Privacy policy

The administrator of personal data is:

General Logistics Systems Poland Sp. z o.o.
with headquarters at ul. Tęczowa 10 in Głuchów, 62-052 Komorniki
Hotline for Recipients: +48 46 814 82 20 (* fee according to the rates of the caller's operator)
(hereinafter GLS Poland)

In order to clarify issues related to the processing of personal data, we encourage you to contact the Data Protection Officer, Ms Katarzyna Tyrakowska, appointed by the Administrator using a specially prepared email address: dataprotection@gls-poland.com. Please remember that if the contact is via unencrypted email, the confidentiality of the information provided cannot be guaranteed - the content of the unencrypted email can be read by an unauthorized person when sending it via the Internet. You can also contact GLS Poland via a letter sent by post to the following address:

GLS Poland,
ul. Tęczowa 10, Głuchowo,
62-052 Bailiffs with the note "Data Protection Officer".

1. Personal data

Personal data is any information relating to an identified or identifiable natural person. The scope of this type of data includes, inter alia, name, surname, address, telephone number and email address.
Information that cannot be associated with a specific or identifiable person (such as statistical data) is not considered personal data.

2. Applicable law on the protection of personal data and an obligation to maintain confidentiality

All GLS Group companies located in the European Union are subject to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95 / 46 / EC (hereinafter: "GDPR") and other relevant national data protection laws.

GLS Poland provides postal and transport services, which is why it is obliged to observe the confidentiality of correspondence and ensure the security of shipments, in accordance with the provisions of the Postal Law and the Transport Law.

3. Information security

GLS Poland, through the use of appropriate technical and organizational measures, makes every effort to protect personal data against loss or misuse.

All notifications regarding the protection of personal data are registered and explained in detail and analyzed based on applicable regulations.

1. Rights of data subjects.

The data subject has the right to:

• receiving information and access to data that pertains to him (the right of access for the data subject under Article 15 of the GDPR),
• rectify her personal data that is incorrect and update the data (right to rectify data, Article 16 of the GDPR),
• request to delete her personal data (the right to delete data, under Article 17 of the GDPR),
• requests to stop processing (right to limit processing, under Article 18 of the GDPR),
• request to transfer data to another administrator (the right to transfer data, under Article 20 of the GDPR),
• submitting an objection to the processing of her personal data (right to object, under Article 21 of the GDPR).

2. Withdrawal of consent

If the basis for data processing is the consent of the data subject, we inform you that this person has the right to withdraw consent at any time. Receipt of such a request does not affect the lawfulness of prior processing of personal data.

3. Exercise of the rights of persons under the GDPR

To submit an application for the implementation of one of the above-mentioned rights of persons, including withdrawing consent to data processing, you must send a message to the Data Protection Inspector at GLS Poland.

Please indicate which right the message concerns so that GLS Poland can take the necessary steps to implement the application. You can also send a letter by post to the Personal Data Protection Inspector at GLS Poland.

It should be remembered that in connection with the submitted application, for identification purposes, GLS Poland may ask for additional confirmation of identity in order to protect against unauthorized access to data.

4. Filing a complaint regarding the incorrect processing of personal data

The data subject has the right to lodge a complaint with the supervisory authority. In Poland, such an authority is the Office for Personal Data Protection.

GLS Poland is entitled to update this privacy information by publishing the amended information on this website.

This information was last updated on May 21st, 2020.

Contact details of GLS Poland (personal data administrator) and data protection officer can be found in the first point of the Privacy Policy above.

If you are looking for information on a country not listed below, you should contact the Corporate Data Protection Office at dataprotection@gls-holding.com or send a letter by post to:

General Logistics Systems Germany GmbH & Co. OHG
KÖ-CAMPUS 3
Kölner Straße 3
65760 Eschborn
Germany

In this tab you will find information on how GLS Poland collects and processes personal data for parcel delivery. We also encourage you to read the Privacy Policy to get detailed information about other purposes of processing personal data by GLS Poland.

1. Categories of personal data. Purposes of their processing and legal basis.

In order to render the Services and fulfil the Agreement with its Clients (Senders) [under Article 6 (1)(b) of the GDPR], GLS Poland, as a Data Controller, shall process the necessary data, such as:

• Client data (registration data, contact persons’ data on the Client’s side, such as first name, last name, business position, telephone number, signature, e-mail address, job position)
• Sender data (sending address and necessary contact details, signature, payment information and other data needed to perform the Service ordered by the sender).
• Recipient data (first name and last name, signature, address, postcode, city, country and optionally other data necessary to perform the Additional service provided by the Sender of the consignment to the data controller, or indicated by the Recipient, such as e-mail address, telephone number).

Provision of personal data is voluntary, however, it is necessary for the performance of Services provided by GLS Poland.

