Spring Privacy Statement

We are Spring Global Delivery Solutions (“Spring”) and our legal entity is G3 Worldwide Mail N.V., registered at Prinses Beatrixlaan 23, 2595 AK, The Hague, The Netherlands. We are part of PostNL Group, headquartered in The Hague, The Netherlands. References to “Spring”, “we” and “our” throughout this statement, depending on the context, collectively refer to G3 Worldwide Mail (UK) Ltd. (Spring UK), G3 Worldwide Hungary Kft. (Spring Hungary) and G3 Worldwide (Canada) Inc. (Spring Canada). We are responsible for the collection and use of your personal data as described in this Privacy Statement. 

We have arranged that if you want to exercise your rights, such as your right to access, correct, erase, restrict, object or port personal data or to withdraw your consent, or if you have any questions about the processing of your personal data, you can contact Spring UK, Spring Hungary or Spring Canada in accordance with Paragraph 12 ‘Contact details for your privacy inquiries’.

‘Personal data’ is any information that relates to you or to your customers and that identifies you or your customers either directly from that information or indirectly, by reference to other information that we have access to. The personal data that we collect, and how we collect it, depends upon how you interact with us. 

We keep personal data from anyone who has been in contact with us either directly or indirectly. An example of indirect contact is if you order an item from an online retailer and Spring delivers the parcel to your home or coordinates delivery with local delivery partners. In this case, you have not shared your address with us directly, but we receive it from the retailer to whom you provided your personal data. 

Categories of personal data that we collect include:

• Mail delivery
  Some examples of data we process: name, address
• Parcel delivery
  Some examples of data we process: name, address, tracking contact information (e.g. email address, telephone number), optional customs information (type of goods, value). 
• International Return Services
  This service allows your customers to return items. Your customers provide personal data which allows us to generate a return label which can be placed on their package and is used to pre-alert the local postal provider and to report upcoming returns to our customers. Examples of data we process: name, address, email address, telephone number.
• Pick & Pack fulfilment
  For specific customers, (e.g. webshops), we warehouse their goods and pack and ship items to their customers. In order to do this we receive the information on orders to be shipped from our customers, this can include the following data: name, address, email address, telephone number, order item description, order item values. 
• Storage service
  As part of this service, we temporarily store mail instead of delivering it to your customers. After the retention period, all mail held will be delivered to your customer. Some examples of data we process: name, address, email address. 
• Online Shipping Tools
  You can use this service to send parcels quickly and efficiently. Some examples of data we process: name, address, email address, telephone number, gender, date of birth, bank account number, username and password, user logins, IP address of your PC, mobile or tablet. 
• Customer service
  You can phone, and chat with our customer service agents. If you chat, we will save the chat and we also keep records of the details of all phone calls – which is convenient if you contact us again in the future. Sometimes we outsource our customer service to a third-party service provider; in this case, this organisation will save your data. However, they will save this data only for the benefit of Spring. 
• Careers at Spring
  When you apply for a job with us we will ask you for information relevant to your application. We ask all applicants to apply via our recruitment section on our website. We will process your personal data from the digital application form, cover letter and your CV. We need to collect and process your personal information so we can process your application for the position you apply for and in order to contact you in connection with your application. 
• Visiting our premises
  If you visit one of our buildings we may collect information that we need in order to identify you and complete necessary security checks. We may also collect your image on CCTV. 
• Your mySpring account
  If you have a Spring account, your personal data can be used for multiple Spring services. We track what services you use, and with what frequency. We store your ID account number for this purpose. 
• Spring’s website
  When you visit our website, we automatically collect, store and use technical information about your service preferences and interaction with our website. Some examples of the data we process are the IP address of your electronic device, details regarding your visit to the website (such as when your visit took place, what were you looking for or what search terms you entered, how long have you stayed on each page you visited, whether you downloaded any information, whether you accessed any of our online tools) and your cookie settings. This information is sent from your electronical device to us using a variety of cookies. We may, with your permission, use encrypted keys to display relevant advertisements to you on websites outside Spring. 

For more information about how we use cookies and how to disable them, please read our Cookie Statement.

There are number of ways in which we use and process your personal information, depending on how you interact with us. If you do not provide your information to us, then we will be unable to interact with you in that way – for example, if you do not provide your or your customers name, address, and/or where relevant account details when using our delivery services, we will not be able to process your payment and/or to deliver the mail or parcels to you or your customers. By ‘processing’, we mean storing, analysing, updating, modifying, deleting, forwarding.

We will only use your personal data fairly and where we have a lawful reason to do so. We are allowed to use your personal data if we have your consent or another legally permitted reason applies. You can withdraw your consent at any time by following the specific instructions in relation to the processing for which you provided your consent, by adjusting your setting (if available) or by reaching us through the contact details in Paragraph 12 ‘Contact details for your privacy inquiries’ below. The different legal grounds we rely on are: 

a. Your consent: You have told us you are happy for us to process your personal information for a specific purpose; 

b. Legitimate interests: The processing is necessary for us to conduct our business, but not where our interests are overridden by your interests or rights. 

c. Performance of a contract with you: We must process your personal information in order to be able to provide you with one of our products or services; 

d. Prevention of fraud: Where we are required to process your data in order to protect us and our customers from fraud or money laundering; 

e. Vital interests: The processing of your personal information is necessary to protect you or someone else’s life; 

f. Legal obligation: We are required to process your personal information by law.

