Carrier Mobile Application (“CMA”) Privacy Notice

Brambles Ltd and its affiliates, including companies operating under the CHEP brand ("Brambles," "we," "us," or "our respect your right to privacy and your right to control the dissemination of your personal information. Please click here for a list of our business locations and contact information. Brambles’ Carrier Mobile Application (“CMA”) is a shipment fulfillment portal for our customers and carriers.

This Privacy Notice applies to the Brambles’ CMA and outlines how we collect, use, and protect your personal information. By using the CMA, you acknowledge that you have read and understood this Privacy Notice, which is incorporated into and forms part of the Terms and Conditions of the CMA.

The CMA is a web based service and mobile application owned by Brambles and locally used by its CHEP Affiliates to i) better comply with our contractual obligations with customers and retailers by tracking Brambles’ pallet shipments and calculating estimated times of delivery to, ultimately, identify and address possible incidents or disruptions in a timely manner; and ii) manage proof of pallet deliveries in a more efficient and sustainable way.

Please note that this privacy notice uses the terms personal data and personal information as equivalent terms as any information relating to an identified or identifiable natural person (‘Data Subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; or as may be further specified by applicable data protection law.

This Privacy Notice addresses the following topic:

Personal data we may collect from you and how we use it
How does location tracking work?
When is CMA location tracking on?
Use of cookies
Disclosure of your personal data
Legal basis to collect and process your personal data
Special provisions for our European Economic Area and United Kingdom users
Your Privacy Rights
Special provisions for our California users
Data Retention
Security
What else should you know?
How to contact us
Privacy Notice updates

1. PERSONAL DATA WE MAY COLLECT FROM YOU AND HOW WE USE IT

When you use CMA, we collect personal data directly from you and your mobile device. This is outlined in the table below:

Personal Data	How We Use It
Your name, last name, email address and telephone number	We collect and use this information to: - Register you as a CMA user and enable application usage - Communicate with you in case of an accident, incident or service center operational issues affecting CHEP pallets collection and delivery
Trailer ID and Vehicle Registration/License Plate number	We collect and use this information to identify your trailer and ensure CHEP pallets are loaded into the right vehicle
Check-in and Check-Out times at CHEP locations	We collect and use this information to: - Know when you arrive and leave CHEP locations - Assess CHEP locations operations productivity and efficiency - Calculate an estimated time of delivery of CHEP pallets to our customers
Geolocation	We may collect and use this information to: - Track the shipment of CHEP pallets - Know in real time when you arrive and leave CHEP locations - Calculate your estimated time of arrival at CHEP locations - Calculate your estimated time of arrival at our customers - Know in real time when CHEP pallets are delivered to our customers - Get insights for transportation efficiencies - Provide further assistance in case you have or are involved in an accident or incident To know more about geolocation, see the section below “How Does Location Tracking Work?”.
Driver signature	This information is used to creation electronic Proofs of Delivery (e-PoDs).

We may also use the information specified above to:

Facilitate the communication between you and our customers and retailers;
Perform our contractual relationship you, your carrier and our customers;
Operate, evaluate and improve our business;
Protect Brambles against and prevent fraud, unauthorized transactions, claims, and other liabilities, and manage risk exposure, including identifying potential hackers and other unauthorized users;
Comply with applicable legal requirements and industry standards and with our policies.

We may aggregate and/or de-identify data about CMA users to analyze and improve CMA usability and navigability.

2. HOW DOES LOCATION TRACKING WORK

Shipment tracking using Global Positioning System (GPS) or Wi-Fi networks is commonly used for transport operations because of the operational efficiencies, safety, and security benefits it provides. GPS is a satellite-based navigation system made up of at least 24 satellites. GPS receivers use the satellite positioning to identify the exact position of your mobile device.

The CMA relies on Google technology for location tracking. You can review Google’s Privacy Policy here. In particular, the shipment location can be determined with varying degrees of accuracy by:

GPS
A Driver’s mobile device IP address
Sensor data from the driver’s mobile device
Information about things near the driver’s device, such as Wi-Fi access points, cell towers, and Bluetooth-enabled devices

3. WHEN IS CMA LOCATION TRACKING ON?

Location tracking is voluntary. When you initially install the CMA on your phone, you will be asked if you would like to turn tracking on as follows:

For the precise location, the CMA will connect with the GPS of your mobile device to pinpoint the shipment in the map. For the approximate location, the CMA will use Wi-Fi cell towers located within 100 meters from your device to track the shipment.