If the Sender provides additional personal data of the Recipient in connection with the selection of one of the Additional Services, the Sender shall be responsible for the correct collection of such data, in particular for having the consent of the Recipient for their transfer to GLS Poland.

Detailed information on personal data processed in connection with the performance of the Additional Services is presented in the table below:

In certain cases, data are also processed:

• on the basis of a consent [under Article 6 (1)(a) and Article 7 of the GDPR], in particular: for marketing purposes or with regard to data provided on a voluntary basis by the Recipient in connection with the parcel delivery
• or legitimate interests of the controller [under Article 6(1)(f) of the GDPR], in particular such as: solvency control, compliance or sanction programmes, satisfaction surveys.

GLS Poland, as a registered postal operator, processes personal data also for the purpose of fulfilling its legal obligations [Pursuant to Article 6 (1)(c) of the GDPR], resulting in particular from the Postal Law and the Transport Law and the Accounting Act (such as: correct settlement of the performed Service or processing of complaints).

2. Data sharing GLS Poland may provide personal data to:

• GLS subsidiaries and subcontractors (e.g. transport partners, operating ParcelShops) within or outside the European Union for the purpose of delivering parcels from the sender to the recipient [under Article 49 (1)(b) and (c) respectively) of the GDPR],
• entities which have an agreement to provide services to GLS Poland or on behalf of GLS Poland (Processors), in particular IT service providers,
• other persons or organisations under the applicable law,

• banks and payment operators in order to execute transactions (payments executed using the BLIK code are handled by Krajowy Integrator Płatności Spółka Akcyjna with its registered office in Poznań ul. Św. Marcin 73/6 61-808 Poznań),
• officers and law enforcement authorities in order to meet national security requirements or as part of a legal process to protect property, or to continue an investigation related to a violation of GLS Poland rules and policies, unauthorised access or use of GLS Poland equipment, or any other illegal activity.

Only the Sender and the Recipient have the right to receive information on the consignment. GLS Poland may provide such information to other entities only in situations specified in relevant provisions of law, in particular in the Postal Law and the Transport Law.

3. The period of data storage and removal of the data

GLS Poland processes personal data only for the time necessary to achieve the purpose for which it was collected. The period of data storage is determined based on the following requirements:

• operational requirements: the period in which information is necessary to perform the Services,
• legal requirements: the period during which GLS Poland is obliged to store data for a certain period of time in order to comply with the regulations,
• GLS Poland’s legitimate interests: the period during which the data are processed for the purpose of their execution, in particular to establish and pursue possible claims in connection with the Services provided.

The archived data are accessible only to authorised employees. After the expiry of the period for which the data are authorised to be stored, they are permanently deleted.

1. Categories of personal data. Purposes of their processing and legal basis

In order to establish and execute the Agreement between the Client and GLS Poland, the data controller shall process the following personal data [under Article 6(1)(b) of the GDPR]:

• Client’s identification data, address data, contact details, financial data (i.e. registration data, first name, surname, position, phone number, e-mail address, bank account number, solvency analysis),
• identification data and contact details of the Client's employees and cooperators (first name, surname, position, phone number, e-mail address,)

GLS Poland gathers personal data from the Customer who shares the said data with GLS Poland.

The provision of personal data is voluntary, however it is required for proper execution of the Agreement.

GLS Poland processes personal data also in order to fulfil its legal obligations [under Article 6(1)(c) of the GDPR] (in particular the accounting and tax regulations, in connection with the settlement of amounts due under the Agreement), and in order to fulfil its legitimate interests [under Article 6(1)(f) of the GDPR] (in particular such as: contact in connection with the performance of the Agreement, solvency control, compliance or sanction programmes, establishing and investigating possible claims related to the Agreement, compiling summaries, analyses and statistics, direct marketing).

2. Data sharing

GLS Poland may provide personal data to:

• GLS subsidiaries,
• subcontractors (e.g. transport partners),
• entities that have an agreement to provide services to GLS Poland or on behalf of GLS Poland (Processors), in particular IT service providers,
• Senders, Recipients,
• employees of the Customer Service Department,
• other persons or organisations under the applicable law,

3. The period of data storage and removal of the data. GLS Poland processes personal data only for the time necessary to achieve the purpose for which they were collected. The period of data storage is determined based on the following requirements:

• operational requirements: the period in which information is necessary to execute the Agreement,
• legal requirements: the period during which GLS Poland is obliged to store data for a certain period of time in order to comply with the regulations,
• GLS Poland’s legitimate interests: the period during which the data are processed for the purpose of their execution, in particular to establish and pursue possible claims in connection with the execution of the Agreement.

The archived data are accessible only to authorised employees. After the expiry of the period for which the data are authorised to be stored, they are permanently deleted.

