Privacy Policy XPO Logistics Website Privacy Policy 1. GLOSSARY The following terms are used within this Policy and are defined here for clarification: “controller” means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by national or EU laws or regulations, the controller or the specific criteria for his nomination may be designated by national or EU law; “data subject” is an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity; “personal data” means any information relating to a data subject; “processing” means any operation or set of operations performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; “processor” shall mean a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the data controller. “XPO Group” shall mean in relation to XPO, that company, any subsidiary or holding company from time to time of that company, and any subsidiary from time to time of a holding company of that company 2. OBJECTIVE AND SCOPE XPO Logistics Europe S.A. SIRET 309 645 539 000 45, with its head office address: 192 Avenue Thiers - 69006 Lyon, France (“XPO,” “we,” “our” or “us”), operates this website in its capacity as a controller. This Privacy Policy describes how we treat personal data when we provide our transport, logistics, warehousing, stock management, global forwarding and other services to our business customers (B2B), as well as to end customers of our business customers on the latter’s behalf (B2B2C) (the “Services”) and on our website europe.xpo.com, which is designed for use in the European Union. If you choose to access our other websites which are designed for use in other regions of the world (e.g. our United States websites), the Privacy Policy found on those websites will apply to your use. This Privacy Policy only applies to the processing of personal data of natural persons whose personal data we process in the course of providing our Services and website visitors from the EU or where applicable EU or EU Member State data protection laws so provide. In particular circumstances indicated below, XPO is not solely but jointly responsible with other XPO Logistics companies, in particular XPO Logistics, Inc., with its seat at 5 American Lane, Greenwich, CT 06831, United States of America and its subsidiaries (“XPO Group”), for the lawfulness of the processing of your personal data. For the purpose of the job application process, please see our separate Applicant Privacy Notice as part of the application process. 3. PERSONAL DATA WE COLLECT AND SOURCES The categories of personal data that XPO processes about you for the purposes described in Section 4 below are: 3.1. Personal Data Collected Directly from You XPO generally collects personal data directly from you (electronically, in writing, or verbal) in the course of our business relationship or by way of website-based inquiry forms. You also provide new or updated or corrected personal data to XPO from time-to-time. This information includes: Business information, such as company name and your position in the company; Your inquiries, our responses and other related information, such as subject matter of the query, service type you are interested in, requirements for the service you wish to consult with us (including pick-up and delivery addresses and cargo specifications); Browsing information, such as the type of browser and the Internet-connected device being used to access the website, your Internet protocol (“IP”) address, your home domain or Internet service provider, your referrer URL (which is the URL for the website that you were viewing prior to visiting our website), how you were directed to the website, which specific pages you access on the website, how long you view each page, the time and date you access our website and the general physical location of your computer or device. 3.2. Personal Data Collected from the XPO Group XPO collects personal data from other XPO Group companies. For example, XPO collects information regarding our services, business relationship and your inquiries made vis-à-vis other XPO Group companies but which are appropriate to be handled by XPO. In this circumstance, the two XPO Group companies involved act as joint controllers. Additionally, as discussed in Sections 5 and 6 below, XPO and other XPO Group entities share personal data among themselves, for the purposes defined in the Section 4 below. 3.3. Personal Data Collected from Third Parties Finally, XPO may receive the categories of personal data listed in Section 3.1 above from third parties who provide services to XPO, in particular search engine optimization services, hosting services, social media services and web mastering services, as well as from our business partners and customers. 4. PURPOSES AND LEGAL BASES OF PROCESSING YOUR PERSONAL DATA We process personal data for the below purposes. For each purpose, the legal basis of the processing is specified, in accordance with Articles 6 and 9 of the GDPR, as the case may be. Where applicable, we will point out, at the time of the data collection, if the provision of the personal data is a statutory or contractual requirement and whether you are obliged to provide the personal data and the possible consequences of failure to provide such data. XPO processes personal data for the following purposes. 4.1. Provision of Services This includes processing personal data to: provide services to our business customers (B2B), as well as to end customers of our business customers on their behalf (B2B2C). This includes deliveries and returns of our business customers’ merchandise, and other related operations. Legal Bases: This processing is justified based on: • The necessity to perform a contract to which you are a party; • Our legitimate interests as specified above. 4.2. Your Inquiries and Communication with Us This includes processing personal data to: process and respond to consumer inquiries received through Build Your Project and Contact forms and other means. Legal Bases: This processing is justified based on: • The necessity to perform a contract to which you are a party; • Our legitimate interests as specified above. 4.3. Website Administration, Optimization and Analytics This includes processing personal data to: carry out system and website optimization, analytics, market research, and maintenance of user login information. Legal Bases: This processing is justified based on: • Our legitimate interests as specified above; • Your consent. 