of GLS-ONE and the GLS App
- GLS-ONE & GLS App
- Senders & Recipients
- Customs Portal
With the following information we would like to provide you with a general overview on how https://gls-one.de/ and der GLS App processes your personal data and inform you about your rights according to privacy laws. Depending on the services you use, the details of the data processing differ.
I. General Information
a. Applicable data protection laws and data protection obligation
GLS Germany GmbH & Co. OHG (GLS Germany) takes data protection and privacy seriously. For that reason, personal data exclusively in accordance of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
As GLS Germany provides postal services or takes part in it, we are committed to maintaining postal secrecy under the Postal Act (PostG) as to following the obligations of the post-services data protection regulation (PDSV).
b. Security of personal data
By means of technical and organisational security measures, GLS Germany does its best to protect personal data from loss or misuse. Personal data is processed only in systems which are protected by appropriate security measures (SSL-Encryption). If required by technical development, we reserve the right to modify these security and privacy practices.
c. Contact details of the controller and the data protection officer
Controller according to Art. 4 (7) GDPR resp. service provider according to §13 TMG (German Telemedia Act):
General Logistics Systems Germany GmbH & Co. OHG
GLS Germany-Str. 1-7
Phone:+49 (0) 6677 646 907 040
(Hereinafter: „GLS Germany“)
You can contact our company data protection officer at:
GLS Germany GmbH & Co. OHG
Company data protection officer
GLS Germany-Str. 1-7
If you want to contact us via unencrypted e-mail, please note that the confidentiality of the transmitted information cannot be guaranteed. Unencrypted e-mails can possibly be read by unauthorised third parties.
d. Personal Data
Personal data comprises particulars on personal or factual circumstances of a specific or determinable individual. This includes for instance information such as name, address, telephone number and date of birth.
Information that cannot be linked to a specific or determinable individual - such as favoured web pages or the number of users on a page - is not considered as personal data.
II. Collection of data, Purpose of processing and legal basis
For a proper use of our services you must provide us with personal data, which is necessary for the fulfilment of the specific purpose or to which we are legally required to collect. Otherwise we are usually not able to form a contract with you.
a. Data, you submit to us
a) Send parcel
The personal data entered by you in the „Send parcel“ form, such as consignor and consignee information (first name, last name, company, address, zip code, city and country) are processed and stored in order to fulfill the contract on the legal basis of Art. 1 (1) b GDPR. Some services require additional data:
- The GLS FlexDeliveryService requires the e-mail address and/or telephone number of the consignee. So we can provide the consignees with information about their upcoming parcel delivery and offer alternative delivery options.
- By commissioning the Send@ParcelShop Service the e-mail address and/ or telephone number of the consignee will be used to inform the consignee about their delivery at their desired ParcelShop.
Consignee data transmitted by the user will exclusively be used by GLS Germany to fulfill the ordered service (parcel delivery). A use for further purposes, in particular the transfer to third parties is excluded, unless legal regulations require another use.
As consignor, please note that transmitting the e-mail address or telephone number of the consignee requires his permission.
We use the following payment service providers to process your data in terms of the payment for our delivery services:
- PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
- Credit Card: EVO Payments International GmbH, Elsa-Brändström-Str. 10-12, 50668 Köln
GLS applies fraud prevention measures when you are making an online payment at GLS-ONE or in the GLS App. Therefore your payment can fail (e.g. when exceeding a maximum amount). If you would like to be exempted from these measure, for example, if you want to send higher amounts of parcels, please contact firstname.lastname@example.org . We ask you for understanding, that we check your payment history before activation.
b) Request Parcel Pickup
The personal data entered by you in the „Request Parcel Pickup“ form, such as the Pickup data (Pickup date, first name, last name, company, address, zip code, city and country) are processed and stored in order to fulfill the contract on the legal basis of Art. 1 (1) b GDPR.
When registering for GLS-ONE or GLS App, your e-mail address and your GLS-ONE password (user data) will be collected and stored. The e-mail address will be used as a user name for GLS-ONE or GLS App and to give you a new password for GLS-ONE if required.
Under “My parcels” you have list of all parcel you sent with GLS-ONE including date, parcel number, consignee, price and status.
In addition to that, as a registered GLS-ONE user you have the opportunity to save your consignee address under “My address book”. You can delete the addresses at any time. We won’t use the addresses, unless you send us a transport request.
