Privacy Notice and Request for Consent for the Processing of Personal Data

(Shipping Order Form)

Pursuant to Chapter III of the Republic Act 10173 of 30 June 2003 “An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes” (hereinafter also referred to as the “Data Privacy Act of 2012”) and its Implementing Rules and Regulations (IRR) we hereby provide you with information regarding the processing of your personal data.
  1. Personal Information Controller
    Your personal data will be processed, depending on the purposes as specified in Section 3 below, “Purposes of the processing of the personal data,” by the following subjects in their capacity as personal information controllers:

    • Sistema Italia 93 S.r.l. – (Fiscal Code and VAT number 10697630159), with office in Milan, Viale Lunigiana, 35-37, Tel. 02 676251, Fax 0267625625, exclusive licensee for Italy of the brand “Mail Boxes Etc”(hereinafter also referred to as “MBE”);
    • MBE Franchisee – that is the entrepreneur as specifically identified in the Shipping Order Form to which said Privacy Notice is attached.
  1. Categories of Personal Information Processed
    1. Personal information provided by you voluntarily
      Please note that personal data you provide directly are subject to processing.
      Personal information means “any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”, this including photos (Sec. 3.(g) of the Data Privacy Act of 2012 and Sec. 3 (j) of its IRR).
    2. Personal data of third parties provided by you voluntarily
      You take note that any indication (for example, in the filling in of the Shipping Order Form and/or of electronic forms via the Internet or any other forms by you and/or by the MBE Franchisee) of personal information and of contact of any other data subject within the scope of the shipping service is a case of processing of personal information where you act as Personal Information Controller with respect to the aforesaid subjects. Therefore, you, in the capacity of Personal Information Controller of personal and contact information shall guarantee that such data is collected and communicated in compliance with the relevant provisions. To that end, you undertake and guarantee, pursuant to Section 11 of the Data Privacy Act of 2012and Section 34(a) of its IRR, to inform the said subjects whose personal data are collected and communicated in relation to the procedures, period and purposes of the processing. The personal data of the said subjects shall be communicated for the sole purpose of the shipment and related management.
  1. Purpose of the processing of the personal data
    Your personal data will be processed, with your prior explicit consent where necessary, by Sistema Italia 93 S.r.l. and/or by the MBE Franchisee depending on the purposes pursued by each in the capacity of Personal Information Controller.
    The MBE Franchisee will process your personal data for:

    1. Purpose of the processing of the personal data by the MBE Franchisee
      Processing Legal basis for the processing Consequences of the failure to provide personal data
      i Processing for purposes related to the performance and management of the requested MBE Service, as well as management of the related payments, complaints and communications with the Customer; where applicable, also for processing relating to the verification of customers and other legal requirements. The legal basis for the processing of personal data is your specific consent shown in the contract to which the Customer is a party in order to enable the performance and management of the requested MBE Service. On the other hand, certain obligations (for example, those of fiscal nature or those of verification of customers in the context of domiciliation services) are mandatory at law. The provision of personal data (and/or personal data of any third party, to the extent this is necessary for the performance and management of the requested MBE Service; for example: in the case of shipment services, the contact data of the person to whom the parcel is sent) is optional, however, failure to provide such data will make it impossible to perform and manage the requested MBE Service.
      ii Processing for general marketing purposes, i.e. to send the Customer, by any means of communication (fax, e-mail, sms, mms, paper mail, telephone calls with operator or other channels), advertising and information materials of a promotional nature or, in any case, of commercial solicitation with regard to services, products or discounts of the MBE Franchisee, as well as to prepare studies, research and market analyses. The legal basis for the processing of personal data is the consent of the Customer. The provision of personal data is optional and failure to do so will only make it impossible for the MBE Franchisee to send advertising and promotional messages and carry out market research. This will not affect the performance and management of the requested MBE Service.
    2. Purpose of the processing of the personal data by MBE (Sistema Italia 93 S.r.l.)
      Processing Legal basis for the processing Consequences of the failure to provide personal data
      i Processing for general marketing purposes, i.e. to send the Customer, by any means of communication (fax, e-mail, sms, mms, paper mail, telephone calls with operator or other channels), advertising and information material of a promotional nature or, in any case, of commercial solicitation with regard to services, products or discounts of MBE, as well as to prepare studies, research and market analyses. The legal basis for the processing of personal data is the specific consent of the Customer. The provision of personal data for the aforementioned purposes is optional and failure to do so will only make it impossible for Sistema Italia 93 S.r.l. to i) send advertising and promotional messages and carry out market research; ii) proceed with the aforementioned profiling and/or iii) communicate the personal data to third parties for their own marketing purposes.
      The performance and management of the requested MBE Service will remain unaffected.
      ii Profiling for direct marketing purposes, concerning individual customers or groups of customers to allow to assess, analyze or predict personal preferences regarding the value and type of the purchased MBE Service or its frequency of use in order to offer further services, products or discounts (such as shipment, graphics and printing services, domiciliation, communication, etc.). The legal basis for the processing of personal data is the specific consent of the Customer.
      iii Communication of personal data of the Customer to third parties for their own marketing purposes. The legal basis for the processing of personal data is the specific consent of the Customer.
    3. Further clarifications on consent
      We further point out that, if you have given consent authorizing the MBE Franchisee and Sistema Italia 93 S.r.l. to pursue the purposes, respectively, as per Section 3.1(ii) and 3.2 (i) (ii) and (iii) above, you will remain in any case free to revoke at any time the consent and/or to object to the processing of the data for the aforesaid purposes, by sending without any formalities, a clear written communication to that effect to the addresses as specified in Section 10 below, “Contacts for the exercise of the rights of the data subject and for further information.”
      As for the exercise of the right to object for purposes of marketing, we inform you that if exercised by you, it will regard all means of contact whether electronic, automated or traditional, but you have the power to exercise your right to object to the limited extent of just some contact channels. For example, at any time by contacting the relevant Personal Information Controller at the addresses as specified in Section 10 below, “Contacts for the exercise of the rights of the Data Subject and for further information,” you may object to just the sending of promotional communications by automated means (that is, contact by e-mail, text message, multimedia messaging service, etc.) and thus give your consent solely to receiving communication by traditional means (that is, paper-based mail or operator-assisted phone calls).
      Following receipt of such application for revocation and/or expression of objection, the MBE Franchisee and/or, depending on the circumstances, Sistema Italia 93 S.r.l. will proceed timely to the deletion and erasure of your personal data from the database and inform, where possible, any third parties to whom or which the data have been communicated for the same purpose of cancellation.
  2. Modalities of processing of personal data
    The processing of your personal data will be done by means of manual and IT devices, as well as paper. The personal data provided by you will not be subject to automated decision-making processes, with the exception of profiling as per Section 3.2 (ii) above.
  1. Recipients of personal data
    Your personal data, which will not disseminated by either the MBE Franchisee or Sistema Italia 93 S.r.l., may be communicated:
    from the MBE Franchisee to:

    • employees, agents or collaborators of the MBE Franchisee that are located within the territory of the European Union;
    • employees, agents or collaborators of Sistema Italia 93 S.r.l. that are located within the territory of the European Union;
    • subjects that engage in activities of assistance and consultation on behalf of the MBE Franchisee in accountancy, administrative, legal, tax and financial matters that are located within the territory of the European Union;
    • subjects, bodies or authorities to whom or which the communication of your personal data is mandatory by virtue of provisions of law or orders issued by authorities;

    from MBE (Sistema Italia 93 S.r.l.) to:

    • employees, agents or collaborators of Sistema Italia 93 S.r.l. that are located within the territory of the European Union;
    • subjects located within the territory of the European Union of whom or which Sistema Italia 93 S.r.l. avails itself for profiling and marketing activities;
    • subsidiaries or associated companies, which currently include MBE Worldwide S.p.A., Jonathan & Assist S.r.l, PonyZero S.r.l., Eurocubia S.r.l., DireFareStampare S.r.l. and Buy-me S.r.l.;
    • third parties, located within the territory of the European Union, with which – from time to time – commercial partnership agreements and/or common initiatives, campaigns and projects will be developed;
    • persons, companies or professional offices located within the territory of the European Union that engage in activities of assistance and consultation in accountancy, administrative, legal, tax and financial matters;
    • subjects, bodies or authorities to whom or which the communication of your personal data is mandatory by virtue of provisions of law or orders issued by authorities.