1. Categories of personal data. Purposes of their processing and legal basis In order to establish and execute the agreement between the Counterparty and GLS Poland the data controller shall process the following personal data [under Article 6(1)(b) of the GDPR]:

• Counterparty’s identification data, address data, contact details, financial data (i.e. registration data, first name, surname, position, phone number, e-mail address, bank account number),

• identification data and contact details of the Counterparty's employees and cooperators (first name, surname, position, phone number, e-mail address,)

GLS Poland gathers personal data from the Counterparty who shares the said data with GLS Poland. In the case of obtaining and processing of personal data of employees/co-workers of the Counterparty by GLS Poland, fulfilling the information obligation towards them shall take place through the Counterparty, based on the information provided to it by GLS Poland.

The provision of personal data is voluntary, however it is required for proper execution of the agreement. GLS Poland processes personal data also in order to fulfil its legal obligations [under Article 6(1)(c) of the GDPR] (in particular the accounting and tax regulations, in connection with the settlement of amounts due under the agreement), and in order to fulfil its legitimate interests [under Article 6(1)(f) of the GDPR] (in particular such as: contact in connection with the performance of the agreement, solvency control, compliance or sanction programmes, establishing and investigating possible claims related to the agreement, compiling summaries, analyses and statistics, direct marketing).

2. Data sharing GLS Poland may provide personal data to:

• GLS subsidiaries,
• subcontractors (e.g. transport partners),
• entities that have an agreement to provide services to GLS Poland or on behalf of GLS Poland (Processors), in particular IT service providers,
• other persons or organisations under the applicable law,

3. The period of data storage and removal of the data. GLS Poland processes personal data only for the time necessary to achieve the purpose for which they were collected. The period of data storage is determined based on the following requirements:

• operational requirements: the period in which information is necessary to execute the agreement,
• legal requirements: the period during which GLS Poland is obliged to store data for a certain period of time in order to comply with the regulations,
• GLS Poland’s legitimate interests: the period during which the data are processed for the purpose of their execution, in particular to establish and pursue possible claims in connection with the execution of the agreement.

The archived data are accessible only to authorised employees. After the expiry of the period for which the data are authorised to be stored, they are permanently deleted.

1. Categories of personal data. Purposes of their processing and legal basis

In order to establish and execute the agreement between the Partner and GLS Poland and the agreement on processing personal data between the Partner and GLS Poland, the data controller shall process the following personal data [under Article 6(1)(b) of the GDPR]:

• Partner’s identification data, contact details, financial data (i.e. registration data, first name, surname, position, phone number, e-mail address, bank account number),
• identification data and contact details of the Party's employees and cooperators (first name, surname, position, phone number, e-mail address,)

Personal data are collected from the Partner.

The provision of personal data is voluntary, however it is required for proper execution of the agreement.

GLS Poland processes personal data also in order to fulfil its legal obligations [under Article 6(1)(c) of the GDPR] (in particular the accounting and tax regulations, in connection with the settlement of amounts due under the agreement), and in order to fulfil its legitimate interests [under Article 6(1)(f) of the GDPR] (in particular such as: contact in connection with the performance of the agreement, solvency control, compliance or sanction programmes, establishing and investigating possible claims related to the agreement).

2. Data sharing

GLS Poland may provide personal data to:

• GLS subsidiaries,
• subcontractors (e.g. transport partners),
• entities that have an agreement to provide services to GLS Poland or on behalf of GLS Poland (Processors), in particular IT service providers,
• Clients of GLS Poland, Senders, Recipients, employees of the customer service department,
• mapping services,
• advertising and marketing agencies,
• recipients of the administrator’s social media,
• other persons or organisations under the applicable law,

3. The period of data storage and removal of the data

GLS Poland processes personal data only for the time necessary to achieve the purpose for which it was collected. The period of data storage is determined based on the following requirements:

• operational requirements: the period in which information is necessary to execute the agreement,
• legal requirements: the period during which GLS Poland is obliged to store data for a certain period of time in order to comply with the regulations,
• GLS Poland’s legitimate interests: the period during which the data are processed for the purpose of their execution, in particular to establish and pursue possible claims in connection with the execution of the agreement.

The archived data are accessible only to authorised employees. After the expiry of the period for which the data are authorised to be stored, they are permanently deleted.

1. Categories of personal data. Purposes of their processing and legal basis In order to establish and execute the agreement between the Transport partner and GLS Poland and the agreement on processing personal data between the Transport partner and GLS Poland, the data controller shall process the following personal data [under Article 6(1)(b) of the GDPR]:

• Identification data and contact details of the Transport partner (including data concerning the Transport partner's vehicles with which he provides services to GLS Poland, such as vehicle registration number)
• Identification data and contact details of Transport partner’s employees and cooperators (Couriers)
• the data collected during the performance of the contract, such as: geolocation data, data on the time of collection and delivery of parcels, data on the quality and efficiency of the provision of services, data on the risk assessment related to the violations of the provisions of the law by Transport partner’s employees and cooperators (Couriers).

