Privacy Policy

General Logistics Systems Germany GmbH & Co OHG (hereinafter referred to as "GLS Germany", "we" or "us") processes your personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the Telecommunications Digital Services Data Protection Act (TDDDG) and the Postal Act (PostG).

GLS Germany protects your personal data against loss and misuse through appropriate technical and organisational security measures. We reserve the right to improve these security and data protection measures as necessary.

When you send us an e-mail, it passes through the servers of the respective providers on the Internet, on which we have no influence. It is therefore possible that the e-mail is transmitted between these servers without encryption, so that it can be read by third parties.

Controller for the data processing according to Art. 4 (7) GDPR or provider of digital services to § 2 TDDDG is:

General Logistics Systems Germany GmbH & Co. OHG
GLS Germany-Str. 1-7
36286 Neuenstein
Phone +49 (0) 6677 646 907 000
service@gls-germany.com

You can reach our company data protection officer at:

General Logistics Systems Germany GmbH & Co OHG
Data Protection Officer
GLS Germany-Str. 1-7
36286 Neuenstein

datenschutz@gls-germany.com

Personal data is information about the personal or factual circumstances of an identified or identifiable natural person (data subject). This includes data such as name, address, telephone number and e-mail address.

Information that cannot be linked to an identified or identifiable natural person - such as anonymised data or aggregated data - is not personal data.

The processing of personal data is lawful if one of the following legal bases applies:

Consent (Art. 6 (1) lit. a GDPR):

The processing of personal data for one or more purposes is lawful if you have given us your consent in advance. Given consent can be withdrawn at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out until the withdrawal. This also applies to the withdrawal of consent given to us prior to the application of the GDPR, i.e. prior to 25 May 2018.

Fulfilment of contractual obligations or implementation of pre-contractual measures (Art. 6 (1) lit. b GDPR):

In order to be able to fulfil our contractual obligations towards you or to initiate a contract, we also process personal data. The purposes of the data processing result from the respective contract (e.g. sales contract).

Due to legal requirements (Art. 6 (1) lit. c GDPR):

GLS Germany is subject to legal obligations, such as retention requirements under commercial or tax law in accordance with the German Commercial Code (HGB) or the German Fiscal Code (AO).

Legitimate interest (Art. 6 (1) lit. f GDPR):

Where necessary we process your data to protect our legitimate interests (e.g. to ensure IT security and IT operations).

Within GLS Germany, your data will be accessed by those employees who need it to fulfil contractual and legal obligations. External service providers and agents used by GLS Germany may also receive data for these purposes, provided that they comply with the applicable legal provisions.

The parties who may receive your personal data include group-affiliated service providers and carefully selected non-group affiliated service providers who are contractually obliged to provide services on behalf of GLS Germany. GLS Germany has entered into appropriate contracts with these parties regarding data protection.

We only transfer your personal data to other recipients if this is required by law, you have given your consent or we are otherwise authorised to transfer the data. If one of these conditions is met, public authorities (e.g. law enforcement agencies) may receive personal data.

Personal data will only be transferred to a country outside the EU (third country) if this is expressly indicated within the scope of the respective service or if the commissioned service provider is based in a third country and the legal requirements for this are fulfilled. In this case, we base the third country transfer on one of the following legal instruments:

• Adequacy decision of the EU Commission for the respective third country
• Agreement on EU standard contractual clauses and additional measures if necessary.
• Binding Corporate Rules

An exemption as described under Art. 49 GDPR

GLS Germany stores personal data in accordance with statutory regulations on data processing and in compliance with legal retention periods as long as necessary for the respective purpose. We determine the duration of data storage in accordance with the following requirements:

Operational requirements: The storage period required for operational processes.

Legal requirements: Retention periods under commercial or tax law, e.g. resulting from the German Commercial Code (HGB) and the German Fiscal Code (AO).

After the defined retention period has expired, the data is deleted or destroyed. Detailed information on the retention period for specific processing operations can be found in the following sections.

Consignor data: Given name, surname, address, contact details, bank details

Consignee data: Given name, surname, address, postcode, city, country.

Delivery data: Surname and signature of the consignee, timestamp.
In case of absence of the consignee: surname and signature of the alternative consignee.
In case of collection from GLS ParcelShop: surname and signature of the consignee or authorised representative. If you authorise another person to collect your parcel, we will collect the person´s given name, surname and address.

Permission of deposit: (one-time or permanent permission of deposit, the latter is valid until withdrawal): Given name, surname, address, postcode, city and location of deposit.

For certain shipping services, additional personal data is required to fulfil the contract:

Legal basis:

Fulfilment of contract with the customer (Art. 6 (1) lit. b GDPR)

The legal basis for the processing of consignee data is Art. 6 (1) lit. e GDPR in conjunction with Section 41a (3) of the German Postal Services Act (PostG), because the guarantee of a functioning postal system represents a special public interest. The same legal basis applies to the processing of alternative consignee data because the collection is necessary to ensure proper delivery of a postal item.

As far as necessary we process your personal data beyond the fulfilment of the contract to protect our legitimate interests (Art. 6 (1) lit. f GDPR). This includes processing for the purpose of credit assessment, quality management, complaint and claims management as well as for controlling purposes.

As a company we are also subject to various legal requirements (Art. 6 (1) lit. c GDPR), such as the fulfilment of checking and reporting obligations under tax law, customs requirements for exports to non-EU countries and audit obligations under the Foreign Trade and Payments Act.

Storage period:

The above data will be stored for 10 years. The storage period begins with the following year of the parcel shipping. The data of the permission of deposit will be stored for three years after withdrawal in case of claims for loss or damage.

Data transfer:

The above consignee data and, if applicable, the data from the permission of deposit will be transmitted exclusively to the subcontractor commissioned with the delivery. Use for other purposes, in particular forwarding to other third parties, is excluded.

When sending parcels to other countries (export), the required consignor and consignee data is transmitted to the respective GLS company or partner company in the destination country.

The transfer is made to fulfil the contract with our customer (shipper/client). In case of shipping to a non-EU country, the legal basis for the data transfer is Art. 49 (1) lit. b) GDPR (for consignor) or lit. c (for consignee).

Compliance with applicable data protection provisions regarding consignor, consignment and consignee data is an original obligation of GLS Germany. The transmission of such data to GLS Germany by the customer for the purpose of fulfilling the contract does not constitute a processing of data on behalf of the customer.

For additional services such as the FlexDeliveryService and the ShopDeliveryService, the consignee’s e-mail address or telephone number is required in order to inform the consignee about the status of the delivery. GLS Germany receives this data from the customer (client) who orders these services.

The client is responsible for the proper collection of this data and in particular for the consignee’s consent to the transfer of his/her telephone number and/or e-mail address to GLS Germany.

For the Pick&ReturnService or Pick&ShipService, the client may provide the e-mail address of the pick-up contact (see above). GLS Germany receives this data from the client. The client is responsible for the proper collection of this data and in particular for the consent of the pick-up contact to the transmission of his/her e-mail address to GLS Germany.

If you have any questions about these procedures, please contact your contractual partner (the consignor or the client of a collection). You can also withdraw your consent from GLS Germany. In this case please use the contact details of the GLS Germany data protection officer (see section 1.3).

Data collected:
Consignee data: Date, name, street, house number, postcode, city
Selection: delivery on next working day, at neighbour, to ParcelShop or GLS depot
Collection authorisation: First and last name of the authorised person, street, house number, postcode, place of residence, first and last name of the authorising person, place, date, signature of the authorising person.

Legal basis:
The data is required to carry out the delivery (time and location) according to your order (fulfilment of contract according to Art. 6 (1) lit. b) GDPR).

Storage period:
The above data is scanned from the notification card and stored together with the other parcel data for 10 years.

Data transfer:
The above consignee data will be transmitted exclusively to the subcontractor commissioned with the delivery and to the selected ParcelShop if applicable. Use for other purposes, in particular forwarding to other third parties, is excluded.

GLS Germany measures the satisfaction of its consignors and consignees by voluntary surveys in order to continuously optimise its services.

Data collected:

• Net Promoter Score (NPS): This determines the probability of recommending the company and its services to others. Optionally, an open opinion poll follows.
  
• Customer Effort Score (CES): This measures the service experience for a GLS Germany service. Consignors and consignees use it to rate the ease of use of GLS services on a scale from "very difficult" to "very easy".

Legal basis:
The data is collected on the basis of your consent (Art. 6 (1) lit. a GDPR) through voluntary participation in the survey.

Storage period:
The survey data will be stored for 12 months.

Data transmission:
The data will not be transferred to a third country.

GLS Germany occasionally purchases commercial address and contact data (telephone numbers and e-mail addresses) from reputable address dealers. This data is used to contact potential new customers (consignors) in the B2B sector by telephone, post, e-mail or other means and to request the demand for parcel services.

If you are contacted in the context of such a campaign and do not wish to be contacted any further, please inform us directly in the telephone call or write to the contact address given in each case. We will then put your address on a blacklist so that future contact for advertising purposes is omitted.

Data collected:
Surname, given name, company (if applicable), street, house number, postcode, city, country, telephone number (if applicable), e-mail address and website.

On first contact, the following data may be requested: potential parcel quantity, products (standard/express) and services, destination countries, weight and volume structure.

Legal basis:
If we have received your address data from an address trader, it will be used on the basis of your consent given to the address trader (Art. 6 (1) lit a GDPR).

Storage period:
The storage period for potential customer addresses is normally two years. In the case of acquisition campaigns, storage is limited to the duration of the respective campaign.

Data transfer:
There is no data transfer to a third country.

The joint data controllers pursuant to Art. 4 (7) GDPR or providers of digital services to § 2 TDDDG for data processing in the context of the application process are:

General Logistics Systems Germany GmbH & Co. OHG,
GLS IT Services GmbH,
GLS Verwaltungs- und Service GmbH

all resident at
GLS Germany-Str. 1-7
36286 Neuenstein
Germany

DER KURIER GmbH & Co. KG
Dörrwiese 2
36286 Neuenstein
Germany

OverNight Service GmbH
Wendenstrasse 349
20537 Hamburg
Germany

General Logistics Systems B.V.
Breguetlaan 28-30
1438 BC Oude Meer
The Netherlands

(in this section 4: „the controllers“, “we” or “us”)

By applying via the website careers.de.gls-group.com , by e-mail or by post to one of the controllers, you provide the respective company with your personal data for the purpose of processing and reviewing your application. We store all data you provided in your application in our applicant management system.

