out such that the general provisions are at the top of this notice and you can then select the data subject type that you wish to view the relevant information.
We collect and process your data based on the type of data subject that you are. Please click on the most relevant category(ies) of data subject for your situation and this will take you to the section that describes what data we collect and the reason and justification for processing for that data subject category.
Please read the General Information and then click on the Data Subject Type that you are, as set out below.
Privacy Notice Contents
General Information
Suppliers or potential Suppliers
Customers/Clients or potential Customers/Clients
Other Data Subject Types
GENERAL INFORMATION
The information in this section is relevant to all categories of data subject.
Who controls your personal data?
GFS is responsible for your personal data. Except where GFS acts strictly as a Data Processor on behalf of a retailer or third-party marketplace (see the ‘Parcel Recipients and Marketplace Deliveries’ section below), GFS is the data controller. You can contact a representative by sending an email to the following address:
Your rights
You have the following rights:
- The right to be informed.
- You have the right to be informed about how GFS processes your personal data. Typically, GFS communicates this information through privacy notices such as this one.
- The right of data access
- You have a right to obtain a copy of the personal data we hold about you, subject to certain exceptions.
- The right of data rectification
- You always have a right to ask for immediate correction of inaccurate or incomplete personal data which we hold about you.
- The right of data erasure
- You have the right to request that personal data be erased when it is no longer needed, where applicable law obliges us to delete the data or the processing of it is unlawful. You may also ask us to erase personal data where you have withdrawn your consent or objected to the data processing. However, this is not a general right to data erasure – there are exceptions.
- The right to restrict data processing
- You have the right to restrict the processing of your personal data in specific circumstances. Where that is the case, we may still store your information, but not use it further.
- The right to data portability
- You have the right to receive your personal data in a structured, machine-readable format for your own purposes, or to request us to share it with a third party.
- The right to object to data processing
- You have the right to object to our processing of your personal data based on the legitimate interests, where your data privacy rights outweigh our reasoning for legitimate interests.
- Rights in relation to automated decision making and profiling.
- You have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. Currently, GFS does not perform any automated decision making or profiling.
You may request to enforce your data privacy rights by emailing datacompliance@gfsdeliver.com – :Please note: If your data relates to an order fulfilled via a third-party marketplace (such as Amazon), you must exercise your rights directly through that marketplace vendor. GFS cannot execute rights requests for marketplace data directly.
In certain circumstances, we may need to restrict the above rights to safeguard the public interest (e.g., the prevention or detection of crime) or our business interests (e.g., the maintenance of legal privilege).
Consent as a legal basis for processing
For some data processing, GFS uses consent as a legal basis. If you have consented to processing by Global Freight Solutions, please be aware that you have the right to withdraw this consent at any point. If you would like to withdraw consent for a particular type of data processing that GFS performs, please email the following address:
Complaints to a Supervisory Authority
You have the right to lodge a complaint with a supervisory authority with regards to the way that GFS processes your personal data. GFS recommends lodging a complaint with the ‘Information Commissioner’s Office (ICO)’. This is the UK’s supervisory authority and is the one which GFS is registered with.
How we share your data
We will not share your information with any third parties for the purposes of direct marketing.
We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.
In some circumstances we are legally obliged to share information. For example under a court order. In any scenario, we will satisfy ourselves that we have a lawful basis on which to share the information and document our decision making and satisfy ourselves we have a legal basis on which to share the information.
How we protect your information
We implement appropriate technical and organisational measures to protect personal data that we hold from unauthorised disclosure, use, alteration, or destruction. Where appropriate, we use encryption and other technologies that assist in securing the data you provide. We also require our service providers to comply with strict data privacy requirements where they process your personal data.
How long we keep your personal data
We only keep your personal data for as long as necessary for the purposes described in this privacy notice, or until you notify us that you no longer wish us to process your data. After this time, we will securely delete your personal data, unless we are required to keep it to meet legal or regulatory obligations, or to resolve potential legal disputes. For end-consumers and Amazon marketplace deliveries, strict automated purging cycles apply (see below), which override general business retention periods.
