Carrier Mobile Application Privacy Notice

CHEP International Inc., a U.S. company with offices in Orlando, Florida (“CHEP,” “we”, “us” or “our”), and its worldwide affiliates all respect your right to privacy and your right to control the dissemination of personal information about yourself. CHEP’s Carrier Mobile Application (“CMA”) is a shipment fulfillment portal for our customers and carriers.

This Privacy Notice describes how the CMA collects information from you, what types of information it collects, what CHEP and its affiliates may do with the information you provide, and your rights to access and correct the information you provide through the CMA.

By using the CMA, you acknowledge you have read and understood this Privacy Notice, which is incorporated into, and part of, the Terms and Conditions of the CMA.

1. HOW DOES THE CMA WORK?

The CMA is a web based service created to facilitate shipments. In order to use the CMA, you may be asked to provide basic personal and authentication information such as your name, job title, email and physical address, mobile telephone number and business telephone number.

Upon registration, you will be asked to select a username and password, which will be used for authentication in the future. If you provide us with personal data or information about other individuals or companies, please ensure that they are aware of our Privacy Policy.

If you are a driver for a shipment, please note that your username will be visible from collection through delivery of a shipment. Consequently, we recommend that you not use your name, phone number or email address as your username.

If you are a driver for a shipment, the CMA uses your phone location as a proxy for shipment location, allowing you to inform CHEP when you collect or deliver a shipment. It also allows you to share your GPS coordinates from collection through delivery of a shipment.

Shipment location will be tracked only when the CMA is active. Location tracking starts when you initiate the CMA and collect a shipment. Tracking stops when you exit the CMA, deliver the shipment or elect to turn off tracking. You can turn off location tracking at any time through your device settings.

If you are a registered user of the CMA, you will be able to view collection, delivery and shipment location in route for shipments to which you have access.

2. HOW DOES LOCATION TRACKING WORK?

Shipment tracking using GPS is a growing trend for transport operations because of the operational efficiencies, safety and security benefits. GPS is a satellite-based navigation system made up of at least 24 satellites. GPS receivers use the satellite positioning to identify the exact position of your mobile device.

The CMA relies on Google technology for location tracking. You can review Google’s Privacy Policy here. In particular, the shipment location can be determined with varying degrees of accuracy by:

• GPS
• A Driver’s mobile device IP address
• Sensor data from the driver’s mobile device
• Information about things near the driver’s device, such as Wi-Fi access points, cell towers, and Bluetooth-enabled devices

3. WHEN IS CMA LOCATION TRACKING ON?

When you initially install the CMA on your phone, you will be asked if you would like to turn tracking on.

The CMA only tracks location when you access the CMA and collect a shipment. You will know that CMA tracking is active when the following truck icon is displayed in the notification bar of the device.

Location tracking stops when you exit the CMA, deliver the shipment or elect to turn off tracking. You can turn off location tracking at any time through your device settings.

4. DOES THE CMA USE COOKIES?

Cookies are files, often including unique identifiers, that are sent by web servers to web browsers, and which may then be sent back to the server each time the browser requests a page from the server.

The CMA does not use cookies.

5. HOW WE USE PERSONAL INFORMATION

We use the information we obtain about you to:

• Operate the CMA as a fulfillment portal for our customers and carriers
• Operate, evaluate, and improve our business
• Gather your feedback about and improve the CMA, as well as our fulfillment process generally
• Analyze and enhance communications and strategies related to the CMA and our fulfillment process generally
• Protect against and prevent fraud, unauthorized transactions, claims, and other liabilities, and manage risk exposure, including by identifying potential hackers and other unauthorized users
• Comply with applicable legal requirements and industry standards and with our policies

5. SHARING PERSONAL INFORMATION

When you provide information through the CMA, we may share that information as follows:

• We may share real time GPS information with authorized customers and carriers, as well as third party service providers who support the CMA. This information will be shared to facilitate shipment planning, including collection and delivery, and will be accessed by shipping number. Your personal information, including your username, name or mobile device number, will not be visible during real time GPS tracking.
• Once the shipment is delivered, we will store GPS information by shipping number, but will not store your personal information, including your username, name or mobile device number with this GPS information. Additionally, once a shipment is delivered, customers and carriers will no longer have access to the GPS tracking information. They will only have access to the date, time and location of collection and delivery for a particular shipment.
• Within the company and its affiliates to facilitate equipment delivery and collection. Please click here for a list of our business locations and contact information. In order to carry out your requests, to make various features, services and materials available to you, to respond to your inquiries, and for other purposes described in the "How We Use Your Information" section of this Privacy Notice, we may share your personal information or usage information with third parties that perform functions on our behalf (or on behalf of our partners), such as companies or individuals that: host or operate our sites; analyze data; provide asset collection services; administer awards programs or other third parties that participate in or administer the Application.
• We may share non-personal information, such as aggregate user statistics, demographic information, and usage information with third parties.
• We may disclose your personal information, usage information, and other information about you to parties acquiring part or all of our assets, as well as to attorneys and consultants. If we transfer your information to an acquirer, we will use reasonable efforts to direct the acquirer to use your information in a manner that is consistent with this Privacy Notice.
• If any bankruptcy or reorganization proceeding is brought by or against us, your information may be considered a company asset that may be sold or transferred to third parties.
• We may disclose information about you to others if we have a good faith belief that we are required to do so by law or legal process, to respond to claims, or to protect the rights, property or safety of Brambles or others.

6. DATA LINKAGE

For purposes of integrating to CHEP’s COLT2020 YMS solution used in the service centre, it is required that the service centre be able to identify the vehicle and be able to communicate with you. In these instances, when you arrive at a service centre that is equipped with the YMS solution, you will be prompted to enter the following data fields:

• vehicle registration number
• telephone number
• name
• trailer size
• trailer type
• SAP reference number
• carrier name

This data is stored locally on your device and not in the CMA. This data can be cleared by you at any time by selecting the Reset local data option in the settings menu (screenshot below).