For the recruiting process, the controllers use an applicant management system from Haufe-Umantis AG. Your data is therefore stored and processed on systems of Haufe-Umantis AG. We have closed a data processing agreement pursuant to Art. 28 GDPR to comply with data protection regulations.

Data collected:
Salutation, given name, surname, e-mail address, registration password (if applicable), salary expectation, curriculum vitae (CV) and details of how you became aware of us.

We obtain additional personal data by voluntary provision of your telephone number, address data, photo, letter of motivation or references.

Legal basis:
Your applicant data is processed for the purpose of initiating an employment contract with you (Art. 6 (1) lit. b GDPR).

In addition, the persons responsible process your personal data for statistical purposes (reports) in anonymised or aggregated form in order to protect legitimate interests (Art. 6 (1) lit. f GDPR).

Storage period:
If you take up a job with one of the controllers, your applicant data will be filed in your personnel file. Rejected applications are stored for six months. The period begins with the date of completion of the respective application process.

Data transfer:
Our service provider Haufe-Umantis uses sub-processors in Switzerland. An adequacy decision of the EU Commission exists for this country.

Data collected:
If you consent to this, your personal data listed under 4.3 will be stored in the so-called talent pool.

Legal basis:
The storage of your personal data in the talent pool is based on your consent (Art. 6 (1) lit. a GDPR).

Storage period:
You have the option of deleting your data (profile and application) at any time. Otherwise, the data will remain in the talent pool for 24 months and will then be anonymised.

Data transfer:
Our service provider Haufe-Umantis uses sub-processors in Switzerland. An adequacy decision of the EU Commission exists for this country.

You can contact us via WhatsApp for initiating an application.

Data collected:

Mobile phone number, contents of communication

Legal basis:

The processing and storage of your personal data for contacting you as part of the application process is based on your consent (Art. 6 (1) lit. a GDPR).

Storage period:

The data transmitted to us via WhatsApp will be stored for 90 days.

Data transfer:

If you have consented that we may contact you via WhatsApp, the data described below will be transmitted to WhatsApp Inc. WhatsApp has enabled end-to-end encryption so that the transmitted content is only accessible to you and us.

However, WhatsApp may collect so-called metadata (who communicates with whom and how often). WhatsApp Inc. also processes personal data including metadata on servers in countries outside the EU (e.g. in the USA). WhatsApp shares this data with other companies within and outside its group of companies. For more information, please refer to WhatsApp’s privacy policy. The controllers have neither precise knowledge nor influence on the data processing by WhatsApp Inc.

As part of the application process, we also conduct video interviews. For this we use a solution from service provider Cammio GmbH, Philipp-Franck-Weg 19, 14109 Berlin. In order to ensure compliance with data protection regulations, we have concluded a data processing agreement pursuant to Art. 28 GDPR with Cammio GmbH.

Data collected:
Video recordings of the answers

Legal basis:
The legal basis for processing your data from the video interview is your consent (Art. 6 (1) lit. a GDPR).

Storage period:
The video recordings will be automatically deleted in a non-recoverable way six months after the end of the selection procedure for the respective position. If you withdraw your consent, the video recordings will be deleted earlier.

Data transfer:
Cammio GmbH is a subsidiary of Cammio B.V., Lange Houtstraat 13, 2511CV The Hague, The Netherlands. It uses cloud infrastructure in the EU provided by Amazon Web Services (AWS), 410 Terry Ave North, Seattle, WA 98109-5210, USA. Cammio B.V. has closed EU Standard Contractual Clauses with AWS.

Data collected:
Given name, surname, address, telephone number, e-mail address, text of your request

Legal basis:
If you use the contact form, the data you enter will be collected and stored for the purpose of processing your enquiry (legitimate interest according to Art. 6 (1) lit. f GDPR).

Storage period:
The enquiries are stored for six years in accordance with the requirements of commercial law (§ 257 HGB).

Data transfer:
There is no data transfer to a third country.

Data collected:

If you apply to become a ParcelShop Partner of GLS Germany, we require the following information from you: Surname, given name, company (if applicable), street, house number, postcode, city, country, telephone number, e-mail address and website (if applicable).

Legal basis:

The data is processed for the implementation of pre-contractual measures (Art. 6 (1) lit. b GDPR).

Storage period:

If no ParcelShop contract is concluded, your data will be deleted no later than 2 years after the conclusion of the procedure.

Data transfer:

For ParcelShop administration we use a CRM-solution of SugarCRM Inc., 10050 N. Wolfe Rd. Wolfe Rd, Suite SW2-130, Cupertino, CA 95014, USA. We have concluded the EU standard contractual clauses with the provider.

Data collected:
If the ParcelShop contract is concluded between you and GLS Germany, we require further data for the performance and settlement of the contractual relationship: Your tax number/sales tax identification number and your bank details. To prove that a business exists, we request a copy of your business registration and, if applicable, an extract from the commercial register.

Legal basis:
The data is processed for fulfilment of the contract (Art. 6 (1) lit. b GDPR).

Storage period:
Your data will be kept for 10 years after termination of the ParcelShop contract.

Data transfer:
For ParcelShop administration we use a CRM-solution of SugarCRM Inc., 10050 N. Wolfe Rd. Wolfe Rd, Suite SW2-130, Cupertino, CA 95014, USA, with which we have concluded the EU standard contractual clauses.

To make it easier to find your ParcelShop, its address will be published or displayed as a search result on the following websites and applications: ParcelShop Search on GLS Germany websites (www.gls-group.com, www.gls-pakete.de), in the GLS app, on internet directory services (e.g. Google Maps, Yellow Pages, public phonebooks) and in the web shops of GLS customers who offer the ShopDeliveryService.

Data collected:
Surname, given name, company if applicable, street, house number, postcode, town, country, opening hours if applicable.

Legal basis:
The data processing is based on our legitimate interest (Art. 6 (1) lit. f GDPR).

Storage period:
The published ParcelShop data will be deleted after termination of the ParcelShop contract.

Data transfer:
In principle, the Parcel Shop Search can be used from any Internet access worldwide. Transmission to a third country only takes place if the Parcel Shop information is retrieved from there.

Data collected:
If you apply to become a GLS Germany supplier, we require the following information from you or the contact person: Salutation, surname, given name, company if applicable, street, house number, postcode, city, country, language, telephone number, fax, e-mail address and website if applicable, participation in COUPA, VAT identification number, tax number, D-U-N-S, bank details, terms of payment and delivery, information on the products and services you offer and on quality and environmental management.

Legal basis:
The data is processed for the implementation of pre-contractual measures (Art. 6 (1) lit. b GDPR).

Storage period:
If no contract is concluded, your data will be kept for 6 years in accordance with the legal retention period for business correspondence and then deleted.

Data transfer:
As a procurement platform, we use the cloud platform of the provider Coupa Inc. Grant Street, San Mateo, CA 94402, USA. We have concluded the EU standard contractual clauses with the provider.

Data collected:
see under 6.1

Legal basis:
The data processing is carried out for the fulfilment of the contract (Art. 6 (1) lit. b GDPR).

Storage period:
Your data will be kept for 10 years after termination of the supplier relationship.

Data transfer:
As a procurement platform, we use the cloud platform of the provider Coupa Inc. Grant Street, San Mateo, CA 94402, USA. We have concluded the EU standard contractual clauses with the provider.

Video surveillance systems are used at GLS Germany locations in accordance with the following regulations. The monitored areas are marked by appropriate signs.

Data collected:
Image/video data, if applicable additional data such as camera name, date and time, linked parcel number

Legal basis:
GLS Germany pursues the following purposes and legitimate interests (Art. 6 (1) lit. f GDPR) by the video surveillance:

1. property protection, burglary prevention and exercise of domiciliary rights

2. security and employee protection for cash on delivery processing

3. parcel tracking incl. documentation of liability transfers

4. processing of parcel-related complaints

Storage period:
The storage period of the video recordings is 30 calendar days for the purposes mentioned under 1., 2., and 3. and 120 calendar days for the purpose mentioned under 4.

Data transmission:
There is no data transfer to a third country.

Each time a user accesses a GLS website, data is recorded in a log file. The following data is temporarily recorded:

• Date and time of request
• IP address or DNS name of the requesting computer
• Requested page (URL)
• HTTP answer code
• Client operating system and version
• Browser and version

The temporary storage of this data is necessary to enable the delivery of the website to your device and to ensure the functionality of the website. With the help of anonymized data, we also gain statistical knowledge about the use of the GLS websites. In addition, we collect the data in order to be able to trace and prevent unauthorized access to the web server and the improper use of the websites and to secure our information technology systems.

8.2.1 Track & Trace

Data collected:
The parcel number, track ID or reference number you enter is needed to provide you with status information about the parcel. For selected parcels, Real-Time-Tracking is available to you on the day of delivery. In this case, you will be redirected to our http://gls-rtt.com/en page. For more information on our Real-Time-Tracking, please see section 9.

Legal basis:
The data processing is carried out for the fulfilment of the transport contract (Art. 6 (1) lit b GDPR).

Storage period:
The parcel data is available in the tracking system five months after the parcel data has been fed in. Afterwards, they are archived for 10 years.

Data transmission:
In principle, shipment tracking can be used from any internet access worldwide. Access from a third country is only possible if the parcel information is retrieved from there.

8.2.2 YourGLS

Upon request, commercial GLS customers will be activated for the closed area YourGLS by their responsible depot. Information on the processing of personal data in the closed area can be found directly in YourGLS.

8.2.3 Searching for ParcelShops / Depots

For searching the closest ParcelShop or GLS Depot, you need to enter the postcode. Please note that a postcode on its own is no personal data.

8.2.4 Application form for suppliers

You can find the data protection information under point 6.1

8.2.5 GLS KlimaProtect / Sustainbale shipping

In a download area, materials such as the “GLS Klima Protect” emblem are available for you to download as a GLS Germany customer (consignor).

Data collected:

In order to access this area, please confirm by stating your company name and customer number that you ship climate-neutrally with GLS Germany and that you only use these materials as part of climate-neutral shipping with GLS Germany.

