1          Introduction

This privacy notice aims to inform you about how Shipex (“we”, “us”, “our”, or “Shipex”) collects and processes personal data via its online platform, which aims at offering a communication tool to track and trace the shipment process of freights (hereafter the “Platform”).

You are typically a user that uses the Platform (“you”, “your”) such as:

• on behalf of a client of Shipex (as an employee or contractor of such client);
• on behalf of a partner or subcontractor of Shipex (as an employee or contractor of such partner or subcontractor); or
• on behalf of a partner or subcontractor of a Shipex’ client (as an employee or contractor of such partner or subcontractor); or
• on behalf of Shipex (as an employee or contractor of Shipex).

Shipex respects your privacy and is committed to protecting your personal data in accordance with the applicable Belgian and European data protection legislation (including the General Data Protection Regulation (“GDPR”)).

Please read this privacy notice carefully. It describes not only your rights, but also the way in which you can exercise them. By using our Platform or disclosing your personal data, you acknowledge the manner in which Shipex collects and processes your personal data as described in this privacy notice.

2          Who are we and how to contact us

Shipex is a public limited company (Naamloze Vennootschap) and acts as data controller in respect of the personal data collected and processed via the Platform.

Registered Office	IJzerlaan 54 box 2, 2060 Antwerp, Belgium
Enterprise number	0423.055.897

If you have any questions about this privacy notice, your privacy and the processing of your personal data, you can contact us through the e-mail address below.

Email address

privacy@shipex.be

3          What categories of personal data do we process

Depending on which data you choose to share with us and how you use the Platform, we may process different types of personal data.

In general, if we process your personal data, it will be personal data of one of the following categories:

• Identification and contact details (such as your name and e-mail address);
• Login details (such as your username and password);
• Technical information (such as your mobile device, IP address, user ID, operating system);
• Usage information (such as information related or generated by your use of the Platform, including history, date, time, frequency, duration of the pages you have viewed); and
• Feedback or information you choose to provide us within the Platform.

Your personal data originates from you directly or is automatically collected by us (in case of technical or usage information), or provided to us by your employer.

4          For which purposes do we process your personal data, on which legal basis and for how long?

4.1      General

Shipex processes personal data as a data controller. The controller is the (legal) person who determines the purposes and means of the processing activity. This Article 4 describes the purposes for which we process your personal data, the type of personal data we process for these purposes, the legal basis for doing so and the period for which we keep your personal data.

Depending on your use of the Platform we may process your personal data for the purposes specified hereunder. Please note that our Platform may evolve and more functionalities may be added from time to time. In such case this list may also evolve and will be updated as necessary in accordance with section 15.

If we ask for your consent, the consent you give is always free and you have the right to withdraw it at any time. You can withdraw your consent by sending an e-mail to: privacy@shipex.be. Your withdrawal of consent does not affect the processing of personal data prior to such withdrawal or our processing activities which are based on another legal basis.

4.2      Data processing activities

Purpose	Type of personal data	Legal basis	Retention period
To create your user account and to ensure that you can log in, access and use the Platform via your user account	Identification and contact details Login details	Performance of a contract (in case the Shipex client is a natural person) Our legitimate interests (in case the Shipex client is a legal person).	As long as necessary for the performance of the contract concluded with you or the organization pursuant to which you have access to the Platform; Your personal data will in any event be deleted no later than (i) one (1) year after termination of said agreement; or (ii) 72 business hours after Shipex is being informed that a user account should be deleted (whichever arises first).
To review your feedback and improve your user experience	Feedback you choose to provide to us Identification and contact details you choose to provide to us	Our legitimate interests	Feedback (and related personal data) will be retained for two (2) years.
To improve the Platform and tailor it to your use and to gather technical, analytical and statistical insights	Technical information Usage information	Consent	The retention period varies from as long as the duration of a Platform visit, to as long as your consent is not withdrawn (as applicable). Reference is made to our cookie statement.
To comply with our legal obligations (including to respond to data subject requests)	Identification and contact details Any additional information you provide to us	Legal obligation	Up to ten (10) years after the expiry or termination of our client relationship; or As long as required by law.

For more details about the retention period, you can always send an email to: privacy@shipex.be.

5          Personal data of third parties

If you disclose any personal data of third parties to us, you guarantee that you have informed those third parties and you have received all necessary consents to communicate the third parties’ personal data to Shipex.

6          Cookies

The Platform uses cookies and similar technologies. For more information, we refer to our cookie statement.

7          Disclosures of Personal Data

Shipex may share your personal data, as required for the purposes set forth in section 4, with:

• third party service providers (such as IT service providers, security providers, or hosting providers);
• professional advisers (such as lawyers or auditors); and
• third parties to whom we intend or choose to sell, transfer or merge (parts of) our shares, business or assets.

Upon request, Shipex shall, as soon as possible after the request, inform you of the third parties with whom your personal data have been shared by providing you a more detailed list.

In addition, we may disclose your personal data if this is required by law, or if we determine in good faith that such disclosure is required in order to comply with any pending judicial inquiry, judicial order or litigation and/or to safeguard our rights.

Processors of Shipex always act under the responsibility of Shipex. If Shipex engages processors, this will always be done in accordance with a data processing agreement that meets the requirements of the GDPR. We require all our processors to take appropriate technical and organizational (including security) measures to protect your personal data in line with our policies. We do not allow our processors to use your personal data for their own purposes. In the event we disclose your personal data as described above, we will implement appropriate safeguards to ensure the integrity and confidentiality of your personal data.

