Privacy Policy
1. Glossary
The following terms are used in connection with this Policy and are defined here for clarification:
"Controller" means the natural or legal person, public authority, agency or any other body which, alone or jointly with third parties, determining the purposes and means of the Processing of Personal Data; in the sense that the purposes and means of the Processing are determined by national or European Union laws;
"Data subject" is an identified or identifiable natural person; an identifiable person is a person who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity;
"Personal Data" means any information about a Data Subject;
"Processing" means any operation or set of operations carried out on the basis of the Personal Data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or other means of making available, alignment or combination, blocking, erasure or destruction;
"Processor" means a natural or legal person, public authority, agency or other body that processes Personal Data, on behalf of the Controller;
"XPO Group" means any company controlled directly or indirectly by XPO LOGISTICS EUROPE within the meaning of Article L233-3 of the French Commercial Code, controlling the latter or under its common control.
2. Purpose and scope
XPO LOGISTICS EUROPE, a French company whose registered office is 192 avenue Thiers – 69006 Lyon, France, registered under the French trade register of Lyon under number 386 220 123 ("XPO", "we", "us" or "our"), operates this website in its capacity as Data Controller.
This Privacy Policy describes how we process Personal Data when we provide our services and our website https://europe.xpo.com/en/, which is designed for use in the European Union. If you choose to access our other websites designed for use in other parts of the world (e.g. our U.S. websites), the Privacy Policy found there applies to your use.
This Privacy Policy only applies to the Processing of Personal Data of natural persons whose Personal Data we process in connection with the provision of our services and visitors to our website from the EU or, where applicable, the EU or EU Member States in terms of data protection.
In the particular circumstances set forth below, XPO is not exclusively but jointly liable with other XPO Logistics companies, in particular XPO, Inc., headquartered at 5 American Lane, Greenwich, CT 06831, United States of America and its subsidiaries with respect to the lawfulness of the Processing of your Personal Data.
3. Personal Data we collect and Sources
The categories of Personal Data that XPO processes for the purposes described in Section 4 below are:
3.1. Personal data collected directly from you
XPO generally collects Personal Data directly from you (electronically, in writing, or orally) as part of our business relationship or through application forms based on the website. You also provide XPO with new, updated or corrected personal data from time to time.
This information includes:
- Business information, such as company name and your position in the company;
- Your inquiries, complaints, our responses and other related information, such as the subject of the request, the type of service you are interested in, the requirements for the service you wish to consult us for (including pick-up and delivery addresses and freight specifications);
- Navigational information, such as the type of browser and device connected to the Internet used to access the Website, your Internet Protocol ("IP") address, your domain name or Internet service provider, your referrer URL (which is the URL of the website you visited before visiting our site), how you were directed to the Website, which specific pages you access on the Website, how long you view each page, the time and date you access our Website and the general physical location of your computer or device.
3.2. Personal Data collected directly from the XPO Group
XPO collects Personal Data from other companies in the XPO Group. For example, XPO collects information about our services, business relationships, and your requests relating to other XPO Group companies that are to be managed by XPO. In these circumstances, the two XPO Group companies involved act as joint Data Controllers. In addition, as discussed in Sections 5 and 6 below, XPO and other XPO Group entities share Personal Data for the purposes set out in Section 4 below.
3.3. Personal data collected directly from third parties
Finally, XPO may receive categories of Personal Data from third parties that provide services to XPO, including search engine optimization services, hosting services, social media and webmastering services, as well as from business partners and customers.
4. Purposes and legal bases for the Processing of your Personal Data
We process Personal Data for the following purposes. The legal basis for the Processing is specified for each purpose, in accordance with the GDPR, as applicable. Where applicable, we will indicate, at the time of data collection, whether the provision of Personal Data is a regulatory or contractual requirement, whether you are required to provide the Personal Data, and the possible consequences of failure to provide such data.
XPO processes Personal Data for the following purposes:
4.1. Provision of services
This includes the Processing of Personal Data to: provide services to our B2B customers, and to the end customers of our B2B customers acting on their behalf (B2B2C). This includes deliveries and returns of goods from our B2B customers, and other related operations.
Legal bases:
- The need to perform a contract to which you are a party;
- Our legitimate interests as specified above.
4.2. Your requests and communications with us
This includes the Processing of Personal Data to: process and respond to customer requests received via the "Build your project" and "Contact" forms, and by other means.
Legal bases:
- The need to perform a contract to which you are a party;
- Our legitimate interests as specified above.
4.3. Administration, optimization and analysis of websites
This includes the Processing of Personal Data: system and website optimization, analytics, market research and maintenance of user login information.
Legal bases:
- Our legitimate interests as specified above;
- Your consent.
5. With whom we share your Personal Data
XPO takes precautions when sharing Personal Data with other XPO Group companies or third parties.