Legal basis:

By accepting the terms of use, you enter into a contract of use. The data is collected for the purpose of implementing the contract of use (Art. 6 (1) lit. b GDPR).

Storage period:

The company name as well as the customer number will be stored in a log file for five months. GLS Germany reserves the right to check the information during this period. After five months, this data is automatically deleted.

Data transfer:

There is no transfer to a third country.

8.2.6 Application as delivery transport partner

The application to become a transport partner for deliveries is made via this form on our website.

Data collected:

Surname, given name, company, street, house number, postcode, town, telephone number, e-mail address and information on the services you offer (existence of a business registration and/or road haulage permit, number of employees subject to social insurance, possible areas of operation, available vehicles according to weight class) We receive additional personal data from you through voluntary information in the message field.

Legal basis:

Your data is stored and processed for the purpose of initiating a contract with you (Art. 6 (1) lit. b GDPR).

Storage period:

If a contract is concluded, your enquiry will be stored as a business e-mail for six years in accordance with § 257 of the German Commercial Code (HGB). If no contract is concluded with you, your data will be deleted after six months following receipt of your application.

Data transfer:

There is no transfer to a third country.

8.2.7 Application as long-distance transport partner

You apply for long-distance services by sending your application documents to the e-mail address named on the website.

Data collected:
We only receive the data that you send us in the e-mail. Please note the information on the website!

Legal basis:
Your data is stored and processed for the purpose of initiating a contract with you (Art. 6 (1) lit. b GDPR).

Storage period:
If a contract is concluded, your enquiry will be stored as a business e-mail for six years in accordance with § 257 of the German Commercial Code (HGB). If no contract is concluded with you, your data will be deleted after six months following receipt of your application.

Data transfer:
There is no transfer to a third country.

8.2.8 Application as a driver

Data collected:

Given name, surname, e-mail address, telephone (optional), street, house number, postcode, city, country, message (optional)

Legal basis:

The processing of personal data is based on your consent (Art. 6 (1) lit. a GDPR).

Data recipient:

Your data will be forwarded to transport companies with which GLS Germany cooperates.

Storage period:

We delete the data after six months.

Data transfer:
There is no transfer to a third country.

8.2.1 Track & Trace

See under 8.2.1

In addition, we work with our partner Publicis Media GmbH, Toulouser Allee 3, 40211 Düsseldorf, Germany, to display advertising on our shipment tracking page on a case-by-case basis.

Data collected:

If you have consented to data processing by the Flashtalking tool in our Consent Management Tool, your IP address will be transmitted to servers of Publicis Media GmbH and, if applicable, its processors. The downstream data processing is the sole responsibility of Publicis Media GmbH.

8.3.2 One-time permission of parcel deposit

You have the option to issue a one-time permission to deposit a certain parcel via our website. This enables delivery even if we are unable to meet you in person.

Data collected:

Given name and surname of the consignee or company name, street, house number, postcode, place of residence, a description of the desired storage location (e.g. garage) , checkbox to permit the deposit and your e-mail address.

Legal basis:

The data processing is carried out for the deposit of parcels (Art. 6 (1) lit. b GDPR).

Storage period:

The data of the permission of deposit will be stored for 10 years together with the parcel data.

Data transfer:

The data collected within the framework of the permission of deposit will not be transferred to third countries.

8.3.3 Parcel redirection and collection authority

Data collected:

Consignee data: Date, name, street, house number, postcode, city, e-mail address to confirm the respective order.

Selection: Redelivery on the next working day, to a neighbour, to a ParcelShop or to a GLS depot.

Collection authorisation: First and last name of the authorised person, street, house number, postcode, place of residence, first and last name of the authorising person, place, date, signature of the authorising person.

Legal basis:

The data is required to carry out the delivery according to your wishes (time/location) (fulfilment of contract according to Art. 6 Para. 1 lit. b) DSGVO).

Storage period:

The above data on redistribution will be digitised and stored together with the other parcel data for 10 years.

Data transer

The above data will be transmitted exclusively to the carrier commissioned with the delivery and, if applicable, to the ParcelShop. Any use for other purposes, in particular the transfer to other third parties, is excluded.

8.3.4 Registration

On the website www.gls-pakete.de you can register for a GLS customer account. This is done either by registering with an e-mail address and password or by using an existing account on one of the following platforms: Facebook, Google or Apple. GLS does not pass on any parcel data to the aforementioned platforms. GLS uses the platform accounts only for authentication. by the registration a GLS customer account is created.

A user account is needed for granting us a permanent permission of deposit. The user account can be used for the GLS Parcels app and the website www.gls-pakete.de.

Data collected:

During registration, the user's first name, last name and e-mail address, as well as a password and a display name are requested and stored. When using one of the above-mentioned platforms, the specification of a password is not required.

Legal basis:

The data is collected and stored for the fulfilment of the contract on the basis of Art. 6 Para. 1 lit. b) GDPR.

Storage period:

The registration data is stored as long as your user account is active. To delete your user account, log in with your account and use the corresponding option ‘Delete account’ in the account management section. If you delete your account, the consignee address data stored in the address book is automatically deleted as well.

Data transfer:

There is no data transfer to a third country.

8.3.5 Order process

You can configure and purchase parcel labels online. The purchased parcel labels are displayed after the order and can be used directly. You can print the parcel labels yourself and stick them onto the parcel. In addition, a QR code is provided that can be used to print out the parcel label in the ParcelShop.

When ordering as a registered user, you will find all your ordered parcel numbers under the menu item "My parcels". You can also access your parcel labels under the "Parcel labels" menu item.

As a registered user you can save consignee addresses by using the menu item "Address book". You can manually delete consignee addresses from the address book at any time. GLS Germany will only use this consignee data if you purchase a parcel label for the respective consignee address.

Data collected:

Consignor and consignee address (first name, last name, company if applicable, street, house number, postal code, city and country).

When using direct delivery of the parcel to a GLS ParcelShop, you have to provide the consignee´s e-mail address. The consignee will receive an e-mail after delivery to the ParcelShop and can pick up the parcel there.

If the consignee wants to be informed via e-mail about the parcel status during transport, the consignees e-mail address must obviously also be provided. In this case the consignee can also change the delivery options (e.g. delivery to a different address or permission of deposit).

Please note as a consignor that you may only transmit the e-mail address of the consignee to GLS Germany with the consignee´s consent!

Legal basis:

The data is collected and stored for the fulfilment of the contract on the basis of Art. 6 Para. 1 lit. b) GDPR.

In addition, we also process your personal data for legitimate interests of GLS Germany on the basis of Art. 6 Para. 1 lit. f) GDPR, such as compiling customer statistics and ensuring the operation of the website and the GLS-Pakete App.

Storage period:

The above data will be stored in the accounting systems for 10 years. The storage period begins with the year following the year of the parcel shipment.

Data transfer:

As part of our ordering process, we work with various service providers:

Order and shopping cart
For the creation of the shopping cart and the order processing we use the platform commercetools and transmit the necessary data to:

commercetools GmbH
Adams-Lehmann-Str. 44
80797 Munich

For further information on data processing by commercetools GmbH, please refer to the data protection provisions of commercetools GmbH.

Payment
For the processing of the payment we use PayPal Braintree and transmit the necessary data to the payment service provider commissioned by us:

PayPal (Europe) S.à r.l. et Cie, S.C.A.,
22-24 Boulevard Royal
L-2449 Luxembourg (hereinafter referred to as "PayPal").

Please note that data processing in the context of payment is the responsibility of PayPal and therefore the data protection provisions of PayPal apply.

In the event of payment complaints on your part or by us, we provide PayPal with further data. Details about that can be found in the buyer protection information of PayPal: https://www.paypal.com/de/webapps/mpp/ua/buyer-protection

Mail dispatch
For the sending of transactional e-mails such as order confirmations, we use the e-mail services of Twilio SendGrid and transmit the necessary data to:

Twilio Ireland Limited
3 Dublin Landings,
North Wall Quay, Dublin 1, Dublin,
Ireland D01 C4E0

We have concluded a data processing agreement with Twilio. It is agreed therein that our data is processed on servers in the EU. In exceptional cases, however, data may also be processed at Twilio's parent company in the USA. In this case Twilio secures the data transfer to the USA by Binding Corporate Rules (BCR).

Google Maps
We use the "Google Maps" service of the provider Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (hereinafter "Google") to search for and display GLS ParcelShops in a map. Corresponding map content is loaded from Google servers. By calling Google servers in the USA, there is a possibility that Google will log and store your IP address among other data. A processing of your data outside the European Union (EU) can therefore not be excluded. By invoking the respective sub-page (for example, by actively clicking on the "Map" button), you give your consent for your data to be processed by Google as described above. Further information on data protection at Google can be found at policies.google.com/privacy.

The processing is based on your consent. The legal basis is Art. 6 para. 1 a) DSGVO and Art. 49 para. 1 a) DSGVO.

8.3.6 Permanent permission of deposit

As a registered user, you have the option of granting us a permanent permission of deposit. This is displayed under the item "Permission of deposit".

Data collected:

Given name and surname of the consignee or company name, street, house number, postcode, place of residence, a description of the desired storage location (e.g. garage) , checkbox to permit the deposit and your e-mail address.

Legal basis:

The data processing is carried out for the deposit of parcels (Art. 6 (1) lit. b GDPR).

Storage period:

The permission of deposit will be stored as long as it is valid and for 3 years after its withdrawal.

Data transfer:

The data collected within the framework of the permission of deposit will not be transferred to third countries.

8.3.7 Contact form

See under 4.7

8.3.8 Join as business partner

Via this for you can pass on information to us needed to become a business partner.

Data collected:

Number of parcels per month, type of recipients, industry, national or international shipping, first name, last name, telephone, email address, company name (optional), postal code, your desired date and time for our call.

Legal basis:
If you use the contact form, the data you enter will be collected and stored for the purpose of initiating a contract (Art. 6 (1) lit. b GDPR).

Storage period:
The enquiries are stored for six years in accordance with the requirements of commercial law (§ 257 HGB).

Data transfer:
There is no transfer to a third country.