    The subjects or categories of subjects to whom or which your personal data will be communicated by the MBE Franchisee and/or by Sistema Italia 93 S.r.l. may process your personal data in the capacity of data processors, autonomous Personal Information Controller or joint Personal Information Controller.
    The complete list of the data processors:

    • of the MBE Franchisee is available at its registered office; for more information you may apply in writing at the addresses specified in Section 10 below, “Contacts for the exercise of the rights of the data subject and for further information.”
    • of Sistema Italia 93 S.r.l. is available at its registered office; for more information you may apply in writing at the addresses specified in Section 10 below, “Contacts for the rights of the data subject and for further information.”
  2. Transfer of personal data extra UE
    Your personal data and those of the consignees will not be transferred outside the European Union by either Sistema Italia 93 S.r.l. or the MBE Franchisee.
  3. Retention of personal data
    In application of the principle of proportionality, we inform you that:

    • the MBE Franchisee, for the purpose as per Section 3.1(i) above (execution and management of shipping), will retain your personal data for the time necessary for the execution and management of the shipment, without prejudice to any specific legal obligations with regard to the retention of accountancy documents;
    • the MBE Franchisee, for the purpose as per Section 3.1(ii) above (marketing), will retain your personal data for a period no longer than twenty-four months from the time of their recording, save for anonymization which prevents, even indirectly or in aggregate with other databases, the identification of the data subject;
    • Sistema Italia 93 S.r.l., for the purposes as per Section 3.2(i) (marketing) and 3.2(ii) (profiling) above, will retain your personal data for a period no longer, respectively, than twenty-four and twelve month from the time of their recording, save for anonymization which prevents, even indirectly or in aggregate with other databases, the identification of the data subject.

    Sistema Italia 93 S.r.l. and the MBE Franchisee have implemented suitable mechanisms for automatic erasure of personal data, including to any third party to whom or which such data might have been communicated.

  1. Exercise of rights by the data subject
    Pursuant to Section 16 of the Data Privacy Act of 2012, as well as pursuant to Section 34 (a)(b)(c)(d)(e) and (f) of its IRR, we inform you that:

    • you have the right to be informed of the collection, procedures, period, scope and methods used in personal data processing, as well as the existence of your rights including the right to access, correction, and object to the processing, as well as the right to lodge a complaint before the National Privacy Commission;
    • you have the right to apply to the Data Process Controller for reasonable access to the personal data, the rectification or deletion of the same or restriction on the processing as concerns you, and to object to such processing, or to revoke consent, in addition to the right to portability of the data;
    • you have a right to lodge a complaint with the National Privacy Commission, following the procedures and instructions published on the official website of the same national privacy authority at https://privacy.gov.ph/filing-a-complaint/;
    • any rectification or deletion or restriction on processing done at your request, unless it proves to be impossible or entails a disproportionate effort, will be communicated by the Personal Information Controller (s) to each of the recipients to whom or which your personal data have been transmitted. The Personal Information Controller (s) may communicate such recipients to you should you expressly so request.
      Your applications for the exercise of such rights shall be addressed in writing to the Personal Information Controller (s) at the addresses as specified in Section 10 below, “Contacts for the exercise of the rights of the data subject and for further information.”
      The exercise of the rights is not subject to any formal restriction and is free of charge. For ease of reference, we reproduce below the text of Section 16 of the National Privacy Act of 2012:
      SEC. 16. Rights of the Data Subject. – The data subject is entitled to:

      • Be informed whether personal information pertaining to him or her shall be, are being or have been processed;
      • Be furnished the information indicated hereunder before the entry of his or her personal information into the processing system of the personal information controller, or at the next practical opportunity:
        1. Description of the personal information to be entered into the system;
        2. Purposes for which they are being or are to be processed;
        3. Scope and method of the personal information processing;
        4. The recipients or classes of recipients to whom they are or may be disclosed;
        5. Methods utilized for automated access, if the same is allowed by the data subject, and the extent to which such access is authorized;
        6. The identity and contact details of the personal information controller or its representative;
        7. The period for which the information will be stored; and
        8. The existence of their rights, i.e., to access, correction, as well as the right to lodge a complaint before the Commission.