5.1. XPO Group
We may share your Personal Data with other XPO Group companies and for any of the purposes specified in Section 4 above. A list of XPO Group companies is available by writing to XPO LOGISTICS EUROPE, 192 Avenue Thiers, 69006 Lyon, FRANCE, or by sending an email to the following address: gdpr@xpo.com
5.2. Third parties
We may exchange your Personal Data with our third-party service providers who perform services on our behalf, for the purposes described in Section 4 of this Privacy Policy. Specifically, we exchange your Personal Data with hosting and IT support service providers. Service providers are required by law and/or contract to protect the confidentiality and security of Personal Data, and to use only Personal Data to provide the services requested from XPO, in accordance with applicable law.
We may share your Personal Data with other companies, vendors and business partners who perform certain functions for us, who are themselves responsible for determining the purposes and/or means of the Processing and the lawfulness of the Processing.
We will disclose Personal Data to purchasers, attorneys or professional advisors, courts, adverse parties or other parties related to the pleadings, and their professional advisors, as necessary, in order to influence the sale or transfer of business assets, to defend or enforce our rights, to protect our property, assets or the safety of third parties. We will also disclose Personal Data if required to do so by law, such as in response to a subpoena, including to law enforcement agencies, courts, and tribunals in countries where XPO operates.
6. International transfer of Personal Data
Because XPO Group companies are located and provide services worldwide, we may need to transfer your Personal Data internationally. In particular, Personal Data collected by us may be transferred to and processed in countries outside the European Economic Area ("EEA"). These countries may not have the same level of protection of Personal Data as is applied in the EEA. Please write to gdpr@xpo.com if you wish to receive further information or, if applicable, a copy of the relevant data transfer mechanism.
6.1. XPO Group
International transfers are addressed to the parent company in the United States. Transfers of your Personal Data outside the EEA are made on the basis of our intra-group data transfer agreement, which is based on the European Commission's standard contractual clauses applicable to data transfers, and in accordance with applicable data protection laws.
6.2. Third parties
Certain third parties with whom we share Personal Data are also located outside the EEA. Some third countries have been officially recognised by the European Commission as ensuring an appropriate level of protection. Transfers to third parties outside the EEA shall be effected through an acceptable data transfer mechanism, e.g. standard contractual clauses for data transfers, binding corporate rules, approved codes of conduct and certifications, or in exceptional circumstances, on the basis of permitted regulatory exceptions.
7. How long we keep your Personal DataWe retain the Personal Data we obtain about you through the Website for as long as necessary to fulfill the purpose(s) for which that collection was collected. In some cases, Personal Data may be retained for an extended period of time to comply with legal obligations, or to establish, exercise, or defend a legal claim, in accordance with applicable laws.
Please do not hesitate to contact us with any further questions about the retention of your Personal Data (see Section 9 below).
8. Your rights in relation to your Personal Data
EU data protection law grants specific rights, as set out below. In instances where XPO entities act as joint Controllers, you may exercise these rights with respect to or against each of them (for a list of XPO Group companies, see Section 5.1 above). XPO entities that act as joint Data Controllers have entered into an agreement, reflecting their respective roles and relationships.
8.1. Access
You have the right to be informed if your Personal Data is processed by XPO and its partners. If this is the case, we will explain how these partners use your data and we will tell you why and how this data is used, which categories of data are concerned, to whom and where this data is shared, how long it is stored and whether your data is used through automated processing allowing in particular the implementation of automated individual decisions. You may also ask us to provide you with a copy of this data, which may result in the payment of a reasonable fee based on the administrative costs we will incur in responding to your request. These fees will not apply if we can communicate this data to you through your right to portability.
8.2. Rectification
Having accurate data is critical for XPO. Therefore, we will rectify your inaccurate data without delay.
8.3. Opposition
In certain circumstances and for reasons relating to your particular situation, you may object to XPO processing your Personal Data. When you make this request and this request complies with applicable law, we will no longer process your data unless we demonstrate the legitimacy and mandatory nature of the processing of Personal Data and it overrides your rights, interests and freedoms. We may still process your data if this is necessary for the establishment, exercise or defence of legal claims;
You may also object at any time to the Processing of your Personal Data for marketing purposes. (Please note that even if you object to the use of your Personal Data for direct marketing purposes, we will continue to send you transactional messages relating to the services you have purchased. This includes answers to your questions and information about a service you have purchased from us.)
8.4. Portability
You have the right to receive the Personal Data concerning you, which you have provided to the Data Controller, in a structured, commonly used and machine-readable format; you also have the right to transmit this data to another controller without the controller being able to prevent you from doing so.
8.5. Erasure
Unless otherwise required by law, we will delete your data in order to comply with our legal obligations, including when your Personal Data is no longer needed or when you request it from us.
8.6. Right to restriction of Processing
You may ask XPO to restrict processing of your Personal Data if you believe that your Personal Data is not accurate or if you ask us to erase your data. In addition, you can ask us to restrict processing if you have the right to object to processing.
8.7. Right to file a complaint with a supervisory authority
You have the right to file a complaint with a data protection authority, in particular in the EU member state in which you reside, your place of work, or the place where the problem, which is the subject of the complaint, occurred.
8.8. Right to refuse or withdraw your consent
You are free not to grant your consent to the Processing of your data and you may withdraw, at any time (with future effect) the consent you have previously provided, without any negative consequences. The lawfulness of the Processing of your Personal Data, which occurred before the withdrawal of your consent, will not be affected.
