General privacy notice
Privacy notice: Studies, research and market statistics
Pursuant to Article 13 of the Regulation (EU) 2016/679 containing provisions for the protection of natural persons with regard to the processing of personal data and for the free movement of such data (hereinafter the “GDPR”), we hereby provide you with information regarding the processing of your personal data provided by you and/or collected via the websites www.mbe.de and www.mbe-franchising.de (together the “Websites”).
Personal Data collected via the Websites will be processed by MBE Deutschland GmbH (registered office: Bundesallee 39-40A, 10717 Berlin), exclusive licensee for Germany of the brand „Mail Boxes Etc.“ (“MBE”) , in its quality of data controller (hereinafter the “Controller” or “MBE”).
The following Personal Data provided by you (hereinafter the “Personal Data”) may be processed via the Websites:
Moreover, the following Personal Data provided by you may be processed if you decide to interact with the Websites:
|
Name, surname, email address, telephone number and company, if you send messages to a specific MBE center through our forms. Only the email address if you wish to receive the MBE newsletter. |
Name and email if you use the chat box. |
|
If you create an account and use our services, name, surname, email, address, company, telephone number, VAT number, your login account details and all the information related to the service you intend to purchase (e.g. size of the package, price, information on the relevant addressee). |
Name, surname, email, telephone number, city, CV, if you ask to be contacted in order to obtain information on how to commence your business with MBE. |
|
Your physical position, if you ask the website for the MBE centers closer to your position. |
Name, surname, email, telephone number, address and CV if you ask to register to our seminars, workshops, webinars and events. |
3. Purposes of processing Personal Data
The Controller will process your Personal Data for the following purposes:
a) to allow you to benefit from the features offered by the Websites, and more in detail:
|
- to allow you to communicate with the specific MBE center selected by you and obtain the information you request through the contact forms on the Website (in this case your Personal Data will be transmitted to the specific MBE center selected). |
- to chat with / send a message to MBE through the forms on the website. |
b) to provide you with the services you request, and more in detail:
|
|
c) to send you, by any means of communication (fax, e-mail, text message, multimedia messaging service, paper-based mail, operator-assisted phone calls), advertising material and literature of a promotional nature or in any case involving commercial solicitation pertaining to services, products or discounts offered by the Controller, as well as for conducting studies and surveys of the market, and elaborating related statistics;
d) communicate the Personal Data to Controller’s group companies, including MBE Worldwide S.p.A, Sistema Italia 93 S.r.l., Jonathan & Assist S.r.l, Eurocubia S.r.l, DireFareStampare S.r.l, Forama S.r.l. and CZ Mail S.r.l. (hereinafter the “MBE Group”) and to the MBE centers to send you, by any means of communication (fax, e-mail, text message, multimedia messaging service, paper-based mail, operator-assisted phone calls), advertising material of promotional nature or in any case involving commercial solicitation pertaining to services, products or discounts offered by the MBE Group and the relevant MBE center, as well as for conducting studies and surveys of the market, and elaborating related statistics.
The Personal Data collected may also be processed in the context of any corporate events (sale of the company or business units), due diligence or in the case of defence of a legal claim and the related preliminary activities.
4. Legal basis for processing Personal Data
The processing of your Personal Data for the purposes referred to in Section 3, a. is carried out in order to comply with your request and on the basis of a legitimate interest of the Controller, which business is inevitably linked to the quality of the services offered by its Websites, to the users’ interaction experience and to the satisfaction of their expectations. Any refusal to provide the Personal Data for the purposes set out above will make it impossible to send your contact request to the Controller and/or the selected MBE center.
The processing of Personal Data for the purposes referred to in Section 3, b., is necessary in order to perform the pre-contractual and contractual measures adopted upon your request when you ask for the services offered by the Websites. Any refusal to provide the Personal Data for the purposes set out above will make it impossible to use and enjoy the services above.