8.3.9 YourGLS

See under 8.1.3

8.3.10 Searching for ParcelShop

See under 8.1.4

8.3.11 Application form for ParcelShop partners

See under 5.1

8.3.12 Proposal for ParcelShop

You can use this function to suggest us a new ParcelShop near you. You will only be notified by us if you have given us your consent.

Data collected:

Mandatory: Street, house number, postcode and town of the ParcelShop

Voluntary: Name of the ParcelShop, contact person and your own contact details.

Legal basis:

The collection of data is based on our legitimate interest (Art. 6 (1) lit f GDPR).

Storage periods:

Your proposal will be deleted no later than eight weeks after receipt.

Data transfer:

There is no transfer to a third country.

8.3.13 Call back request

You can post a request for a call back via our website.

Data collected:

Given name, surname, company and telephone number, your request

Legal basis:

If you post a call back request, the data you entered will be collected and stored to process your request (legitimate interest according to Art. 6 (1) lit. f GDPR).

Storage period:

The request will be stored as a business e-mail in accordance with § 257 HGB for six years.

Data transfer:

There is no transfer to a third country.

8.3.14 Become a technology partner

If you would like to become a GLS technology partner, we need certain information from you. You will then be contacted by e-mail or telephone if necessary.

Data collected:

Approximate number of GLS customers/expected potential, approximate number of GLS parcels per month, company name and contact person's title, given name, surname, e-mail address. In addition, telephone number and free text can be entered voluntarily.

Legal basis:

If you use the contact form for technology partners, the data you enter will be collected and stored for the purpose of processing your enquiry (legitimate interest according to Art. 6 (1) lit. f GDPR).

Storage period:

If a contract is concluded, your enquiry will be stored as a business e-mail for six years in accordance with § 257 of the German Commercial Code (HGB). If no contract is concluded, your data will be stored for a maximum of 3 years and then deleted.

Data transfer:

There is no transfer to a third country.

8.3.15 GLS Parcel Configurator

The GLS Parcel Configurator helps consignors find the perfect shipping solution quickly and easily in just four steps. Accessible at any time, the various shipping options and service benefits from the GLS portfolio are clearly presented.

Data collected:

If you use the GLS Parcel Configurator on gls-pakete.de, we require the following information from you: Core business, industry, shipping method, parcels/month, surname, first name, telephone, email address, postcode.

Optional: Company name

Legal basis:

The data processing is carried out for the implementation of pre-contractual measures (Art. 6 (1) lit. b GDPR).

Storage period:

The data entered is not temporarily stored on the website, as the information is sent directly by e-mail to the responsible sales department. Should a contract be concluded, your enquiry will be stored as a business e-mail for six years in accordance with § 257 HGB. If no contract is concluded, your data will be stored for a maximum of 3 years and then deleted.

Data transfer:

There is no transfer to a third country.

8.3.16 GLS Partner finder

Interested parties will find an overview of GLS integrations in software partner solutions such as (e-commerce) ERP systems as well as shop and shipping systems. In addition, useful information on the respective GLS connection is available with one click, which also benefits customers who already use a software solution.

Only the search terms from the partner search, i.e. the partner names entered, are saved. These are used to analyse the use of the Partner Finder. This is not personal data.

8.3.17 LivePerson

On some subpages of our website we use the conversational cloud tools of the provider LivePerson Germany GmbH, P3 1-3, 68161 Mannheim, Germany.

Data collected:

The following data is collected:

• IP address of the user
• Referring URL
• Search engine used
• Used search engine keywords
• Indicator for returning visitors incl. number of visits
• Previous chats and/or message transcripts

For more information on data collection and processing, please refer to LivePerson's privacy policy: https://www.liveperson.com/policies/privacy/

Legal basis:

The data will be processed on the basis of your consent (requested via the cookie consent dialog) in accordance with Art. 6 (1) (a) GDPR.

You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage period:

The storage period for the above data is 13 months.

Transmission:

The above data may be transferred to countries outside the EEA. To secure these transfers, we have concluded the current EU Standard Contractual Clauses with the provider. A copy of the concluded EU Standard Contractual Clauses will be provided to you on request. Please contact datenschutz@gls-germany.com for this.

8.3.17 Trustpilot rating

In the redirection process on gls-pakete.de, you can indicate that you would like to receive a Trustpilot review invitation. In this case, Trustpilot will contact you via e-mail on behalf of GLS Germany to invite you to evaluate the delivery and to collect your feedback in order to improve our service. GLS Germany may also use such reviews in anonymised form for advertising purposes.

Data collected:

Consent to leave a review, name, e-mail address and reference number (order number and parcel number)

Legal basis:

The legal basis for the processing of your personal data in the context of the review invitation is Art. 6 para. 1 lit. a) GDPR.

You can revoke your consent at any time with effect for the future. Your revocation does not affect the lawfulness of the processing up to the time of the revocation.

Data recipients:

As we work with Trustpilot A/S ("Trustpilot") to collect customer feedback, we will share your name, email address and reference number (order number and parcel number) with Trustpilot for this purpose. If you would like to learn more about how Trustpilot processes your data, you can view the company's privacy policy here.

Storage period:

The reviews are deleted from our systems after 365 days.

Data transmission:

The abovenamed data will not be transferred to a third country.

1.1.2 Contact form reusable packaging

Data collected:

Name, e-mail address, reason for interest in reusable packaging, company name (optional)

Legal basis:

If you use the contact form, the data you enter will be collected and stored to process your request (legitimate interest according to Art. 6 para. 1 lit. f GDPR).

Storage period:

The enquiries are stored for six years in accordance with the requirements of commercial law (§ 257 HGB).

Transmission:

There is no data transfer to a third country.

8.3.19 Contact form reusable packaging

Data collected:

Name, e-mail address, reason for interest in reusable packaging, company name (optional)

Legal basis:

If you use the contact form, the data you enter will be collected and stored to process your request (legitimate interest according to Art. 6 para. 1 lit. f GDPR).

Storage period:

The enquiries are stored for six years in accordance with the requirements of commercial law (§ 257 HGB).

Transmission:

There is no data transfer to a third country.

8.4 GLS-Pakete App

8.4.1 Logging of User IDs

Each time a user accesses the Paket Magnet app, data is stored in a log file. In detail, the following data set is saved:

• The type of mobile device you are using;

• The unique ID of your mobile device;

• The IP address of your mobile device;

• your mobile operating system;

• Mobile Internet browser type;

• Unique device identifiers and other diagnostic information

We use the above data to provide the contractual services and customer support, to correctly deliver and optimize the content of our services and to ensure the long-term functionality and technical security of our systems.

8.4.2 Registration

Within the GLS-Pakete App and on the website www.gls-pakete.de, GLS offers the possibility to register for a GLS customer account by providing personal data.

For information on data processing in the context of registration, see 8.3.4.

8.4.3 Order process

To use the parcel shipping service offered by GLS, you can configure and purchase parcel labels online using the GLS-Pakete App and on our website www.gls-pakete.de.

For information on data processing in the context of registration, see 8.3.5.

8.4.4 Track & Trace

Data collected:

The parcel number, track ID or reference number you enter is needed to provide you with status information about the parcel. For selected parcels, Real-Time-Tracking is available to you on the day of delivery. In this case, you will be redirected to our http://gls-rtt.com/en page. For more information on our Real-Time-Tracking, please see section 8.9.

Legal basis:

The data processing is carried out for the fulfilment of the transport contract (Art. 6 (1) lit b GDPR).

On the day of delivery, you can, by consent, receive a push notification for the notification of the time of delivery, if this function is available for your parcel. The legal basis for the display of the push notification is your consent in accordance with Art. 6 (1) lit. a) GDPR. Push notifications can be deactivated again in the settings of the GLS Parcels app or in your system settings.

Storage period:

The parcel data is available in the Track & Trace for five months after the parcel data has been fed in. Afterwards, they are archived for 10 years.

Data transmission:

In principle, Track & Trace can be used from any internet access worldwide. Access from a third country only takes place if the parcel information is retrieved from there.

If you use the tracking function of another parcel service provider in the GLS-Pakete App, you will be redirected to their website. The data protection provisions of the respective service provider apply there.

8.4.5 Permanent permission of deposit

As a registered user, you have the option of granting us a permanent permission of deposit. This is displayed under the item "Permission of deposit".

For information on data processing in the context of registration, see 8.3.6.

8.4.6 Search for a ParcelShop

To search for the nearest ParcelShops, we need your GPS location or the postal code of the respective location. The postcode is not personal data.

Processing of location data: In the course of using our app, your location data, as collected by the device or otherwise entered by you, will be processed. The use of the location data is solely for the purpose of providing the respective functionality of our app. The location data is only collected if you have consented to it. The legal basis for the processing of location data is Art. 6 (1) lit. a) GDPR. If you no longer wish to share your location, you can deactivate this at any time in the system settings.

8.4.7 Map display iOS

We use Apple Maps from Apple Inc. for all map displays on iOS devices within the GLS-Pakete App.

When using Apple Maps, the following data is transmitted to Apple Inc.:

• Time of the request

• Device model and software version

• Input language

• Device location, if consent is obtained

• Boundaries of the map area visible on the device

• Interactions with Maps, including search terms used and places viewed

For more information, see Apple's privacy policy.

8.4.8 Map display Android

We use Google Maps from Google Inc. for all map displays on Android devices within the GLS-Pakete App.

When using Google Maps, the following data is transmitted to Google Inc.:

• Device type and settings of the operating system
• App version number
• IP address
• Crash reports, system activity and the date, time and referrer URL of your request

For more information, see Googles privacy policy.

8.4.9 User feedback

In our GLS-Pakete App, we use the services of the provider Instabug, Inc., 230 California Street, San Francisco, CA 94111, USA to transmit user feedback as well as crash and error reports of the GLS Parcels app.

Data collected:

Automatically collected data: screenshots and other attachments, logs (user steps, gestures, network requests), session profile (memory usage, battery level, CPU, connectivity).

Manually collected data: Email address for any necessary queries.

Legal basis:

The legal basis for the processing is your consent according to Art. 6 (1) lit. a) GDPR.

You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage period:

The data transmitted to Instabug will be deleted after 6 months.

Data transmission:

The above data is transmitted to Instabug's servers in the USA and processed/stored there. We have concluded the EU Standard Contractual Clauses with the provider, as Instabug is not certified under the EU-US Data Privacy Framework and therefore does not fall under the EU's adequacy decision for the USA. A copy of the relevant EU Standard Contractual Clauses will be provided upon request. Please contact datenschutz@gls-germany.com for this.