If you allowlocation tracking “while using the app”, the message will not show again. However, if you chose “only this time”, this message will appear every time you use CMA. If you do not accept any sort of location tracking, the CMA will not be able to track the shipment. In any case, you will be able to change your tracking location preferences at any time through the CMA settings.

If you allow location tracking, the CMA will only track location when you access the CMA and collect a shipment. Shipment location will be tracked only when the CMA is active. Location tracking starts when you initiate the CMA and collect a shipment. You will know that CMA tracking is active when the following truck icon is displayed in the notification bar of your device:

Location tracking stops when you exit the CMA, deliver the shipment or elect to turn off tracking. You can turn off location tracking at any time through your device settings.

Brambles will be able to view collection, delivery, and shipment location in route for shipments processed through CMA. This information will also be visible to Brambles’ customers as shipment recipients.

4. USE OF COOKIES

Cookies are files, often including unique identifiers, that are sent by web servers to web browsers, and which may then be sent back to the server each time the browser requests a page from the server. The CMA does not use cookies.

5. DISCLOSURE OF YOUR PERSONAL DATA

When you provide information through the CMA, we may share that information as follows:

We may share real time location information with authorized customers and carriers you are delivering for, as well as third party service providers who support the CMA. This information will be shared to facilitate shipment planning, including collection and delivery numbers and vehicle ID, and will be accessed by shipping number. Other personal information related to you, including your username, name, or mobile device number, will not be visible during real time location tracking.

Once the shipment is delivered, we will store location information by shipping number, but will not store your personal information, including your username, name, or mobile device number with this location information. Additionally, once a shipment is delivered, customers and carriers will no longer have access to the tracking location information. They will only have access to the date, time and location of collection and delivery for a particular shipment.

Within Brambles and its affiliates to facilitate equipment delivery and collection. Please click here for a list of our business locations and contact information. Brambles employees will have access on need-to-know basis and have committed themselves to confidentiality. Sharing your information within companies under CHEP brand is subject to an Intragroup Data Transfer Agreement. Additionally, as some of group entities are located outside the European Union (EU), the European Economic Area (EEA) and the United Kingdom (UK), International Data Transfers will take place in application of the safeguards foreseen in the Standard Contractual Clauses and/or Standard Data Protection Clauses adopted or approved by the European Commission or equivalent supervisory authority.
In order to carry out your requests; operate the CMA; make various features, services and materials available to you; respond to your inquiries; and for other purposes described in the "How We Use Your Personal Information" section of this Privacy Notice, we may share your personal information or usage information with third parties that perform functions on our behalf (or on behalf of our partners), such as companies or individuals that: provide IT services; host our data; host or operate our systems and sites; analyze data; provide asset collection services; or other third parties that participate in or administer the application. To the extent we grant these parties access to your personal information, they are expected to follow privacy practices no less protective that our practices to the extent allowed by applicable law. Specific data protection agreements including, where applicable, the execution of valid cross border personal data transfer mechanisms, are executed with these third parties.
We may share non-personal information, such as aggregate user statistics, demographic information, and usage information with third parties in order to improve our services and products; our sites and our communication with you.

We may disclose your personal information, usage information, and other information about you to parties acquiring part or all of our assets, as well as to attorneys and consultants. If we transfer your information to an acquirer, we will use reasonable efforts to direct the acquirer to use your information in a manner that is consistent with this Privacy Notice.

If any bankruptcy or reorganization proceeding is brought by or against us, your information may be considered a company asset that may be sold or transferred to third parties.
We may disclose information about you to others if we have a good faith belief that we are required to do so by law or legal process, to respond to claims, or to protect the rights, property or safety of Brambles or others.
We do not “sell” personal information we collect from you, in accordance with the definition of “sale” under the California Consumer Privacy Act (CCPA).

6. LEGAL BASIS TO COLLECT AND PROCESS YOUR PERSONAL DATA

We will only collect and process personal data about you where we have a legal basis to do so, including: i) performance of a contract (where processing is necessary for entering into or the performance of a contract with you);); ii) compliance with a legal obligation (for example, when we produce invoices or proof of pallet deliveries); or and iii) for our legitimate interests (e.g. automate the tracking of pallet shipments in compliance with our sustainability commitments). We may process your personal data for the purposes of legitimate interests, provided that such processing does not outweigh your rights and freedoms. Where we rely on legitimate interests, you have the right to object to such processing. Please keep in mind that if you object this may affect our ability to perform certain services for your benefit.

