Privacy Notice

Introduction

General Logistics Finland Oy (hereinafter “GLS Finland”) provides high-quality parcel delivery services, express deliveries and additional logistics-related services. This Privacy Notice explains how GLS Finland processes personal data relating to shipments in connection with the provision of its services. We process personal data in accordance with applicable legislation, including the EU General Data Protection Regulation (2016/679, “GDPR”). This Privacy Notice may be updated from time to time, for example, due to changes in our practices or applicable legislation. The current version of the Privacy Notice is always available on our website.

The services provided by GLS Finland are subject to the General Terms and Conditions . The provision of the services under the applicable agreement requires the processing of personal data. If a data subject does not provide the personal data necessary for the provision of the service or objects to its processing, the service cannot be provided.

The GLS Finland website uses cookies and other similar technologies. Further information on the use of cookies is available in the Cookie Notice. Consent given to the use of cookies can be modified at any time by opening the Cookie Notice via the icon displayed in the bottom corner of the website.

Data Controller

General Logistics Systems Finland Oy

Rydöntie 6

tel. 020 758 12 00

Business ID: 1739617-9

dataprotection@gls-finland.com

Processing of Personal Data

The purposes of processing personal data, the applicable legal bases, the personal data involved and the applicable retention periods are set out below.

Delivery of shipments and related communications

• Legal basis: Performance of a contract; legitimate interest in delivering the shipment.
• Personal data processed: Contact details of parties associated with the shipment, such as name, telephone number, email address, address and door access code; name and signature of the person acknowledging receipt of the shipment and the coordinates of the delivery location; shipment details, such as weight and dimensions.
• Retention period: Up to 2 years from the delivery of the shipment.

Notification of shipments to Customs and submission of customs declarations

• Legal basis: Legal obligation; performance of a contract.
• Personal data processed: Contact details of parties associated with the shipment, such as name, telephone number, email address and address, as well as the personal identity code or date of birth of individuals; information on the contents and value of the shipment.
• Retention period: 6 years from the end of the current calendar year.

Sanctions screening

• Legal basis: Legal obligation.
• Personal data processed: Name and address of parties associated with the shipment and representatives of relevant stakeholders.
• Retention period: 1 year from the date of the screening.

Processing of payment transactions

• Legal basis: Performance of a contract.
• Personal data processed: Name and address of the person paying for the shipment; payment amount; payment method.
• Retention period: The retention period prescribed by the Accounting Act, i.e. 10 years from the end of the financial year.

Invoicing and accounting

• Legal basis: Performance of a contract; legal obligation.
• Personal data processed: Personal data contained in invoices and other accounting records, such as the name of the person ordering the shipment.
• Retention period: The retention period prescribed by the Accounting Act, i.e. 10 years from the end of the financial year.

Website analytics

• Legal basis: Legitimate interest in monitoring the use of the website; consent to the use of cookies.
• Personal data processed: IP address; information about interactions with the website; login information and visitor identifier; device and browser information; referring URL and visited URL; geolocation data (continent, country, region and language).
• Retention period: 25 months.

Service-related communications and newsletter

• Legal basis: Legitimate interest in maintaining, developing and establishing customer relationships.
• Personal data processed: Name and email address of the organisation’s representative.
• Retention period: Until the recipient unsubscribes from the newsletter.

Customer relationship management

• Legal basis: Legitimate interest in maintaining, developing and establishing customer relationships.
• Personal data processed: Name, telephone number, email address and title/role of the organisation’s representative.
• Retention period: For as long as the information remains relevant.

Customer service and handling of enquiries

• Legal basis: Legitimate interest in providing customer service.
• Personal data processed: Customer’s name, email address and telephone number; other personal data disclosed in connection with the enquiry, such as address details.
• Retention period: Up to 2 years.