For the provision of our newsroom we use the provider TheNewsMarket, part of DMA Media Group, Waldhornstrasse 4, D-80997 Munich. The privacy policy of our partner TheNewsMarket can be found at

The privacy policy of our partner TheNewsMarket can be found at https://www.thenewsmarket.com/Privacy.

8.5.1 Search function

If you use the search function in our newsroom, we store the search terms entered to process your search query and to optimise our offer. This is not personal data.

8.5.2 Media basket

Data collected:

If you have placed media in the media basket of our newsroom and would like to send it, we collect the e-mail address of the message recipient(s), the subject, optionally a message and your name and e-mail address in order to send the media basket by e-mail.

If you would like to download the media in the media basket, we collect your name, e-mail address, country, function, company and title in order to learn more about you and to contact you if necessary.

Legal basis:

The basis for the data collection is our legitimate interest according to Art. 6 (1) lit. f) GDPR.

Storage period:

The data is stored for one year.

Data transmission:

Our partner TheNewsMarket uses a sub-processor in the UK. For this country an adequacy decision of the EU Commission exists.

8.5.3 Newsletter

Data collected:

Here you have the possibility to subscribe to our news. When you register, your e-mail address is transmitted to us and a confirmation e-mail is sent to the specified address. This e-mail contains a link that you must click to confirm your registration (double opt-in procedure).

Legal basis:

The legal basis for the processing of the data after registration to the newsletter by the user is Art. 6 (1) lit. a) GDPR if the user has given his consent.

You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage period:

Your data will be stored until you unsubscribe from the newsletter or revoke your consent.

Data transmission:

Our partner TheNewsMarket uses a sub-processor in the UK. For this country an adequacy decision of the EU Commission exists.

8.6.1 Application

For more information on data processing in the context of your application to GLS Germany or an affiliated company, please see section 4. Information for applicants.

8.6.2 YouTube

YouTube videos are embedded on our careers page. You can find more information about YouTube below in section 10.6 YouTube.

8.6.3 Search function

If you use the search function on our careers page, we store the search terms entered to process your search query and to optimise our offer. This is not personal data.

This website is used for customs data collection by consignors.

Data collected:

Legal basis:

The legal basis for the processing of the data is Art. 6 (1) lit. c) GDPR: This data is required to comply with the statutory customs regulations for the import and export of goods to and from the European Union.

Data recipient:

To provide our functions in the AEB Customs Portal, we use the provider AEB SE, Sigmaringer Str. 109, 70567 Stuttgart. Other data is only transmitted to the organisations involved in the process.

Storage period:

The customs data is stored together with the other parcel data for 10 years. If no associated parcel is notified or handed over to GLS within six days, the entered customs data will be deleted.

Data transfer:

A third country transfer only takes place if the cleared parcel is sent to a third country.

The legal basis for the transfer is in this case the fulfilment of the contract according to Art. 49 (1) lit. c) GDPR.

8.8.1 Real-Time-Tracking

For certain parcels Real-Time-Tracking is available. By entering your tracking ID and postcode you will find out the estimated delivery time for your parcel on the day of delivery and can track the approximate position of the delivery vehicle live on a map.

If "FlexDeliveryService" is booked by the shipper, you will be notified via e-mail as soon as real-time tracking is available. The shipper is responsible for collecting and transmitting your e-mail address to GLS Germany, see section 2.2.

The real-time tracking process is provided by GLS eCom Lab GmbH. We have concluded a data processing agreement pursuant to Art. 28 GDPR with them to ensure compliance with data protection regulations.

Data collected:
Real-Time-Tracking: Parcel number or tracking ID and postcode

Legal basis:
The data processing is carried out for the fulfilment of the transport contract (Art. 6 (1) lit b GDPR).

Data recipient:
The integration of Amazon Location Service in real-time tracking provides an improved user experience on this website. For the map display, we use Amazon Location Service from Amazon Web Services, 410 Terry Ave North, Seattle, WA 98109-5210 (AWS). When you visit our website, your personal data (IP address, referrer, browser information) is processed on the servers of AWS.

Data transfer:
We have agreed with AWS that this data is processed on servers in EU data centres. In exceptional cases, personal data may be transferred to the USA. Amazon Web Services Inc. is part of the AWS Group, which is certified under the EU-US Data Privacy Framework and falls under the EU adequacy decision for the US, provided that no data about the employment relationship or applicant data is processed. For this data processing, Amazon Web Services Inc. ensures an adequate level of data protection through the EU Standard Contractual Clauses. A copy of the relevant EU Standard Contractual Clauses will be provided upon request. Please contact datenschutz@gls-germany.com.

Further Details can be found here: https://aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum/ . For more information, please see the AWS privacy policy: https://aws.amazon.com/de/privacy/?nc1=f_pr .

The use of the Amazon Location Service is based on Art. 6 (1) lit. f GDPR: We have a legitimate interest in a reliable map display as part of our Real-Time-Tracking.

8.8.2 Alternative Delivery

Here it is possible to order a delivery to an alternative consignee, neighbour or to create a permission of deposit.

Data collected:

New delivery address.

Note: Please note that you are only allowed to enter the data of third parties (e.g. name and address of an alternative consignee) in this online form if they agreed before.

Legal basis:

The legal basis for the processing of this personal data is the consent of the data subject pursuant to Art. 6 (1) lit. a) GDPR.

Storage period:

The redistribution is stored together with the parcel data for 10 years. The storage period begins with the following year of the parcel shipping.

Data transfer:

For this processing, we use cloud-based systems of Amazon Web Services, Inc (AWS). We have agreed with AWS that this data is processed on servers in EU data centres. In exceptional cases, personal data may be transferred to the USA. Amazon Web Services Inc. is part of the AWS Group, which is certified under the EU-US Data Privacy Framework and falls under the EU adequacy decision for the US, provided that no data about the employment relationship or applicant data is processed. For this data processing, Amazon Web Services Inc. ensures an adequate level of data protection through the EU Standard Contractual Clauses. A copy of the relevant EU Standard Contractual Clauses will be provided upon request. Please contact datenschutz@gls-germany.com.

Further Details can be found here:
https://aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum/. For more information,please see the AWS privacy policy: https://aws.amazon.com/de/privacy/?nc1=f_pr.

8.8.3 Rating

Once your parcel has been delivered, you have the option of giving the service a star rating and commenting accordingly.

Data collected:

Star rating and optional comment

Legal basis:

The basis for the processing is our legitimate interest according to Art. 6 (1) lit. f) GDPR.

Storage period:

The rating data will be stored for one year.

Data transfer:

For this processing, we use cloud-based systems of Amazon Web Services, Inc (AWS). We have agreed with AWS that this data is processed on servers in EU data centres. In exceptional cases, personal data may be transferred to the USA. Amazon Web Services Inc. is part of the AWS Group, which is certified under the EU-US Data Privacy Framework and falls under the EU adequacy decision for the US, provided that no data about the employment relationship or applicant data is processed. For this data processing, Amazon Web Services Inc. ensures an adequate level of data protection through the EU Standard Contractual Clauses. A copy of the relevant EU Standard Contractual Clauses will be provided upon request. Please contact datenschutz@gls-germany.com.

Further Details can be found here:
https://aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum/. For more information, please see the AWS privacy policy: https://aws.amazon.com/de/privacy/?nc1=f_pr.

8.8.4 Rating via Trustpilot

See under 8.6.6

08.9.1 Login

Collected data:

Access data (login name and password)

Legal basis:

The legal basis is the fulfilment of the user contract for the customer portal in accordance with Art. 6 para. 1 lit. b) GDPR.

Storage period:

Your access data will be stored as long as your access is active. Inactive accesses will be deleted after three years.

Data transfer:

Your data will not be transferred to third countries.

8.9.2 Statistics and reports

Only aggregated data is shown in the reports and statistics, so there is no personal reference.

08.9.3 Research request

Data collected:

Company name, ContactID, address, e-mail address, optional: telephone number, parcel number

Legal basis:

The legal basis is the fulfilment of the transport contract in accordance with Art. 6 para. 1 lit. b) GDPR.

Storage period:

The data will be deleted 90 days after collection.

Data transfer:

Your data will not be transferred to third countries.

8.9.4 Damage and loss

Data collected:

Company name, ContactID, address, e-mail address, optional: telephone number, parcel number,

Documents required for claims processing (e.g. goods invoice)

Legal basis:

The legal basis for claims processing is our statutory liability pursuant to Section 425 HGB in conjunction with Art. 6 para. 1 lit. c) GDPR.

Storage period:

Recorded claims are deleted from the business customer portal after 90 days. The claims data remains in the claims processing systems for 10 days after the case has been closed.

Data transfer:

We use a workflow solution from the provider Nintex Global Ltd. to process parcel claims,

10800 NE 8th Street, Suite 400, WA 98004 Bellevue, United States. We have concluded EU standard contractual clauses with the provider to secure the data transfer.

8.9.5 Billing documents

Data collected/displayed:

Company name, ContactID, address, e-mail address for receiving invoices

Legal basis:

The legal basis is the fulfilment of the contract of use for the customer portal in accordance with Art. 6 para. 1 lit. b) GDPR.

Storage period:

This data is stored for as long as electronic invoice access or sending invoices by email is active.

Data transfer:

Your data will not be transferred to third countries.

8.9.6 Dispatch monitor

Data displayed:

Parcel data for up to 30 days, sender name and address, recipient name and address, parcel number, customer reference number if applicable, shipment status

Legal basis:

The legal basis is the fulfilment of the contract of use for the customer portal in accordance with Art. 6 para. 1 lit. b) GDPR.

Storage period:

The data is available in the customer portal for 30 days after dispatch.

Data transfer:

Data is only transferred to third countries if you use the customer portal in a third country.

8.9.7 Ordering materials

Data collected:

Company name, ContactID, delivery address, e-mail address, voluntary: telephone number for queries.

Legal basis:

The legal basis is the fulfilment of the purchase contract in accordance with Art. 6 para. 1 lit. b) GDPR.

Storage period:

The above data is stored in the customer portal for 24 months.

