Annex 1

DATA PROCESSING ACTIVITIES WHICH TAKE AN INTEGRAL PART OF THE GENERAL BUSINESS CONDITIONS PERTAINING TO PARCEL DELIVERY AND MANAGEMENT AND THE GENERAL BUSINESS CONDITIONS APPLICABLE TO GLS PARCEL SHOP CUSTOMERS

1. DATA PROCESSING RELATED TO DELIVERY OF PARCELS

1.1. DATA PROCESSING RETALED TO DOOR-TO-DOOR DELIVERY (POSTAL SERVICE)

Purpose of the data processing: Performing the contract on postal services (delivering parcels) and the proof of delivery

Legal basis of data processing: Performance of a Contract

Scope of personal data processed:

Related to the Sender (personal data collected from the data subject or his /her representative) Name, Pickup address, Email address, Telephone number, Signature

Related to the Recipient

i. personal data collected from the Sender: Name, Delivery address, Email address, Telephone number,

These data are provided by the Sender based on the legal relationship (contract) between the Sender and the Recipient. The email address and the telephone number is not compulsory in the event of a basic door-to-door delivery service.

ii. personal data collected from the Recipient (data subject): Signature

Related to the Other authorized recipient (in the event the parcel is not delivered directly to the Recipient): Signature (which is collected from the data subject)

Duration of data storage: The end of the year following the dispatch of the parcel

1.2. DIFFERENCES BETWEEN THE DATA PROCESSING RELATED TO THE NORMAL AND THE VALUE-ADDED SERVICES

This Point contains those personal data which

(1) shall be provided to the Controller contrary to the door-to-door delivery,

(2) shall be provided in addition to the personal data processed for door-to-door delivery or

(3) shall not be provided due to the nature of the service.

Personal data or rules related to the purpose of the data processing, legal basis of data processing and duration of data storage not mentioned herein shall be processed and applied in compliance with the rules applicable to door-to-door delivery.

Data processing related to the SMSService, ContactService (PreadviceService, FlexDeliveryService

Scope of personal data processed: Telephone number of the Recipient

Collecting (processing) telephone number is necessary for the performance of the contract.

Data processing related to the a ShopDeliveryService, FlexDeliveryService and the Delivery to a GSL ParcelLocker

Scope of personal data processed:

Personal data collected from the Sender: Telephone number and email address of the Recipient

Personal data collected from the data subject: (Recipient or Other authorized recipient): the number of the official certificate suitable for the proof of identity (only in the event of a delivery to a ParcelShop)

Collecting (processing) telephone number and email address is necessary for the performance of the contract.

Legal basis of data processing: Related to the official certificate the legitimate interest of the Controller, related to the other personal data mentioned above the Performance of the Contract

Data processing related to the AddresseeOnlyService

Scope of personal data processed: the number of the Recipient’s official certificate suitable for the proof of identity

Legal basis of data processing: Legitimate interest of the Controller

2. OTHER DATA PROCESSING ACTIVITIES RELATED TO CONCLUDING OR ENTERING INTO CONTRACTS WITH CLIENTS

2.1. DATA PROCESSING RELATED TO CONTACTING POTENTIAL CUSTOMERS BY PHONE (“COLD CALLS”)

Purpose of the data processing: Contacting potential customers, making quotations

Legal basis of data processing: Legitimate interest of the Controller

Scope of personal data processed: Contact person’s name, phone number, e-mail address, position, customary behaviours relating to parcel sending.

Duration of data storage: Until the purpose of data processing is achieved. In the case of customers where a quote is made and then a contract is signed, the data is stored for the duration specified for this data processing purpose.

2.2. DATA PROCESSING RELATED TO CUSTOMER VISITS

Purpose of the data processing: Visiting potential customers with the purpose of making a quotation or concluding a contract.

Legal basis of data processing: Legitimate interest of the Controller

Scope of personal data processed: Contact person’s name, phone number, e-mail address, position, customary behaviours relating to parcel sending, place, date of visit to customer, names, phone number and e-mail address of participants.

Duration of data storage: Until the purpose of data processing is achieved. In the case of customers where a quote is made and then a contract is signed, the data is stored for the duration specified for this data processing purpose.

2.3. QUOTATION, CONTRACT

Purpose of data processing: signing and performing the contract for the provision of parcel logistical services.

Legal basis of data processing: Performance of a Contract.

Providing the personal data is a prerequisite of the contract signed with GLS, and is mandatory.

Scope of personal data processed: Client’s (Sender’s) name, Client’s (Sender’s) website address, name of person authorized to act on behalf of the Client (Sender); Client’s (Sender’s) bank account number, Contact person’s name, e-mail address, phone number, Parcel pick-up address.

Duration of data storage: 5 years from termination of contract.

2.4. DATA PROCESSING RELATING TO CONTRACTS SIGNED WITH SOLE TRADERS, SMALLHOLDERS

Purpose of data processing: signing and performing the contract for the provision of parcel logistical services.