By deleting your GLS-ONE account, those consignee addresses will be deleted automatically. The erasure of your data will take place after everything has been settled and after expiry of the legal retention periods.
d) Where is my parcel?
Your entered parcel number is required to provide you with status information about your searched parcel.
e) Search for a ParcelShop
For searching the closest ParcelShop, you need to enter the zip code. Please note that a zip code on its own is no personal data.
b. Data, that is collected automatically
a) Logging of IP addresses
Each time a user accesses a GLS-ONE website, data is recorded in a log file. The following data is temporarily recorded:
- Date and time of request
- IP address or DNS name of the requesting computer
- requested page (URL)
- HTTP answer code
- Client operating system and version
- Browser and version
The log file data is anonymously analysed for statistical purposes. Statistical reports are used to evaluate the usage of the website. In particular, the order in which the pages are visited and the path taken between pages is shown. This is intended to give GLS Germany an indication how the usability of the website can be improved further.
c) Google Analytics
The website operator has a legitimate interest in analyzing user behavior in order to optimize its website. Due to that the legal basis for the data processing is Art. 6 (1) f GDPR. We are using Google Analytics to analyze and improve the use of our website. These statistics help us make our services more interesting and efficient. For the exceptional cases in which personal data is transferred to the USA, Google has the EU-US Privacy Shield certification:
The GLS website uses the Google Analytics extension „gat._anonymizeIp();“. This ensures anonymized registration of IP addresses ("IP masking"). If IP anonymization is activated on this website, your IP address is shortened before transmission in member states of the European Union or other contractual states of the agreement on the European Economic Area. Only in exceptional cases the full IP address is transmitted to a Google server in the USA and shortened there.
Google, on behalf of the website operator, will use this information in order to analyse your use of the website, to compile reports about the website activities and to perform further services that are connected with the website use and the internet use. Google will in no case connect your IP address with other data of Google. Further information about how Google Analytics handles user data can be found in the Google
You can avoid the installation of cookies by adjusting the according settings of your browser software; however we would like to point out that in this case you might not be able to use all functions of this web site to the full extent. Furthermore you can block the registration of the data created by the Cookie (incl. your IP address) and related to your use of this website and the processing of this data by Google by downloading and installing the browser plugin available under
Information about the third party supplier: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001
Terms and conditions: https://www.google.com/analytics/terms/de.html
d) Conversion measurement with Facebook Pixel
If you have consented to our use of the Facebook Pixel, our website will feature the Facebook Pixel provided by Facebook Inc. 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). This enables us to track the actions a user takes after having been forwarded to the website of the provider by clicking on a Facebook advertisement. This enables us to evaluate the effectiveness of Facebook advertisements for statistical and market research purposes and can help us to optimize future promotional measures.
The data collected are anonymized for us, and as such we are unable to draw any conclusions as to the identity of a user. However, Facebook stores and processes the data, making it possible to associate them with the profile of a user and for Facebook to use the data for its own advertising purposes in line with its data policy (https://www.facebook.com/about/privacy/). The data enable Facebook and its partners to place advertisements on and outside of Facebook. Furthermore, a cookie can be installed on your computer for these purposes.
Only users over the age of 13 can consent to the Facebook Pixel. If you are younger, please ask your parent or legal guardian for permission.
e) Microsoft Advertising
On our pages we use the Conversion Tracking of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Microsoft Advertising will place a cookie on your computer if you access our website via a Microsoft Advertising. This allows Microsoft Advertising and netfiles to identify if someone has clicked on an ad, has been redirected to our website and has reached a previously defined target page (conversion page). We only see the total number of users who clicked on a Bing ad and were then redirected to the conversion page. No personal information about the user is disclosed.