We will only use your personal data fairly and where we have a lawful reason to do so. Our use of your personal data depends on how and where you interact with us, for example: 

a. We do our work 

Spring provides a full range of services, including: 

• Delivering parcels and mail 
• International Return Services 
• Pick & Pack fulfilment 
• Online shipping tools 
• Sorting destination address data We require name and address data for these services, often of both sender and recipient. Additionally we require information about size and weight of postal items. In case of international deliveries and returns we may also require customs related information, such as type of goods and value. 

b. We will notify you when your parcel is on the way

If you have ordered an item for home delivery, we will keep you or your customers updated by sending you an email containing the status of your order. Alternatively you or your customers can track your status using our Track & Trace feature. 

c. We make sure the Spring website works properly 

We use personal data of website visitors to analyse how they use the website. We use customer data to ensure the site operates as effectively as possible. 

d. Sometimes we share personal data with authorities In some cases, we are compelled to provide personal data to various authorities, including consumer and market authorities, law enforcement authorities, and investigation services. We always check the competencies of these authorities before sharing this data. 

e. We improve our services We can improve our services by analysing and aggregating information derived from personal data. In analysing this information, we use anonymous data as much as possible which we cannot link to any individuals. Examples of items we create and improve through this analysis includes: 

• We improve pages and forms on our website; 
• We resolve the root causes of complaints; 
• We develop new products; 
• We produce reports for other organisations. These reports never contain any names and addresses, as this information relates to large groups of users (e.g. the number of parcels delivered in a specific postcode area) 

f. MySpring account 

If you hold a MySpring account and have given your consent, we will create a customer profile for you and combine the information from your profile with other information relating to you which we may have in our possession, e.g. how many parcels you send on an annual basis. We will then create a customer profile, so as to be able to tailor our website and e-mails to your needs and interests, while our employees can use your customer profile to provide you with superior assistance and support. 

g. We read job applicants’ CVs 

If you apply for a job with us, you provide us with your cover letter and your CV when filling out our digital application form. We need to use and process your personal information for a number of purposes relating to recruitment, including: 

• To assess your suitability to work for Spring; 
• To contact you in connection with your application; 
• To conduct screening, assessments and interviews; 
• To maintain a library of correspondence; 
• To make offers and provide contracts of employment; 
• To conduct pre-employment checks, including determining your legal right to work and carrying out criminal record and credit checks where applicable – for more information about the pre-employment checks we carry out, please speak with your recruitment contact; and 
• To ensure that we comply with our legal obligations and, where applicable, to ensure that our recruitment processes are fair. 

Your personal information will be retained for as long as necessary to process your application and in accordance with the applicable retention periods in the country of the position you apply for. We may continue to hold information about you and your applications after any application process is complete, in case we need to consult it in the future if you make another application or become a Spring employee, if a dispute arises about an application that you have made or in order to contact you if potentially suitable jobs become available in the future. We will delete or anonymise your information when we no longer need it, however, although we may continue to hold purely statistical information which does not identify you in particular. 

Spring will only share your personal information with those who have a legitimate need to know. During the recruitment process pieces of your personal information will only be available to dedicated HR professionals and/ or hiring managers. Information in your profile (such as contact details) will only be available by default to the Spring people who need it to contact you and/or assess your suitability for a role. 

If at any stage you wish to withdraw an application, want your information removed from the system or do not wish us to contact you in relation to future employment opportunities, please let us know by sending an email in accordance with Paragraph 12 ‘Contact details for your privacy inquiries’.

We internally maintain a strict access policy with regard to the processing of personal data. Only a limited group of authorised Spring staff on a need to know basis will have access to your personal data. All our employees have signed a non-disclosure agreement, which remains in force even after they have left the company. As a rule, we do not share your data with any individuals or organisations outside Spring. However, we may share your personal data with trusted third parties that perform business functions or provide services to us (e.g. our delivery services in countries where we work with delivery partners). All such third parties will be required to adequately safeguard your personal data, subject to agreements that correspond to the requirements of applicable laws. Your personal data may also be shared for investigations (e.g. disclosure to prevent crime or fraud, or to comply with court order or legislation). The following organisations are entitled by law to request data from us in specific cases: 

• Law enforcement agencies 
• Judicial organisations 
• Regulators such as the Dutch Data Protection Authority (AP) and the Authority for Consumers & Markets (ACM) 
• Tax and Customs Administration

Given the global nature of our company, your personal data may be transferred to Spring entities and trusted third parties in countries outside the European Economic Area whose laws may not afford the same level of protection of your personal data. As a result, your personal information may be transferred to, stored and/or processed in such other countries, including on servers located in such other countries. Unless you have expressly consented to the transfer of personal information, the transfer is necessary for the performance of a contract with you or concluded in your interests or the transfer is otherwise permitted by applicable data protection laws we will only transfer your personal information to a country that is deemed to have an adequate level of protection under the applicable data protection law or otherwise where we have put in place adequate safeguards to protect the personal information. Where necessary, Spring will ensure that adequate safeguards are in place to comply with the requirements for the international transfer of personal data under applicable privacy laws.

