INFORMATION ON PERSONAL DATA PROTECTION
With the coming into force of the EU Regulation no. 679/2016, "relative to the protection of natural persons as regards the processing of personal data, as well as the free circulation of such data and abrogating the directive 95/46/EC" (hereafter "Regulation" or "GDPR"), the Company indicated in the bill of lading letterhead, as Data Controller, is bound to provide information concerning the methods and purposes of processing personal data. The table below gives a brief summary of the content of the information notice subsequently provided.
| Data Controller | The Company indicated in the bill of lading letterhead |
|---|---|
| Purposes | Conclusion, management and execution of goods transport contract |
| Legal basis | Fulfilment of the contract and legal obligations |
| Data transfer | Possible, where adequate guarantees safeguarding the data subject's rights exist |
| Data subject's rights | a. to access personal data;
b. to obtain the rectification or erasure of data or limit the processing thereof; c. to object to the processing of personal data; d. to obtain the portability of such data; e. to complain to the appropriate control authority (e.g. Data Protection Authority); rights which can be exercised by writing to: privacy@aclcargo.com |
The Data Controller has designated a Data Protection Officer (DPO), having specialist knowledge of legislation and standard practices in the matter of data protection, who is therefore qualified to perform the tasks as per Article 39 of EU Regulation no. 679/2016
1. Subject of the processing
We would hereby inform you, in accordance with Art. 13 GDPR, that the identifying, non- sensitive personal data (i.e. name, surname, tax ID, VAT number, e-mail, telephone no. etc.) provided by you to this Company, or otherwise acquired by the same in compliance with the current legislative and contractual provisions - concerning, related and/or instrumental to the freight transport contract - may be subject to processing in compliance with the aforementioned legislation and requirements of confidentiality.
The processing operations concern:
- personal and contact data of Shippers, Consignees and Notifiers, Customers, Invoice Payers.
2. Purposes of the processing which the data is intended for (Art. 24 letters a, b, c Personal data Protection Code and Art. 6 letter b, and GDPR)
Such data will be processed for purposes related to the mutual obligations deriving from the freight transport contract in force with you. In particular, the data will be processed:
- to manage requests for quotes;
- for the conclusion, management and execution of the operations connected with the freight transport contract;
- to send logistical information on the journey (e.g. delays, departure quay, etc.);
- for the transmission of your data to shipping agencies, terminals and port authorities, legal authorities and police forces;
- for the extraction of statistical information in anonymous form.
3. Data processing methods (Art. 4 Personal Data Protection Code and Art. 5 GDPR)
We also inform you that the personal data concerning you will be processed, including using electronic means, in compliance with the methods indicated in the GDPR, which provides, among other things, that the data must be:
- processed according to the principles of lawfulness, transparency and fairness;
- collected and recorded for specific, explicit and legitimate purposes ("purpose limitation");
- adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation');
- accurate and kept up to date ("accuracy");
- kept for no longer than is necessary for the purposes for which the personal data are processed ("retention limitation");
- processed using instruments that ensure the security and confidentiality of the personal data, including protection against unauthorised or unlawful processing and against loss, destruction or damage, or accidental damage ('integrity and confidentiality').
Personal data is stored as shown in the table below.
| Data | Storage times | Purpose of storage |
|---|---|---|
| Name
Surname Tax Code VAT number Address of residence Vehicle number plate Vehicle make and model Telephone number |
10 years from end of transport | For accounting purposes, and to challenge any disputes that may be raised against the company |
4. Legal basis
The legal basis of the processing listed above from point 1 to point 3 of paragraph 2 "Purpose for which the data will be processed" lies in the fulfilment of contractual obligations, precontractual measures and the law in order to manage the freight shipping contract.
With regard to point 4 of paragraph 2 "Purposes of processing that the data is intended for", this falls within the scope of the data controller's obligations in terms of the law and public interest in protecting port security.
