This Privacy and Personal Data Protection Policy is intended to inform you of the way in which the XPO Group collects, processes, retains and protects your Personal Data.  
For clarification purposes, the term " XPO Group" refers to any company directly or indirectly controlled by XPO LOGISTICS EUROPE (RCS LYON 386 220 123) within the meaning of Article L.233-3 of the French Commercial Code, controlling the latter or under its common control.  
All terms defined with a capital letter herein are defined in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 : The General Data Protection Regulation (the " GDPR"). 
 

This Privacy Policy describes how we process Personal Data within the XPO Group in connection with the provision of our services and the management of visitors to our website (accessible at the following link: https://europe.xpo.com – hereinafter referred to as the " Website").  

We are committed to protecting your privacy and processing your personal data in compliance with the GDPR and any applicable national legislation, including the UK General Data Protection Regulation and Law No. 09-08 of 18 February 2009 on the protection of individuals with regard to the processing of personal data. 

XPO LOGISTICS EUROPE, 192 avenue Thiers – 69006 Lyon, France, registered with the Lyon Trade and Companies Register under number 386 220 123 ("XPO", "we", "us" or "our"), is designated as the Data Controller.

The categories of Personal Data that XPO processes for the purposes described in Section 4 below are: 

3.1. Identification, Contact and Financial Data 

XPO generally collects Personal Data directly from you (electronically, in writing or verbally) in the context of our commercial relationship or through Website-based request forms. You also provide XPO from time to time with new, updated or corrected personal data. Such Personal Data includes: 

• Last name
• First name
• Company name
• Customer/supplier number
• EU VAT number
• Postal address
• Email address
• Phone number
• Bank details (in the context of the contractual relationship)
• Pricing conditions
• Billing data 

3.2. Website Browsing Data 

When you browse our Website, we automatically collect certain personal data through tracking technologies, including cookies. 
A cookie is a text file stored on your computer's browser, which is transmitted to us each time you return to our Website. It enables us to assign you a unique browsing identifier. 
Such data includes in particular: 

• Pages visited and your browsing behaviour
• Access preferences and language settings
• Your IP address
• Connection dates and times 

We use this data to distinguish new visitors from returning visitors, to analyse the use of our Website and improve its content, design and offerings, to personalise your experience (recognition on subsequent visits, display in your browser language, promotion of events adapted to your time zone), and to produce aggregated Website usage statistics. 
When you provide your email address to access or download content, it will be associated with your browsing data in order to offer you a personalised experience. 
For more information on our use of cookies and how to configure them, please refer to Section 13 of this policy. 

3.3. Contact and Messaging Data 

- Your email address. To access or download certain information on our Website, we may ask you to provide your email address or other contact details. We may use your email address in the context of our marketing activities, as described below. 

- Use of the "Contact" section. You may also contact us to request information or report a problem or concern via the "Contact" section of our Website. When you do so, we collect and retain your email address and the content of your message, as well as the content of any response we provide to you. 
We regularly communicate by email with users who request information about our products and services, and we may also communicate by phone to follow up on information requests or resolve any issues. 
Our Website also offers a chat feature in the "Contact" section for real-time assistance. We may retain any information you provide through the chat feature. 

3.4. Access Data for Customer Portals (XPO CONNECT / KEY PL / GLOBAL FORWARDING) 

You may request access to the Customer Portals by creating an account on each of these applications. When creating an account on one of our Customer Portals, we ask for your first and last name, email address, phone number, country, and VAT number. 
You will have access to non-public information as well as documentation relating to all services and contracts concluded with the XPO Group. All your activities, requests and exchanges with us will be recorded on your customer account on each of these applications. 

3.5. Application Data 

You may provide us with information relating to your professional background and training when applying for a position by submitting your CV, whether directly via the website: jobs.europe.xpo.com or through a third party, such as a recruitment firm, your higher education institution or the organisers of a job fair. 
We do not combine this information with other Personal Data we collect about you, and we store it in a separate database. 
The information you provide as an applicant is used solely to respond to your application and to retain your contact details in order to contact you should a future vacancy match your qualifications. 
 

3.6. Newsletter Subscription Data 

Subscribing to our newsletter is optional and you may unsubscribe at any time. 
Our newsletter is intended to keep you informed of XPO Group news, including new content available on our Website and our services. 
We will only send you email communications with your explicit and prior consent. To do so, you must enter your email address, to which we will send a subscription confirmation email, thereby ensuring that the consent obtained is indeed yours. You may withdraw your consent at any time by unsubscribing via the link provided for this purpose in each of our emails. 

