Privacy statement

This page is a translation of the Dutch version. In the event of any discrepancy, the Dutch version prevails.

1. WHO IS RESPONSIBLE FOR YOUR DATA

XPCG provides transport and distribution with its own drivers and its own depots in Drongen, Laarne and Evergem. For the processing operations in this statement we are the data controller within the meaning of the GDPR, except where we expressly state otherwise below.

XPCG, [enter the official company name and legal form], Industriepark-Drongen 15d, 9031 Ghent, Belgium. Company number [enter the company number]. E-mail info@xpcg.be. Phone +32 470 81 01 13. [Determine whether XPCG must appoint a data protection officer and, if so, add the contact details here.]

2. WHICH DATA WE COLLECT AND WHY

Contact form: your name, e-mail address, phone number and your message. We use these to answer your question.

Transport request on the home page: point of departure, destination, requested date and the contact details you provide with it. We use these to propose a schedule and a price.

Clients: names and roles of contact persons, business contact details, invoicing details and the agreements on runs and shipments. We use these to carry out the assignment, to invoice and to stay in touch.

Recipients of shipments: name, delivery address, phone number or e-mail address when provided, delivery instructions and the proof of delivery, such as time, status notification, signature or a photo of the delivery location.

Drivers and carriers in our platform XPCG Flow: account details, assigned runs and routes, time and scan registrations, notifications on the road and, for carriers, the company details and documents we need to verify that they are allowed to perform the transport. [Review the exact data fields in XPCG Flow before the platform goes into production.]

Job applications: the data you provide via the vacancies page, such as CV, motivation and, where the role requires it, driving licence and professional competence.

Website and blog: [describe the cookies and analytics data once it has been established which settings are active on the Framer platform, and refer to the cookie policy].

3. ON WHICH LEGAL BASIS WE PROCESS

We process data to perform or prepare a contract (clients, drivers, carriers, your request). We process data because we have a legitimate interest in doing so: answering your question, executing a run correctly, being able to prove that a shipment was delivered, and securing our people, goods and systems. We process data because the law requires us to, for example for accounting and transport documents. Where we ask for your consent, you can withdraw it at any time.

4. RECIPIENT DATA: OUR ROLE IN THE CHAIN

We often drive on behalf of a parcel carrier, a web shop or a retailer. The recipient of a shipment is then not a customer of XPCG. That client determines which data is passed on to us and for what purpose. In that case the client is the data controller and XPCG acts as processor: we use that data only to deliver the shipment and to report back to the client what happened to it. We do not use it for our own purposes and not for marketing.

If you are a recipient and want to know which data about your delivery was processed, please contact the party you ordered from first. If you contact us, we will help you and forward your question to the client concerned. [Review the data processing agreements with clients and verify them against this paragraph.]

5. WITH WHOM WE SHARE DATA

With carriers and subcontractors from our network who perform the run, and only with the data they need for it. With the client or parcel carrier we drive for, for status information and proof of delivery. With our IT suppliers and hosting provider [enter the names of the processors]. With our accounting firm and social secretariat [to be completed]. With authorities and inspection services when the law requires it. With our insurer in the event of damage [to be completed]. We do not sell your data.

Our runs within Europe go to the Netherlands, France, Germany and Luxembourg; that data stays within the European Economic Area. [Determine whether suppliers process data outside the EEA and, if so, which safeguards apply.]

6. HOW LONG WE KEEP DATA

We do not keep data longer than necessary. Messages from the contact form and transport requests: [determine the retention period]. Client data and run files: [determine the retention period]. Proofs of delivery: [determine the retention period in consultation with the clients]. Data in XPCG Flow: [determine the retention period]. Job applications: [determine the retention period and state whether we may retain your application for future vacancies]. We keep invoices and accounting records as long as the law requires. [Have the statutory retention periods confirmed.] Where we act as processor, we follow the client’s retention period.

7. YOUR RIGHTS

You have the right to access your data and request a copy of it. You can have incorrect data corrected or completed. You can ask us to erase your data. You can have the processing restricted. You can object to processing based on our legitimate interest. You can receive the data you provided yourself in a readable file or have it transferred. If you gave consent, you can withdraw it at any time; this does not affect the lawfulness of processing carried out before withdrawal. We do not make decisions about you that are based solely on automated processing.

8. HOW TO EXERCISE YOUR RIGHTS

Send an e-mail to info@xpcg.be or a letter to Industriepark-Drongen 15d, 9031 Ghent. Briefly state what you are asking and, if it concerns a shipment, which delivery it is about. We may ask you for proof of identity if we are in doubt about who is making the request. We reply within one month. If your request is extensive, we will let you know within that month that we need more time. If your request concerns data we manage as a processor, we will pass it on to the responsible client and let you know to whom.

9. SECURITY

We take technical and organisational measures to protect your data. Access to files and to XPCG Flow is limited to those who need them for their work, and our drivers, employees and carriers are bound to confidentiality. [Describe the specific security measures once they have been finalised.] If something nevertheless goes wrong, we report a data breach in accordance with the GDPR to the Data Protection Authority and, where required, to the persons concerned or to the client we work for.

10. COMPLAINT WITH THE SUPERVISORY AUTHORITY

If you are not satisfied with how we handle your data, please let us know first via klachten@xpcg.be. We prefer to find a solution together. You can also always file a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, via www.gegevensbeschermingsautoriteit.be. You can also turn to the courts.

11. CHANGES TO THIS STATEMENT

Our services and our platform evolve, so this statement may change. The version on this page is always the applicable version. We announce important changes on the website and, where appropriate, by e-mail to our clients. This statement was last updated on [enter the date of the latest amendment].