Pursuant to Article 13 of the United Kingdom General Data Protection Regulation (hereinafter, "GDPR"), we hereby provide the informative notice regarding the processing of personal data of subjects who may act either as an individual customer or a person representing a business organisation (hereinafter, in both cases, "Customer"). In the latter case, we will process the personal data of those individuals who act on behalf of the entity or, in any case, within its organisation.
1. Data Controller
Personal data will be processed, depending on the purposes as specified in paragraph 3 below, “Purposes of the processing of the personal data,” by the following subjects in their capacity as independent data controllers:
- The MBE Franchisee - that is the entrepreneur that has entered into a franchising agreement with MBE (hereinafter, “MBE Franchisee”) and from which the Customer has requested the provision of one or more of the following services of the MBE franchising network such as; (a) shipment services; (b) mailbox services; (c) graphic and printing services (hereinafter, “MBE Services”). A list of the MBE Franchisees is available online on the website https://www.mbe.co.uk/.
- Mail Boxes Etc. (UK) Limited - (Company number 03107457), with registered office in 3a Tournament Court, Tournament Fields, Warwick, England, CV34 6LG (headquarters address: 1 Northumberland Avenue, Trafalgar Square, London, England, WC2N 5BW), Tel. +44 (0) 20 3535 0250, exclusive licensee for the UK and Ireland of the brand “Mail Boxes Etc” (hereinafter, “MBE”).
2. Categories of personal data processed
2.1. Personal data voluntarily provided
Customer's personal data, such as:
- identification data, including first name, last name, employer name or similar identifier, postal address, email address, telephone number; and
- data relating to the requested MBE Service.
2.2. Personal data of third parties provided by you voluntarily
Customer acknowledges that any possible mention (for example, within the “Parcel Shipping Order”, in case of shipment services and/or within other forms, depending on the requested MBE Service) of personal data and contact data of any other data subject will represent processing of personal data in respect of which the Customer is responsible for compliance with the relevant applicable data protection provisions. In this respect, the Customer guarantees also that the said data subjects whose personal data are collected and communicated were informed about the modalities and the purposes of the processing of their data. The personal data of said subjects will be communicated for the sole purpose of making the provision of the requested MBE Service possible.
3. Purposes, legal basis of the processing and consequences of the failure to provide personal data
Personal data will be processed by the MBE Franchisee and/or MBE depending on the purposes pursued by each of them, as independent data controllers, as better described below.
3.1. Purposes of the processing of the personal data by the MBE Franchisee
|
|
Processing
|
Legal basis for the processing
|
Consequences of the failure to provide personal data
|
|
i)
|
Processing for purposes related to the performance and management of the requested MBE Service, as well as management of the related payments, complaints and communications with the Customer; where applicable, also for processing relating to the verification of customers and other legal requirements.
|
The legal basis for the processing of personal data is the contract to which the Customer is a party in order to enable the performance and management of the requested MBE Service. On the other hand, certain obligations (for example, those of fiscal nature or those of verification of customers in the context of mailboxes services) are mandatory at law.
|
The provision of personal data (and/or personal data of any third party, to the extent this is necessary for the performance and management of the requested MBE Service; for example: in the case of shipment services, the contact data of the person to whom the parcel is sent) is optional, however, failure to provide such data will make it impossible to perform and manage the requested MBE Service.
|
|
ii)
|
Processing for general marketing purposes, i.e. to send the Customer, by any means of communication (fax, e-mail, sms, mms, paper mail, telephone calls with operator or other channels), advertising and information materials of a promotional nature or, in any case, of commercial solicitation with regard to services, products or discounts of the MBE Franchisee, as well as to prepare studies, research and market analyses.
|
The legal basis for the processing of personal data is the consent of the Customer.
|
The provision of personal data is optional and failure to do so will only make it impossible for the MBE Franchisee to send advertising and promotional messages and carry out market research. This will not affect the performance and management of the requested MBE Service.