Legal basis of data processing: Performance of a Contract.

Providing the personal data is a prerequisite of the contract signed with GLS, and is mandatory.

Scope of personal data processed: Client’s name, mother’s name, home address, personal identification data, place and date of birth.

Duration of data storage: 5 years from termination of contract.

2.5. INVOICING

Purpose of data processing: invoicing the fee payable for the service.

Legal basis of data processing: Compliance with legal obligation (The legal obligation is based on Section 169(2) of the Accounting Act).

Scope of personal data processed: Client’s (Buyer’s) name, address, Recipient’s name, address, phone number, e-mail address.

Duration of data storage: Based on Section 169 of the Accounting Act, 8 years.

2.6. MANAGING COD

Purpose of data processing: collecting and settling COD.

Legal basis of data processing: Performance of a Contract

Indicating the personal data is not a prerequisite to the contact signed with GLS, but if the customer wishes to order this service, indicating the data is a condition of its performance. If it is not indicated, the service cannot be performed, therefore indicating it is mandatory.

Scope of personal data processed: Contact person’s name, e-mail address, Recipient’s name, e-mail address, address, bank account number, position, phone number.

Duration of data storage: The end of the year following the dispatch of the parcel

2.7. DEBT COLLECTION

Purpose of data processing: managing and collecting debt

Legal basis of data processing: Performance of a Contract

Scope of personal data processed: Buyer’s Name, address, mother’s name, place and date of birth, phone number, e-mail address.

Duration of data storage: 5 years following termination of contract or collection of debt.

Based on the General Business Conditions, these personal data are transmitted to the Companies specialized in debt collection defined in Annex 3.

2.8. RECIPIENT’S PERSONAL DATA PRINTED ON THE LABEL

Purpose of data processing: Perform postal services (delivery)

Legal basis of data processing: Performance of a Contract

Scope of personal data processed: Recipient’s name, delivery address, Recipient’s phone number

Duration of data storage: These personal data are provided to the data subject after delivery.

2.9. CONTACT PERSONS RELATED TO THE CONTRACTS

Purpose of data processing: Cooperation in order to perform the postal service contract

Legal basis of data processing: Legitimate interest of the Controller

Scope of personal data processed: Contact person’s name, phone number, email address

Duration of data storage: During the term of the contract to the end of the position of contact, otherwise 5 years following the termination of the contract

3. DATA PROCESSING RELATED TO CUSTOMER SERVICE

3.1. DATA PROCESSING RELATED TO E-MAILS RECEIVED AT THE E-MAIL ADDRESSES INFO@GLS-HUNGARY.COM, JOFOGAS@GLS-HUNGARY.COM

Purpose of data processing: communication with the customer, complaint management

Legal basis of data processing: Compliance with legal obligation (The legal obligation is based on Section 17/A-17/C. of Consumer Protection Act and on Section 57 of Postal Act)

Scope of personal data processed: Recipient’s name, e-mail address, Delivery address, phone number, Sender’s name, address, phone number, e-mail address, Other authorized Recipient’s name, telephone number, email address, Pickup address, The number of the official certificate suitable for the proof of identity, bank account number

Duration of data storage: 5 years

3.2. COMPLAINT MANAGEMENT

Purpose of data processing: complaint management, complaint approval, parcel identification

Legal basis of data processing: Compliance with legal obligation (The legal obligation is based on Section 17/A-17/C. of Consumer Protection Act and on Section 57 of Postal Act)

Scope of personal data processed: Recipient’s name, e-mail address, Delivery address, phone number, Sender’s name, address, phone number, e-mail address, Other authorized Recipient’s name, telephone number, email address, Pickup address, The number of the official certificate suitable for the proof of identity, bank account number

Duration of data storage: The end of the year following the dispatch of the parcel

3.3. MANAGING COD

Purpose of the data processing: Managing (modifying) inquiries relating to COD received at the e-mail address beszedes@gls-hungary.com

Legal basis of data processing: Performance of a Contract

Indicating the personal data is not a prerequisite to the contact signed with GLS, but if the Client wishes to order this service, indicating the data is a condition of its performance. If it is not indicated, the service cannot be performed, therefore indicating it is mandatory.

Scope of personal data processed: Recipient’s name, Recipient’s e-mail address, home address, bank account number, position, phone number.

Duration of data storage: The end of the year following the dispatch of the parcel

3.4. NEW CLIENT START PACKAGE

Purpose of data processing: Performance of the contract on parcel logistics

Legal basis of data processing: Performance of a Contract

Indicating the personal data is not a prerequisite to the contact signed with GLS, but if the Client wishes to order this service, indicating the data is a condition of its performance. If it is not indicated, the service cannot be performed, therefore indicating it is mandatory.

