Privacy Informative Notice and Request for Consent for the Processing of Personal Data

(MBE Franchising Network Services)

Pursuant to Chapter III of the Republic Act 10173 of 30 June 2003 “An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes” (hereinafter also referred to as the “Data Privacy Act of 2012”) and its Implementing Rules and Regulations (IRR), we hereby provide the informative notice regarding the processing of personal data of subjects who may act either as individual customer or as person representing a business organization (hereinafter, in both cases, “Customer”). In the latter case, we will process the personal data of those individuals who act on behalf of the entity or, in any case, within its organization.

  1. Personal Information Controller
    Your personal data will be processed, depending on the purposes as specified in Section 3 below, “Purposes of the processing of the personal data,” by the following subjects in their capacity as personal information controllers:

     

    • The MBE Franchisee – that is the entrepreneur that has entered into a franchising agreement with MBE (hereinafter, “MBE Franchisee“) and to which the Customer has requested the provision of one or more of the following services of the MBE franchising network such as; (a) shipment services; (b) domiciliation services; (c) graphic and printing services (hereinafter, “MBE Services“).
    • Sistema Italia 93 S.r.l. – (Fiscal Code and VAT number 10697630159), with registered office in Milan, Viale Lunigiana, 35-37, Tel. 02 676251, Fax 0267625625, exclusive licensee for Italy of the brand “Mail Boxes Etc” (hereinafter, “MBE“).
  1. Categories of personal information processed
    1. Personal information voluntarily provided
      Please note that personal data you provide directly are subject to processing. Personal information means “any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual”, this including photos (Sec. 3.(g) of the Data Privacy Act of 2012 and Sec. 3 (j) of its IRR).Customer’s personal information, such as identification data, payment data and data relating to the requested MBE Service.
    2. Personal data of third parties provided by you voluntarily
      Customer acknowledges that any possible mention (for example, within the “Shipping Order Form”, in case of shipment services and/or within other forms, depending on the requested MBE Service) of personal information and contact data of any other data subject will represent a personal data processing in respect of which the Customer shall act as Personal Information Controller of personal and contact information and guarantee the compliance with the relevant applicable data protection provisions of the Data Privacy Act of 2012 and its Implementing Rules and Regulation. To this respect, the Customer guarantees also that the said data subjects whose personal data are collected and communicated were informed about the modalities and the purposes of the processing of their data. The personal data of said subjects will be communicated for the sole purpose of making the provision of the requested MBE Service possible.
  1. Purposes, legal basis of the processing and consequences of the failure to provide personal data
    Personal data will be processed, with the prior explicit consent, where necessary, by the MBE Franchisee and/or MBE depending on the purposes pursued by each of them, as independent personal information controller, as better described below.

     

    1. Purposes of the processing of the personal data by the MBE Franchisee
      Processing Legal basis for the processing Consequences of the failure to provide personal data
      i Processing for purposes related to the performance and management of the requested MBE Service, as well as management of the related payments, complaints and communications with the Customer; where applicable, also for processing relating to the verification of customers and other legal requirements. The legal basis for the processing of personal data is the contract to which the Customer is a party in order to enable the performance and management of the requested MBE Service. On the other hand, certain obligations (for example, those of fiscal nature or those of verification of customers in the context of domiciliation services) are mandatory at law. The provision of personal data (and/or personal data of any third party, to the extent this is necessary for the performance and management of the requested MBE Service; for example: in the case of shipment services, the contact data of the person to whom the parcel is sent) is optional, however, failure to provide such data will make it impossible to perform and manage the requested MBE Service.
      ii Processing for general marketing purposes, i.e. to send the Customer, by any means of communication (fax, e-mail, sms, mms, paper mail, telephone calls with operator or other channels), advertising and information materials of a promotional nature or, in any case, of commercial solicitation with regard to services, products or discounts of the MBE Franchisee, as well as to prepare studies, research and market analyses. The legal basis for the processing of personal data is the consent of the Customer. The provision of personal data is optional and failure to do so will only make it impossible for the MBE Franchisee to send advertising and promotional messages and carry out market research. This will not affect the performance and management of the requested MBE Service.
    2. Purpose of the processing of the personal data by MBE (Sistema Italia 93 S.r.l.)
      Processing Legal basis for the processing Consequences of the failure to provide personal data
      i Processing for general marketing purposes, i.e. to send the Customer, by any means of communication (fax, e-mail, sms, mms, paper mail, telephone calls with operator or other channels), advertising and information material of a promotional nature or, in any case, of commercial solicitation with regard to services, products or discounts of MBE, as well as to prepare studies, research and market analyses. The legal basis for the processing of personal data is the specific consent of the Customer. The provision of personal data for the aforementioned purposes is optional and failure to do so will only make it impossible for Sistema Italia 93 S.r.l. to i) send advertising and promotional messages and carry out market research; ii) proceed with the aforementioned profiling; and/or iii) communicate the personal data to third parties for their own marketing purposes.
      The performance and management of the requested MBE Service will remain unaffected.
      ii Profiling for direct marketing purposes, concerning individual customers or groups of customers to allow to assess, analyze or predict personal preferences regarding the value and type of the purchased MBE Service or its frequency of use in order to offer further services, products or discounts (such as shipment, graphics and printing services, domiciliation, communication, etc.). The legal basis for the processing of personal data is the specific consent of the Customer.
      iii Communication of personal data of the Customer to third parties for their own marketing purposes. The legal basis for the processing of personal data is the specific consent of the Customer.