Your personal data will be stored no longer than is necessary to fulfill the purpose they were obtained for, including compliance with legal and fiscal obligations of the local laws of the countries where Spring operates and for solving any disputes. If you have any questions regarding retention of your personal data by us, please contact the relevant Record Manager in accordance with Paragraph 12. ‘Contact details for your privacy inquiries’.

We protect and secure your personal data in accordance with our IT and security policies so that personal data is protected against unauthorised use, unauthorised access and wrongful modifications, loss or destruction. We have robust information security management systems in place to protect your personal data.

You can contact us (please see Paragraph 12. ‘Contact details for your privacy inquiries’ below) to exercise any of the rights you are granted under applicable data protection laws, which includes (1) the right to access your data, (2) to rectify them, (3) to erase them, (4) to restrict the processing of your data, (5) the right to receiving a file of your personal data and (6) the right to object to the processing, and where we have asked for your consent, to withdraw this consent. These rights will be limited in some situations. We will, for example, deny your request for access when necessary to protect the rights and freedoms of other individuals or refuse to delete your personal data in case the processing of such data is necessary for compliance with legal obligations. The right to data portability, for example, does not apply in case the personal data was not provided by you or if we process the data not on the basis of your consent or for the performance of a contract. 

When you would like to exercise your rights, please send your request to the contact details in Paragraph 12. ‘Contact details for your privacy inquiries’ below. Please note that we may need you to provide additional information to confirm your identity. 

You also have the right to lodge a complaint with your local Data Protection Authority, these are: 

For the United Kingdom: the Information Commissioner, go to https://www.ico.org.uk/ concerns to find out more 

For Hungary: Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság), go to https://www.naih.hu/ to find out more 

For Canada: the Office of the Privacy Commissioner of Canada, go to https://www.priv.gc.ca/en/ to find out more 

You can also contact us in accordance with Paragraph 12 ‘Contact details for your privacy inquiries’ if you have any questions, remarks or complaints in relation to this Privacy Statement.

You may ask us whether or not we process any of your personal data and, if so, receive access to that data in the form of a copy. When complying with an access request, we will also provide you with additional information, such as the purposes of the processing, the categories of personal data concerned as well as any other information necessary for you to exercise the essence of this right.

You have the right to have your data rectified in case of inaccuracy or incompleteness. Upon request, we will correct inaccurate personal data about you and, taking into account the purposes of the processing, complete incomplete personal data, which may include the provision of a supplementary statement.

You also have the right to have your personal data erased, which means the deletion of your data by us and, where possible, any other controller to whom your data has previously been made public by us. Erasure of your personal data only finds place in certain cases, prescribed by law and listed under article 17 of the General Data Protection Regulation (GDPR). This includes situations where your personal data is no longer necessary in relation to the initial purposes for which it was processed as well as situations where it was processed unlawfully. Due to the way we maintain certain services, it may take some time before backup copies are erased.

You have the right to obtain the restriction of the processing of your personal data, which means that we suspend the processing of your data for a certain period of time. Circumstances which may give rise to this right include situations where the accuracy of your personal data was contested but some time is needed for us to verify their (in)accuracy. This right does not prevent us from continuing to store your personal data. We will inform you before the restriction is lifted.

Your right to data portability entails that you may request us to provide you with your personal data in a structured, commonly used and machine-readable format and to have such data transmitted directly to another controller, where technically feasible. Upon request and where this is technically feasible we will transmit your personal data directly to the other controller.

You also have the right to object to the processing of your personal data, which means you may request us to no longer process your personal data. This only applies in case the ‘legitimate interests’ ground constitutes the legal basis for processing. In case you exercise this right, we will no longer process your personal data for such purposes.

We have most recently updated this Privacy Statement on 25 May 2018 and it replaces earlier versions. This Privacy Statement will be updated from time to time and we reserve the right to change this Privacy Statement at any time without prior notice. Please check this page frequently to be informed of any changes.

If you would like to exercise one of your rights as set out in the Paragraph 10 ‘Your rights’ or if you have any questions after reading this Privacy Statement about how we use your personal data, please contact our local Record Managers by one of the following means: 

United Kingdom 

By email: gdpr.uk@spring-gds.com 

By post: Record Manager, G3 Worldwide Mail (UK) Ltd., Unit 9 Trident Way, International Trading Estate, Southhall Middlesex, UB2 5LF, United Kingdom 

Hungary 

By email: gdpr.hu@spring-gds.com

By post: Record Manager, G3 Worldwide Hungary Kft., Ecseri út 14-16, 1097 Budapest, Hungary 

Canada 

By email: gdpr.ca@spring-gds.com 

By post: Record Manager, G3 Worldwide (Canada) Inc., 3170 Orlando Drive Unit nr.3, Mississauga, Ontario L4V 1R5, Canada