BECOME A FRANCHISEE
MBE CENTER
CONTACT US

INFORMATION NOTICE ON PRIVACY AND CONSENT REQUEST FOR THE PROCESSING OF PERSONAL DATA (MBE FRANCHISE NETWORK SERVICES)

In accordance with Article 13 of Regulation (EU) 679/2016, which contains provisions for the protection of individuals regarding the processing of personal data and the free movement of such data (hereinafter “GDPR”), we are providing the information notice regarding the processing of personal data of individuals acting as private clients or as representatives of a commercial enterprise (hereinafter, in both cases, referred to as “Client”). In the latter case, we will process personal data of individuals acting on behalf of the entity or within their businesses.

1. Data Controller

Personal data will be processed for the purposes set forth in section 3 below, “Purposes of Personal Data Processing,” by the following individuals acting as independent data controllers:

  • The MBE Master Franchisee – the entrepreneur who has entered into a franchise agreement with MBE (hereinafter “MBE Master Franchisee”) and to whom the Client has requested one or more of the following services from the franchise network, such as: (a) shipping services; (b) domiciliation services; (c) graphic design and printing services (hereinafter “MBE Services”).
  • MBE Luxembourg Sarl (RCS Luxembourg B288506 – VAT LU36088680), headquartered at 110 Route d’Arlon, L-8210 Mamer, Tel. 27 52 11 27, holder of the exclusive license for the “Mail Boxes Etc.” brand in Luxembourg (hereinafter “MBE”).

2. Categories of Personal Data Processed

2.1. Personal Data Voluntarily Provided

Customer personal data, such as identification data, payment data, and data related to the requested MBE
Service.

2.2. Personal Data of Third Parties Voluntarily Provided

The Customer acknowledges that any mention (e.g., in the “Shipment Form” for shipping services and/or in other forms, depending on the requested MBE Service) of personal data and contact details of any other person constitutes data processing for which the Customer must ensure compliance with the relevant data protection regulations in force. In this regard, the Customer also guarantees that such individuals, whose personal data is collected and shared, have been informed about the methods and purposes of the processing of their data. The personal data of these individuals will only be shared to enable the provision of the requested MBE Service.

3. Purposes, Legal Basis for Processing, and Consequences of Refusal to Provide Personal Data

Personal data will be processed, with prior explicit consent if necessary, by the MBE Master Franchisee and/or MBE for the purposes pursued by each of them, acting as independent data controllers, as further detailed below.

3.1. Purposes of Personal Data Processing by the MBE Master Franchisee

Treatment

i) Processing for the purposes of providing and managing the required MBE Service, as well as managing related payments, complaints and communications with the Client; where applicable, also for processing relating to customer verification and
other legal requirements.

ii) Processing for general marketing purposes, e.g. to send to the Client, by any means of communication (fax, email, SMS, MMS, postal mail, telephone calls with operator or other channels), advertising and information of a promotional nature or, in any case, commercial solicitation in terms of services, products or discounts of the MBE Master Franchisee, as well as to prepare studies, market research and analysis.

Legal basis for processing

i) The legal basis for the processing of personal data is the contract to which the Client is a party to enable the provision and management of the required MBE Service. On the other hand, certain obligations (e.g. those of a tax nature, or those relating to the verification of clients in the context of domiciliation services) are imposed by law.

ii) The legal basis for the processing of personal data is the Customer’s consent.

Consequences of refusing to provide personal data

i) The provision of personal data (and/or personal data of third parties, insofar as it is necessary for the provision and management of the requested MBE Service, for example: in the case of shipping services, the contact details of the person to whom the package is sent) is optional, but refusal to provide such data will prevent the delivery and management of the requested MBE Service.

ii) The provision of personal data is optional and any refusal will make it impossible for the MBE Franchisee to send advertising and promotional messages and to conduct market research. This will not impact the delivery and management of the required
MBE Service.

3.2. End of the processing of personal data by MBE (MBE Luxembourg Sarl )

Treatment

i) Processing for general marketing purposes, e.g. to send to the Client, by any means of communication (fax, email, SMS, MMS, postal mail, telephone calls with the operator or other channels), advertising and promotional information documentation or,
in any case, commercial solicitation in terms of services, products or discounts of the MBE Master Franchisee, but also to
prepare studies, market research and analysis.

ii) Profiling for direct marketing purposes, relating to individual customers or groups of customers to enable the evaluation, analysis or prediction of personal preferences as to the value and type of MBE Service purchased, or the frequency of
its use to offer other services, products or discounts (such as shipping, graphic design and printing services, etc.). domiciliation, communication, etc.).

iii) Communication of the Customer’s personal data to third parties for their own marketing purposes.