      In case of data processing in connection to corporate transactions (sale of the company or transfer of a business going concern), due diligence, in case of defense of a legal right in court and in relation to the related preliminary activities, such processing will be carried out on the basis of legitimate interests of the data controller to the continuation of its business activities and for the protection of its rights.

    3. Further clarifications on consent
      We would like also to point out that where the Customer has given its consent to authorise MBE and/or the MBE Franchisee to pursue the purposes set out in paragraph 3.1. (ii) and pragraph 3.2. (i), (ii) and (iii) above, you will be free at any time to withdraw your consent to the processing of your data for the aforementioned purposes, with reference to all or some of the communication channels used by the data controller. The withdrawal may be exercised by sending, without any formality, a written communication to the addresses better specified in paragraph 9 below “Contacts for the exercise of the rights of the data subject and for further information”.
  1. Modalities of processing personal data
    The processing of your personal data will be done by means of manual and IT devices, as well as paper. The personal data provided by you will not be subject to automated decision-making processes, with the exception of profiling as per Section 3.2 (ii) above.
  2. Recipients of personal data
    Personal data, which will not be publicly disclosed by either the MBE Franchisee or MBE, may be communicated:
    by the MBE Franchisee to:

     

    • employees, agents or collaborators of the MBE Franchisee that are located within the territory of the European Union;
    • employees, agents or collaborators of Sistema Italia 93 S.r.l. that are located within the territory of the European Union;
    • subjects that engage in activities of assistance and consultation on behalf of the MBE Franchisee in accountancy, administrative, legal, tax and financial matters that are located within the territory of the European Union;
    • subjects, bodies or authorities to whom or which the communication of your personal data is mandatory by virtue of provisions of law or orders issued by authorities;

    by MBE (Sistema Italia 93 S.r.l.) to:

    • employees, agents or collaborators of Sistema Italia 93 S.r.l. that are located within the territory of the European Union;
    • subjects located within the territory of the European Union of whom or which Sistema Italia 93 S.r.l. avails itself for profiling and marketing activities;
    • subsidiaries or associated companies, which currently include MBE Worldwide S.p.A., Sistema Italia 93 S.r.l., Jonathan & Assist S.r.l., Eurocubia S.r.l., DireFareStampare S.r.l., Forama S.r.l. and CZ Mail S.r.l.;
    • third parties with which – from time to time – commercial partnership agreements and/or common initiatives, campaigns and projects will be developed, which are located within the territory of the European Union and operate in the following industries:
      • information and other computer services (data processing, hosting and related activities; web portals; other information service activities);
      • (i) land transport and pipeline transport (rail freight transport; road freight transport and moving services); (ii) maritime and waterborne transport (maritime and coastal freight transport; inland waterway transport of goods); (iii) air transport (air freight and space transport); (iv) warehousing and transport support activities (warehousing and storage; transport support activities); (v) postal services and courier activities (postal activities with universal service obligation; other postal and courier activities);
      • electricity, gas, steam and air conditioning supply (electricity generation, transmission and distribution of electricity; gas production and distribution of gaseous fuels by pipelines);
      • telecommunications (land telecommunications; mobile telecommunications; satellite telecommunications; other telecommunications activities);
      • in advertising and market research (advertising; market research and opinion polling);
    • persons, companies or professional offices located within the territory of the European Union that engage in activities of assistance and consultation in accountancy, administrative, legal, tax and financial matters;
    • subjects, bodies or authorities to whom or which the communication of your personal data is mandatory by virtue of provisions of law or orders issued by authorities.