We process your personal data based on legitimate interests in order to:

Improve safety and security while a shipment is in route. For example, if your vehicle is in an accident, we will be able to provide location information to your employer to provide aid.
Ask for feedback and collect usage information to help us develop the CMA.

We process your personal data based on contractual necessity in order to:

Track CHEP pallet shipments, monitor real-time arrivals and departures at CHEP locations, estimate arrival times at both CHEP and customer sites, confirm pallet deliveries, optimise transportation efficiency, and provide assistance in case of accidents or incidents.
Facilitate shipments, including timing of collection and delivery, addressing shipment delays or incidents, and managing expected time of arrivals. For example, tracking enables our customers to plan for delivery as the shipment nears its final destination.

7. SPECIAL PROVISIONS FOR OUR EUROPEAN ECONOMIC AREA AND UNITED KINGDOM USERS

By providing us with personal information, you understand and acknowledge that we may collect, use and disclose such information for commercial purposes, and may provide such information (consistent with the terms of this Privacy Notice) within the company and its affiliates, which may be outside your resident jurisdiction.

7.1. Communications

To continually improve the effectiveness of the CMA, we may examine communications with you for effectiveness. Insofar as this communication relates to European Union or European Economic Area (EU/EEA) data subjects or United Kingdom (UK) data subjects, such analyses are performed on the basis of anonymized information. We ensure that any data we share with third parties outside the UK/EEA is fully anonymised so it cannot be used to identify you. The security of your data will be protected by appropriate safeguards, including but not limited to Model Clauses pursuant to the European Commission’s decision 2021/914 as published in O.J. EU 2021 L 199/31 (and is also available online by clicking here or via URL https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) or the International Data Transfer Clauses approved by the UK Authorities (“Model Clauses”).

7.2. Where We Store Your Personal Information

Please be aware that the personal data you provide will be transferred, and stored, in a database and on servers in Ireland and the United States. For the storage of your personal information in the United States, where the privacy laws may not be as comprehensive as those in your country of residence or citizenship, please be assured that appropriate safeguards are in place for this transfer, including but not limited to EU Standard Contractual Clauses and UK International Data Transfer Addendum to EU Standard Contractual Clauses for international data transfers.

7.3. European, Switzerland and UK Supervisory Authorities

You have the right to register a complaint with a data protection or supervisory authority about our collection and use of your personal information. For more information, please contact your local data protection authority (contact details for data protection authorities are available at Our Members | European Data Protection Board (europa.eu), Homepage (admin.ch) for Switzerland and for UK data protection authority at https://ico.org.uk/).

8. YOUR PRIVACY RIGHTS

Depending on the country where you are based and the applicable data protection regulations, you may:

Request information on and access to the personal information we hold about you (Right of Access);
Request that any inaccurate personal information we hold be corrected (Right of Rectification);
Object to certain types of processing of your personal information we carry out (Right to Object);
Request that we delete the personal information we hold about you (Right to Erasure or Right to be Forgotten); and
Request a copy of your personal information in a machine readable, commonly used format (or to request we transfer your personal information in such a format to a third-party service provider) (Right to Data Portability).
Request that we restrict our processing of your personal information in certain circumstances, such as when you contest the accuracy of that personal information (Right to Restriction of Processing);
Request not to be subject to an automated decision-making or profiling;
Withdraw your consent at any time when we process your personal information based on your consent.

While some of these rights can be exercised by you directly through CMA, many other rights, such as those relating to requests to delete your personal data will need to be submitted to us. You may exercise any of the applicable rights by clicking here to complete the Privacy Rights Intake Form.

We will consider such requests and respond to you within the applicable deadline as per the applicable jurisdiction. If we deny a request, we will notify you of the reasons for the denial. We may require verification of your identity before providing a copy of your information as permitted by law. We may charge you a small fee and may require verification of your identity before providing a copy of your information as permitted by law.

If you request that your information to be deleted, we will retain the equipment location and collection information by anonymizing the source of the submission. We will also cancel your registration and delete your information from the CMA.

If you work or reside in the UK and you are not satisfied with how we process your personal information, you have the right to submit a complaint to us through our Speak Up hotline or by sending us an email to privacy@brambles.com. For information about how we process complainants’ information, please visit our Speak Up privacy notice. If you are not satisfied with our response to your complaint, you may also have the right to escalate the matter to the relevant supervisory authority, that is, the Information Commissioner’s Office.