        Any information supplied or declaration made to the data subject on these matters shall not be amended without prior notification of data subject: Provided, That the notification under subsection (b) shall not apply should the personal information be needed pursuant to a subpoena or when the collection and processing are for obvious purposes, including when it is necessary for the performance of or in relation to a contract or service or when necessary or desirable in the context of an employer-employee relationship, between the collector and the data subject, or when the information is being collected and processed as a result of legal obligation;

      • Reasonable access to, upon demand, the following:
        1. Contents of his or her personal information that were processed;
        2. Sources from which personal information were obtained;
        3. Names and addresses of recipients of the personal information;
        4. Manner by which such data were processed;
        5. Reasons for the disclosure of the personal information to recipients;
        6. Information on automated processes where the data will or likely to be made as the sole basis for any decision significantly affecting or will affect the data subject;
        7. Date when his or her personal information concerning the data subject were last accessed and modified; and
        8. The designation, or name or identity and address of the personal information controller;
      • Dispute the inaccuracy or error in the personal information and have the personal information controller correct it immediately and accordingly, unless the request is vexatious or otherwise unreasonable. If the personal information have been corrected, the personal information controller shall ensure the accessibility of both the new and the retracted information and the simultaneous receipt of the new and the retracted information by recipients thereof: Provided, That the third parties who have previously received such processed personal information shall he informed of its inaccuracy and its rectification upon reasonable request of the data subject;
      • Suspend, withdraw or order the blocking, removal or destruction of his or her personal information from the personal information controller’s filing system upon discovery and substantial proof that the personal information are incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes or are no longer necessary for the purposes for which they were collected. In this case, the personal information controller may notify third parties who have previously received such processed personal information; and
      • Be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information.

      For more information about the provisions contained in Section 34 (a)(b)(c) (d) (e) and (f) of its IRR, click on the following link: https://www.privacy.gov.ph/wp-content/uploads/2016/07/updated-draft-July-12-2016.pdf.

  1. Contacts for the exercise of the rights of the data subject and for further information
    With respect to the exercise of your rights in relation to the purposes as per section 3.1 above and/or to obtain any type of information you may need in relation to the MBE Franchisee pursuant to this Privacy Notice, you may send a written communication to its registered office.
    With respect to the exercise of your rights in relation to the purposes as per Section 3.2 above and/or to obtain any type of information you may need in relation to Sistema Italia 93 S.r.l. pursuant to this Privacy Notice, you may send a written communication to Sistema Italia 93 S.r.l. (Fiscal Code and VAT number 10697630159), with registered office in Milan, Viale Lunigiana, 35-37 or a fax by dialling 02 67625625 or an email to privacy@mbe.it.
  2. Consent to the processing of personal data
    The undersigned, ___________________________________ (first name and surname in capital letters), born on __________________ (date of birth) □ declare i) to have been duly informed of the nature, scope and consequences of the processing of my personal data for purposes of the execution and management of shipments, as well as for other specified purposes, pursuant to to Section 16 of the Data Privacy Act of 2012, as well as pursuant to Section 34 (a)(b)(c) (d) (e) and (f) of its IRR,; as well as of ii) my rights with respect to my personal data;
    SIGNATURE _____________________
    □ agree / □ do not agree to the processing of my personal data for the purpose of marketing by Sistema Italia 93 S.r.l. in the manner and for the purpose as per Section 3.2(i) of the above-mentioned Privacy Notice;
    SIGNATURE _____________________
    □ agree/ □ do not agree to the processing of my personal data for the purpose of marketing by the MBE Franchisee in the manner and for the purpose as per Section 3.1(ii) of the above-mentioned Privacy Notice;
    SIGNATURE _____________________
    □ agree / □ do not agree to the processing of my personal data for the purpose of profiling by Sistema Italia 93 S.r.l. in the manner and for the purpose as per Section 3.2(ii) of the above-mentioned Privacy Notice;
    SIGNATURE _____________________
    □ agree / □ do not agree to the communication by both Sistema Italia 93 S.r.l. and the MBE Franchisee to third parties of my personal data in the manner and for the purposes specified in the above-mentioned Privacy Notice.
    DATE __________________
    SIGNATURE _____________________