    Subjects belonging to the categories listed above, may act, as the case may be, as data processors (and in this case they will receive appropriate instructions from the relevant data controller) or as autonomous data controllers. In the latter case, personal data will be communicated only with the express consent of the data subject, except where the communication is mandatory or necessary pursuant to the applicable law or for the pursue of purposes for which the consent from the data subject is not required. With respect to MBE and to the subjects indicated at point (iv) above, personal data may be communicated for third parties own marketing purposes only following data subject’s consent.

  1. Transfer of personal data extra EU
    Customer’s personal data (and/or third parties’ personal data, depending on the requested MBE Service), will not be transferred outside the European Economic Area either by the MBE Franchisee or by MBE, unless it is necessary for the performance of that certain services (e.g. international shipments). In any case, each personal information or data controller has the right to transfer your Personal Data to third countries. Transfers of data outside the European Economic Area are subject to a special regime pursuant to the GDPR, and are only made in respect of countries that ensure an adequate level of personal data protection, on the basis of an adequacy decision of the Commission or where adequate safeguards have been adopted (including the standard contractual conditions provided by the European Commission), provided that the data subjects have enforceable rights and effective judicial remedies.
  2. Retention of personal data
    In application of the principle of proportionality, we inform you that:

     

    • the MBE Franchisee will retain the personal data for a period not exceeding what is necessary to pursue the purposes specified in paragraph 3.1. (i) (execution and management of the requested MBE Service) and (ii) (marketing) above, save for the right of the Customer to withdraw its consent at any time where it constitutes the legal basis for the processing;
    • MBE will retain the personal data for a period not exceeding what is necessary to pursue the purposes specified in paragraph 3.2 (i) (marketing), (ii) (profiling) and (iii) (communication to third parties for its own marketing purposes) above, save for the right of the Customer to withdraw its consent at any time where it constitutes the legal basis for the processing.

    The criteria for determining the retention period of the personal data take into account the processing period allowed at law, the applicable laws on the statute of limitation of rights and the legitimate interests of the data subject, where they are the applicable legal basis for processing.
    Following the above retention periods, personal data will be deleted, aggregated or anonymized.

  3. Exercise of rights by the data subject
    Pursuant to Section 16 of the Data Privacy Act of 2012, as well as pursuant to Section 34 (a), (b), (c) (d), (e) and (f) of its IRR, the Client is entitled to:

     

    • the right to be informed of the collection, procedures, period, scope and methods used in personal data processing, as well as the existence of your rights including the right to access, correction, and object to the processing, as well as the right to lodge a complaint before the National Privacy Commission;
    • the right to apply to the Data Process Controller for reasonable access to the personal data, the rectification or deletion of the same or restriction on the processing as concerns you, and to object to such processing, or to revoke consent, in addition to the right to portability of the data;
    • the right to lodge a complaint with the National Privacy Commission, following the procedures and instructions published on the official website of the same national privacy authority at https://privacy.gov.ph/filing-a-complaint/;
    • any rectification or deletion or restriction on processing done at your request, unless it proves to be impossible or entails a disproportionate effort, will be communicated by the Personal Information Controller (s) to each of the recipients to whom or which your personal data have been transmitted. The Personal Information Controller (s) may communicate such recipients to you should you expressly so request.

    The Customer shall also have the right to withdraw the consent to the processing of personal data (where given) at any time, without prejudice to the lawfulness of the processing based on consent before its withdrawal. Customer will have the possibility to opt-out from marketing via email by clicking on the relevant “unsubscribe” link.
    Should Customer request more than one copy of personal data or in cases of excessive or unfounded requests, the data controller may: (i) charge a reasonable expense, considering the administrative costs incurred to fulfil the request; or (ii) refuse to fulfil the request. In these cases, the data controller will inform the Customer of the costs before fulfilling the request.
    The data controller may ask for further information before fulfilling the requests if it needs to verify the identity of the person who has made them.
    In any case, the data controller is interested in knowing the reasons for the complaint and asks the Customer to use the contact methods below before turning to the authorities, in order to prevent and resolve any disputes, amicably and promptly, with the greatest courtesy, professionalism and discretion.
    The exercise of the rights is not subject to any formal restriction and is free of charge. For ease of reference, we reproduce below the text of Section 16 of the National Privacy Act of 2012:
    SEC. 16. Rights of the Data Subject. – The data subject is entitled to:

    • Be informed whether personal information pertaining to him or her shall be, are being or have been processed;
    • Be furnished the information indicated hereunder before the entry of his or her personal information into the processing system of the personal information controller, or at the next practical opportunity:
      1. Description of the personal information to be entered into the system;
      2. Purposes for which they are being or are to be processed;
      3. Scope and method of the personal information processing;
      4. The recipients or classes of recipients to whom they are or may be disclosed;
      5. Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access is authorized;
      6. The identity and contact details of the personal information controller or its representative;
      7. The period for which the information will be stored; and
      8. The existence of their rights, i.e., to access, correction, as well as the right to lodge a complaint before the Commission.