7. SPECIAL PROVISIONS FOR OUR EUROPEAN USERS

By providing us with personal information, you understand and acknowledge that we may collect, use and disclose such information for commercial purposes, and may provide such information (consistent with the terms of this Privacy Notice) within the company and its affiliates - any or all of which may be outside your resident jurisdiction.

7.1. Communications

As discussed above, to continually improve the effectiveness of the CMA, we may examine communications with you for effectiveness. Insofar as this communication relates to European Union or European Economic Area (EU/EEA) data subjects, such analyses are performed on the basis of anonymized information. We anonymize in accordance with the requirements of the General Data Protection Regulation and local law before transmitting them to a processor / service provider outside of the EU/EEA for their analysis.

7.2. Where we store your personal information

Please be aware that the personal data you provide will be transferred, and stored, outside of the EU/EEA, and in a database and on servers in the United States where the privacy laws may not be as comprehensive as those in your country of residence or citizenship. Please be assured that appropriate safeguards are in place for this transfer, including but not limited to Model Clauses pursuant to the European Commission’s decision (C(2010)593) of 5 February 2010 on Standard Contractual Clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection.

7.3. Legal Basis for Processing

We will only collect and process personal data about you where we have a legal basis, including performance of a contract (where processing is necessary for entering into or the performance of a contract with you), legal obligation and legitimate interests. We may process your personal data for the purposes of legitimate interests, provided that such processing does not outweigh your rights and freedoms. Where we rely on legitimate interests, you have the right to object. Please keep in mind that if you object this may affect our ability to perform certain services for your benefit.

We process your personal data based on legitimate interests in order to:

• Facilitate shipments, including timing of collection and delivery. For example, tracking enables our customers to plan for delivery as the shipment nears its final destination.
• Improve safety and security while a shipment is in route. For example, if your vehicle is in an accident, we will be able to provide location information to your employer to provide aid.
• Monitor, progress and record deliveries. For example, the CMA reduces the time needed to record deliveries and reduces the possibility of errors due to manual data entry.
• Ask for feedback and collect usage information to help us develop the CMA.

7.4. European Supervisory Authority

You have the right to register a complaint with a European data protection or supervisory authority about our collection and use of your personal information. For more information, please contact your local data protection authority (contact details for data protection authorities are available at http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm ).

8. PERSONAL INFORMATION REQUESTS

You may: (i) request information on and access to the personal information we hold about you; (ii) request that any inaccurate personal information we hold be corrected; (iii) object to certain types of processing of your personal information we carry out; (iv) request that we delete the personal information we hold about you; and (v) request a copy of your personal information in a machine readable, commonly used format.

Whilst some of these rights can be exercised by you directly through the CMA, many of the rights, such as those relating to requests to delete your personal information, will need to be submitted to cmaprivacy@brambles.com.

We will consider such requests and respond to you. If we deny a request, we will notify you of the reasons for the denial. We may require verification of your identity before providing a copy of your information as permitted by law.

If you request that your information be deleted, we will retain the equipment location and collection information by anonymizing the source of the submission. We will also cancel your registration and delete your information from the CMA.

9. DATA RETENTION

We retain the personal data that we collect from you no longer than is necessary except where we have an ongoing legitimate business need to do so (for example, to provide you with the services you requested or to comply with an applicable legal requirement). Specifically, the CMA retains the information that we collect from you as follows:

• The username you select when registering is used for authentication and is deleted when your registration is canceled.
• Shipment pick-up and delivery data is identified by shipping number and stored for 13 months.
• GPS tracking is aggregated and anonymized and used for route planning purposes. For instance, we may use this information to identify the safest and most efficient route from a pickup location to a customer location.
• The CMA does not store IP addresses.

10. SECURITY

We maintain certain administrative, technical and physical safeguards to help protect against loss, misuse or unauthorized access, disclosure, alteration, or destruction of your personal information. However, no electronic data transmission or storage of information can be completely secure. We cannot ensure or warrant the security of any information you transmit to us or that we acquire. Accordingly, you must use our services at your own risk.

If, despite all our efforts, a data breach does occur, we shall do everything in our power to limit the damage. In case of a data breach which is likely to result in a high risk, and depending on the circumstances, we will inform you about remedial actions to prevent any further damage.

11. WHAT ELSE SHOULD YOU KNOW?

1. California Residents and Do-Not-Track Disclosure

If you are a California resident, you may ask us to refrain from sharing your information (whether collected online or offline) with our affiliates for their marketing purposes, if the affiliates are separate legal entities. Please tell us your preference by contacting us as indicated in the "How to Contact Us" section of this Website Privacy Notice.

Because there is not yet a consensus on how companies should respond to web browser-based or other do-not-track ("DNT") mechanisms, Brambles websites do not respond to web browser-based DNT signals.

2. Children

Our services are generally not directed to children under 16. We do not knowingly collect personal information from anyone under 16 without parental consent. If you become aware that we have collected personal information from a child under the age of 16 without parental consent, please let us know immediately so we can take appropriate action.

12. HOW TO CONTACT US

If you have any questions, comments or concerns about this Privacy Notice or if you would like us to update information we have about you or your preferences, please contact our Chief Privacy Officer at privacy@brambles.com. Alternatively, please contact our location nearest you. Our list of business locations is available HERE.

13. PRIVACY NOTICE UPDATES

We reserve the right to modify or supplement this Privacy Notice at any time. Changes to the policy will be posted at least 30 days prior to the effective date. The date below indicates when this Privacy Notice was last changed.