Contact and further information
If you have any questions about how we use your personal data or wish to make a complaint about how we handle it, you may contact GFS at: datacompliance@gfsdeliver.com
SUPPLIERS OR POTENTIAL SUPPLIERS
The personal data we collect about you and how we use it
We collect and use personal data that concerns you in connection with the agreements with our suppliers. We may collect the following categories of personal data:
- Identification data and business contact information, you share with us such as first name, last name, job/position/title, nationality, business email address, business address, telephone number, mobile telephone number, telefax number, private telephone number, gender, date of birth.
- Additional information you provide to us in the course of our business relations such as data concerning the fulfilment of our contractual obligations and pre-contractual measures including correspondence data, offers, tenders, resume/CV, conditions, contract and order data, invoices, payments, business partner history, records relating to queries/questions/complaints/orders.
- Electronic identification data and information collected by the communications systems, IT applications and website browser (where supplier has access or is affected by such systems or applications and in accordance with the applicable law) such as information technology usage (system access, IT and internet usage), device identifier (mobile device ID, PC ID), registration and login credentials, IP address, login data and log files, Analytics ID, time and URL, searches, website registration and cookie data, sound recordings (e.g. voice mail/phone recordings, Skype recordings).
The below mentioned types of personal data are only collected and processed, if at all, in accordance with applicable local laws in your country of residence and where relevant depending on the agreements with our suppliers.
- Data about criminal convictions and offences such as criminal background information and sanction list information to the extent required for the purposes of criminal background screening, due diligence and Anti Money Laundering obligations
- To the extent necessary to fulfil our obligations, data obtained from publicly accessible sources or which are legitimately transmitted by other third parties (e.g. a credit agency) such as commercial register data, creditworthiness data.
What we use your personal data for
We may use your personal data as described above for the following purposes:
- supplier and service provider management throughout the supply chain including contact interaction including tendering, engagement, processing orders, process and fulfilment of purchases, administration and management of suppliers, vendors, contractors, advisers and other professional experts;
- paying debts, supplier invoice and payment management, purchasing of direct and indirect services;
- reporting and analytics including market intelligence and development and improvement of services or products through assessment and analysis of the information;
- management of process quality;
- references on documents, such as tenders, purchase orders, invoices, reports;
- contract lifecycle management;
- payment collection and insolvency processes;
- training suppliers;
- finance and shared accounting services, providing record to report and purchase to pay services;
- reorganisation, acquisition and sale of activities, business units and companies;
- monitoring and auditing compliance with Global Freight Solution’s corporate policies, contractual obligations and legal requirements;
- carrying out audits, reviews and regulatory checks to meet obligations to regulators;
- governance, risk and compliance, including due diligence and anti-money laundering obligations, customs and global trade compliance and sanctioned party list screening, security, including prevention, detection of crime and fraud;
- maintain and protect the security of products, facilities, services, systems, networks, computers and information, preventing and detecting security threats, and fraud or other criminal or malicious activities; and
- manage IT resources, including infrastructure management including data back-up, information systems’ support and service operations for application management, end user support, testing, maintenance, security (incident response, risk, vulnerability, breach response), user accounts management, software licenses assignment, security and performance testing and business continuity.
We collect only the personal data from you that we need for the purposes described above. For statistical purposes, improvement of our services and testing of our IT systems we use as much as reasonably possible anonymised data. This means that these data can no longer (in)directly identify you or single you out as an individual.
What happens if you do not provide us with the information, we had asked you for or if you ask us to stop processing your information?
Where it concerns processing operations related to the agreements with our suppliers (as described above), GFS will not be able to adequately establish, conduct or terminate a business relationship with you or your company and generally perform the purposes described above without certain personal data. Although we cannot obligate you to share your personal data with us, please note that this then may have consequences which could affect the business relationship in a negative manner, such as not being able to take requested pre-contractual measures to enter into a contract with you or to establish and continue the business relationship you have asked for.
