Pursuant to articles 13 and 14 of Regulation (EU) 2016/679, containing provisions for the protection of natural persons with regard to the processing of personal data and the free movement of such data (also referred to as the “GDPR”), the Data Protection Act 2018 and GDPR as it forms part of the law of England and Wales by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the “UK GDPR”); we hereby provide you with information regarding the processing of your personal data provided by you and/or collected via the website www.packsend.co.uk (the “Website”).
1. Data controller
Personal data collected during the registration process will be processed by Pack & Send UK Ltd., with registered office in 3a Tournament Court, Tournament Fields, Warwick, Warwickshire, England, CV34 6LG, in its quality of data controller (hereinafter also referred to as the “Company” and/or the “Controller“).
2. Categories of personal data processed
The following personal data provided by you (hereinafter, the “Personal Data”) may be processed via the Website:
3. Purposes of the processing of Personal Data
The Controller will process your Personal Data for the following purposes:
a. to provide you with the services you request, and more in detail to be contacted by the Company staff in order to obtain the relevant information on how to commence your business with the Company;
b. to send you, by any means of communication (e-mail, text message, multimedia messaging service, paper-based mail, operator-assisted phone calls), advertising material and literature of a promotional nature or in any case involving commercial solicitation pertaining to services, products or discounts offered by the Controller, as well as for conducting studies and surveys of the market, and elaborating related statistics;
c. communicate the Personal Data to World Options Ltd. and Mail Boxes Etc. (UK) Limited to send you, by any means of communication (e-mail, text message, multimedia messaging service, paper-based mail, operator-assisted phone calls), advertising material of promotional nature or in any case involving commercial solicitation pertaining to services, products or discounts offered by the aforementioned companies, as well as for conducting studies and surveys of the market and elaborating related statistics.
The Personal Data collected may also be processed in the context of possible corporate events (sale of the company or company branches), due diligence, in the event of the defence of a right in court and in relation to the related prodromal activities.
4. Legal basis for the processing of Personal Data
The processing of Personal Data for the purposes referred to in Section 3, a., is necessary in order to perform the pre-contractual and contractual measures adopted upon your request when you ask for the services offered by the Website pursuant to Article 6 par. 1 lit. b) UK GDPR. Any refusal to provide the Personal Data for the purposes set out above will make it impossible to provide the service.
The processing of your Personal Data for the purposes set out in Section 3, b. and c. is optional and is based on your freely given consent pursuant to Article 6 par. 1 lit. a) UK GDPR. Any refusal to provide your Personal Data for the above purpose will have the sole consequence of making it impossible for the Controller and/or the third party to send you advertising and promotional messages, as well as to carry out studies, research, and market statistics.
The Personal Data collected may also be processed in the context of possible corporate events (sale of the company or company branches), due diligence, in the event of the defence of a right in court and in relation to the related prodromal activities. These processing activities will be carried out for legitimate interests pursued by the Controller to continue its business activities and for the protection of its rights.
5. Methods of processing Personal Data
Personal Data will be processed both by automated means and by paper means, suitable to guarantee security and confidentiality, to collect, consult, store, manage, extract and transmit Personal Data.
The personal data provided by you will not be subject to completely automated decision-making processes.
6. Recipients of Personal Data
Personal Data will be disclosed to the persons authorized for the processing within the organisational structure of the Controller.
Personal Data may be disclosed by the Controller solely and exclusively for the purposes indicated, and where necessary, to the following categories of subjects:
Personal Data shall not, however, be disclosed to unspecified persons.
The subjects belonging to the above-mentioned categories may operate, depending on the cases, as data processors (and, in this case, they will receive specific instructions from the Controller) or as autonomous data controllers. In the latter case, Personal Data will be communicated only with the explicit consent of the data subject, except where communication is required by law or necessary or to pursue purposes for which the data subject’s consent is not necessary.
The Controller also reserves the right to transfer your Personal Data to third countries. Transfers of data outside UK are subject to a special regime under the UK GDPR and are only made to countries that provide an adequate level of protection for Personal Data.
8. Retention of Personal Data
Personal Data will be stored by the Controller for 6 years, in accordance with the applicable law, for a period not longer than is necessary for the purposes for which the Personal Data are processed, without prejudice to the right to withdraw consent at any time where this is the legal basis for the processing.
Personal data disclosed to MBE group companies referred to in Section 3.c. will be stored for a period of 3 years.
The criteria for determining the storage period of Personal Data takes into account the allowed processing period and the applicable laws on the limitation of rights and legitimate interests where they are applicable legal basis for the processing.
Thereafter, Personal Data will be erased, aggregated or anonymised.
9. Rights of the data subject
At any time, you will be entitled to:
You will also have the right to withdraw your consent to the processing of your Personal Data (where given) at any time, without affecting the lawfulness of the processing carried out on the basis of the consent previously given. You will also have the possibility to opt-out of receiving email communications for marketing purposes by clicking on the relevant “unsubscribe” link (so-called opt-out).
Pursuant to the UK GDPR, the exercise of the foregoing rights requires no further formalities and is free of charge. We may merely request to verify your identity prior to taking any further action following your request.
Without prejudice to any other administrative or jurisdictional recourse, you shall also have the right to lodge a complaint with a Supervisory Authority (for UK: the Information Commissioner’s Office, ICO), if you consider that the processing concerning you is carried out in breach of the UK GDPR and the applicable data protection legislation. Further information is available on the website https://ico.org.uk/.
In any event, the Controller is interested in knowing the reasons for your complaint and invites you to use the contact methods below before turning to the authorities, to prevent and resolve any disputes concerning the processing of Personal Data, amicably and as quickly as possible, with the utmost courtesy, professionalism and discretion.
10. Contact for the exercise of the data subject’s rights and for further information
Last updated: November 9th, 2023