Your personal data will only be viewed and made available to processors, employees and other third parties on a “need-to-know” basis, limited to the extent necessary to perform their services.

8          International transfers

In principle, Shipex does not transfer your personal data to third countries located outside the European Economic Area (“EEA”) unless you are located outside the EEA and are visiting our Platform from outside the EEA. It is possible that through its processor, Shipex does transfer your personal data to countries outside the EEA. In this event, Shipex will only transfer your personal data outside the EEA in accordance with the applicable data protection legislation and subject to appropriate safeguards.

Please contact us if you want further information on the specific mechanism(s) used by us when transferring personal data out of the EEA.

9          Data security

Shipex is committed to trying to make sure that your personal data is secure and makes all reasonable and appropriate efforts to protect the confidentiality of your personal data. We have implemented appropriate technical and organizational measures, safeguards and assurances to process your personal data in accordance with the GDPR, in particular to protect your personal data against loss, misuse, or unauthorized alteration or destruction.

Please contact us if you would like more information on the specific measures taken.

Despite the measures taken by us, you should be aware that there are always risks associated with sending personal data over the internet. The security and protection of your personal data can never be fully guaranteed, nor can we guarantee that unauthorized third parties will never be able to defeat those measures or use your personal data for improper purposes.

10       Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes determined in section 4 of this privacy notice, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you or the organization you work for. Afterwards it is still possible that they can be found in our back-ups or archives, but they will no longer be actively processed in a file and such back-ups or archives will be deleted automatically in accordance with our back-up and archiving policies.

The applicable retention periods are set out in the table above under section 4.

11       Your legal rights

Within the limits defined in Articles 15-22 of the GDPR, you have the following legal rights in relation to your personal data:

• Right of access and information: you have the right to obtain confirmation from us as to whether or not we are processing your personal data, to access that personal data and how and why it is being processed, as well as to receive a copy of that data.
• Right to rectification: you have the right to obtain a rectification of your personal data or to request that we complete your personal data when you become aware that we are processing incorrect or incomplete data about you.
• Right to erasure ('right to be forgotten'): you have the right to obtain erasure of your personal data in certain specific cases.
• Right to restriction: you have the right to have the processing of your personal data restricted in certain specific cases.
• Right to portability: you have the right to obtain the personal data you have provided to us in a structured, commonly used and machine-readable form, and to transfer (have transferred) that personal data to another controller.
• Right to object: you have the right to object to the processing of your personal data on the basis of our legitimate interest for reasons relating to your specific situation.

The exercise of these rights is in principle free of charge. Only in the event of unreasonable or repeated requests we may charge a reasonable administrative fee. We will always inform you of the applicable fee before charging it.

You can exercise your rights by sending an e-mail to: privacy@shipex.be.

In your request, make sure to clearly specify which right you wish to exercise so we can help you as efficient as possible. Please note that in some case we may require you to give more information about yourself to ensure that we are dealing with the correct person.

If you contact us to exercise your rights we will respond within one (1) month. Exceptionally this may take longer (up to three (3) months), but then we will inform you within one (1) month of the reasons why.

12       Your right to lodge a complaint with a supervisory authority

If you consider that our processing of personal data infringes the GDPR, you have the right to file a complaint with a supervisory authority, in particular in the member state of your habitual residence, the place of work or the place of alleged infringement.

In Belgium the competent supervisory authority is the Data Protection Authority (“Gegevensbeschermingsauthoriteit” “Autorité de protection des données”):

www.gegevensbeschermingsautoriteit.be

Drukpersstraat 35, 1000 Brussels, Belgium

+32 (0)2 274 48 00

contact@apd-gba.be.

However, we would appreciate the chance to deal with your concerns before you approach the authority, so please contact us in first instance.

13       Third party links

The Platform may contain links to third party platforms, websites and/or applications. Shipex is not responsible for the content of these platforms, websites and applications and is not responsible for the privacy standards and practices of such third parties. We recommend you to read the relevant privacy policies of these third parties and their platforms, websites and/or applications before you accept their cookies and visit them to ensure yourself that your personal data is sufficiently protected.

14       Liability

If Shipex has legitimately transmitted your personal data to a third party (not being its processor), Shipex shall not be liable for any unlawful processing or unlawful use by that third party.

Shipex is in any case only liable for the damage caused by the processing of personal data if it did not comply with its specific obligations under the GDPR and our liability shall not exceed an amount equal to the amounts actually paid out by our insurer for the damage causing event. Shipex shall in no event be liable for any special, incidental, indirect or consequential losses or damages.

The foregoing exclusions and limitations shall only apply to the maximum extent permitted by applicable law.

15       Changes to this privacy notice

Shipex may amend this privacy notice at all times. Any changes we may make to our privacy notice will be indicated on the Platform and when proportionate and in line with the significance of the changes, may be notified to you by email or advised to you on your next login to the Platform. Please review Shipex’ privacy notice periodically to stay informed of changes that may affect you.

Amended versions of this privacy notice take effect ten (10) days after their publication on the Platform and/or other form of announcement and, if necessary, will always be submitted for approval, unless such modifications are necessary to comply with a legal requirement. In the latter case, such changes will take effect immediately.

16       Applicable law and jurisdiction

This privacy notice shall be governed, interpreted, and implemented in accordance with Belgian laws.

The courts of Antwerp (department Antwerp) shall have exclusive jurisdiction to decide on any dispute that may arise from the interpretation or implementation of this privacy notice, without prejudice to the consumer’s right to submit a dispute before a competent court on the basis of a mandatory legal provision.

Last updated: 21 November 2024