Personal data are collected from the Transport partner. The provision of personal data is voluntary, however it is required for proper execution of the agreement. GLS Poland processes personal data also in order to fulfil its legal obligations [under Article 6(1)(c) of the GDPR] (in particular the accounting and tax regulations, in connection with the settlement of amounts due under the agreement), and in order to fulfil its legitimate interests [under Article 6(1)(f) of the GDPR] (in particular such as: contact in connection with the performance of the agreement, solvency control, compliance or sanction programmes, establishing and investigating possible claims related to the agreement, compiling summaries, analyses and statistics; examining the quality of the rendered services; direct marketing; GPS monitoring and video surveillance; organising competitions for the Couriers; organising company meetings and parties).

2. Data sharing GLS Poland may provide personal data to:

• GLS subsidiaries,
• subcontractors (e.g. transport partners),
• entities that have an agreement to provide services to GLS Poland or on behalf of GLS Poland (Processors), in particular IT service providers,
• Clients of GLS Poland, Senders, Recipients, employees of the customer service office,
• mapping services,
• advertising and marketing agencies,
• recipients of the administrator’s social media,
• other persons or organisations under the applicable law,

3. The period of data storage and removal of the data GLS Poland processes personal data only for the time necessary to achieve the purpose for which it was collected. The period of data storage is determined based on the following requirements:

• operational requirements: the period in which information is necessary to execute the agreement,
• legal requirements: the period during which GLS Poland is obliged to store data for a certain period of time in order to comply with the regulations,
• GLS Poland’s legitimate interests: the period during which the data are processed for the purpose of their execution, in particular to establish and pursue possible claims in connection with the execution of the agreement.

The archived data are accessible only to authorised employees. After the expiry of the period for which the data are authorised to be stored they are permanently deleted.

1. Categories of personal data. Purposes of their processing and legal basis

CCTV camera systems are installed in the GLS Poland branch. They are used for the following purposes:

• protecting property, preventing burglaries and maintaining order,
• tracking shipments and documenting the actions taken,
• ensure the safety and protection of workers.

Personal data, in the form of an image, collected in the video surveillance system shall be processed on the basis of the legitimate interest of the controller [In accordance with Article 6(1)(f) of the TYROM].

The area covered by the video surveillance has been marked accordingly, by means of information boards.

2. Sharing of data

GLS Poland may disclose personal data:

• to GLS subsidiaries,
• to subcontractors (e.g. transport partners),
• to entities which have an agreement to provide services to GLS Poland or on behalf of GLS Poland (Processing Entities), in particular to IT service providers,
• other persons or organisations under applicable law.

3. Storage period and deletion of data

GLS Poland processes personal data only for such time as is necessary to achieve the purpose for which they were collected. The period of data storage is determined based on the following requirements:

• operational requirements: the period during which the information is necessary to achieve the objectives pursued,
• legal requirements: the period during which GLS Poland is obliged to store data for a certain period of time in order to comply with the regulations
• Legitimate interests of GLS Poland: the period during which the data are processed for the purpose of their execution, in particular in order to establish and assert possible claims, in connection with the execution of the contract.

The archived data is available only to authorised employees. After the expiry of the period for which the data may be stored, they are permanently deleted. The time of storing recordings in the video surveillance system is maximum 30 calendar days.

1. The event log and cookies. Each time the user visits the GLS website the data are saved in the log file. The data stored temporarily include:

• IP address of the computer from which the query was received,
• domain name,
• date and time of access,
• HTTP response code,
• the sites visited,
• name and version of the operating system,
• name and version of the browser,
• screen resolution.

The use of GLS websites may involve the use of cookies by the GLS servers. These files are used by the website administrators. Each user can configure their browser settings in such a way that cookies are not accepted. In such a situation, no data of the person visiting the website will be saved. Information stored in cookies will not be sent to GLS. GLS applies a clear division of its website into a free-access zone and restricted zone. Certain aspects of the Agreement concluded between the Client and GLS are implemented with the use of the restricted zone. Access to the restricted zone requires a login generated by GLS.