The processing of your Personal Data for the purposes referred to in Section 3, c. and d., is optional and is based on your freely given consent. Any refusal to provide the Personal Data for the purposes set out above will have the sole consequence of making it impossible for the Controller, the MBE Group and/or the selected MBE center to send you advertising and promotional messages, to conduct studies and surveys of the market, and elaborating related statistics.
In case of processing in the event of any potential corporate events (sale of the company or business units), due diligence or in the case of defence of a legal claim and the related preliminary activities, such processing will be carried out on the basis of legitimate interests of the Controller in the continuation of its commercial activities and for the protection of its rights.
5. Modalities of processing of Personal Data
The processing will be carried out with the assistance of both automated instruments and on paper suitable for guaranteeing the security and confidentiality of Personal Data, this to collect, consult, store, manage, extract and transmit the Personal Data.
6. Recipients of Personal Data
The Personal Data will be disclosed to the persons authorized for the processing within the Controller's staff.
The Personal Data may be disclosed by the Controller solely and exclusively for the purposes indicated and where necessary, to the following categories of subjects:
Personal Data will not be publicly disclosed.
Entities belonging to the categories listed above, may act, as the case may be, as data processors (and in this case they will receive appropriate instructions from the Controller) or as autonomous data controllers. In the latter case, the Personal Data will be communicated only with the express consent of the data subjects, except where the communication is mandatory or necessary pursuant to the applicable law or for the pursue of purposes for which the consent from the data subject is not required.
The Controller also have the right to transfer your Personal Data to third countries. Transfers of Data outside the European Economic Area are subject to a special regime pursuant to the GDPR, and are only made in respect of countries that ensure an adequate level of personal data protection, on the basis of an adequacy decision of the Commission or where adequate safeguards have been adopted (including the standard contractual conditions provided by the European Commission), provided that the data subjects have enforceable rights and effective judicial remedies.
7. Cookies
8. Retention of Personal Data
Personal Data will be stored, in compliance with the applicable law, for a term not exceeding what is necessary to pursue the purposes for which they are processed, save for the right to withdraw the consent at any time where it constitutes the legal basis for the processing.
The criteria for determining the storage period of the Personal Data takes into account the allowed processing period and the applicable laws on the statute of limitation of rights and legitimate interests of the data subject where they are the applicable legal basis for processing.
Subsequently, the Personal Data will be deleted, aggregated or anonymized.
9. Rights of the data subject
At any time, you will be entitled to:
You also have the right to withdraw your consent to the processing of your Personal Data (where given) at any time, without prejudice to the lawfulness of the processing based on your consent before its withdrawal. You will have the possibility to opt-out from marketing via email by clicking on the relevant “unsubscribe” link.
According with the GDPR, the Controller may not charge for complying with any of the requests mentioned in this paragraph, unless they are clearly unfounded or excessive and repetitive. Should you request more than one copy of your Personal Data or in cases of excessive or unfounded requests, the Controller may: (i) charge a reasonable expense, considering the administrative costs incurred to fulfil the request; or (ii) refuse to fulfil the request. In these cases the Controller will inform you of the costs before fulfilling the request.
The Controller may ask for further information before fulfilling the requests if it needs to verify the identity of the person who has made them.
Without prejudice to any administrative or legal remedy, you also have the right to lodge a complaint to the relevant supervisory Authority (for Germany: the „BfdDI“, nationale Aufsichtsbehörde für Datenschutz), if you believe that processing of your data is in breach of the GDPR. More information is available on the website https://www.bfdi.bund.de/DE/Home/home_node.html
In any case, the Controller is interested in knowing the reasons for the complaint and requests that you use the above contact methods before turning to the authorities, in order to prevent and resolve any disputes, amicably and promptly, with the greatest courtesy, professionalism and discretion.