Video surveillance of business premises and outdoor areas

• Legal basis: Legitimate interest in ensuring security and the proper functioning of processes and in investigating potential incidents involving damage, criminal activity or other exceptional circumstances.
• Personal data processed: Video recordings.
• Retention period: 2 months from the date of the recording.

Data Sources

Personal data is primarily collected from the sender when the shipment is ordered. If a shipment is received from another company within the GLS Group, the personal data required for the delivery of the shipment is obtained from the relevant GLS subsidiary. Personal data may also be received from other postal and transport service providers.

Recipients of Data

Personal data may be disclosed to other companies within the GLS Group where necessary for the provision of the services. In connection with customs clearance of shipments, personal data is disclosed to Customs. In individual cases, personal data may also be disclosed to other public authorities on the basis of a legal obligation.

GLS Finland uses subcontractors, such as system providers and logistics partners, in the provision of its services. These subcontractors process personal data on behalf of GLS Finland in their capacity as data processors. All our subcontractors are contractually required to maintain a high level of data protection.

International Data Transfers

Some of the sub-processors involved in the processing of personal data may process personal data outside the EU/EEA, for example due to the technical implementation of systems. Personal data is also transferred outside the EU/EEA where a party associated with the shipment, such as the recipient, is located outside the EU/EEA. Transfers of personal data outside the EU/EEA are carried out in accordance with the requirements of the GDPR, including the use of appropriate transfer mechanisms and supplementary safeguards.

Data Subject Rights

The GDPR provides data subjects with several rights that enable them control the processing of their personal data. Not all rights apply in all circumstances; their applicability depends, for example, on the legal basis for the processing of personal data. You can submit a request concerning your data protection rights by email to dataprotection@gls-finland.com. We will respond to requests concerning data subject rights within one month of receiving the request. The identity of the data subject will be verified before the request is fulfilled.

Right of access

The data subject has the right to obtain confirmation as to whether the controller processes personal data concerning them and, if this is the case, to obtain a copy of the personal data being processed.

Right to rectification

The data subject has the right to have inaccurate personal data corrected or rectified and incomplete personal data completed.

Right to erasure

The data subject has the right to have their personal data erased, for example, where the personal data is no longer necessary for the purposes for which it was originally collected or where the data subject has withdrawn the consent on which the processing was based. The right to erasure may be restricted, for example, where the controller is subject to a legal obligation to retain the personal data in question.

Right to restriction of processing

The data subject has the right to obtain restriction of processing. Where processing has been restricted, the personal data concerned will be stored but may otherwise be processed only with the data subject’s consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another person, or for reasons of important public interest of the European Union or a Member State. Processing may be restricted, for example, where the lawfulness of the processing of personal data has been contested.

Right to object

The data subject has the right to object, on grounds relating to their particular situation, to the processing of personal data where the processing is based on legitimate interests, the performance of a task carried out in the public interest, or the exercise of official authority. In such cases, the processing of personal data will cease unless the controller demonstrates compelling legitimate grounds for the processing which override the grounds presented by the data subject. The data subject always has the right to object to the processing of personal data for direct marketing purposes without providing any specific grounds.

Right to data portability

The data subject has the right to receive the personal data they have provided in a machine-readable format or, where technically feasible, to have the personal data transmitted directly to another controller. The right to data portability applies where the processing of personal data is based on consent or a contract.

Right not to be subject to automated decision-making

The data subject has the right not to be subject to decisions based solely on automated processing. GLS Finland does not make decisions based solely on automated processing that produce legal effects concerning the data subject or otherwise similarly significantly affect them.

Right to withdraw consent

The data subject has the right to withdraw their consent to the processing of personal data at any time. You can change your consent regarding cookies by opening the Cookie Notice via the icon displayed at the bottom of the website.

Right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint concerning the processing of personal data with a supervisory authority. In Finland, the competent data protection supervisory authority is the Office of the Data Protection Ombudsman ( tietosuoja.fi ).

Last updated: 10.9.2026