2. Statistical and analytical data The data recorded shall be anonymously grouped for statistical purposes. Statistical data are used to assess the manner in which visitors use the GLS website. In particular, this applies to the sequence in which individual sites are opened, as well as the paths of movement between the sites. GLS uses this information to increase usability and improve the conditions for using the website. The GLS website uses Google Analytics, i.e. an analytical service offered by Google Inc. (‘Google’). Google Analytics uses cookies, i.e. text files stored on the user’s computer that enable the analysis of how the user uses the website. The information generated by cookies (including the IP address of the user) is sent to the Google server located in the USA and then saved to it. If anonymisation of IP addresses is activated on the website, the addresses of individual users shall be abridged before they are sent to the territory of the European Union or other countries which are parties to the Agreement on the European Economic Area. It is only in exceptional cases that the IP address is sent in full to the Google server in the USA, where it is abridged. Google uses this information to analyse how the website is used, in order to prepare the website traffic reports for the operator, as well as to provide other services related to the use of the website and the Internet. In addition, Google makes such information available to third parties in specific situations, if required by law or if a third party processes data on behalf of Google. In any event, Google does not link the user’s IP address with other Google data. To prevent cookies being recorded, the browser settings need to be changed; however, we would like to point out that this may result in the inability to use some of the functions available on the website. In addition, the user may block the record of data generated by cookies (including its IP address), and the data on how to use the website, as well as to block the processing of data by Google. To this end, download and install a browser plug-in to the browser, available at http://tools.google.com/dlpage/gaoptout?hl=en. The GLS website uses the extension of Google Analytics, ‘ga('set', 'anonymizeIp', true);’ which provides anonymisation of IP addresses (‘IP masking’). Uses the remarketing of Google Inc. This function is used to present website users, in Google advertising network, with ads based on their interest. ‘Cookies’ will be stored in a web browser of the website that allows the identification of the visitor, when he or she gains access to the websites belonging to the Google advertising network. Such advertisements can be displayed to the visitors that are related to the content to which the user had access, on the websites using Google remarketing function. Google does not collect any personal data in this process. However, if you do not agree to Google remarketing, you can always turn it off by changing settings on the website http://www.google.com/settings/ads. Alternatively, you can exclude the use of cookies in advertising based on interest via Network Advertising Initiative, by following the instructions on the website http://www.networkadvertising.org/managing/opt_out.asp.

3. Categories of personal data. Purposes of their processing and legal basis. The use of GLS websites may involve the processing of personal data for the following purposes:

• Tracking of ‘Track & Trace’ consignments [under Article 6(1)(b) of the GDPR] - the Parcel Identification Number is required to provide information about the status of the parcel.

• Contact through a contact form [under Article 6(1)(f) of the GDPR] - data sent by a contact form such as: first and last name, address, postal code, city, e-mail address) are required for the processing and replying to the inquiry; [under Article 6(1)(a) of the GDPR], the consent to the processing of such data, such as e-mail address, telephone number is required to make a contact for the purpose of presenting a commercial offer.

• YourGLS

• Redirecting the Parcel [under Article 6(1)(b) of the GDPR] - via the GLS Poland website, the recipient has the possibility to change the address of service if they cannot collect the shipment in person. For this purpose, the following personal data are collected:
  • first name and surname of the recipient or company name,
  • street / house number,
  • postal code / place of residence,
  • e-mail address and description of the desired location.

• Social media links - GLS Poland website contains links to GLS Poland social networks (Facebook, LinkedIn). For more information on the subject, select the relevant Privacy Policy tab.

• Searching Parcel Shop, Szybka Paczka points and GLS Poland branches and price calculator - to search for the nearest ParcelShop point or GLS Poland branch, and to check the cost of the consignment, enter the postal code, city (the postal code on its own does not constitute personal data).

• The ‘Zostań Agentem ParcelShop’ form (Become a ParcelShop Agent) [under Article 6(1)(b) of the GDPR] - in connection with the received declaration of intent to conclude the agreement, we collect the following personal data: first name, surname, (company name), address, postal code, city, country, telephone number, fax, e-mail address (website).

The ‘Zostań klientem biznesowym’ form (Become a business partner)[under Article 6(1)(b) of the GDPR] - in connection with the received declaration of intent to conclude the agreement, we collect the following personal data: first name, surname, (company name), address, postal code, city, country, telephone number, e-mail address (website).

4. Data sharing GLS Poland may provide personal data to:

• GLS subsidiaries,
• subcontractors (e.g. transport partners),
• entities that have an agreement to provide services to GLS Poland or on behalf of GLS Poland (Processors), in particular IT service providers, services related to customer service (help desk, teleshopping, marketing agencies),
• other persons or organisations under the applicable law,

5. The period of data storage and removal of the data GLS Poland processes personal data only for the time necessary to achieve the purpose for which it was collected. The period of data storage is determined based on the following requirements:

• operational requirements: the period in which information is necessary to perform the assumed objectives,
• legal requirements: the period during which GLS Poland is obliged to store data for a certain period of time in order to comply with the regulations,
• GLS Poland’s legitimate interests: the period during which the data are processed for the purpose of their execution, in particular to establish and pursue possible claims

The archived data are accessible only to authorised employees. After the expiry of the period for which the data are authorised to be stored, they are permanently deleted.