Legal basis for processing

i) The legal basis for the processing of personal data is the Customer’s consent.

ii) The legal basis for the processing of personal data is the Customer’s consent.

iii) The legal basis for the processing of personal data is the Customer’s consent.

Consequences of refusing to provide personal data

i) The provision of personal data for the aforementioned purposes is optional, but its refusal will make it impossible for MBE Luxembourg Sarl to i) send advertising and promotional messages and to conduct market research; ii) carry out the aforementioned profiling: and/or iii) communicate personal data to third parties for their own marketing purposes.
The delivery and management of the required MBE Service will remain unchanged.

In the event of processing in connection with business transactions (sale of the company or transfer of a business in operation), due care, in the event of the defence of a legal claim in court or in connection with related preliminary activities, such processing will be carried out on the basis of the legitimate interests of the data controller for the pursuit of its business activities and for the protection of its rights.

3.3. Additional clarification regarding consent

We would like to point out to you that if the Customer has given their consent to authorize MBE and/or the MBE Master Franchisee to pursue the purposes set out in paragraph 3.1. (ii) and in paragraph 3.2 (i), (ii) and (iii) above, you will be free to revoke your consent to the processing of your data for the aforementioned purposes at any time, by reference to all or part of the communication channels used by the data controller. The revocation may be exercised by sending, without any formality, a written communication to the addresses better specified in paragraph 9 “Contacts for the exercise of the rights of the data subject and for further information” below.

4. Methods of Processing

The processing will be carried out using automated instruments and on paper capable of guaranteeing the security and confidentiality of personal data, in order to collect, consult, store, manage, extract and transmit personal data.

5. Recipients of Personal Data

It is possible to communicate personal data that will not be publicly disclosed either by the MBE Master Franchisee or by MBE.

by the Master Franchisee MBE to:

(i) employees, agents or collaborators of MBE Luxembourg Sarl who are located in the territory of the European Union;

(ii) persons located in the territory of the European Union who are mobilised by MBE Luxembourg Sarl itself for profiling and marketing purposes;

(iii) subsidiaries or associated companies, which currently include MBE Worldwide S.p.A., Sistema Italia 93 S.r.l., Jonathan & Assist S.r.l., Eurocubia S.r.l., DireFareStampare S.r.l., Forama S.r.l. and CZ Mail S.r.l.;

(iv) third parties with whom – from time to time – business partnership contracts and/or joint initiatives, campaigns and projects will be developed, who are located in the territory of the European Union and operate in the following sectors: (a) information and other IT services (data processing, hosting and related activities, web portals, other information service activities); (b) (i) ground transportation and pipeline transportation (rail transportation; road transportation and removal services); (ii) maritime and floating transport (transport by sea and coast; transport of inland goods by waterway); (iii) air transport (air cargo and space transport); (iv) warehousing and transportation support activities (warehousing and storage; transport support activities); (v) postal services and courier activities (postal activities with universal service obligation; other postal and courier activities); (c) supply of electricity, gas, steam and air conditioning (electricity generation, transmission and
distribution of electricity, production of gas and distribution of gaseous fuels through pipelines); (d) telecommunications (terrestrial telecommunications; mobile telecommunications; satellite telecommunications; other telecommunications activities);

(e) in advertising and market research (advertising; market research and opinion polling);

(v) persons, companies or professional offices located in the territory of the European Union that carry out assistance and consultancy activities in the accounting, administrative, legal, tax and financial fields;

(vi) persons, bodies or authorities to whom the communication of your personal data is mandatory by virtue of legal provisions or orders promulgated by the authorities.

Persons in the above categories may, where appropriate, act as data processors (and in this case, they will receive appropriate instructions from the relevant data controller) or as autonomous data controllers. In the latter case, personal data will only be communicated with the explicit consent of the data subject, unless the communication is mandatory or necessary in accordance with the law in force, or for purposes for which the consent of the data subject is not required. As for MBE and the persons indicated in point (iv) above, personal data may only be disclosed for the marketing purposes of third parties if the data subject has given his or her consent.