Data transfer:

As a procurement platform, we use the cloud platform of the provider Coupa Inc, 1855 S. Grant Street, San Mateo, CA 94402, USA. We have concluded the EU standard contractual clauses with the provider, as Coupa Inc. is not certified under the EU-US Data Privacy Framework and is therefore not covered by the EU adequacy decision for the USA. A copy of the relevant EU Standard Contractual Clauses will be provided upon request. Please contact datenschutz@gls-germany.com for this.

8.9.8 Collections

No personal data is collected during collections.

8.9.9 Contact form

Data collected:

Company name, ContactID, e-mail address, optional: telephone number

Legal basis:

The legal basis is our legitimate interest pursuant to Art. 6 para. 1 lit. b) GDPR in processing your enquiry.

Storage period:

Your enquiries will be stored in our systems for 6 years in accordance with the legal requirements for business correspondence. The period begins at the end of the year in which the communication took place.

Data transfer:

Your data will not be transferred to third countries.

On this website you can access the documentation of our customer systems and APIs after registration.

8.10.1 Registration

Data collected:

If you register as a user in our developer portal, we collect and store the login name (e-mail address), surname, given name and your self-selected password.

Legal basis:

The legal basis is the fulfilment of the user contract according to Art. 6 (1) lit. b) GDPR.

Storage period:

User data is stored for as long as your user account is active. To delete your user account, please contact the support contact indicated on the website.

Data transfer:

Your data will not be transferred to third countries.

Commercial GLS customers can be activated for GLS easyConnect with a separate user account on request. To provide the GLS easyConnect portal, we use the provider PAINT ORANGE SA, Via do Conhecimento, Central Building, 3830-352 Ílhavo, Portugal.

The privacy policy of our partner PAINT ORANGE SA can be found at https://www.shiptimize.me/privacy-policy/ .

As part of the use of GLS easyConnect, personal data is collected and stored on behalf of GLS Germany for the following purposes:

8.11.1 User Registration

Data collected:

For user registration, a user and one or more shipping point(s) are created.

The user's name, login name, e-mail address and associated shipping points are stored.

For each shipping point, we store the name of the shipping point, the name and address of the shipper (street, house number, postcode, city, country), contact details of the shipper (telephone number, e-mail address), time zone of the shipper, a contact person (name, telephone number, e-mail address), as well as optional customs information (VAT ID, EORI number, UK EORI number, UK VAT number) and GLS access data (API user, password, GLS customer ID and GLS contact ID).

Legal basis:

The data is collected and stored for the performance of the contract on the basis of Art. 6 (1) (b) GDPR.

Storage period:

The data will be stored for as long as your user account is active. Your data will be deleted after all outstanding items have been settled, in compliance with the legally prescribed archiving period.

Data transfer:

There is no transfer of data to a third country.

8.11.2 Parcel shipping

See 2.1 Parcel shipping and 2.2 Responsibility

8.11.3 Support Requests

Data collected:

Name and contact details (landline and mobile phone numbers, e-mail).

Legal basis:

The data is collected and stored for the performance of the contract on the basis of Art. 6 (1) (b) GDPR.

Storage period:

The support requests will be stored as long as your user account is active. Your data will be deleted in compliance with the legally prescribed archiving period.

Data transfer:

There is no transfer of data to a third country.

8.11.4 Search

If you use the search function in GLS easyConnect, we store the search terms you enter in order to process your search query and to optimise our offer. This is not personal data.

8.11.5 Contact List

As a registered user, you can save recipient addresses in the "Contact List". You can delete them manually at any time. The data in the Contact List will only be used by GLS Germany if you generate a parcel label for a saved address and thereby issue us with a transport order. If you delete your account, the recipient addresses stored in it will be automatically deleted.

Our transport companies are activated for the closed area of PartnerLifeCycle by their responsible depot. Information on the processing of personal data in the closed area can be found directly in PartnerLifeCycle.

Cookies are small text files stored on your computer, enabling an analysis of your website use. The information stored by cookies can be read by the website when you visit it again at a later date. On the one hand cookies are necessary to ensure that all processes on the site work smoothly. On the other hand, cookies can make the re-use of the site easier for the user: Information stored by cookies at the first visit, e. g. language settings or user names, do not need to be entered again. Hence, the website adjusts itself to a certain extent to your individual needs under the condition that the same device will be used.

That’s why GLS uses cookies:

By using cookies, we intent to provide an optimal service depending on your needs. For instance, some information you have already received at the first visit, will not be displayed once more. Activities such as the login and logout process can be facilitated, information you already searched for will be displayed faster. The performance of the website can be increased.

How to deactivate cookies:

You can adjust this in the settings of your browser. You can find more information in the help for your browser. Please note: If you deactivate cookies, you may no longer be able to use all functions of the respective website.

We use the content delivery services of Cloudflare, Inc., Westminster Bridge Road, 6th Floor, Riverside Building, County Hall London SE1 7PB, United Kingdom Through the way Cloudflare's features are integrated, the service filters all traffic that takes place through this website, i.e. the communication that takes place through this website and the user's browser, while allowing the collection of analytical data contained by this website. Cloudflare's privacy policy can be found here: https://www.cloudflare.com/security-policy/

We use a consent dialog from the provider consentmanager AB, Håltegelvägen 1b, 72348 Västerås, Sweden. Through this dialog, you can give your consent in accordance with the GDPR regarding cookies and tracking providers that are not necessary. For this purpose, the consent dialog stores a cookie in your browser in order to be able to assign the consents granted by you or their withdrawal. The data collected in this way is stored until you delete the cookie yourself or the storage period of the cookie expires.

Furthermore, in this dialog you will also find detailed information on the cookies used, including the storage period, as well as links to the data protection declaration and imprint.

If you wish to revoke your consent, you can call up the consent dialog again at any time: To do so, click on the black cookie icon at the bottom left of the website.

These are our internal cookies. They allow the site to run properly and our consent banner to work across domains (across all GLS websites).

On our websites we use the service "Friendly Captcha" of Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany. Friendly Captcha is a novel, privacy-friendly protection solution to make it more difficult to use our website through automated programs and scripts (so-called "bots").

For this purpose, we have integrated a program code from Friendly Captcha into our website (e.g. for contact forms) so that the visitor's device can establish a connection to the servers of Friendly Captcha in order to receive a calculation task from Friendly Captcha. The visitor's device solves the computational problem, which requires certain system resources, and sends the calculation result to our web server. The user contacts the Friendly Captcha server via an interface and receives an answer as to whether the puzzle has been solved correctly by the end device. Depending on the outcome, we may apply security rules to requests via our website, such as processing or rejecting them. The data will only be used for the protection against spam and bots described above.

With Friendly Captcha, no cookies are set or read on the visitor's device. IP addresses are only stored in hashed (one-way encrypted) form and do not allow us and Friendly Captcha to draw any conclusions about an individual.

If personal data is stored, this data will be deleted within 30 days.

The legal basis for the processing is our legitimate interest in accordance with Art. 6 (1) (f) GDPR in protecting our website from abusive access by bots, i.e. spam protection and protection against attacks (e.g. mass enquiries).

For more information on data protection when using Friendly Captcha, see https://friendlycaptcha.com/legal/privacy-end-users

For our website and the GLS Pakete App On our website gls-pakete.de and in our GLS-Pakete App, wwe use the background tool Segment analysis tool from Twilio Ireland Limited, 25-28 North Wall Quay, Dublin 1, Ireland ("Twilio"). This tool is used to forward informationanalyse collected by several tracking tools user behaviour in our appto analytics solutions, if the user has given the necessary consent for this. For this purpose, usage profiles are created using pseudonyms. We use this to measure the performance and stability of the respective app.

Data collected:
Segment does not collect personal data itself, but forwards data collected by other tools for analytics, if the user has given consent for this.Aggregated user behaviour under pseudonymous user profiles, performance and stability of the apps.

Legal basis:
The legal basis for the processing/processingforwarding of data is is your consentour legitimate interest in accordance with Art. 6 (1) fa) GDPR.

You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage period:
12 monthsAs Segment only forwards data as described above, data is not stored within Segment.

Data transfer:
We have concluded an order processing agreement with Twilio. It is agreed therein that our data is processed on servers in the EU. In exceptional cases, however, data may also be processed at Twilio's parent company in the USA. Twilio Inc. is certified under the EU-U.S. Data Privacy Framework and is covered by the EU U.S. adequacy decision, provided that it does not process employment or candidate data. For this data processing, Twilio Inc ensures an adequate level of data protection via Binding Corporate Rules (BCR).

Twilio privacy policy: https://www.twilio.com/legal/privacy

You can find information about the tracking tools used on our websites in the respective consent dialog ("Consent banner"). There you can also select which tracking mechanisms and technically unnecessary cookies you want to allow.

The specified websites use Google Analytics with IP anonymization, a web analytics service provided by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Some of our web pages also use Google Optimize. Google Optimize analyses the use of different variants of our website and helps us to improve the user experience according to the behaviour of our users on the website. Google Optimize is a tool integrated into Google Analytics.

On behalf of GLS Germany, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator.

You may refuse the use of cookies by selecting the appropriate settings on your browser. However, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en .

Data collected:

You can find the categories of processed data in the consent dialog (see 9.3) under the items

"Google Analytics" and "Google Optimize".

Legal basis:

The legal basis for the processing is your consent in accordance with Art. 6 (1) a) GDPR.

You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage period:

You can find the deletion periods for the cookies under the item "Cookies" in the consent dialog (see 9.3).

Data transfer:

Google Analytics uses cookies. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there.

On the specified web pages, the Google Analytics code has been extended by "gat._anonymizeIp();". This ensures anonymized collection of IP addresses (so-called IP masking). In this case, your IP address is shortened before transmission to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. You can find more information on the handling of user data by Google Analytics in Google's privacy policy at https://support.google.com/analytics/answer/6004245?hl=en .

Our website uses the conversion tracking of Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). If you have reached our website via an ad placed by Google, Google Ads will set a conversion cookie on your computer. If you visit certain pages of our website and the cookie has not yet expired, we and Google can recognize that you have clicked on the ad and have been redirected to this page. Each website operator receives a different cookie.