Scope of personal data processed: Client’s name, address, phone number

Duration of data storage: 5 years following the termination of the contract

3.5. PHONE CALLS

Purpose of data processing: providing information, complaint management

Legal basis of data processing: Compliance with legal obligation (The legal obligation is based on Section 17/A-17/C. of Consumer Protection Act and on Section 57 of Postal Act)

Scope of personal data processed: voice of the data subject;

Duration of data storage: 5 years

4. DATA PROCESSING RELATED TO FILING DAMAGE CLAIMS, DAMAGE CLAIM ADMINISTRATION

4.1. DATA PROCESSING RELATED TO FILING DAMAGE CLAIMS

Purpose of data processing: complaint management, complaint approval which could be filled in various ways including complaint received at the e-mail address qualitygroup@gls-hungary.com

Legal basis of data processing: Compliance with legal obligation (The legal obligation is based on Section 57 of Postal Act)

Scope of personal data processed: Recipient’s name, phone number, e-mail address, home address, Sender’s name, phone number, e-mail address, home address, Other authorized Recipient’s name, phone number, e-mail address, home address, personal identity card number, bank account number

Duration of data storage: The end of the year following the dispatch of the parcel

4.2. DATA PROCESSING RELATED TO PAYMENTS RELATED TO DAMAGE CLAIMS ACCEPTED BY THE CONTROLLER

Purpose of data processing: complaint management, complaint approval

Legal basis of data processing: Compliance with legal obligation (The legal obligation is based on Section 169(2) of the Accounting Act)

Scope of personal data processed: Statements, invoices

Duration of data storage: 8 years

4.3. DATA PROCESSING RELATED TO LOST, UNFOUND PARCELS

Purpose of data processing: parcel identification, managing claims received at the e-mail address lossp@gls-hungary.com

Legal basis of data processing: Compliance with legal obligation

Scope of personal data processed: recipient’s name, phone number, e-mail address, home address, Sender’s name, phone number, e-mail address, home address, Other authorized Recipient’s name, phone number, e-mail address, home address

Duration of data storage: The end of the year following the dispatch of the parcel

4.4. DATA PROCESSING RELATED TO ADR PARCELS

Purpose of the data processing: Certification of being compliant with ADR regulations

Legal basis of data processing: Compliance with legal obligation (The legal obligation is based on Point 1.3.2.4. of the Government Decree 178/2017 (VII. 5.) (ADR Regulation) based on the Decree 61/2013. (X. 17.) NFM of the National Development Ministry on the domestic application of Annexes A and B to the European Agreement concerning the International Carriage of Dangerous Goods by Road (ADR) which has been modified by the Decree 20/2019. (VIII.1.) ITM)

Scope of personal data processed: name of car driver (and other persons related to ADR parcels), his or her mother’s name, place and date of birth, home address, e-mail address, position

Duration of data storage: 5 years

5. DATA PROCESSING RELATED TO THE PARCELSHOP ACTIVITY

5.1. DISPATCHING PARCELS AT THE PARCEL SHOP

Purpose of the data processing: Performing the contract on postal services (delivering parcels) concluded with the Client and the proof of delivery

Legal basis of data processing: Performance of a Contract

Scope of personal data processed:

Related to the Sender (personal data collected from the data subject or his /her representative) Name, Pickup address, Email address, Telephone number, Signature

Related to the Recipient (personal data collected from the Sender): Name, Delivery address, Email address, Telephone number,

Duration of data storage: The end of the year following the dispatch of the parcel

5.2. DELIVERING PARCELS AT THE PARCEL SHOP

Purpose of the data processing: Performing the contract on postal services (delivering parcels) concluded with the Client and the proof of delivery

Legal basis of data processing: Performance of a Contract

Scope of personal data processed:

Related to the Sender (personal data collected from the data subject or his /her representative) Name, Pickup address, Email address, Telephone number, Signature

Related to the Recipient

  • personal data collected from the Sender: Name, Delivery address, Email address, Telephone number,

These data are provided by the Sender based on the legal relationship (contract) between the Sender and the Recipient.

  • personal data collected from the Recipient (data subject): Signature

Related to the other authorized recipient (in the event the parcel is not delivered directly to the Recipient): Signature (which is collected from the data subject)

Duration of data storage: The end of the year following the dispatch of the parcel

5.3. FILLING COMPLAINT AT THE PARCEL SHOP

Purpose of data processing: complaint management

Legal basis of data processing: Compliance with legal obligation (The legal obligation is based on Section 17/A-17/C. of Consumer Protection Act and on Section 57 of Postal Act)

Scope of personal data processed: Recipient’s name, e-mail address, Delivery address, phone number, Sender’s name, address, phone number, e-mail address, Other authorized Recipient’s name, telephone number, email address, Pickup address, The number of the official certificate suitable for the proof of identity, bank account number

Duration of data storage: The end of the year following the dispatch of the parcel