In the recruitment process GLS Poland shall act in accordance with the legal provisions specified in Article 22.1, par. 1. in the Labour Code and asks only for the transfer of personal data specified in the legal regulations, that is:

• first and last name(s);
• date of birth;
• the contact details indicated by that person;
• education;
• professional qualifications;
• the course of employment to date.

Other personal data beyond the categories indicated above (e.g. image) are processed at the candidate's initiative and on the basis of his/her voluntary consent, expressed by sending a recruitment application, and their submission does not affect the possibility of taking part in the recruitment.

In the case of remote recruitment, joining an online meeting by a candidate means consenting to the processing of personal data in the form:

• the name or nickname of the participant,
• e-mail address,
• the IP address of the device
• image (in case of using the possibility of uploading a profile photo).

The data is processed until the recruitment is completed. The recipients of personal data may be entities providing services to the Administrator, in particular those providing services such as support for the Administrator's IT systems and other companies of GLS Group.

If an e-mail address is indicated in the contact details, during or after the recruitment process, the candidate may be asked to complete an electronic survey in order to obtain an opinion on the recruitment process. The legal basis for data processing in this case is the legitimate interest of the data controller, the information collected will allow us to improve the recruitment process in our organization.

The candidate's personal data will be kept until the recruitment process is completed. If the candidate gives his or her express and voluntary consent also for the purposes of future recruitments, then personal data will be stored for a maximum of 12 months from sending the application.

GLS Poland came into possession of personal data at the moment of its delivery by the candidate for employee. The data held are not used for profiling. Candidates' personal data may be processed outside the European Economic Area - the basis for data transfer is:

• in the case of data related to the participation in the online meeting, the subcontractor joining the 'Privacy Shield' programme (under EU Commission Decision 2016/1250 of 12 July 2016).
• for other recruitments, Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council (notified under document C(2010) 593).

1. Categories of personal data. Purposes of their processing and legal basis

• Data sent to us via Facebook

Please note that the use of our Facebook page and its functions is subject to the terms and conditions of use of the platform services (for more information: https://en-gb.facebook.com/legal/terms). Users are responsible for the use of features such as: commenting, sharing, rating.

In order to communicate with visitors to our Facebook page (comment, post, message), we store the following data [In accordance with Article 6(1)(f) RODO]: Facebook user name, message or comment content. Depending on the case, we may ask for additional personal data via private messages:

• parcel number, delivery address, e-mail address or telephone number [In accordance with Article 6(1)(b) RODO], where the enquiry concerns the sender, recipient of the parcel or a desire to enter into a contract with GLS Poland,
• e-mail address, delivery address, telephone number, if you agree to participate in a competition organised by GLS Poland [pursuant to Article 6(1)(a) of the RODO].

Please note that no personal or confidential data should be given in publicly visible comments or posts.

• Collection and processing of access data by Facebook

Please check carefully what personal data is provided to us via Facebook. We would like to remind you that Facebook stores your data (e.g. personal data, IP address etc.) and may use it for business purposes. For detailed information on data processing by Facebook, please refer to Facebook's data policy at https://facebook.com/privacy/explanation. If you do not accept the terms of data processing by Facebook, please contact us in another way.

2. Information on co-controllers

To the extent that data are also processed by Facebook (Insights data), Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland and GLS Poland are co-controllers of data in accordance with Article 26 of the RODO. The processing of data in this respect is carried out on the basis of an agreement between the joint controllers, the content of which can be found here: https://facebook.com/legal/terms/page_controller_addendum.

The Facebook Data Protection Officer can be contacted via the contact form: https://facebook.com/help/contact/540977946302970.

• Processing of data for statistical purposes by means of page information

Facebook provides GLS Poland with some information about our Facebook page. This is aggregate data that helps us understand how users interact with our site. This information may be based on personal data collected in connection with your visit to or interaction with our site or its content. You can opt-out of data processing at any time by changing the advertising settings on your Facebook user account.

• Analytical tools

In order to continuously improve our social media presence, we use the analytical tool "Fanpage Karma" from uphill GmbH, Oranienstr. 188, 10999 Berlin. This applies only to statistical analyses in an aggregated form (without reference to individual persons).

3. Data sharing

GLS Poland may disclose personal data:

• to GLS subsidiaries,
• to subcontractors (e.g. transport partners),
• to entities which have an agreement to provide services to GLS Poland or on behalf of GLS Poland (Processing Entities), in particular to IT service providers,
• other persons or organisations under applicable law.