If you do not want information as described above to be used by Microsoft, you can prevent the setting of a cookie required for this purpose – for example, by using a browser setting that generally deactivates the automatic setting of cookies. You can also prevent the collection of data generated by the cookie and related to your use of the website and the processing of this data by Microsoft by clicking on the following link: https://account.microsoft.com/privacy/ad-settings/signedout?lang=en-GB to declare your objection. Further information on data protection and the cookies used at Microsoft and Microsoft Advertising can be found on the Microsoft website at https://privacy.microsoft.com/en-us/privacystatement
f) Social Media Links
c. Legal bases of processing
Your personal data will only be processed by us provided with a legal basis. The processing is lawful, if at least one of the following conditions applies:
a) Consent (Art. 6 (1) a GDPR)
The data subject has given consent to the processing of his or her personal data for one or more specific purposes. One purpose might the processing of your request. The consent can be withdrawn by any time. This also applies to consent given even before the EU GDPR. The withdrawal is only effective for the future and does not affect the legality of the data processed until the withdrawal
b) Contractual obligations or pre-contractual measures (Art. 6 (1) b GDPR)
The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Upon your request we process your data. Usually this results out of our products/services or can include consultation or analysis on demand.
c) Legitimate interest (Art. 6 (1) f GDPR)
The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. Besides the fulfillment of a contract we may have further interests. (e.g. ensuring IT security and operations, to analyze and improve the use of our website, etc.)
d) Compliance with legal obligation (Art. 6 (1) c GDPR)
The processing is necessary for compliance with a legal obligation to which the controller is subject. GLS Germany is subject to different legal obligations. Among others, these include retention periods prescribed by German Commercial Code (HGB) or Fiscal Code of Germany (AO).
III. Data transfer and recipients
Within GLS Germany, those entities, who need your data to fulfil their contractual or legal obligations, have access to your data. Also providers, commissioned by GLS Germany, may receive data for these purposes, provided they meet the legal requirements. Those parties include Group and carefully selected non-Group third parties contractually required to provide services for or on behalf of GLS Germany. GLS Germany has concluded corresponding contractual agreements with these parties.
In regard to a data transfer to further recipients, we will only pass on your personal data if required by law, with your consent or if we are authorized for disclosure. Under these conditions, public bodies and institutions (such as prosecuting authorities) can receive your personal data if it is required by law.
A transfer of personal data to a third countries will exclusively take place if explicitly mentioned in the context of the former mentioned services.
IV. Duration of data storage and erasure
GLS Germany stores your personal data only in accordance to legal retention periods and legal obligations, as long as it is necessary for the purpose. We set the duration of the storage according to the following requirements:
Operational requirements: The storage duration, that is needed to complete operational processes.
- Commercial and tax retention periods, which result e.g. from the German Commercial Code (HGB) or the Fiscal Code of Germany (AO). They usually prescribe retention periods of 6 to 10 years.
- The periods of limitation according to §§ 195 ff. Of the German Civil Code (BGB) may be up to 30 years, whereby the regular period of limitation is three years. E.g. Complaints communicated via the contact form.
After expiry of the defined retention period, the data will be deleted or destroyed by us.
V. Rights of the data subject, withdrawal of consent, exercise of rights, right to complain
1. Rights of the data subject
As data subject you have the right to,
- obtain the controller confirmation as to whether or not and which personal data concerning him or her are being processed (Right of access by the data subject acc. to Art. 15 GDPR)
- obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her (Right to rectification acc. to Art. 16 GDPR)
- obtain from the controller the erasure of personal data concerning him or her without undue delay (Right to erasure acc. to Art. 17 GDPR)
- obtain from the controller restriction of processing (Right to restriction of processing acc. to Art. 18 GDPR)
- receive the personal data concerning him or her, which he or she has provided to a controller (Right to data portability acc. to Art. 20 GDPR)
- object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. (Right to object acc. to Art. 21 GDPR)
The right of access and the right to erasure are limited by §§34 and 35 BDSG.
2. Withdrawal of consent
At any time you have the right to withdraw your consent in data processing. This also applies to consent given even before the GDPR. The withdrawal is only effective for the future and does not affect the legality of the data processed until the withdrawal.
3. Exercise your rights
To exercise your rights or for withdrawal of your consent, please contact email@example.com and declare which right you wish to exercise so that GLS Germany may take further steps required to work on your request.
Please note, that we may ask you for a proof of identity in order to protect your personal information from unauthorized access or alteration.
4. Right to lodge a complaint with a supervisory authority
If you note any violation against our data protection regulations, do not hesitate to contact us. Furthermore, in such cases, you also have the right to lodge a complaint with a supervisory authority. (Art. 77 GDPR in conjunction with §19 BDSG)
Federal Commissioner for Data Protection and Freedom of Information
VI. Updating this privacy information
This information was last updated on July 30, 2019.