For more information about the provisions contained in Articles from 15 to 22 of the GDPR, click on the following link: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=en
10. Contacts for the exercise of the rights of the data subject and for further information
With respect to the exercise of your rights in relation to the purposes as per Section 3 above and/or to obtain any type of information you may need in relation to the Controller pursuant to this privacy notice, you can send a written communication to MBE Deutschland GmbH (Fiscal Code and VAT number DE 813 34 12 50), with registered office in 10717 Berlin, Bundesallee 39–40A or a fax by dialling +49 30 72 62 09 250 or an email to datenschutz@mbe.de
11. Changes to this privacy notice
This privacy notice will be valid as of the date indicated below. It is advisable to regularly monitor this privacy notice by visiting the Websites in order to keep up to date with any future changes.
Privacy notice: Studies, research and market statistics
(STUDIES, RESEARCH AND MARKET STATISTICS BY CALL CENTER VIA MBE FRANCHISING NETWORK SERVICES)
Pursuant to Articles 13 and 14 of Regulation (EU) No. 679/2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter "GDPR"), we hereby inform you about the processing of personal data of individuals working in the organization of a company (hereinafter "Customer") who have used one (or more) service(s) offered by the MBE Franchising Network and who are contacted by telephone for the purpose of conducting studies, research and market statistics on the services offered by the MBE Franchising Network. The MBE Franchising Network consists of third party entrepreneurs operating under the MAIL BOXES ETC. brand under a franchise agreement (hereinafter, "MBE Franchisees") who primarily provide mailing, communications, graphics and printing services (hereinafter, "MBE Centers").
1. Data Controller
The personal data is processed by MBE Deutschland GmbH with its registered office at Bundesallee 39-40a, 10717 Berlin, Germany, as the Controller (hereinafter the "Controller" or "MBE").
2. Categories of personal data processed
The following personal data may be processed:
3. Purposes, legal basis of processing and consequences of not providing personal data
The personal data of the customer may be processed for the activities indicated below.
3.1. Contacting the customer by phone and conducting the conversation
The Customer's personal data will be processed for the purpose of contacting the Customer at the above telephone number and conducting an interview to enable MBE to conduct the relevant study, research or market statistics on the services offered by MBE's franchising network.
Depending on the case, the customer's personal data may also be processed to arrange a follow-up appointment with the interviewer, to reschedule the interview or to schedule further interviews.
The processing of data for this purpose is carried out on the basis of the consent already given by the Customer for the processing of personal data for general marketing purposes, i.e. to send the Customer, through any means of communication (fax, e-mail, SMS, MMS, paper mail, telephone calls or other channels), advertising and information material of a promotional nature or, in any case, with commercial solicitation regarding MBE's services, products or discounts, as well as for the preparation of studies, surveys and market statistics (hereinafter "commercial communications").
The Customer may withdraw the consent to the processing of his/her personal data for these purposes at any time, either during the telephone call or by sending a written notice to this effect to the contact details indicated below in paragraph 9 "Contacts for exercising the rights of the data subject and for further information". In the event of a request not to receive further telephone calls on behalf of MBE, the Customer's telephone number will be added to the blacklist of the data controller, i.e. the list of customers who cannot be contacted by MBE for commercial purposes. Blacklisting corresponds to the best possible protection of the Customer's interests, and the related processing is carried out on the basis of the Controller's legitimate interest in ensuring compliance with the Customer's intention so that the Customer does not receive telephone calls for commercial purposes in the future. In such cases, the only consequence for the customer is to no longer be able to receive commercial communications by telephone.
3.2. Other processing options
In the case of processing of possible corporate events (sale of the company or business units), due diligence or in the case of defense of a legal claim and related preparatory activities, the further processing is based on the legitimate interests of the controller to continue its commercial activity and to protect its rights.
4. Modalities of the processing of personal data
The processing is carried out with the help of both automated instruments and in paper form. Both procedures are suitable to ensure the security and confidentiality of personal data, and are used to collect, query, store, manage, extract and transmit personal data.