4. Storage period and deletion of data

GLS Poland processes personal data only for such time as is necessary to achieve the purpose for which they were collected. The period of data storage is determined based on the following requirements:

• operational requirements: the period during which information is necessary to perform the contract,
• legal requirements: the period during which GLS Poland is obliged to store data for a certain period of time in order to comply with the regulations,
• legitimate interests of GLS Poland: the period during which the data are processed for the purpose of their execution, in particular in order to establish and assert possible claims, in connection with the execution of the contract.

The archived data is available only to authorised employees. After the expiry of the period for which the data may be stored, they are permanently deleted.

For the maintainance of the GLS business profile on Facebook GLS uses the technical platform and services of Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland („Facebook“).

For the maintainance of the GLS business profile on Instagram GLS uses the technical platform and services of Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA 94025, USA („Instagram“).

The Instagram service is one of the Facebook products provided by Facebook Ireland Limited. Consequently, the following information on Facebook also applies to our business profile on Instagram.

We point out that you use our Facebook fan page and its functions on your own responsibility. This is especially true for the use of the interactive features (e.g. commenting, sharing, rating). The terms of use of Facebook apply.

Collection and processing of access data by Facebook (Insights)

Please carefully check which personal data you share with us via Facebook. As long as you are logged into your Facebook account and visit our Facebook profile, Facebook can assign this to your Facebook profile. We expressly point out that Facebook stores the data of its users (for example, personal information, IP address, etc.) and may also use it for business purposes. If you want to prevent Facebook from processing personal data transmitted to us, please contact us by other means. Detailed information about the data processing of Facebook can be found in the data policy of Facebook under https://www.facebook.com/privacy/explanation (Instagram: https://help.instagram.com/519522125107875).

Name and contact details of the joint controllers

As far as the data submitted by you is also or exclusively processed by Facebook (Insights data), Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland and we are the joint data controllers as defined in GDPR. The data processing takes place in this respect on the basis of an agreement between the joint controllers according to Art. 26 GDPR, which you can find here: www.facebook.com/legal/terms/page_controller_addendum.

You can contact the Data Protection Officer of Facebook via the contact form provided under https://www.facebook.com/help/contact/540977946302970.

Data processing for statistical purposes using site insights

Facebook provides us with so-called site insights for our Facebook page: www.facebook.com/business/a/page/page-insights.( Instagram: https://help.instagram.com/788388387972460?helpref=related&ref=related). This is aggregated data that helps us to understand how people interact with our site. Site insights may be based on personal information collected in connection with a visit or interaction of people on or with our site and its content.

You may opt-out of the processing of your data for any of the above purposes at any time by changing your ad settings in your Facebook user account at www.facebook.com/settings?tab=ads.

Competent supervisory authority for Facebook and Instagram

Data Protection Commission
Canal House
Station Road
Portarlington
Co. Laois
R32 AP23, Ireland
https://www.dataprotection.ie

For the maintainance of the GLS business profile on Facebook GLS uses the technical platform and services of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Irland („LinkedIn“).

Privacy policy of LinkedIn: https://www.linkedin.com/legal/privacy-policy.

Through the privacy shield certification LinkedIn guarantees an adequate level of data protection when processing data in the USA: https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active;

LinkedIn Page Analytics

LinkedIn’s page analytics provides insight into the performance of our LinkedIn business profile to assess trends based on dates and time periods. The analysis data (e.g. follower and visitor numbers) are only aggregated data that do not allow any conclusions to be drawn about individuals.

Competent supervisory authority for LinkedIn

Irish Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland
https://www.dataprotection.ie

For the maintenance of the GLS business profile on YouTube GLS uses the technical platform and services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA („Google“). YouTube is a Google service.

The privacy policy of Google and the associated services can be found at https://policies.google.com/privacy.

Through the privacy shield certification Google guarantees an adequate level of data protection when processing data in the USA https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.

Competent supervisory authority for Google

Irish Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland
https://www.dataprotection.ie

The Privacy Policy available on the GLS Poland website also regulates how GLS Poland processes personal data using the application available through the Apple App Store and Google Play platforms for use on iOS and Android operating systems (the application).

1. Event log and cookies

Each time a user enters the GLS website, the data is saved in a log file. The scope of temporarily stored data includes:

• the IP number of the computer from which the query was received,
• domain name,
• date and time of access,
• http response code,
• pages visited,
• name and version of the operating system,
• name and version of the browser,
• screen resolution.

The use of GLS websites may involve the use of cookies by GLS servers. These files are used by site administrators. Each user can configure the settings of his browser so that cookies are not accepted by him. In such a situation, no data will be stored on the computer of the website visitor. Information stored in cookie files will not be sent to GLS.

GLS uses a clear division of its website into a public area and a restricted area. Using the closed zone, certain aspects of the contract concluded between the customer and GLS are implemented. Access to the restricted area requires a login generated by GLS.