9. SPECIAL PROVISION FOR OUR CALIFORNIA USERS

9.1. Your Rights

Depending on the circumstances you may have certain rights and choices regarding our processing of your personal information, including the right: (i) to know the categories and/or specific pieces of personal information collected about you, including whether your personal information is sold or disclosed and the purpose, and with whom your personal information was shared in the prior twelve months; (ii) to request deletion of personal information, if permissible by law; (iii) to access a copy of the personal information we retain about you; (iv) to opt-out of the sale of personal information; and (v) to non-discrimination based on the exercise of a consumer’s privacy rights.

9.2. Exercising Your Rights

You may exercise any of the applicable rights described in this Privacy Notice by contacting us as detailed in the “Your Privacy Rights” section of this Privacy Notice or calling 1-855-409-0019. We will promptly respond to all applicable requests.

We reserve the right to verify your identity in connection with any requests regarding personal information to help ensure that we provide the information we maintain to the individuals to whom it pertains and allow only those individuals or their authorized representatives to exercise rights with respect to that information. If you are an authorized agent making a request on behalf of a consumer, we may require and request additional information to verify that you are authorized to make that request.

We reserve the right to deny your request if we cannot verify your identity. Where we deny your request in whole or in part, we will endeavor to inform you of the denial, provide an explanation of our actions, and the reason(s) for the denial.

We will not restrict or deny you access to our services because of choices and requests you make in connection with your personal information.

9.3. California Residents and Do-Not-Track Disclosure

If you are a California resident, you may ask us to refrain from sharing your information (whether collected online or offline) with our affiliates for their marketing purposes, if the affiliates are separate legal entities. Please tell us your preference by contacting us as indicated in the "How to Contact Us" section of this Website Privacy Notice.

Because there is not yet a consensus on how companies should respond to web browser-based or other do-not-track ("DNT") mechanisms, Brambles’ websites do not respond to web browser-based DNT signals.

California’s “Shine the Light” Law.

If you are a California resident, you are entitled, once a year, free of charge, to request information regarding our disclosure, if any, of certain categories of Personal Information to third parties for their direct marketing purposes in the preceding calendar year. You may exercise your right under California’s “Shine the Light” Law by contacting us as detailed in the “Your Privacy Rights” and “How to Contact Us” sections of the Privacy Notice.

10. DATA RETENTION

We retain the personal data that we collect from you no longer than is necessary except where we have an ongoing legitimate business need to do so (for example, to provide you with the services you requested or to comply with an applicable legal requirement). Specifically, the CMA retains the information that we collect from you as follows:

The username you select when registering is used for authentication and is deleted when your registration is canceled.
Shipment pick-up and delivery data is identified by shipping number and stored according to Brambles Record Retention Policy to comply with applicable legal obligations.
Location tracking is aggregated and anonymized and used for route planning purposes. For instance, we may use this information to identify the safest and most efficient route from a pickup location to a customer location.
The CMA does not store IP addresses.

11. SECURITY

We maintain certain administrative, technical, and physical safeguards to help protect against loss, misuse or unauthorized access, disclosure, alteration, or destruction of your personal information. However, no electronic data transmission or storage of information can be completely secure. We cannot ensure or warrant the security of any information you transmit to us or that we acquire. Accordingly, you must use our services at your own risk.

If, despite all our efforts, a data breach does occur, we shall do everything in our power to limit the damage. In case of a data breach which is likely to result in a high risk, and depending on the circumstances, we will inform you about remedial actions to prevent any further damage.

12. WHAT ELSE SHOULD YOU KNOW?

12.1. Your choices

If you no longer wish to provide us information through the CMA, you may uninstall the application from your device. Note that this action will not delete your user account or any information we previously collected through the application.

12.2. Children

Our services are generally not directed to children under 16. We do not knowingly collect personal information from anyone under 16 without parental consent. If you become aware that we have collected personal information from a child under the age of 16 without parental consent, please let us know immediately so we can take appropriate action.

13. HOW TO CONTACT US

If you have any questions, comments, or concerns about this Privacy Notice or data protection concerns in general, please send us an email to privacy@brambles.com.

14. PRIVACY NOTICE UPDATES

We reserve the right to modify or supplement this Privacy Notice at any time. Changes to the policy will be posted at least 30 days prior to the effective date. The date below indicates when this Privacy Notice was last changed.

Carrier Mobility Application Privacy Notice