Cookies can therefore not be tracked across the websites of different Google Ads clients. The information obtained with the help of the cookie is used by us to create conversion statistics. We learn the total number of users who clicked on our ad and were redirected to a website tagged with a conversion tracking tag. However, we do not receive any information with which we can personally identify users.

If you do not wish to participate in conversion tracking, you can refuse the setting of the cookie - for example, via browser settings that generally disable the automatic setting of cookies or set your browser to block only cookies from the domain "googleleadservices.com".

Data collected:

You can find the categories of processed data in the consent dialog (see 9.3) under the item

"Google Ads".

Legal basis:

The legal basis for the processing is your consent in accordance with Art. 6 (1) a) GDPR.

You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage period:

You can find the deletion periods for the cookies under the item "Cookies" in the consent dialog (see 9.3).

Data transfer:

The information generated by the conversion cookie is usually transferred to a server of the Google parent company in the USA and stored there.

This website uses the remarketing function of Google Inc. This function serves to present website visitors within the Google advertising network with ads based on their interests. A “cookie” will be stored in the website user’s browser that makes it possible to recognise the visitor when they access websites that belong to Google’s advertising network.

Visitors on this page can be shown ads related to content that the visitor previously accessed on websites that use Google’s remarketing function.

According to their own information, Google does not collect any personal data in this process. However, if you do not want Google’s remarketing function, you can always disable it by making the appropriate settings at http://www.google.com/settings/ads .

Terms of use: https://www.google.com/analytics/terms/gb.html
Privacy Policy: https://policies.google.com/privacy?hl=en-GB

If you have given your consent, we use the "visitor action pixel" of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal, Dublin 2, Ireland ("Facebook") on some of our websites. This makes it possible to track the behaviour of users after they have been redirected to the provider's websites by clicking on a Facebook advertisement. This procedure is used to evaluate the effectiveness of Facebook ads for statistical and market research purposes and to optimize future advertising measures.

Data collected:

You can find the categories of processed data in the consent dialog (see 9.3) under the item

"Facebook (Meta)".

Legal basis:

The legal basis for this processing is your consent pursuant to Art. 6 (1) a) GDPR. Consent to the use of the visitor action pixel may only be declared by users who are older than 13 years. If you are younger, we ask you to ask your legal guardians for permission.

You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage Period:

The deletion periods for the cookies can be found under the item "Cookies" in the consent dialog (see 9.3).

Data transfer:

The data is stored and processed by Facebook so that a connection to your Face-book user profile (if any) is possible. You can find more details about this in Facebook's data usage policy at https://www.facebook.com/about/privacy/ .

If you have given your consent, we use the LinkedIn In-sight tag from LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn") on some of our websites.

Data collected:

You can find the categories of data processed in the consent dialogue (see 9.3) under the item.

"LinkedIn".

LinkedIn and we can thereby recognise that you have been redirected to our website by clicking on an advertisement. We only learn the total number of users who have clicked on a LinkedIn ad. No personal information about the user's identity is disclosed. LinkedIn's privacy policy can be found at https://de.linkedin.com/legal/privacy-policy.

Legal basis:

The legal basis for the processing is your consent in accordance with Art. 6 para. 1 lit. a) GDPR.

You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage period:

You can find the deletion periods for the cookies under the item "Cookies" in the consent dialogue (see 9.3).

Data transfer:

The information generated by the cookie may be transmitted to a LinkedIn server in the USA.

If you have given your consent, we use conversion tracking from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft") on some of our websites.

Data collected:

You can find the categories of data processed in the consent dialogue (see 9.3) under the item.

"Microsoft Advertising/Bing Ads". Further information on data protection with Microsoft Advertising can be found at https://privacy.microsoft.com/en-gb/privacystatement .

Legal basis:

The legal basis for the processing is your consent in accordance with Art. 6 (1) a) GDPR.

You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage period:

You can find the deletion periods for cookies under the item "Cookies" in the consent dialogue (see 9.3).

Data transfer:

The information generated by the cookie may be transmitted to a Microsoft server in the USA.

If you have given your consent, we use the session recording and heatmap service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft") on some of our websites.

Data collected:

The categories of data processed can be found in the consent dialogue (see 9.3) under the item.

"Microsoft Clarity". Further information on data protection at Microsoft Clarity can be found at https://privacy.microsoft.com/en-gb/privacystatement .

Legal basis:

The legal basis for the processing is your consent in accordance with Art. 6 (1) a) DSGVO.

You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage period:

You can find the deletion periods for cookies under the item "Cookies" in the consent dialogue (see 9.3).

Data transfer:

The information generated by the cookie may be transmitted to a Microsoft server in the USA.

On some of our websites, we use marketing automation software from Marketo Inc, 901 Mariners Island Boulevard, Suite #500 (Reception), San Mateo CA 94404, USA ("Marketo").

Data collected:

The categories of data processed can be found in the consent dialogue (see 9.3) under the heading.

"Marketo.com". The privacy policy of Marketo can be found here: https://documents.marketo.com/legal/privacy/

Legal basis:

The legal basis for the processing is your consent in accordance with Art. 6 (1) a) GDPR. You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage period:

You can find the deletion periods for cookies under the item "Cookies" in the consent dialogue (see 9.3).

Data transfer:

The information generated by the cookie may be transmitted to a Marketo server in the USA.

This company helps us to make data usable in real time at every touch point of the customer experience: Tealium Inc,11095 Torreyana Road, San Diego, CA 92121, USA ("Tealium").

Data collected:

The categories of data processed can be found in the consent dialogue (see 9.3) under the item.

"Tealium Inc." You can find Tealium's privacy policy here: https://tealium.com/privacy-notice

Legal basis:

The legal basis for the processing is your consent in accordance with Art. 6 (1) a) GDPR.

You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage period:

You can find the deletion periods for cookies under the item "Cookies" in the consent dialogue (see 9.3).

Data transfer:

The information generated by the cookie may be transmitted to a Tealium server in the USA.

On our website gls-pakete.de and in our GLS-Pakete App, we use the Mixpanel analysis tool from Mixpanel, Inc., 405 Howard St, Floor 2, San Francisco, CA 94105, USA ("Mixpanel"). This tool allows us to analyse aggregated user behaviour in our app. In addition, we can measure and thereby improve app performance and stability.

Data collected:
Aggregated user behaviour, app performance and stability.

Legal basis:
The legal basis for the processing is your consent in accordance with Art. 6 (1) a) GDPR.

You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage period:
12 months

Data transfer:
We have concluded a commissioned processing agreement with Mixpanel, which also includes the EU standard contractual clauses. It is agreed therein that our data is processed on servers in the EU. In exceptional cases, however, data may also be transferred to the USA.

Privacy policy of Mixpanel: https://mixpanel.com/legal/privacy-policy/

On our website gls-pakete.de and in our GLS-Pakete App, we use the Firebase-Remote-Config service provided by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland ("Google") to perform A/B tests and to control configurations. We use the data collected in this context to increase the attractiveness of our app and to minimise future failures and malfunctions of the app.

Information about how Remote Config works can be found at https://firebase.google.com/products/remote-config/. You can find more information about data protection at Google Firebase at https://firebase.google.com/support/privacy?hl=de.

Data collected:
Firebase installation IDs

Legal basis:
The legal basis for the processing is your consent in accordance with Art. 6 (1) a) GDPR.

You can revoke your consent at any time with effect for the future. Your withdrawal will not affect the lawfulness of the processing up to the time of withdrawal.

Storage periods:

Data transfer:

The data collected may also be processed on or via Google servers (in the US). Google LLC is certified under the EU-US Data Privacy Framework and falls under the EU adequacy decision for the US, provided that no data about the employment relationship or applicant data is processed. For this data processing, Google ensures an adequate level of data protection via the EU Standard Contractual Clauses. In our contracts with Google Firebase, the EU Standard Contractual Clauses have been integrated for all relevant data transfers. A copy of these EU Standard Contractual Clauses will be provided upon request. Please contact datenschutz@gls-germany.com for this.

On our websites we use the map service of HERE Global B.V, Kennedyplein 222 -226, 5611 ZT Eindhoven, The Netherlands ("here.com") The privacy policy of here.com can be found here: https://legal.here.com/en-gb/privacy

Typeforms is a survey tool of the company TYPEFORM SL, C/Bac de Roda 163, 08018 Barcelona

Spain. We use Typeforms on our websites to collect feedback on specific topics. We then use this information to improve our products and services. You can find Typeforms' privacy policy here: https://admin.typeform.com/to/dwk6gt/

GLS Germany operates so-called company profiles in the social networks listed below. In principle, GLS Germany is jointly responsible for data processing with the respective operator of the network within the meaning of Article 4 (7) of the Data Protection Regulation. Information on data processing by the respective provider and ways of contacting the provider can be found in the following sections.

Note on interactive functions

If you use the interactive functions of the respective social network (e.g. "Like" button, "Follow" button), it will be visible to the responsible parties and, if applicable, to the users of the social network that you are a fan of our site.

Data collected:

As soon as you communicate and interact with us (comment, post, message), we store your user name and the content of the message or comment for the purpose of processing your request. In private messages, depending on the request, further personal data may be provided by yourself or requested by us. (e.g. package number, e-mail address or telephone number if you wish to be contacted by telephone). Please do not provide any personal or confidential data in publicly visible comments and posts, if possible!

Legal basis:

The data you provide will be collected and stored to process your request (legitimate interest according to Art. 6 Para. 1 lit. f DSGVO). Should you wish to have it deleted manually, you have the right to do so at any time.

Storage period:

The data is stored in our system for 12 months and then anonymised.

You can find the storage period with the provider of the social network in their privacy policy.

Data transfer:

In order to continuously improve our social media presences, we use the analysis tool "Fanpage Karma" from the provider uphill GmbH, Oranienstr. 188, 10999 Berlin for our profiles on Facebook, Instagram, Twitter and LinkedIn.

Here, only statistical evaluations are carried out in aggregated form (without drawing conclusions about individuals).

The GLS websites contain links to the social media accounts of GLS Germany (e.g. Xing, Twitter, LinkedIn, Instagram, YouTube und Facebook). When using these links, please note that data processing on these profile pages is carried out in part by the respective provider.

