Appendix B: General Data Protection Regulation (“GDPR”)

Additional provisions applicable to the processing personal information of individuals based in the European Economic Area (“EEA”) and the United Kingdom (“UK”).

Scope and Applicability

This Appendix B (“Appendix B”) applies to individuals based in the EEA and UK and outlines your rights and choices regarding the processing of your personal information under the General Data Protection Regulation (“GDPR”). This Appendix B controls to the extent it conflicts with any provision in the main body of the Notice. Capitalized terms not defined in Appendix B are defined in our Notice.

Data Collection, Use and Sharing

toncarton acts as a Data Controller for personal information that we collect about you while using our Site or interacting with our Marketing Activities as described in the Privacy Notice.

We act as a Data Processor on behalf of our Customers for most of the personal information that we process through our Services. This means that Customers mainly control what personal information we collect and process through the Services and how we use it, and we only process the information in accordance with their instructions.

This Appendix B does not apply to any personal information that we process as a Data Processor, as we only process that information on behalf of our Customers and in accordance with our agreement with them. A Customer that has entered into an agreement to use our Services (e.g., an organization that uses our dashboard to connect dispatchers with drivers) controls its instance of the Service and any associated data. If your personal information is contained in Customer data and you have any questions about the specific settings and privacy practices the relevant Customer has made to share your personal information with us, please contact the relevant Customer or review its privacy notice.

We collect and process personal information about you only where we have a legal basis for doing so under applicable data protection laws. Our legal bases include processing personal information under:

• Your consent: Where appropriate or legally required, we collect and use information about you subject to your consent. For example, we collect your email address when you sign up for marketing emails and updates on our Site.
• Performance of contract: We collect and use information about you to contract with you or to perform a contract that you have with us. For example, we collect your name, email, and billing addresses when you purchase our Services and to process transactions.
• Legitimate interests: We collect and use information about you for our legitimate interests to improve our Services, deliver content, optimize your experience, and market our Services. For example, we collect your IP address and device information when you use our Services to prevent malicious activity and fraudulent transactions.
• Compliance with laws: We may also collect and use information about you:
  • As required by law, such as to comply with a subpoena or similar legal process;
  • When we believe in good faith that disclosure is necessary to protect our rights or property, protect your health and safety or the health and safety of others, investigate fraud, or respond to a government request; or
  • If we participate in a merger, acquisition, or sale of all or a portion of its assets.

Transfer of Personal Information to Other Countries

When you use our Services and provide personal information to us, we use data hosting service providers in the europe. to store information we have about you.

Although the data protection laws of various countries may differ from those in your own country, we take appropriate steps to ensure that your personal information is processed as described in this Notice and under the law.

Data Subject Rights

You have certain rights related to the personal information we hold about you when you use our Services. Some of these rights only apply in certain circumstances, as set out below. We also describe how to exercise these rights in the “Exercising your Rights” section of this Appendix B.

Depending on the Services provided, Recipients and Authorized Users seeking to access, correct, amend, or delete personal information should contact the Customer (Data Controller) which has transferred such data to us for processing. If our Customer receives a data subject request and sends the request to us, we will respond to the Customer’s request within the agreed timeframe outlined in our Customer agreements. The Customer is responsible for responding to Recipient data subject requests as determined under the applicable local data protection law.

The GDPR provides data subjects with the following rights:

• Right of Access: You have the right to request access and receive certain information about how we use personal information about you and who we share it with.
• Right to Rectification: You have the right to request correction of personal information we hold about you where it is inaccurate or incomplete.
• Right to Data Portability: You have the right to request a copy of data we hold about you in a structured, machine-readable format, and to ask us to share this information with another entity.
• Right to Erasure: You have the right to request deletion of the personal information we hold about you:
  • Where you believe that it is no longer necessary for us to hold your personal information;
  • Where we are processing your personal information based on legitimate interests and you object to such processing and we cannot demonstrate an overriding legitimate ground for the processing;
  • Where you have provided your personal information to us with your consent and you wish to withdraw your consent and there is no other ground under which we can process your personal information; or
  • Where you believe your personal information is being unlawfully processed by us.
• Right to Restriction of Processing: You have the right to ask us to restrict (stop any active) processing of your personal information:
  • Where you believe your personal information is inaccurate and while we verify accuracy;
  • Where we want to erase your personal information as the processing is unlawful, but you want us to continue to store it;
  • Where we no longer need your personal information for our processing, but you require us to retain the data for the establishment, exercise, or defense of legal claims; or
  • Where you have objected to us processing your personal information based on our legitimate interests and we are considering your objection.
• Right to Object: You can object to our processing of your personal information based on our legitimate interests. We will no longer process your personal information unless we can demonstrate an overriding legitimate purpose.
• Objection to Marketing, Automated Decision Making, and Profiling: You have the right to object to our processing of personal information for marketing communications, automated decision making and profiling. We will stop processing the data for that purpose.
• Withdrawal of Consent: Where you have provided your consent for us to process your personal information, you can withdraw your consent by emailing privacy@toncarton.com.

Please note that before we respond to requests for information, we will require that you verify your identity, or the identity of any data subject for whom you are requesting information. Our verification methods may include requesting that you log into your toncarton account, confirm your contact information or email address, and/or provide documents for identity verification.

Exercising your Rights

To exercise any of the rights above, please contact us as noted in the “Contact Us” section in this Appendix B. If you are a Recipient and in certain instances an Authorized User, contact the Customer acting as the Data Controller directly to fulfill any requests.

We will fulfill your request within 30 days of receipt. Please note that the above rights may be limited in the following situations:

• Where fulfilling your request would adversely affect other individuals, company trade secrets or intellectual property;
• Where there are overriding public interest reasons; or
• Where we are required by law to retain your personal information.

If you have unresolved concerns, we encourage you to come to us in the first instance, but you are entitled to address any grievance directly to the relevant Supervisory Authority. If you are a Recipient and in certain instances an Authorized User, we encourage you to reach out to the relevant Customer first to address any complaints.

Contact Us

To submit questions about this Appendix B or to update or request changes to your personal information, please contact us at privacy@toncarton.com or write to us:

toncarton, sas.
9 rue anatole de la forge

Paris, 75017

France

← Back to Privacy Notice