5. WITH WHOM DO WE SHARE YOUR PERSONAL DATA XPO takes precautions when sharing personal data with other XPO Group companies (i.e., Intra-Group) or with Third Parties. 5.1. Intra-Group We may share your personal data with other XPO Group companies and for all the purposes specified in Section 4 above. A list of XPO Group companies is available by writing to XPO Logistics Europe S.A. SIRET 309 645 539 000 45, with its head office address: 192 Avenue Thiers - 69006 Lyon, France or by email to gdpr@xpo.com. 5.2. Third Parties We may share your personal data with our service providers who perform services on our behalf for the purposes described in Section 4 of this Privacy Policy. In particular, we share personal data with providers of hosting services and IT support. The service providers are bound by law and/or contract to protect the confidentiality and security of personal data, and to only use personal data to provide requested services to XPO in accordance with applicable law. We may share your personal data with other companies, vendors and business partners that perform certain functions for us, whereby these companies are themselves responsible to determine the purposes and/or means of the processing and for the lawfulness of the processing, We will disclose personal data to buyers, lawyers or professional advisors, courts, tribunals, opposing or other related parties to the proceedings and to their professional advisors, where needed, to affect the sale or transfer of business assets, to defend or enforce our rights, protect our property, assets or safety of others. We will also disclose personal data when required to do so by law, such as in response to a subpoena, including to law enforcement agencies, tribunals and courts in countries where XPO operates. 6. INTERNATIONAL TRANSFER OF PERSONAL DATA Given that XPO Group companies are located and provide services all over the world, we may need to transfer your personal data internationally. In particular, personal data collected by us may be transferred to and processed in countries outside the European Economic Area ("EEA"). Those countries may not have the same level of protection for personal data as in the EEA. Please write to gdpr@xpo.com if you want to receive further information or, where available, a copy of the relevant data transfer mechanism. 6.1. Intra-Group International transfers are to the parent company in the United States of America. The transfer of your personal data outside the EEA takes place on the basis of our intra-group Data Sharing Agreement, which is based on the European Commission’s standard contractual clauses for data transfers, and in accordance with applicable data protection laws. 6.2. Third Parties Some of the third parties with whom we share personal data are also located outside the EEA. Certain third countries have been officially recognized by the European Commission as providing an adequate level of protection. Transfers to third parties located in other third countries outside the EEA take place using an acceptable data transfer mechanism, such as the EU-US Privacy Shield framework for transfers to self-certified US organizations, the EU standard contractual clauses for data transfers, Binding Corporate Rules, approved Codes of Conduct and certifications, or in exceptional circumstances on the basis of permissible statutory exceptions. 7. HOW LONG WE KEEP YOUR PERSONAL DATA We keep your personal data that we obtain about you through this website for no longer than is reasonably necessary for the purpose(s) for which they were collected. In certain cases, personal data may be kept for an extended period of time in order to comply with legal obligations, or for the establishment, exercise or defence of a legal claim, in accordance with applicable laws. If you have further questions regarding our retention of your personal data, you can contact us (see Section 9 below). 8. YOUR RIGHTS WITH RESPECT TO YOUR PERSONAL DATA EU data protection law affords particular rights as set out below. In instances where XPO entities act as joint controllers, you can exercise these rights in respect of and against each of them (for a list of XPO group companies, see Section 5.1 above). XPO entities which act as joint controllers have entered into an arrangement, reflecting their respective roles and relationships. Please see Section 9 on how to exercise these rights or if you want to know more about this contractual arrangement. 8.1. Access You have the right to obtain from us confirmation if your personal data are being processed, relevant information about such processing as provided by applicable EU data protection laws, and a copy of the personal data undergoing processing. 8.2. Rectification You have the right to obtain from us the rectification of inaccurate personal data concerning you and to have incomplete personal data completed. 8.3. Objection You have the right to object to the processing of your personal data on grounds relating to your particular situation. You can also object at any time to the processing of your personal data for marketing purposes. (Please note that even if you object to your use of personal data for direct marketing purposes, we will still send you transactional messages in relation to services that you have purchased from us. These include responses to your questions and information about a service you have purchased from us.) 8.4. Portability You have the right to receive the personal data concerning you which you have provided to the controller in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller. 8.5. Restriction You may request to restrict processing of your personal data. 8.6. Erasure You may request to erase (delete) your personal data. 8.7. Right to Lodge a Complaint You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your residence, place of employment, or the location where the issue that is the subject of the complaint occurred. 8.8. Right to Refuse or Withdraw Consent You are free to refuse to give consent and you can withdraw (with effect for the future) your previously provided consent to the processing at any time without any adverse negative consequences. The lawfulness of any processing of your personal data that occurred prior to the withdrawal of your consent will not be affected. 