|
|
iii)
|
Processing for soft opt in purposes, to send e-mail communications related to direct purchases of services like those purchased in the past 12 months.
|
The legal basis for the processing of personal data is the legitimate interest of the Controller.
|
The provision of personal data is optional and failure to do so will only make it impossible for the MBE Franchisee to send soft opt in communications via e-mail. This will not affect the performance and management of the requested MBE Service.
|
3.2. Purpose of the processing of the personal data by MBE (Mail Boxes Etc (UK) Limited)
|
|
Processing
|
Legal basis for processing
|
Consequences of the failure to provide personal data
|
|
i)
|
Processing for general marketing purposes, i.e. to send the Customer, by any means of communication (fax, e-mail, sms, mms, paper mail, telephone calls with operator or other channels), advertising and information material of a promotional nature or, in any case, of commercial solicitation with regard to services, products or discounts of MBE, and/or other companies of the MBE group, as well as to prepare studies, research and market analyses.
|
The legal basis for the processing of personal data is the consent of the Customer.
|
The provision of personal data for the aforementioned purposes is optional and failure to do so will only make it impossible for Mail Boxes Etc. (UK) Limited to i) send advertising and promotional messages and carry out market research; ii) proceed with the aforementioned profiling: and/or iii) communicate the personal data to third parties for their own marketing purposes.
The performance and management of the requested MBE Service will remain unaffected.
|
|
ii)
|
Profiling for direct marketing purposes, concerning individual customers or groups of customers to allow to assess, analyze or predict personal preferences regarding the value and type of the purchased MBE Service or its frequency of use in order to offer further services, products or discounts (such as shipment, graphics and printing services, domiciliation, communication, etc.).
|
The legal basis for the processing of personal data is the consent of the Customer.
|
|
iii)
|
Communication of personal data of the Customer to third parties for their own marketing purposes.
|
The legal basis for the processing of personal data is the consent of the Customer.
|
|
|
iv)
|
Anti-money-laundering checks related to the mailboxes services.
|
The legal basis for the processing of personal data is the legal obligation to which the data controller is subject.
|
The provision of personal data (and/or personal data of any third party, to the extent this is necessary for the performance and management of the requested mailboxes services is optional, however, failure to provide such data will make it impossible to perform and manage the requested mailboxes services.
|
In case of processing in connection to corporate transactions (sale of the company or transfer of a business going concern), due diligence, in case of defense of a legal right in court and in relation to the related preliminary activities, such processing will be carried out on the basis of legitimate interests of the data controller to the continuation of its business activities and for the protection of its rights.
3.3. Further clarifications on consent
We would like also to point out that where the Customer has given its consent to authorise MBE and/or the MBE Franchisee to pursue the purposes set out in paragraph 3.1. (ii) and paragraph 3.2. (i), (ii) and (iii) above, you will be free at any time to withdraw your consent to the processing of your data for the aforementioned purposes, with reference to all or some of the communication channels used by the data controller. The withdrawal may be exercised by sending, without any formality, a written communication to the addresses better specified in paragraph 9 "Contacts for the exercise of the rights of the data subject and for further information" below.
3.4. Further clarifications on soft opt in
We would like also to point out that the Customer at the time of the collection of personal data and at the time of sending any communication sent for the purposes referred to in paragraph 3.1. (iii), has the possibility to object to the processing easily and free of charge, through the opt-out functionality or by sending without any formality a written communication to the contact details better specified in paragraph 9 “Contacts for the exercise of the rights of the data subject and for further information” below.
4. Modalities of processing personal data
The processing will be carried out with the assistance of both automated instruments and on paper suitable for guaranteeing the security and confidentiality of personal data, this to collect, consult, store, manage, extract and transmit the personal data.