2. Statistical and analytical data

The stored data are anonymously grouped for statistical purposes. The statistical data is used to evaluate the use of the GLS website by its visitors. This applies in particular to the order in which individual pages are visited as well as the pathways between pages. GLS uses this information to increase usability and improve the conditions of use of the website.

The GLS website uses Google Analytics, the analytical service offered by Google Inc. ("Google"). Google Analytics uses cookies, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie (including your IP address) is transmitted to a Google server in the USA and saved there. If IP anonymisation is enabled on this website, the addresses of individual users are truncated before they are transmitted to the European Union or other states party to the Agreement on the European Economic Area. Only in exceptional cases is the IP address transmitted in full to a Google server in the USA, where it is shortened. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for the website operator and providing other services relating to website activity and internet usage. In addition, Google will also provide this information to third parties where required to do so by law or where such third parties process the information on Google's behalf. Under no circumstances will Google link your IP address to other Google data. In order to prevent cookies from being saved, you must change your browser settings; however, we would point out that this may prevent you from using some of the functions available on the website. Furthermore, you can prevent the data generated by the cookie (including your IP address) from being saved and your use of the website from being processed by Google. To do this, you will need to download and install the browser plug-in, available at http://tools.google.com/dlpage/gaoptout?hl=en.

The GLS website uses the Google Analytics extension "ga('set', 'anonymizeIp', true);" which provides IP anonymization ("IP masking").

This website uses a remarketing service provided by Google Inc. This function is used to present users of the website in the Google advertising network with advertisements based on their interests. The "cookie" will be stored in your browser, which allows you to recognize the visitor when he or she accesses pages belonging to the Google advertising network. Visitors to this website may be shown ads related to content to which the user has previously had access on sites that use the Google remarketing function. According to its own information, Google does not collect any personal information in this process. However, if you do not agree to Google's remarketing, you can always turn it off by making the appropriate settings at http://www.google.com/settings/ads. Alternatively, you can disable the use of cookies in interest-based advertising through the Network Advertising Initiative by following the instructions at http://www.networkadvertising.org/managing/opt_out.asp.

3. Categories of personal data. Purposes of their processing and legal basis.

• Registration [Pursuant to Article 6(1)(a) RODO] - when registering in the GLS application, the GLS-ONE e-mail address and password (user data) will be collected and saved. The e-mail address will be used as a user name for GLS-ONE or the GLS application and, if necessary, to generate a new GLS-ONE password. The "My packages" section lists all packages sent with GLS-ONE, including date, package number, recipient, price and status. In addition, a registered GLS-ONE user has the option to save the recipient's address in "My Address Book". The user can delete these addresses at any time. After deletion of the GLS-ONE account, the recipient addresses will be automatically deleted.
• Practical tracking of a package [In accordance with Article 6(1)(b) RODO] - by entering the package number or Track-ID, which can be found on the Advice Note, you can check where the package is at any time. All "travel points" of the package are shown in the overview. Detailed information about the package is also available.
• Searching for ParcelShop and QuickPack points - just enter the postcode, street name or city name. The nearest ParcelShop/ Szybka Paczka points are shown on an interactive map together with opening hours and contact details.
• FlexDeliveryService, Redirecting a parcel [In accordance with Article 6(1)(b) RODO] - the application allows the recipient of a parcel to choose an appropriate delivery option - for example, delivery to ParcelShop, Szybka Paczka, or change the date and address of delivery.
• Scanning of barcodes and two-dimensional codes [In accordance with Article 6(1)(b) of the RODO] - this way the Track-ID is directly loaded and the scanning of the code allows quick access to trace parcels.
• Ensuring the safety of operations carried out through the application [In accordance with Article 6(1)(f) RODO]
• GLS Poland shall also process personal data in order to fulfil the legal obligations of the controller [pursuant to Article 6(1)(c) of the RODO] - in particular accounting and tax legislation.

4. Data sharing

GLS Poland may disclose personal data:

• to GLS subsidiaries,
• to subcontractors (e.g. transport partners),
• entities which have an agreement in force to provide services to GLS Poland or on behalf of GLS Poland (Processing Entities), in particular to providers of IT services, services related to customer service (hotline, tele-sales, marketing agencies)
• other persons or organisations under applicable law.

5. Storage period and deletion of data

GLS Poland processes personal data only for such time as is necessary to achieve the purpose for which they were collected. The period of data storage is determined based on the following requirements:

• operational requirements: the period during which the information is necessary to achieve the objectives pursued,
• Legal requirements: the period during which GLS Poland is obliged to store data for a certain period of time in order to comply with the regulations,
• Legitimate interests of GLS Poland: the period during which the data are processed for the purpose of their execution, in particular in order to establish and assert possible claims, in connection with the execution of the contract.

The archived data is available only to authorised employees. After the expiry of the period for which the data may be stored, they are permanently deleted.