9. Contact
If you wish to exercise any of the above rights (see Section 8), or if you have any questions about this Privacy Policy, the roles and responsibilities of XPO Group companies in the event that they act as joint Controllers, including their contractual agreement, please direct your request to:
Address: XPO LOGISTICS EUROPE - 192 Avenue Thiers, 69006 Lyon, FRANCE
Address e-mail: gdpr@xpo.com
Phone : 0033 (0)4 72 83 66 00
10. Changes to our Privacy Policy
Any changes we make to our Privacy Policy in the future will be posted on this page.
11. Cookies and Other Tracking Technologies
By placing a small file called a "cookie" on your computer (or other device), XPO and its service providers' servers may passively collect information about your use of our website for several purposes including, but not limited to: statistical collection and analysis, website optimization, analytics (as described below), market research and maintenance of user login information. browsing information, which we and our service providers track with cookies may include, but is not limited to, the type of browser (Google Chrome or Internet Explorer) and the Internet-connected device used to access the Website, your Internet Protocol ("IP") address, your domain name or Internet service provider, your referring URL (which is the URL of the website you visited before accessing our site), how you were redirected to the website, which specific pages you access on the website, how long you view each page, the time and date you access our website and the total number of visitors to the website, and all parts thereof. We may also use your IP address to determine the general physical location of your computer or device, and to know which geographic locations visitors to our website come from.
The most popular Internet browser applications allow you to configure the browser so that cookies are not accepted. However, if you set your browser to reject cookies, in some cases you will not be able to take full advantage of the Website (or parts of it) and its capabilities, or some features of the Website may work slower or incorrectly.
The Website (and parts of the System) uses Google Analytics (including the Universal Analytics feature), a web analytics service provided by Google, to better understand your use of the Website (or other parts of the System) and how we can improve the Website and the System. Google Analytics collects information such as how often users visit the website, which pages they visit and what other websites they use before entering this website. Google Analytics only collects the IP address assigned to you on the date you visit the Site, not your name and other personally identifiable information. We do not combine the information collected through the use of Google Analytics with your Personal Data. Although Google Analytics installs a permanent cookie on your web browser to identify you as a unique user, the next time you visit a website, the cookie can only be used by Google. Google's ability to use and share information collected by Google Analytics about your visits to the Site or System is restricted by the Google Analytics Terms of Service and Google's Privacy Policy. Google uses the collected data to track and examine the use of the website, prepare reports on its activities and exchange them with other Google services. Google may use the data collected on the website to contextualize and personalize the advertisements of its own advertising network. To better understand how Google may use the data it collects on the website, see "How Google uses data when you use our partners' sites or apps" (located here or any successor URLs). For additional information about the security and privacy practices of Google's Universal Analytics feature, see the documents provided by Google here.
Category | Cookie | Name | Purpose | Expiry |
Necessary | Cookie consent (1st party) | cookie_consent | Stores the visitor's consent action | 13 months |
Analytics consent (1st part) | analytics_consent | Stores the visitor's consent to media and analytics cookies | 13 months | |
Django csrftoken (3rd party) | csrftoken | This cookie is associated with the Django web development platform for Python. It is designed to help protect a site against a particular type of software attack on web forms. | 1 year | |
Media and analytics cookies | Google Analytics (3rd party) | _ga _Can _hole _gid | These cookies are installed by Google Analytics They are used to generate statistical data on visitors, sessions and advertising campaigns and to keep track of your navigation on the site for the purposes of site analysis reports. These cookies store information anonymously and assign a randomly generated number to identify unique visitors. | 2 years |
Google Tag Manager (3rd party) | _ga# | Used by Google Analytics to retrieve data on the number of times a user has visited the site as well as the dates of their first and last visits. | 2 years | |
Heap analytics - Clearbit (3rd party) | _hp2_id* _hp2_ses_props* | These cookies collect information to measure and understand how visitors use our site. This includes user activity tracking on this site, including pages visited and links clicked. These cookies are persistent cookies that persist in the browser (unless deleted) ranging from 24 hours up to two years. | 24 hours to 2 years | |
Linkedin Analytics (3rd party) | lidc | This cookie is used for routing from share buttons and advertising tags | 24 hours | |
bcookie | This cookie is used by LinkedIn to identify the browser ID. It is set from LinkedIn share buttons and advertising tags. | 2 years | ||
UserMatchHistory | This cookie is used by LinkedIn Ads to help XPO measure advertising performance. | 30 days | ||
lang | This cookie is used to set default locale/language. | Session | ||
lissc | Used to ensure there is correct SameSite attribute for all cookies in that browser | 1 year | ||
YouTube (3rd party) | YSC | This cookie is set by Youtube and is used to track views of embedded videos. | Session | |
VISITOR_INFO1_LIVE | This cookie is set by Youtube and is used to estimate the available bandwidth | 6 months | ||
DoubleClick (3rd party) | GOES | Used by Google DoubleClick, stores information about how the user navigates with the site and any other advertisement prior to the consultation of the site. Used to provide users with ads that are relevant to them in relation to their user profile. | 1 year |
Effective Date: 1 January 2019. Last Update: July 2, 2024.