5. Recipients of personal data
Personal data, which will not be publicly disclosed by either the MBE Franchisee or MBE, may be communicated:
|
by the MBE Franchisee to:
|
|
i) employees, agents or collaborators of the MBE Franchisee;
|
|
ii) employees, agents or collaborators of Mail Boxes Etc. (UK) Limited;
|
|
iii) subjects that engage in activities of assistance and consultation on behalf of the MBE Franchisee in accountancy, administrative, legal, tax and financial matters;
|
|
iv) subjects, bodies or authorities to whom or which the communication of your personal data is mandatory by virtue of provisions of law or orders issued by authorities;
|
|
by MBE (Mail Boxes Etc. (UK) Limited) to:
|
|
i) employees, agents or collaborators of Mail Boxes Etc. (UK) Limited;
|
|
ii) subjects of whom or which Mail Boxes Etc. (UK) Limited avails itself for profiling and marketing activities;
|
|
iii) entities belonging to the same group of Mail Boxes Etc. (UK) Limited;
|
|
iv) third parties with which - from time to time - commercial partnership agreements and/or common initiatives, campaigns and projects will be developed, which operate in the following industries:
(a) information and other computer services (data processing, hosting and related activities; web portals; other information service activities);
(b) (i) land transport and pipeline transport (rail freight transport; road freight transport and moving services); (ii) maritime and waterborne transport (maritime and coastal freight transport; inland waterway transport of goods); (iii) air transport (air freight and space transport); (iv) warehousing and transport support activities (warehousing and storage; transport support activities); (v) postal services and courier activities (postal activities with universal service obligation; other postal and courier activities);
(c) electricity, gas, steam and air conditioning supply (electricity generation, transmission and distribution of electricity; gas production and distribution of gaseous fuels by pipelines);
(d) telecommunications (land telecommunications; mobile telecommunications; satellite telecommunications; other telecommunications activities);
(e) in advertising and market research (advertising; market research and opinion polling);
|
|
v) persons, companies or professional offices that engage in activities of assistance and consultation in accountancy, administrative, legal, tax and financial matters;
|
|
vi) subjects, bodies or authorities to whom or which the communication of your personal data is mandatory by virtue of provisions of law or orders issued by authorities;
|
|
vii) third parties for the purposes of identity verification and complying with MBE's anti-money laundering obligations.
|
Subjects belonging to the categories listed above, may act, as the case may be, as data processors (and in this case they will receive appropriate instructions from the relevant data controller) or as autonomous data controllers. In the latter case, personal data will be communicated only with the express consent of the data subject, except where the communication is mandatory or necessary pursuant to the applicable law or for the pursue of purposes for which the consent from the data subject is not required. With respect to MBE and to the subjects indicated at point (iv) above, personal data may be communicated for third parties own marketing purposes only following data subject’s consent.
6. International transfers of personal data
Customer's personal data (and/or third parties’ personal data, depending on the requested MBE Service), will be transferred outside the United Kingdom either by the MBE Franchisee or by MBE, in accordance with paragraph 5 which refers to transfers to the European Union in certain cases. In any case, each data controller has the right to transfer your personal data to third countries. Transfers of data outside the United Kingdom are subject to a special regime pursuant to the GDPR, and are only made in respect of countries that ensure an adequate level of personal data protection, on the basis of an adequacy decision of the UK government or where adequate safeguards have been adopted (including the standard contractual conditions provided by the UK government and Information Commissioner's Office), provided that the data subjects have enforceable rights and effective judicial remedies.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.
7. Retention of personal data
In application of the principle of proportionality, we inform you that:
- the MBE Franchisee will retain the personal data for a period not exceeding what is necessary to pursue the purposes specified in paragraph 3.1. (i) (execution and management of the requested MBE Service) and (ii) (marketing) above, save for the right of the Customer to withdraw its consent at any time where it constitutes the legal basis for the processing;
- MBE will retain the personal data for a period not exceeding what is necessary to pursue the purposes specified in paragraph 3.2 (i) (marketing), (ii) (profiling) and (iii) (communication to third parties for its own marketing purposes) above, save for the right of the Customer to withdraw its consent at any time where it constitutes the legal basis for the processing.