      Any information supplied or declaration made to the data subject on these matters shall not be amended without prior notification of data subject: Provided, That the notification under subsection (b) shall not apply should the personal information be needed pursuant to a subpoena or when the collection and processing are for obvious purposes, including when it is necessary for the performance of or in relation to a contract or service or when necessary or desirable in the context of an employer-employee relationship, between the collector and the data subject, or when the information is being collected and processed as a result of legal obligation;

    • Reasonable access to, upon demand, the following:
      1. Contents of his or her personal information that were processed;
      2. Sources from which personal information were obtained;
      3. Names and addresses of recipients of the personal information;
      4. Manner by which such data were processed;
      5. Reasons for the disclosure of the personal information to recipients;
      6. Information on automated processes where the data will or likely to be made as the sole basis for any decision significantly affecting or will affect the data subject;
      7. Date when his or her personal information concerning the data subject were last accessed and modified; and
      8. The designation, or name or identity and address of the personal information controller;
    • Dispute the inaccuracy or error in the personal information and have the personal information controller correct it immediately and accordingly, unless the request is vexatious or otherwise unreasonable. If the personal information have been corrected, the personal information controller shall ensure the accessibility of both the new and the retracted information and the simultaneous receipt of the new and the retracted information by recipients thereof: Provided, That the third parties who have previously received such processed personal information shall he informed of its inaccuracy and its rectification upon reasonable request of the data subject;
    • Suspend, withdraw or order the blocking, removal or destruction of his or her personal information from the personal information controller’s filing system upon discovery and substantial proof that the personal information are incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes or are no longer necessary for the purposes for which they were collected. In this case, the personal information controller may notify third parties who have previously received such processed personal information; and
    • Be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.

    For more information about the provisions contained in Section 34 (a)(b)(c) (d) (e) and (f) of its IRR, click on the following link: https://www.privacy.gov.ph/wp-content/uploads/2016/07/updated-draft-July-12-2016.pdf

  1. Contacts for the exercise of the rights of the data subject and for further information
    With respect to the exercise of the rights in relation to the purposes specified in paragraph 3.1 above and/or to obtain any type of information you may need in relation to the MBE Franchisee pursuant to this privacy notice, you may send a written communication to the MBE Franchisee’s registered office.
    With respect to the exercise of the rights in relation to the purposes specified in paragraph 3.2 above and/or to obtain any type of information you may need in relation to MBE pursuant to this privacy notice, you may send a written communication to Sistema Italia 93 S.r.l. (Fiscal Code and VAT number 10697630159), with registered office in Milan, Viale Lunigiana, 35-37 or a fax by dialling 02 67625625 or an email to privacy@mbe.it.
  2. Consent to the processing of personal data
    The undersigned, ___________________________________ (first name and surname in capital letters), born on __________________ (date of birth)
    DECLARE to have received and read the privacy informative notice on the processing of personal data (“MBE Franchising Network Services”) pursuant to to Section 16 of the Data Privacy Act of 2012, as well as pursuant to Section 34 (a)(b)(c) (d) (e) and (f) of its IRR, and:
    SIGNATURE _____________________
    With respect to the processing of personal data by the MBE Franchisee:

    • Agree
    • Do not agree

    To the processing of personal data for marketing purposes of the MBE Franchisee, with the modalities and for the purposes specified in paragraph 3.1. (i) of the informative notice;

    With respect to the processing of personal data by MBE (Sistema Italia 93 S.r.l.):
    Agree
    Do not agree    		 To the processing of personal data for marketing purposes of MBE (Sistema Italia 93 S.r.l.), as specified in paragraph 3.2. (i) of the informative notice;
    Agree
    Do not agree    		 To the processing of personal data for profiling for direct marketing purposes of MBE (Sistema Italia 93 S.r.l.), as specified in paragraph 3.2. (ii) of the informative notice;
    Lastly:
    Agree
    Do not agree    		 To the communication by MBE (Sistema Italia 93 S.r.l) of personal data to third parties for their own marketing purposes as specified in paragraph 3.2. (iii) of the informative notice.

DATE __________________
READABLE SIGNATURE _____________________