Applicable for clients of the entities named under point 1 hereunder.

March 2023

The following information provides our clients with an overview of how we process your personal data and your rights under data protection law. The personal data are used to provide you and/or your company with freight forwarding and transport related services.

1.   Who is responsible for data processing and who can I contact in this regard?

2.   What sources and data do we use and for what purpose?

We process personal data which we receive from you or from your employer in the context of our business relationships. In particular, your personal data are used for the following purposes and/or in following processes:

a) in general, we keep your business contacts in the framework of our contractual relationship with your company;

b) if you or your employer have provided you as a user of our KV4.0 Data Hub, your identification data has been linked to your username. The utilization of the online services are traced using your log for purposes of fulfill our and your/your employer’s contractual obligations.

c) if you or your employer have indicated you as a contact person, we may send you information about our products, newsletters and invitations to events.

To the extent necessary in order to provide our services, we also process personal data which we lawfully (e. g., for executing orders, performing contracts or on the basis of your consent) receive from other entities or other third parties (for instance, other intermodal operators).

We also process personal data from publicly available sources (e. g., debtor directories, land registers, commercial registers and registers of associations, press, media, Internet) which we lawfully obtain and are permitted to process.

Relevant personal data collected and processed in the context of our business relationship may be:

- identification data for business purposes (name, business telephone number, business address, e-mail address);

3.   What is the legal basis?

We process the aforementioned personal data in compliance with the provisions of the EU General Data Protection Regulation (GDPR) as well as the data protection laws and regulations, which are applicable locally (in Switzerland and in the EEA/EU area):

a.   for the fulfilment of contractual obligations (Article 6 (1) b GDPR)

If you (as an individual) are the contracting party, the processing of personal data is carried out in order to take steps necessary for entering into a contract or for performing a contract in the field of freight forwarding and transportation related services. For further details on the purpose of the data processing, please refer to the respective contractual documentation and terms and conditions..

b.   for the purposes of safeguarding legitimate interests (article 6 (1) f) GDPR)

Where necessary, we process your data above and beyond the actual performance of our contractual obligations in order to safeguard the legitimate interests pursued by us or by a third party. For example, for the transmission of information about our products, newsletters and invitations to events (direct marketing)

c.   on the basis of your consent (article 6 (1) a) GDPR)

Insofar as you have granted us consent to the processing of personal data for specific purposes, the lawfulness of such processing is based on your consent. Any consent granted may be revoked at any time. Please be advised that the revocation shall only have effect for the future.

Any processing that was carried out prior to the revocation shall not be affected thereby. You can request a status overview of the consents you have granted from us at any time or view some of them.

d.   to comply with a legal obligation (Art. 6 (1) c GDPR) or in the public interest (Art. 6 (1) e) GDPR)

As a service provider, we are also subject to various legal obligations, i.e. legal requirements, e.g.  Security obligations  and protection obligations.

4.   Who receives my data?

Within and outside Hupac, those recipient are given access to your data which require them in order to perform our contractual and statutory obligations. Moreover, those recipients may be given access to your data which require them for the purpose of our legitimate interest according to the “need-to-know-principle”.

Within DX Intermodal GmbH it can be the following recipients:

- Accounting

- Sales

- Marketing

- Legal Services

Outside DX Intermodal GmbH, the following recipients may be:

- Tax authorities

- Maintenance provider

- Other suppliers (software, hardware, etc.)

5.   Is data transferred to a third country or an international organisation?

No data will be transferred to third countries outside the EU or the EEA.

6.   How long will my data be stored?

We process and store your personal data as long as it is necessary for the performance of our contractual and statutory obligations.

If the data are no longer required for the performance of our contractual and statutory obligations, they are regularly deleted, unless their further processing (for a limited time) is necessary for the following purposes:

• Compliance with records retention periods under commercial and tax law
• Legal proceedings

7.   What data protection rights do I have?

Every data subject has a right of access (article 15 GDPR) to the processed data, a right to rectification (article 16 GDPR) a right to erasure (article 17 GDPR), a right to restriction of processing (article 18 GDPR), a right to object (article 21 GDPR) and a right to data portability (article 20 GDPR).

Data subjects also have a right to lodge a complaint with a supervisory authority (article 77 GDPR).

If data processing is based on your consent, you have the possibility to revoke this at any time. However, revocation of the consent has no retroactive effect. Any personal data that was processed before the revocation is not concerned.

8.   Am I under any obligation to provide data?

Within the scope of our business relationship, you must provide personal data which is necessary for the initiation and execution of a business relationship and the performance of the associated contractual obligations or which we are legally obliged to collect. As a rule, we would not be able to enter into any contract or execute the order without these data or we may no longer be able to carry out an existing contract and would have to terminate it.

9.   To what extent is automated decision-making (including profiling) carried out?

As a rule, we do not make decisions based solely on automated processing (as defined for instance in article 22 GDPR) to establish and implement the business relationship. Provided that this is prescribed by law, we will inform you separately about automated decision making.