3.7. Office Visit Data 

When you visit one of our offices, we may ask you to register as a visitor and to provide us with your name, your company name, as well as the date and time of your visit. 
Where applicable, our sites may be equipped with video surveillance systems. Where we manage these systems, information notices are displayed at the entrance to each area concerned, in accordance with applicable regulations.  

3.8. Guest Wi-Fi Network 

When you connect to the Wi-Fi network of one of our sites or agencies (hereinafter the " Guest Wi-Fi Network "), the identification data linked to your connection is processed and retained. This covers the identification of network users (MAC address, IP address, full name, company name, email address), technical characteristics (date and time of registration, date and time of first login, account expiry date and time, which access point you connected to, how much data you used) and device location (XPO site’s/agencies’).  
Data collected is limited to operational, security and compliance-related metadata necessary for the provision and protection of the service. The content of messages exchanged or information consulted on the network is not concerned. 
Unless otherwise explicitly stated, the XPO Group does not monitor, inspect, record or retain the content of your communications when providing the Guest Wi-Fi Network.   

3.9. Data Related to Last Mile Services 

In the context of providing our transport and logistics services, we process personal data on behalf of our B2B clients, as well as for their end customers in connection with our last-mile delivery services, where we act on behalf of our B2B clients. This covers in particular deliveries and returns of goods for our B2B clients, and other associated operations such as communication with recipients (delivery notifications, missed delivery notices, delivery time slots) or shipment tracking and associated logistics operations. 

3.10. Data Related to Professional Events 

The XPO Group may organise professional events as part of its commercial activities. To this end, you will be asked to provide your first and last name, phone number and email address, as well as the name of the company you represent.  

3.11. Data Related to a Quote Request 

In the context of entering into a contractual relationship, you may request that the XPO Group provide a quote via https ://europe.xpo.com/en/get-a-quote/https://europe.xpo.com/en/get-a-quote/. For this purpose, the Personal Data collected is: 

• First and last name
• Email address
• Postal address
• Phone number
• Company name
• Job title 

We process your personal data only where necessary and on the basis of a valid legal ground in accordance with Article 6 of the GDPR. 

XPO does not share, sell, transfer or otherwise communicate your Personal Data to third parties and will not do so in the future, unless required by law, for the purposes of the contract or with your express consent.

When you contract with the XPO Group, we may need to provide certain of your Personal Data to our subcontractors. 

However, in the context of the Processing of Data as described in this privacy notice and the respective legal basis given, XPO will transfer your data to the following categories of recipients:  

• Other companies within the XPO Group: The transfer is necessary within the XPO Group, its legal entities and shared service centres to provide and improve our products and services. It is also possible that your Data may be transferred to manage our relationship with you, to identify you, to respond to your requests and to respect your privacy rights. 
• Our subcontractors and technical service providers (hosting, IT maintenance, CRM tools, etc.), bound to XPO by contracts compliant with the requirements of the GDPR. Third-party subcontractors who process your Personal Data are contractually required to maintain strict confidentiality in accordance with Article 28 of the GDPR. We retain responsibility for the protection of your Personal Data in this case. Business partners follow our instructions and this process is guaranteed by organisational and technical measures, as well as controls and audits where applicable. If a service provider needs to access your Personal Data to provide services on behalf of XPO, it does so in accordance with XPO's instructions and under the contract XPO has concluded with it. 
• Competent authorities, in the event of a legal or regulatory obligation.
• Business partners, within the limits of any consent you may have given. 

We never sell your personal data to third parties.

Where your data is transferred outside the European Economic Area (EEA) (to other companies within the XPO Group, third-party business partners or public authorities), we ensure that such transfers only take place under the conditions authorised by applicable data protection legislation. Where applicable, we put in place appropriate safeguards to govern these transfers (for example: binding corporate rules, standard contractual clauses, etc.). 

For further information on international transfers, please refer to the "Contact" section. 

We will retain your data for as long as necessary to achieve our objectives, perform our contracts and comply with any legal obligation. The retention period may vary from country to country depending on applicable national laws.

We endeavour to always minimise the retention period of data where the purpose, the law or contracts allow us to do so. Data that we collect on the basis of your consent will be retained until you withdraw your consent. 