9. CONTACT If you wish to exercise any of the afore-mentioned rights (see Section 8) or if you have any questions regarding this Privacy Policy, the roles and responsibility of any of the XPO Group companies where they act as joint controllers including their contractual arrangement, or complaints, please direct your request to: Address: XPO Logistics Europe S.A. 192 Avenue Thiers 69006 Lyon France Email address: gdpr@xpo.com Telephone: 0033 (0)4 72 83 66 00 10. COOKIES AND OTHER TRACKING TECHNOLOGIES By placing a small file known as a "cookie" on your computer (or other device), XPO’s and its service providers’ servers may passively gather information about your use of our website for several purposes, including, but not limited to, the following: statistics collection and analysis, website optimization, analytics (as described below), market research, and maintenance of user login information. The information that we and our service providers track with cookies may include, but is not necessarily limited to, the type of browser (such as Google Chrome or Internet Explorer) and the Internet-connected device being used to access the website, your Internet protocol (“IP”) address, your home domain or Internet service provider, your referrer URL (which is the URL for the website that you were viewing prior to visiting the System), how you were directed to the website, which specific pages you access on the website, how long you view each page, the time and date you access our website and the total number of visitors to the website and any portions thereof. We may also use your IP address to determine the general physical location of your computer or device and understand from what geographic locations our website visitors come. Most popular Internet browser applications will allow you to configure the browser so as not to accept cookies. However, setting your browser to reject cookies may, in certain instances, prevent you from taking full advantage of the website (or some portion thereof) and its capabilities, or cause some features of the website to function improperly or more slowly. The website (and certain other portions of the System) use Google Analytics (including the Universal Analytics feature), a web analysis service provided by Google, in order to better understand your use of the website (or other portions of the System) and how we can improve the website and the System. Google Analytics collects information such as how often users visit the website, what pages they visit when they do so, and what other websites they used prior to coming to such site. Google Analytics collects only the IP address assigned to you on the date you visit the Site, rather than your name or other identifying information. We do not combine the information collected through the use of Google Analytics with your personal data. Although Google Analytics plants a permanent cookie on your web browser to identify you as a unique user the next time you visit a website, the cookie cannot be used by anyone but Google. Google’s ability to use and share information collected by Google Analytics about your visits to the Site or the System is restricted by the Google Analytics Terms of Use and the Google Privacy Policy. Google utilizes the data collected to track and examine the use of the website, to prepare reports on its activities and share them with other Google services. Google may use the data collected on the website to contextualize and personalize the ads of its own advertising network. To more fully understand how Google may use the data it collects on the website, please review “How Google uses data when you use our partners' sites or apps” (located here or any successor URL). If you would like additional information regarding the security and privacy practices of Google’s Universal Analytics feature, please review the materials provided by Google here. Category Cookie Name Purpose Expiry Necessary Google Analytics (3rd party) _ga _gali _gat _gid These cookies are installed by Google Analytics. They are used to calculate visitor, session, campaign data and keep track of site usage for the site's analytics report. The cookies store information anonymously and assign a randomly generated number to identify unique visitors. 2 years Google Tag Manager (3rd party) _ga# Used by Google Analytics to collect data on the number of times a user has visited the website as well as dates for the first and most recent visit. 2 years Django csrftoken (3rd party) csrftoken This cookie is associated with the Django web development platform for Python. It is designed to help protect a site against a particular type of software attack on web forms. 1 year Media and analytics Heap analytics - Clearbit (3rd party) _hp2_id* _hp2_ses_props* These cookies collect information to measure and understand how visitors use our site. This includes user activity tracking on this site, including pages visited and links clicked. These cookies are persistent cookies that persist in the browser (unless deleted) ranging from 24 hours up to two years. 24 hours to 2 years Linkedin Analytics (3rd party) lidc This cookie is used for routing from share buttons and advertising tags 24 hours bcookie This cookie is used by LinkedIn to identify the browser ID. It is set from LinkedIn share buttons and advertising tags. 2 years UserMatchHistory This cookie is used by LinkedIn Ads to help XPO measure advertising performance. 30 days lang This cookie is used to set default locale/language. Session lissc Used to ensure there is correct SameSite attribute for all cookies in that browser 1 year YouTube (3rd party) YSC This cookie is set by Youtube and is used to track views of embedded videos. Session VISITOR_INFO1_LIVE This cookie is set by Youtube and is used to estimate the available bandwidth 6 months Cookie consent (1st party) cookie_consent Stores the visitor's consent action 13 months Analytics consent (1st party) analytics_consent Stores the visitor's consent to media and analytics cookies 13 months DoubleClick (3rd party) IDE Used by Google DoubleClick and stores information about how a user interacts with the website and any other advertisement before visiting the website. This is used to present users with ads that are relevant to them according to their profile. 1 year Effective Date: 1 January 2019. Last Update: 2 April 2021. Work With Us Contact Us Global Locations Privacy Policy News Modern Slavery Statement © 2021 XPO Logistics, Inc. All rights reserved. Our website uses cookies. By continuing to use the site you are agreeing to our use of cookies. You can find out more by viewing our Privacy Policy Necessary cookies Analytics cookies Accept and save