- MBE will retain the personal data with respect to paragraph 3.2 (iv) (anti-money laundering checks) for a period of 5 years.
The criteria for determining the retention period of the personal data take into account the processing period allowed at law, the applicable laws on the statute of limitation of rights and the legitimate interests of the data subject, where they are the applicable legal basis for processing.
Following the above retention periods, personal data will be deleted, aggregated or anonymized.
8. Exercise of rights by the data subject
At any time, the Customer will be entitled to:
- obtain confirmation from the data controller as to whether personal data is being processed, and where that is the case, to access to the personal information pursuant to art. 15 of the GDPR;
- obtain the rectification of personal data should it be inaccurate, or, taking into account the purpose of the processing, the integration of incomplete personal data;
- obtain the erasure of personal data, where one of the grounds under art. 17 of the GDPR applies;
- obtain the restriction of processing of personal data, where one of the cases under art. 18 of the GDPR applies;
- object to the processing of personal data on grounds relating to the Customers’ particular position, where applicable;
- receive in a structured, commonly used and machine-readable format personal data concerning the Customer and that were provided to us, as well as to transmit those personal data to another controller, in the cases and within the limits referred to in art. 20 of the GDPR, where applicable.
The Customer shall also have the right to withdraw the consent to the processing of personal data (where given) at any time, without prejudice to the lawfulness of the processing based on consent before its withdrawal. Customer will have the possibility to opt-out from marketing via email by clicking on the relevant “unsubscribe” link.
According to the GDPR, the data controller may not charge for complying with any of the requests mentioned in this paragraph, unless they are clearly unfounded or excessive and repetitive. Should Customer request more than one copy of personal data or in cases of excessive or unfounded requests, the data controller may: (i) charge a reasonable expense, considering the administrative costs incurred to fulfil the request; or (ii) refuse to fulfil the request. In these cases, the data controller will inform the Customer of the costs before fulfilling the request.
The data controller may ask for further information before fulfilling the requests if it needs to verify the identity of the person who has made them.
Without prejudice to any administrative or legal remedy, you also have the right to lodge a complaint to the relevant supervisory Authority (for the UK: the “UK’s Information Commissioner’s Office – ICO”), if you believe that processing of your data is in breach of the GDPR. More information is available on the website https://ico.org.uk/.
In any case, the data controller is interested in knowing the reasons for the complaint and asks the Customer to use the contact methods below before turning to the authorities, in order to prevent and resolve any disputes, amicably and promptly, with the greatest courtesy, professionalism and discretion.
For more information about the provisions contained in Articles from 15 to 22 of the GDPR, click on the following link: https://www.legislation.gov.uk/eur/2016/679/contents.
9. Contacts for the exercise of the rights of the data subject and for further information
With respect to the exercise of the rights in relation to the purposes specified in paragraph 3.1 above and/or to obtain any type of information you may need in relation to the MBE Franchisee pursuant to this privacy notice, you may send a written communication to the MBE Franchisee’s registered office.
With respect to the exercise of the rights in relation to the purposes specified in paragraph 3.2 above and/or to obtain any type of information you may need in relation to MBE pursuant to this privacy notice, you may send a written communication to Mail Boxes Etc. (UK) Limited - (Company number 03107457), with registered office in 3a Tournament Court, Tournament Fields, Warwick, England, CV34 6LG (headquarters address: 1 Northumberland Avenue, Trafalgar Square, London, England, WC2N 5BW), Tel. +44 (0) 20 3535 0250 or an email to privacy@mbe.uk.
10. Changes to this privacy informative notice
You can view the always-updated privacy informative notice by visiting the MBE Sites so that you can keep up to date with any future changes.
Last update date: May 30, 2024