DEUTSCHE POST DHL
DATA PRIVACY POLICY
SUMMARY
Global Data Protection
Version: 2.0 October 2019

Global Data Protection
Version: 2.2 June 20203

Deutsche Post DHL Data Privacy Policy
Summary for external publication purposes1

What is the Deutsche Post DHL Data Privacy Policy?
The DPDHL Data Privacy Policy is a corporate guideline for the data protection standards applicablewithin the Group and is designed to satisfy legal data protection requirements. All companies within theGroup are bound by these regulations with reference to the use of personal data belonging to customers,
employees, shareholders and suppliers. The DPDHL Data Privacy Policy was submitted for approval toall European supervisory authorities, within the framework of the mutual recognition process and underthe executive authority of the German Federal Commissioner for Data Protection and Freedom ofInformation (Bundesbeauftragter für den Datenschutz und die Informationsfreiheit, BfDI). In 2011 theBfDI has approved the DPDHL Data Privacy Policy. When the European General Data Protection
2016/679/EU (GDPR) came into application in May 2018 the DPDHL Data Privacy Policy has beenadjusted to the new law. The editorial modifications have been accepted by BfDI in 2019. The DPDHL
Data Privacy Policy satisfies the requirements for binding corporate rules to guarantee an adequate levelof data protection vis à vis data transfer in countries outside the European Union (EU). As such, it provides
appropriate safeguards for DPDHL’s transmission of personal data belonging to its customers andemployees to Group companies around the world, and ensures compliance with the GDPR.
The principles of data protection
Group companies are obliged to protect your personal data. Personal data is any data which candirectly or indirectly identify you as an individual, for example your contractual data, such as your nameand surname, postal or email address, telephone number or, should an employment relationshipexist, your personnel number or data from your personnel file. Insofar as your data has been collected
within the scope of the GDPR, i.e. you are a European customer or employee, all Group companies
must observe the following basic principles, in particular:-Your personal data is only processed in the event that a legal basis to do so exists. This legal basis
may be derived from a law, a contract or your previous express consent, insofar as theprocessing of your personal data is required (Principle of legitimatingbasis).

-Group companies may only process such personal data required in terms of type and scope
for the fulfillment of authorized purposes. Such data must be relevant and appropriate(Principle of purpose limitation).

-

As a matter of principle, you will be informed of the concrete purpose of the data processing inquestion and of the controller, being the unit responsible for these activities, insofar as nospecial exceptions exist with reference to the duty to inform, e.g. you have already been
informed via another channel or the data is already publically accessible. Information is available
in the Privacy Statements on our websites or within the framework of written contracts(Principle of transparency).

1This text is a summary of applicable regulations under DPDHL Data Privacy Policy and does not in itself constitute a right toindividual legal claims.

1-Your personal data is deleted as soon as it may no longer be retained pursuant to DPDHL
storage guidelines or applicable legislation. Where at all possible and economically viable,anonymization and pseudonymization measures are applied to ensure that your actual
identity is not discernible or cannot be reestablished without recourse to a disproportionate
amount of effort (Principle of data minimization and data avoidance).

-

All necessary technical and organizational measures are taken to ensure your personal data
is protected against unauthorized use and publication, and its security and confidentiality
guaranteed. All data stored is up to date (Principle of data security and data quality).

Group companies may transmit your personal data to third parties, such as internal or external
service providers or suppliers commissioned by DPDHL to render services on your behalf. Your
personal data shall, however, only be transmitted to companies who are obliged to observe data
secrecy and who abide by the relevant legislation in the processing of your data. Should suchcompanies be located outside the EU, DPDHL shall ensure the protection of your personal data inaccordance with the relevant legislation by means of the DPDHL Data Privacy Policy or otherappropriate measures.
Should you, under exceptional circumstances, provide DPDHL with personal data which is, according tosome legal standards, classified as particularly sensitive – such as ethnic origin, religion or health issues– the Group is obliged to only process such sensitive personal data in compliance with the applicablelegislation, which can often first require your express consent.
Your rights as the data subject
Group companies are obliged to protect and uphold the rights of the person whose data isprocessed (data subjects’ rights). As a European customer or employee, the following, in particular,
fall under such rights in accordance with EU privacy legislation:-In your capacity as data subject you may, at any time, request to be informed which data
pertaining to you is stored by a given Group company, and also to whom such personal data
has been transferred. DPDHL is however not obliged to comply with your request for
information in the event that it affects the interests of a third party in a manner which is notlegally permissible, or in the event that, in a specific case, a legitimate interest in protecting
business secrets contradicts such a course of action (Right to information).

-As the data subject, you retain the right of rectification should the saved data pertaining to
you be incomplete or incorrect (Right of rectification).

-Group companies must delete your personal data in the event that data processing was illegalor the requirement for data processing no longer exists. Should statutory retention periods
apply, or if deletion is not possible or unreasonable, data shall be blocked (Right to deletion andblocking).

-

You retain the right to object to the use of your data in the event that a contractual or legal
right to object exists. In the event you are approached for the purposes of advertising ormarket/opinion research, the Group company must, upon first contact, inform you onceagain of your right to object as regards the use or transfer of data for direct marketing2

purposes. In the event you have consented to the use of your data, you retain the right torevoke your consent at any time (Right to object and right of revocation).

-

The exercising of your rights may not result in discrimination against your person(Prohibition of discrimination).

-

You retain the right to approach the data protection officer of the respective Group company
or DPDHL with questions at any time (Right to express concerns).

Furthermore, within the framework of the DPDHL Data Privacy Policy, the following rights (third partybeneficiary rights) shall apply to you as a European DPDHL customer or employee in the event that you
believe your personal data has been transmitted in violation of the principles of the DPDHL Data
Privacy Policy to a DPDHL company outside the EU, and/or has been processed by the DPDHL
company outside the EU in violation of the DPDHL Data Privacy Policy:-You retain the right to submit a complaint to the DPDHL Group company within the EU
which transmitted the data in question to a Group company outside the EU. Allcomplaints shall be thoroughly investigated by the company’s data protection officer with aview to resolving the complaint (Extrajudicial settlement).

-You may also submit a complaint to the respective data protection authorities in the county ofthe European DPDHL Group company which transmitted the data to a Group company
outside the EU (Involvement of supervisory authorities).

-You also retain the right to take legal action against the DPDHL Group company whichtransmitted the data to a Group company outside the EU. In the event of infringement by aDPDHL company outside the EU, you may take direct legal action against this company in theevent that the EU-based company which transmitted the data does not assert its rights against
the DPDHL Group company which is not situated in the EU within one month. You may
also pursue the Group company outside the EU which received the data in the event that thecase relates to data processing on behalf of the controller, and the EU-based company whichtransmitted the data has factually disappeared or ceased to exist in law, or has become
insolvent (Judicial clarification).

-Compensation for damage incurred shall be granted insofar as either the DPDHL Groupcompany which transmitted the data to a Group company outside the EU or the Group company
in question outside the EU is responsible for the occurrence of financial loss through theinfringement of third party beneficiary provisions within the DPDHL Data Privacy Policy(Compensation).

Should you require any further information regarding the DPDHL Data Privacy Policy, pleasecontact the Corporate Data Protection team at Privacy.Policy@DPDHL.com.

1st June 20203