6. Transfer of Personal Data Outside the EU

The customer’s personal data (and/or the personal data of third parties, depending on the MBE Service required) will not be transferred outside the European Economic Area, neither by the MBE Master Franchisee, nor by MBE, unless this is necessary for the provision of certain services (e.g. international shipments). In any case, each data controller has the right to transfer your Personal Data to third countries. Data transfers outside the European Economic Area are subject to a special regime in accordance with the GDPR, and are only carried out for countries that ensure an adequate level of protection of personal data, according to the Commission’s adequacy decision or if adequate safeguards have been provided (including the standard contractual conditions provided by the European Commission) provided that the data subjects can exercise their rights and make a adequate legal remedies.

7. Retention of Personal Data

In the interests of the principle of proportionality, we inform you that:

(i) the MBE Master Franchisee will retain the personal data for a period that does not exceed what is necessary to pursue the purposes indicated in paragraph 3.1 (i) (execution and management of the required MBE Service) and (ii) (marketing) above, except for the Customer’s right to revoke consent at any time if this constitutes the legal basis for the processing;

(ii) MBE will retain personal data for a period that does not exceed what is necessary to pursue the purposes indicated in paragraph 3.2 (i) (marketing), (ii) (profiling) and (iii) (communication to third parties for its own marketing purposes) above, except for the Customer’s right to revoke consent at any time if this constitutes the legal basis for the processing.

The criteria for determining the retention period of personal data are based on the processing period permitted by law, the applicable laws on the limitation period of rights and the legitimate interests of the data subject, if they are the legal basis for the processing.

At the end of the above retention periods, personal data will be deleted, aggregated or anonymized.

8. Exercise of Rights by the Data Subject

The Client reserves the right at any time to:

(i) to obtain confirmation from the Data Controller that the personal data is being processed, and if so, to access the personal information pursuant to Art. 15 GDPR;

(ii) to obtain the rectification of personal data if it is inaccurate, or taking into account the purposes of processing, the integration of incomplete personal data;

(iii) to obtain the deletion of the personal data, if one of the grounds under Article 17 of the GDPR can be invoked;

(iv) to obtain the restriction of the processing of personal data, if any of the cases provided for in art. 18 of the GDPR applies:

(v) to object to the processing of personal data on the grounds of the Customer’s particular position, if applicable;

(vi) to receive in a structured, commonly used and machine-readable format, personal data concerning the Client that has been received by us, and to transmit such data to another controller, in the cases and within the limits referred to in Art. 20 GDPR, if applicable.

The Client shall also have the right to revoke consent to the processing of personal data (if given) at any time, without prejudice to the lawfulness of processing based on consent prior to its revocation. The customer will have the opportunity to remove themselves from the email marketing list by clicking on the relevant “unsubscribe” link.

In accordance with the GDPR, the Data Controller may not charge for the processing of requests in this paragraph, unless they are unfounded, or excessive, or repetitive. If Customer requests multiple copies of personal data, or in the event of an excessive or unfounded request, the Data Controller may: (i) charge a reasonable fee, taking into account the administrative costs incurred in responding to the request; or (ii) refuse to comply with the request. In these cases, the data controller will inform the Client about the costs before acting on the request.

The data controller may request further information before acting on requests if it needs to verify the identity of the person who made them.

Without prejudice to any administrative or legal remedy, you even have the right to lodge a complaint with the competent Supervisory Authority (for France: the “Commission nationale de l’informatique et des libertés”) if you consider that the processing of your data commits a violation of the GDPR. More information is available on the website https://www.cnil.fr/

In any case, the Data Controller is keen to know the reasons for the complaint, and asks the Client to use the means of contact below before appealing to the authorities, in order to prevent and resolve any dispute, amicably and quickly, for the sake of courtesy, professionalism and discretion.

For more information on the provisions contained in Articles 15 to 22 of the GDPR, click on the following link: https://cnpd.public.lu

9. Contacts for the exercise of the rights of the data subject and for further information

As for the exercise of the rights in connection with the purposes set out in paragraph 3.1 below and/or to obtain any type of information necessary in relation to the MBE Master Franchisee in accordance with this Privacy Notice, you may send a written communication to the registered office of the MBE Master Franchisee .

As for the exercise of the rights in relation to the purposes set out in paragraph 3.2 below and/or to obtain any type of information necessary in relation to MBE in accordance with this Privacy Notice, you may send a written communication to MBE Luxembourg Sarl (RCS Luxembourg B288506 et TVA LU36088680), with its registered office at 110 Route d’Arlon, L-8210 Mamer Tel. 27 52 11 27 or an email at mbe01@mbeluxembourg.lu.