The legal basis on which we use your personal data
We use your personal data for the purposes described in this notice based on one of the following legal bases, as applicable:
We may process your personal data for the fulfilment of contractual obligations resulting from contracts with you or your company, or as part of pre-contractual measures we take;
In some cases, we rely on our legitimate interests to process your personal data insofar as this is not overridden by your own privacy interests. Such interests may include:
- conduct, management, development and furtherance of our business in the broadest sense possible including supply of products and services, performance of agreements and order management with suppliers, process and fulfilment of purchases, process quality management and improvement of products or services, analytics and market intelligence, reduction of default risks in our procurement processes and reorganization, acquisition and sale of activities, business divisions and companies;
- monitor, investigate and ensure compliance with legal, regulatory, standard and GFS internal requirements and policies;
- prevent fraud and criminal activity including investigations of such activity, misuse of GFS assets, products and services, and as strictly necessary and proportionate for ensuring network and information security; and
- transmitting personal data within the GFS group for internal administrative purposes as necessary for example to provide centralised services.
In some cases, we process your personal data on the basis of legal obligations and statutory requirements, for example, on the basis of tax or reporting obligations, cooperation obligations with authorities, statutory retention periods or the disclosure of personal data within the scope of official or judicial measures may be required for the purposes of taking evidence, prosecution or enforcement of civil law claims.
Regarding personal data concerning criminal convictions and offences, we will only process such data where such processing is permitted by applicable (local) law.
CUSTOMERS/CLIENTS OR POTENTIAL CUSTOMERS/CLIENTS
The personal data we collect about you and how we use it
We collect the following categories of personal data:
- The business contact information you share with us: name, title, job title, email address, business address, telephone number, mobile telephone number
- Additional information you provide to us in the course of our business relations, such as:interests in GFS services or products, marketing preferences, registration information provided at events, fairs, contract or order data, invoices, payments, business partner history, etc.
- Information your browser makes available when you visit the GFS website:IP address, the source of your site visit, time spent on the website or a particular page, links clicked, comments shared, browser type, date and time of visit, etc.
- To the extent necessary to fulfil our obligations, data obtained from publicly accessible sources or which are legitimately transmitted by other third parties (e.g. a credit agency):commercial register data, association register data, creditworthiness data.
What we use your personal data for
We use your personal data to:
- process and fulfil orders and keep you informed about the status of your or your company’s order;
- provide and administer our products and services;
- provide customer support and process, evaluate and respond to requests and inquiries;
- conduct and facilitate customer satisfaction surveys;
- conduct marketing and sales activities (including generating leads, pursuing marketing prospects, performing market research, determining and managing the effectiveness of our advertising and marketing campaigns and managing our brand);
- send you marketing communications (such as alerts, promotional materials, newsletters, etc.);
- perform data analytics (such as market research, trend analysis, financial analysis, and customer segmentation).
We only collect the personal data from you that we need for the above purposes. We may also anonymise your personal data, so it no longer identifies you and use it for various purposes, including the improvement of our services and testing our IT systems.
What happens if you do not provide us with the information, we had asked you for, or if you ask us to stop processing your information?
Certain personal data is necessary to establish, conduct or terminate a business relationship with you. We need you to provide us with the personal data required for the fulfilment of contractual obligations or which we are legally obliged to collect. Without such personal data, we will not be able to establish, execute or terminate a contract with you. Also, we will be unable to take requested pre-contractual measures to enter a contract with you or to establish and continue the business relationship you have asked for.
The legal basis on which we use your personal data
We use your personal data for the purposes described in this notice based on one of the following legal bases, as applicable:
- We may process your personal data for the fulfilment of contractual obligations resulting from contracts with you or your company, or as part of pre-contractual measures we have been asked to take;
- We may process your personal data on the basis of statutory requirements, for example, on the basis of tax or reporting obligations, cooperation obligations with authorities or statutory retention periods;
- We will ask your consent for the activities described in this privacy notice when required by applicable law, for example when we process your data for marketing purposes where we don’t have an existing business relationship with you or your company; or
- We will rely on our legitimate interests to process your personal data within the scope of the business relationship with you or your company. Our legitimate interests to collect and use the personal data for this purpose are management and furtherance of our business. You may obtain a copy of our assessment of why we may process your personal data for these interests by submitting a request at datacompliance@gfsdeliver.com
OTHER DATA SUBJECT TYPES
Unsolicited Personal Information
If you send GFS unsolicited personal information, for example a CV, GFS reserves the right to immediately delete that information without informing you or to decide which category of data subject that you appear to be and manage your personal data within the remit of that category as described elsewhere in this Privacy Notice.