5. Recipients of personal data
Personal data - which is not publicly disclosed - may be transferred to:
(i) employees, agents or collaborators of the data controller located within the territory of the European Union;
(ii) Group companies of the data controller (including MBE Worldwide S.p.A.);
(iii) Companies providing call center or market research services;
(iv) MBE centers;
(v) service providers for marketing activities located on the territory of the European Union;
(vi) Persons, companies or professional offices located in the territory of the European Union that perform activities of assistance and advice in accounting, administrative, legal, tax and financial matters;
(vii) subjects, bodies or authorities to whom the communication of the personal data is mandatory due to legal provisions or official orders.
Recipients belonging to the above categories may, depending on the case, act as data processors (and in this case they will receive appropriate instructions from the Controller) or as independent controllers. In the latter case, the personal data will be disclosed only with the express consent of the data subjects, unless the disclosure is mandatory under applicable law or is necessary for the pursuit of purposes for which the consent of the data subject does not need to be obtained.
6. Transfer of personal data outside the EU
The personal data of the Customer will not be transferred outside the European Economic Area. In any case, the Controller reserves the right to transfer the personal data to third countries. Data transfers outside the European Economic Area are subject to separate regulations of the GDPR and only take place in countries that ensure adequate protection of personal data. This is done on the basis of an adequacy decision of the European Commission or if appropriate safeguards have been agreed (including standard contractual clauses provided by the European Commission). The prerequisite is that the data subjects have enforceable rights and can exercise effective legal remedies.
7. Storage of personal data
Personal data shall be stored in accordance with applicable law for a period not exceeding what is necessary to pursue the purposes for which they are processed, except that the processing shall be based on consent and the Customer shall have the right to withdraw it at any time for the future.
The criteria for determining the storage period of the personal data shall take into account the permitted processing period and the applicable laws on the limitation of rights and legitimate interests of the data subject, where these constitute the applicable legal basis for the processing.
Thereafter, the personal data will be deleted, aggregated or anonymized.
8. Exercise of rights by the person involved
The Customer (only in the case of a natural person, but not a legal person) is entitled at any time to:
(i) to obtain confirmation from the Controller as to whether Personal Data are being processed and, if so, to obtain access to the Personal Data in accordance with Article 15 of the GDPR;
(ii) to obtain the rectification of inaccurate personal data or, taking into account the purpose of the processing, the completion of incomplete personal data;
(iii) to obtain the erasure of the personal data if one of the grounds under Article 17 of the GDPR applies;
(iv) to obtain the restriction of the processing of personal data if one of the cases of Art. 18 of the GDPR applies;
(v) object to the processing of Personal Data on grounds relating to the specific situation of the Customer, if applicable;
(vi) to receive data in a structured, commonly used and machine-readable format and to transfer the personal data provided by you to another controller, in the cases and within the limits referred to in Art. 20 of the GDPR, where applicable.
In accordance with the GDPR, the Controller may not charge for responding to the requests referred to in this paragraph, unless they are clearly unfounded or excessive and repetitive. Should Customer request more than one copy of its Personal Data, or in cases of excessive or unfounded requests, the Controller may: (i) charge a reasonable fee taking into account the administrative burden of fulfilling the request; or (ii) refuse to fulfill the request. In such cases, the Controller will notify the Customer of the charges prior to executing the request.
The Controller may request additional information prior to executing the requests if it needs to verify the identity of the person making the requests.
Without binding any administrative or legal remedies, the Customer also has the right to file a complaint with the competent supervisory authority.
In any case, the Controller is interested in knowing the reasons for the complaint and asks the Customer to use the contact details mentioned in paragraph 9 "Contacts for the exercise of the rights of the data subject and for further information" before contacting the authorities, in order to prevent and resolve any disputes amicably and quickly, with the utmost attention, professionalism and discretion.
9. Contacts for the exercise of the rights of the data subject and for further information
To exercise your rights and/or obtain any type of information you may need in connection with this Privacy Policy, send written notice to MBE Deutschland GmbH, located at Bundesallee 39-40a, 10717 Berlin, Germany, or send an email to datenschutz@mbe.de