5. Data transfer
Please note that your data may be disclosed, as well as to other companies belonging to the Grimaldi Group, also to entities established in third countries, even outside the territory of the European Union, subject to compliance with specific procedures.
With reference to EU countries, your data may be disclosed to the port authorities, judicial authorities, and police forces, shipping agents and terminals situated in the whole EU. With regard to countries outside of the EU, data may be transferred to the recipients listed above operating in:
Great Britain, Switzerland, Russia, Tunisia, Algeria, Morocco, Libya, Egypt Turkey, Israel, Syria, Lebanon, Senegal, Benin, Nigeria, Ghana, Ivory Coast, Gambia, Guinea, Sierra Leone, Liberia, Togo, Cameroon, Gabon, Congo, Angola, Burkina Faso, Mauritania, Equatorial Guinea, Central African Republic, Chad, Madagascar, Saudi Arabia, United Arab Emirates, Abu-Dhabi, Qatar, South Korea, Japan, USA, Canada, Mexico, Brasil, Uruguay, Argentina, Paraguay.
In the case of emergency stopovers, your data could be communicated to countries other than those listed above.
More specifically, disclosure of your data to shipping agencies could take place insofar as it acts in representation of the shipowner in transferring data to the Competent Authorities (e.g. Port Authorities, Financial Police Force and Customs).
Additionally, the Company may disclose data directly to the Authorities specified. As regards the terminal, on the other hand, there is an obligation whereby it must carry out specific controls on objects to be embarked or disembarked.
With reference to transfers that may take place in countries like Israel, Uruguay, Argentina, the USA and Canada, the European Commission has ruled that the transfer shall be legitimate by specific decision of adequacy in accordance with Article 25, paragraph 6 of Directive 95/46/EC.
In other countries, however, where the GDPR applies, data transfer will be regulated in accordance with the principles established by the Regulation in the contractual relations carried out by the Company indicated in the bill of lading letterhead.
6. Data disclosure
Please also note that said personal data processing relating to, connected with and/or instrumental to the freight shipping contract may envisage access to said data by:
- public authorities;
- legal authorities and police forces;
- ticket offices, terminals and shipping agencies for the organisation of embarkation/disembarkation;
- law firms, if disputes should arise;
- insurance companies;
- experts in the event of a claim;
- companies, including Grimaldi Group companies supplying other essential services to freight shipping provisions, such as roadside maintenance, repair and assistance, the hosting of web systems and sites, e-mail services, audit services and data analysis.
It may also be necessary for you - on the basis of laws, legal proceedings, disputes and/or requests made by public or government authorities within or outside your country of residence, purposes of national security or other matters of public importance - to disclose your personal data. Where lawfully possible, we will inform you before any such disclosure. We may also disclose your personal data if we establish in good faith that said disclosure is reasonably necessary in order to enforce and protect our rights and activate available remedies.
7. Data Subject's Rights (Art. 7 Personal Data Protection Code and Arts 15 - 21 GDPR)
Lastly, we inform you that the data subject may, at any time, exercise the rights:
a. access to personal data, requiring that such data be made available to you in an intelligible form, as well as the purposes of the processing (former Art. 15);
b. to obtain the rectification (former Article 16) or the erasure (former Art. 17) of the same or the limitation of processing (former Art. 18);
c. to data portability (pursuant to Art. 20);
d. to object to data processing (pursuant to Art. 21);
e. to lodge a complaint with the competent supervisory authority.
The above rights can be exercised by e-mailing a request to privacy@aclcargo.com
In this regard, please also note that the Data Protection Officer appointed by the Company can be contacted by e-mail at DPO@aclcargo.com
8. Nature of data provision and consequences of a potential failure to disclose the data
Data provision is necessary in order to ensure the correct fulfilment of our contractual and precontractual obligations; failure to supply such will make it impossible to stipulate the freight transport contract you have requested and to properly fulfil legal obligations and those deriving from the public interests in protecting security at ports.