Users of our website that do not fall under the specifically stated Data Subject Types
The personal data we collect about you and how we get it
We collect the following categories of personal data:
- The business contact information you share with us:name, title, job title, email address, business address, telephone number, mobile telephone number, etc.
- Information your browser makes available when you visit the GFS website:IP address, the source of your site visit, time spent on the website or a particular page, links clicked, comments shared, browser type, date and time of visit, etc.
What we use your personal data for
We use your personal data to:
- respond to your specific request that you make, for example request a demonstration, whitepapers, newsletters, or other information.
- provide customer support and process, evaluate and respond to requests and inquiries;
- conduct and facilitate customer satisfaction surveys;
- conduct marketing and sales activities (including generating leads, pursuing marketing prospects, performing market research, determining and managing the effectiveness of our advertising and marketing campaigns and managing our brand);
- send you marketing communications (such as alerts, promotional materials, newsletters, etc.);
- perform data analytics (such as market research, trend analysis, financial analysis, and customer segmentation).
We only collect the personal data from you that we need for the above purposes. We may also anonymise your personal data, so it no longer identifies you and use it for various purposes, including the improvement of our services and testing our IT systems.
The legal basis on which we use your personal data
We use your personal data for the purposes described in this notice based on one of the following legal bases, as applicable:
- Legitimate interest as by using our website it is understood that there is potential for you to be a potential customer, contractor, employee, or supplier.
PARCEL RECIPIENTS
Where GFS carries out delivery, sorting, routing or final-mile services, we process limited personal data about the intended recipient of a parcel — typically name, delivery address, contact telephone number or email address, and delivery tracking status. In most cases GFS acts as a data processor on behalf of the retailer, seller or marketplace that arranged the delivery (the data controller), and we process this data only on that party’s documented instructions, solely to provide the delivery service and to return tracking updates.
We do not use parcel recipient data for our own marketing, profiling or analytics, and we do not sell it. We share it only with the delivery partners and carriers strictly necessary to complete the delivery, each of whom is required to protect it under equivalent data-protection and confidentiality obligations.
Exercising your rights. Because GFS usually acts as a processor, requests to access, correct or delete parcel data should be directed to the retailer or marketplace you ordered from, who will instruct us as required. Where GFS is itself the controller for a delivery, you can contact us at datacompliance@gfsdeliver.com.
Amazon Marketplace and Seller Fulfilled Prime (SFP) Deliveries
The following additional terms apply where GFS fulfils a delivery arranged through the Amazon marketplace, including under Seller Fulfilled Prime (SFP). They reflect the data-handling standards Amazon requires of us.
- Our role. GFS processes this data strictly as a data processor. The legal basis, permitted purposes and data-handling boundaries are determined by Amazon and/or the Amazon seller acting as controller. GFS uses the data only to provide logistics, sorting, routing and final-mile delivery, and to return delivery and tracking status to Amazon.
- No secondary use. GFS does not use Amazon-sourced personal data for marketing, advertising, profiling, analytics or any purpose other than completing and confirming the delivery, and does not retain it for its own business purposes.
- Onward transfer. The data is shared only with the delivery partners and carriers strictly necessary to complete the delivery. Each is bound by data-protection and confidentiality obligations equivalent to those Amazon requires of GFS.
- Retention and deletion. Identifiable personal data sourced from Amazon (including recipient name, address and contact details) is deleted or irreversibly anonymised across GFS operational systems within 30 days of successful delivery. Copies retained in system backups are not returned to live use and are overwritten on expiry of the standard backup rotation.
- Exercising your rights. As a processor, GFS cannot independently access, amend, export or delete these records on request. Any such request must be made to Amazon or the relevant Amazon seller as controller, who will instruct GFS accordingly.
