Personal Data Protection Policy in accordance with the General Data Protection Regulation (GDPR)

Policy overview

ShipExpress recognizes the importance of having effective privacy protections in place and is committed to compliance with applicable data privacy laws, regulations, internal policies and standards. These protections form the foundation of a trustworthy company; are necessary to maintain the confidence of customers and employees; and ensure the company’s own compliance with such local laws. This Global Privacy Policy (“Policy”) is based on globally accepted, basic principles on data protection.

Any information that can directly or indirectly be used to identify a natural person, whether that individual is an employee, a customer or employee of a customer, a vendor or employee of a vendor, a job applicant or any other third party.

Examples:

• Names
• Government-issued identification numbers (social security and driver’s license numbers, etc.)
• Addresses
• Phone numbers
• Email addresses
• Photos

Personal Data is classified as confidential. Any unauthorized Processing of such data by employees is prohibited. Any Processing undertaken by an employee that is not part of his or her legitimate duties is prohibited. Employees may have access to Personal Data only as is appropriate for the type and scope of the task in question. This requires the definition and separation, as well as implementation, of roles and responsibilities.

Employees are prohibited from using Personal Data outside of the scope of their employment at ShipExpress, to disclose it to unauthorized persons or to make it available in any other way outside the permitted business use. Supervisors must inform their employees at the start of the employment relationship about the obligation to protect Personal Data. This obligation shall remain in force even after employment has ended.

Personal Data must be safeguarded from unauthorized access and unlawful Processing or disclosure. This applies regardless of whether data is Processed electronically or in paper form. Before the introduction of new methods of data Processing, a privacy impact assessment should be performed for new IT systems, which may lead to implementing technical and organizational measures to protect Personal Data.

Employees are expected to follow ShipExpress Information Security Standards, which can be found by searching keyword “standards.” Note that Information Security classifies all data as Sensitive, Internal or Public. Depending on its classification, Personal Data must be protected in accordance with the applicable Information Security Standards.