GLS maintains business profiles on Facebook, Instagram, YouTube, XING, LinkedIn and Twitter. As the operator of these business profiles, together with the respective operator of these social networks we are responsible within the meaning of Art. 4 (7) GDPR. When visiting one of our fan pages, personal data will be processed by the controllers. Find more information on privacy when visiting on of our business profiles here.

On our in 9.1 listed websites you can find some, so called Share Buttons (e.g. Facebook, Twitter and WhatsApp). Those Buttons can be seen as a kind of bookmark that allows users to share our job advertisements with the respective service. On our website the share buttons are integrated by the privacy-friendly „Shariff-solution“ of heise.de and serve as a link to the corresponding services. After clicking on the integrated graphic, you will be redirected to the respective provider’s website. Only then user information will be transmitted to the provider. Please refer to the provider’s policy for further information on how they deal with your personal data.

We are joint data controllers with Meta for the Facebook Fanpage according to Art. 4 No. 7 DSGVO and on the basis of an agreement according to Art. 26 DSGVO. You can view the agreement here: www.facebook.com/legal/terms/page_controller_addendum .

Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta") is responsible for the technical operation of the Facebook fan page. We are solely responsible for the content of the Facebook fan page.

Competent supervisory authority for Meta

Data Protection Commission
Canal House
Station Road
Portarlington
Co. Laois
R32 AP23, Ireland
https://www.dataprotection.ie

Page Insights

Meta provides us with so-called Page Insights for our Facebook page. These are aggregated data that tell us how people interact with our site. Page Insights may be based on personal data collected when you visit or interact with our Page and its content.

Data collected:

Information is collected about how you use Facebook products, such as the types of content you view or interact with, or the actions you take (see "Things You and Others Do and Provide" in the Facebook Privacy Policy), as well as information about the devices you use (e.g., IP addresses, operating system, browser type, language settings, cookie data; see "Device Information" in the Facebook Privacy Policy). The information Facebook actually collects depends on whether and how people use Facebook products.

If you are logged into your Facebook account and visit our Facebook profile, Me-ta can associate this with your Facebook profile. If you do not have a Facebook account or are not logged in, your data will be collected anonymously.

Legal basis:

The basis for the data collection is our legitimate interest according to Art. 6 para. 1 lit. f) DSGVO.

You can object to the processing of your data for the aforementioned purposes at any time by changing your settings for advertisements in your Facebook user account at www.facebook.com/settings?tab=ads accordingly.

Please exercise your rights as a data subject (see 11.1) vis-à-vis one of the joint controllers. If we receive a request that falls within Facebook's area of responsibility, we will pass it on to Facebook for further processing.

Storage period:

You can find the deletion periods for cookies under the item "Cookies" in the consent dialogue (see 9.3).

The communication content is anonymised in our system after 12 months.

Data transfer:

We expressly point out that Meta stores the data of visitors to the Facebook fan pages (e.g. personal information, IP address, etc.) in the USA and may also use this for business purposes.

If you would like to avoid this, please contact us by other means. For more information on Meta's data processing, please refer to the Facebook privacy policy at http://en-gb.facebook.com/policy.php .

Contacting us via Facebook fan page

Data collected:

Facebook username, timestamp of the message.

Which other data you transmit to us depends on you and the respective request.

Legal basis:

We use your data to process your request within the scope of our legitimate interest according to Art. 6 para. 1 lit. f) DSGVO. If you contact us for the purpose of initiating a contract, the legal basis is Art. 6 para.1 lit. b) DSGVO.

Storage period:

Your enquiry will be stored in our system for 12 months and then anonymised.

Data transfer:

We expressly point out that Meta stores the data of visitors to the Facebook fan pages (e.g. personal information, IP address, etc.) in the USA and may also use this for business purposes.

If you would like to avoid this, please contact us by other means. For more information about Meta's data processing, please see the privacy policy at http://en-gb.facebook.com/policy.php .

Instagram is one of the products provided by Meta. Consequently, the information on Facebook under 11.4 nevertheless applies to our company profile on Instagram. The terms of use of Meta and the privacy policy of Instagram are authoritative for this: https://help.instagram.com/519522125107875 . Explanations on Instagram Insights can be found here: https://help.instagram.com/788388387972460?helpref=related&ref=related

For the operation of the Twitter company profile, GLS Germany uses the technical platform and services of Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland ("Twitter").

Collection and processing of access data by Twitter

Information about which data is processed by Twitter and for what purposes can be found in Twitter's privacy policy. The data collected about you in this context is processed by Twitter and may be transferred to countries outside the European Union.

Competent supervisory authority for Twitter

Irish Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland
https://www.dataprotection.ie

For the maintenance of the GLS business profile on XING GLS uses the technical platform and services of New Work SE, Dammtorstraße 30, 20354 Hamburg („XING“).

Privacy policy of XING: https://privacy.xing.com/en/privacy-policy .

XING BrandManager

The XING BrandManager provides us with general evaluation of the performance of our company profile. The key figures provided there (e.g. total number of page visits, total number of followers etc.) are merely aggregated data that do not allow any conclusions to be drawn about individuals.

Competent supervisory authority for XING

Freie und Hansestadt Hamburg
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22, 7. OG
20459 Hamburg
https://datenschutz-hamburg.de

For the maintenance of the GLS business profile on LinkedIn GLS uses the technical platform and services of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland („LinkedIn“).

Privacy policy of LinkedIn: https://www.linkedin.com/legal/privacy-policy .

LinkedIn Page Analytics

LinkedIn’s page analytics provides insight into the performance of our LinkedIn business profile to assess trends based on dates and time periods. The analysis data (e.g. follower and visitor numbers) are only aggregated data that do not allow any conclusions to be drawn about individuals.

Competent supervisory authority for LinkedIn

Irish Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland
https://www.dataprotection.ie

For the maintenance of the GLS business profile on YouTube GLS uses the technical platform and services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA („Google“). YouTube is a Google service.

The privacy policy of Google and the associated services can be found at https://policies.google.com/privacy .

Competent supervisory authority for Google

Irish Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland
https://www.dataprotection.ie

Integration of YouTube videos

We integrate YouTube videos on some of our websites. If you have not already consented to this in the consent dialogue (see section 9.3), a separate consent dialogue will appear.

Data collected:

You will find the categories of data processed in the consent dialogue (see 9.3) under the item "YouTube".

Legal basis:

The legal basis for the processing is your consent in accordance with Art. 6 (1) a) GDPR.

Storage period:

You can find the deletion periods for cookies under the item "Cookies" in the consent dialogue (see 9.3).

Data transmission:

When the video is called up, the above-mentioned information is transmitted to the Google parent company in the USA.

TikTok is a free video platform where users can upload short, self-made videos from their smartphones and share them. Other users can then react to these videos, share them or like them.

Please carefully check which personal data you share with us via TikTok. We expressly point out that TikTok stores the data of its users (e.g. personal information, IP address, etc.) and may also use it for business purposes.

We have no influence on the data collection and further processing by TikTok. Furthermore, it is not clear to us to what extent, where and for how long the data is stored, to what extent TikTok complies with existing deletion obligations, what evaluations and links are made with the data and to whom the data is passed on. If you would like to avoid TikTok processing personal data that you have submitted to us, please contact us by other means.

TikTok's Privacy Policy forms the basis on which TikTok processes all personal data collected by TikTok from users or provided by users.

Data Controller:

A controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

If you submit personal data to us via our TikTok page and we alone decide on the purposes and means of the processing, we are the sole controller of the processing.

Insofar as personal data is processed in connection with your use of our TikTok page and the operators of the TikTok platform alone decide on the purposes and means of the processing, TikTok Technology Limited 10 Earlsfort Terrace, Dublin D02 T380 Ireland and TikTok Information Technologies UK Limited, One london wall 6th floor, London EC2Y 5EB United Kingdom (hereinafter collectively referred to as "TikTok") are the joint controllers of the processing.

Data collected:

We collect personal data when you contact us, e.g. via contact form or messenger. You can see which data we collect when you contact us via the relevant contact form. This data will be stored and used exclusively for the purpose of answering your request or for contacting you and the associated technical administration.

Legal basis:

The legal basis for the processing of the data is our legitimate interest in answering your request in accordance with Art. 6 (1) (f) GDPR.

Storage period:

Your data will be deleted after your request has been processed, provided that there are no statutory retention obligations to the contrary. We assume a final processing if the request has been conclusively clarified.

Transmission:

How TikTok transmits your data can be found in TikTok's privacy policy, which you can access under the following link: https://www.tiktok.com/legal/page/eea/privacy-policy/de

As data subject you have the right to,

• obtain the controller confirmation as to whether or not and which personal data concerning him or her are being processed (Right of access by the data subject acc. to Art. 15 GDPR)
• obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her (Right to rectification acc. to Art. 16 GDPR)
• obtain from the controller the erasure of personal data concerning him or her without undue delay (Right to erasure acc. to Art. 17 GDPR)
• obtain from the controller restriction of processing (Right to restriction of processing acc. to Art. 18 GDPR)
• receive the personal data concerning him or her, which he or she has provided to a controller (Right to data portability acc. to Art. 20 GDPR)
• object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. (Right to object acc. to Art. 21 GDPR)

The right of access and the right to erasure are limited by §§ 34 and 35 BDSG.

If legal retention periods require the storage of the personal data, it can only be deleted after the prescribed retention period expired.

At any time, you have the right to withdraw your consent in data processing towards us. This also applies to consent given even before the GDPR. The withdrawal is only effective for the future and does not affect the lawfulness of the data processed until the withdrawal.

To exercise your rights or for withdrawal of your consent, please contact datenschutz@gls-germany.com and declare which right you wish to exercise so that we may take further steps required to work on your request.

Please note, that we may ask you for a proof of identity in order to protect your personal information from unauthorized access or alteration.

If you note any violation against our data protection regulations, do not hesitate to contact us. Furthermore, in such cases, you also have the right to lodge a complaint with a supervisory authority. (Art. 77 GDPR in conjunction with §19 BDSG)

Competent supervisory authority for with postal services data:
Federal Commissioner for Data Protection and Freedom of Information
Graurheindorfer Str. 153
53117 Bonn
https://www.bfdi.bund.de

Competent supervisory authority for other data processings:
The Officer for Data Protection and Freedom of Information of the State of Hesse
PO Box 3163
65021 Wiesbaden
https://datenschutz.hessen.de/