For further information on the length of time we retain your Personal Data, please refer to the "Contact" section. 

XPO implements the necessary means to ensure the security and confidentiality of your Personal Data, including technical measures and organisational security measures. 
XPO takes appropriate security measures to protect against unauthorised access, modification, disclosure or destruction of all Personal Data that we store. 
These measures vary depending on the type and sensitivity of the data: 

• Business continuity is maintained and regularly tested. 
• An IT charter has been defined and the company gives it binding force.
• Specific authorisations are granted to persons who have access to the
• Personal Data collected on the Website.
• Pseudonymisation/encryption of user data, or access to Personal Data with multi-factor authentication where necessary.
• A DPO has been appointed. 

As we cannot guarantee that the system is 100% secure, we cannot guarantee that communications between you and XPO, or any information provided to us in the context of our services, will be protected from unauthorised access by third parties. 

You must not share your password with third parties, and if you believe that your password or account has been compromised, you must change it immediately and contact gdpr@xpo.com to ensure that we are informed.  

Under the GDPR and applicable national data protection legislation, you have the following rights: 

9.1. Right of Access, Rectification and Right to Erasure (Articles 15, 16 and 17 of the GDPR) 

You may access, update, modify or request the deletion of the Personal Data concerning you by sending an email to the Data Controller specifying the subject of your request and using the following contact email address: gdpr@xpo.com. 

9.2. Right to Restriction and Right to Object to the Processing of Data (Articles 18 and 21 of the GDPR) 

The User has the right to request the restriction of or to object to the processing of their data by the Data Controller, which may not refuse, unless it can demonstrate the existence of compelling legitimate grounds which override the interests, rights and freedoms of the user. 
The User must submit a request for restriction of the processing of their personal data to the data controller by sending an email to the address specified above. 

9.3. Right to Data Portability (Article 20 of the GDPR) 

You have the right to request the portability of your Personal Data held by the Website or by our DPO to another website, by submitting a request for portability of your Personal Data to the Personal Data Controller by sending an email to the address specified above. 

9.4. Right Not to Be Subject to Automated Decision-Making (Article 22 of the GDPR) 

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This right does not apply where the automated decision: 

• Is necessary for the conclusion or performance of a contract between you and the Group;
• Is authorised by a legal provision applicable to the Data Controller; or
• Is based on your explicit consent. 

In cases where automated processing is implemented, you have the right to: 

• Obtain human intervention from the Data Controller;
• Express your point of view;
• Contest the decision taken with regard to you. 

9.5. Right to Withdraw Consent at Any Time (Article 7.3 of the GDPR) 

Where the processing of your Personal Data is based on your consent, you have the right to withdraw your consent at any time, without having to provide any justification. 

The withdrawal of your consent does not affect the lawfulness of processing carried out prior to such withdrawal, based on the consent previously given. 

Following your withdrawal, we will cease processing your Personal Data for the relevant one or more purposes, unless another legitimate legal basis justifies the continuation of such processing. 

If you have any questions regarding the processing of your personal data, please contact our DPO: 

• By email: gdpr@xpo.com
• By post: XPO LOGISTICS EUROPE – 192 Avenue Thiers, 69006 Lyon, France
• By phone: 0033 (0)4 72 83 66 00 

If, after contacting us, you consider that your rights regarding your Personal Data are not being respected, you may: 

• In France: lodge a complaint with the CNIL.
• In the United Kingdom: lodge a complaint with the ICO — www.ico.org.uk. 

We may amend and update this privacy policy in order to take into account legal, regulatory, technical or operational changes to our data processing practices. 
The version in force is the one published on our relevant communication channels, in particular our Website. We invite you to consult this policy regularly in order to be aware of any updates. 
Any new version of this policy applies to personal data processing carried out from its effective date, without affecting the lawfulness of prior processing. 
 

This Policy is governed by French law. In the event of a dispute, the competent French courts shall have jurisdiction. 
Notwithstanding the above, the GDPR applies mandatorily to all personal data processing operations covered by this Policy, as does the UK GDPR for data subjects located in the United Kingdom, and Law No. 09-08 for data subjects located in Morocco. 
Any invalid provision shall be replaced by the provision most closely reflecting its original intent. 
In the event of ambiguity or absence of applicable provisions, EU data protection law shall govern and prevail.