MISSION DESPATCH GDPR STATEMENT

Introduction

This document has been prepared to inform customers and suppliers of Mission Despatch Limited (“WE”) how we have gone about complying with the General Data Protection Regulations (GDPR).

GDPR sets out the requirements for all businesses processing data relating to EU citizens regardless of the location of the data or the processing thereof.

GDPR also includes the following rights for individual EU citizens:

• The right to be informed (privacy information)
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• The right not to be subject to automated decision-making including profiling.

Data Controller

Mission Despatch considers itself to be a Data Controller as we determine the purpose for which data is processed.

Responsibilities of The Data Controller include:

• Defining the lawful basis for processing personal data
• Providing the Controller’s identity and contact details when collecting personal data
• Protection of customer data
• Providing a copy of the processed data to the data subject upon request
• Erasing/correcting personal data without delay upon request
• Cooperation with supervisory authorities
• Informing supervisory bodies without undue delay when becoming aware of a personal data breach
• Ensuring that Data Processors only act on documented instructions for the Data Controller

Company Addresses

1. Unit 8 Brentford Business Centre, Commerce Road, Brentford, Middlesex, TW8 8LG
2. Advantage One, Third Avenue, Denbigh West, Milton Keynes, MK1 1DR

Services Provided

Mission Despatch provides the following services:

1. Same day courier services carried out by own vehicles or subcontractor /supplier vehicles.
2. Next day, international and pallet services carried out by subcontractors/suppliers
3. Storage services in its own or third-party warehouses
4. Fulfilment services

Different services require the use of different software systems and so data capture and handling varies depending on the service being used.

In order to provide the services listed above we need to process personal information. This may include:

• Personal details
• Employment details
• Private and commercial addresses
• Telephone numbers
• Credit card information

With whom do we share information?

We only share information required to the extent that it is required to fulfil our responsibilities to our customers, namely:

• Company drivers and subcontractors/suppliers
• Employers of bookers or those paying for the service

Everybody who works for us must acknowledge responsibility for and understand the importance of maintaining the security of customer, employee and other confidential information.

Basis for processing and data types stored

The lawful basis for processing customer data is to enable us to fulfil a contract between the customer and ourselves. In most cases parcel data is one-off data that is only a point-in-time record and is kept for a fixed period to support accounting and responding to queries and complaints. Data is processed as follows:

1. SAME-DAY COURIER WORK

CUSTOMER                MISSION

     DRIVER/HANDHELD DEVICE

When a customer makes a booking, that information sits on the Mission servers and the information required to fulfil the job is sent via GPRS to the allocated employee/subcontractor. The computer programme used to manage this service is password protected and thus the data is only accessible to the person who has been asked to carry out the job and operational staff of Mission. Mission is able to log the rider/driver out of the system at any time and prevent them accessing information.

Data is retained in the system for the purposes of providing a full audit trail of activity carried out for a customer. Whilst data records pertaining to individuals may be deleted as per the right to erasure, references to activities carried out by those individuals will be retained under the GDPR provisions for the exercise or defence of legal claims.

Credit card bookings, depending on whether they are made via our website or over the telephone, are processed by either Sagepay, Worldpay or Paypal. Credit card information is not held within our own systems and no record is maintained by us. All companies used by us to process credit card information are GDPR compliant with robust systems in place to protect against data misuse.

2. NEXT DAY/INTERNATIONALS/PALLETS

We work with a number of suppliers to facilitate these deliveries and we monitor their GDPR compliance in order to sure that our customers details are protected. Records of compliance checks are held by the Data Protection Officer (DPO).

3. FULFILMENT

When an individual makes an online purchase their personal and financial data is captured by the retailer. Our role is to process the order and so we in turn capture name, address and phone number so that we can despatch the order.

Access to our fulfilment software requires a unique username, email address and password. Passwords are stored on a fully secure 128bit SSL encryption . All data is stored on Microsoft Azures secure cloud hosting platform and data is backed up daily.

The fulfilment software only stores relevant personal data to carry out the services contracted for. This data is retrieved by API integrations to external shopping carts and marketplaces, which have been authorised by the customer to connect to.

The software stores customer names, address, phone numbers and email addresses so that delivery services can be carried out effectively but does not retrieve or store sensitive data information such as dates of birth and payment card details.

Records are stored for a minimum of 7 years however if an individual wants their address data to be wiped this can be completed on request and a deletion record provided.

ONLINE BOOKINGS

Mission account customers who book online are given usernames and passwords to access the booking system. Customers are responsible for protecting this information and ensuring that it is not shared. Where a customer believes that their password has been compromised they are advised to inform us as soon as practicably possible.

Policies relating to all services

Underpinning all the services that are currently provided and may be provided in the future, Mission has policies in place to ensure that any supplier with whom we contract is compliant with GDPR.

Third Parties

Mission, nor it’s data processing partners, share personal data with third parties except as detailed above, ie where it is necessary so that we can perform our obligations under a contract.

Right to Access

Under GDPR an individual has the right to request a copy of the personal data that is processed. Where an individual requires this, they can write to the DPO who will review the request and respond accordingly.

Data Protection Officer

Mission Despatch has appointed Paul Witkover as Data Protection Officer. Paul is a Director of Mission Despatch.