Geopost considers the protection of your Personal Data and privacy when designing new products and services (principles of "privacy by design" and "privacy by default"), and where appropriate, when these products or services are revised/upgraded. To ensure the security of your Personal Data and safeguard the proper exercise of your rights, Geopost implements measures designed to protect your Personal Data :

 - Establishment of a procedure for exercising rights and a procedure in the event of a personal data breach;

- Carrying out IT security and GDPR compliance questionnaires prior to the implementation of a project or an application;

- Verification of the guarantees presented by our subcontractors and future subcontractors with regard to the requirements of the GDPR;

- Carrying out internal audits, drawing up recommendations, monitoring and updating the inherent actions;

- Consulting with project managers to define relevant and reasonable retention periods, not exceeding the time necessary to fulfil the purpose of the processing;

- Maintaining and updating a register of processing operations;

- Conducting regular training sessions for all our employees;

- Coordination of a Data Protection Officer network including all our European subsidiaries

Geopost undertakes to only collect the data that is strictly necessary for the provision of the requested services.

If optional data is requested, you will be given a clear explanation of the Personal Data Geopost needs to provide the requested service and the data you may decide to provide voluntarily.

If you ship a package, we receive your data when you contact us, visit one of our shipping sites or ship packages with us.

If you are the recipient of a package, we receive your data from our shipping customers. They provide us with your data, together with package information or notification instructions, primarily in electronic form or via their own or our shipping systems. They normally do this to the extent that they have established a contractual relationship with you in accordance with Article 6(1b) of the GDPR, and we need this data to deliver the goods you have ordered to the shipper. In addition, we naturally receive your data from other postal service providers who act on our behalf for the delivery of consignments, for example if the consignment originates from abroad and another postal service provider who cooperates with us has been commissioned with the delivery.

Finally, we receive data directly from you when you have filled in your personal information in your user area (delivery address, delivery preferences, etc.).

If you are a visitor to our website, we receive your data through various functions of the website. For this purpose we use cookies or ask you directly for information. Our priority is to optimise the presentation of our website and to provide you with information about our services. You can limit the services or disable them completely at any time by using a link or by making the appropriate selection. (Please see "Web analysis, cookies and advertising services").

Your Personal Data will only be used to propose other services if you have agreed to receive commercial communication. In any case, you have the possibility to revoke your consent at any time.

Your data may be transferred to:

• Departments within Geopost: departments in charge of performing the requested services;

• External providers: technical service providers, including sub-contractors (if applicable, the data is transmitted to our subcontractors under the conditions prescribed by Article 28 of the GDPR);

• Companies of La Poste Group, for the performance of the services.

Geopost carries out all Personal Data processing activities within the European Union (EU).

However, for some specific services, Geopost may use data processors or business partners located outside of the EU. Some of your Personal Data may therefore be transferred to them for the strict purposes of their services. In such cases and in accordance with the regulations in force, Geopost requires its data processors to provide the necessary safeguards to ensure regulated, secure transfers, mainly by requiring them to sign the European Commission’s standard contractual clauses.

Different retention periods apply for the various services we provide. Geopost undertakes not to retain your Personal Data any longer than is necessary for the provision of the service or, if applicable, for compliance with the retention periods arising from the applicable limitation periods.

For the implementation of the processing of personal data described, Geopost determines, jointly with its subsidiaries located on the territory of the European Union or in a country recognised as adequate by the European Commission, the purposes and means of the processing. In accordance with Article 26 of the GDPR, a joint data controller agreement has been signed by all the data controllers concerned. It describes in particular the responsibilities and obligations of each of the joint controllers, the relations with the data subjects and the way in which the latter can exercise their rights with regard to the GDPR, the security and confidentiality measures taken to protect their personal data, the defined retention periods (these may however vary locally in application of the regulations in force), as well as the procedure in the event of detection of a data breach.

Geopost undertakes to adopt all measures protecting the security and confidentiality of your Personal Data and, in particular, to prevent any damage, erasure or unauthorised access by a third party.

To this end, Geopost has an Information System Security Policy based on the ISO 27002 standard, which defines the guidelines for good information security management practices. The policy covers human, physical, organisational and technical security controls.

If your Personal Data is affected by a security breach (destruction, loss, alteration or disclosure), Geopost undertakes to fulfil our obligation to notify Personal Data Breaches, in particular to the French Data Protection Authority (CNIL) and to inform you as soon as possible in accordance with Article 34 of the GDPR.