SPED Courier Partner Privacy Statement

1. INTRODUCTION

1.1. Welcome to SPED Courier Privacy Statement

At SPED, we hold data protection in high regard, with privacy and information security being fundamental to our values. This privacy statement (referred to as the “Courier Privacy Statement”) outlines the core principles and practices we adhere to in order to ensure your privacy is safeguarded while utilizing SPED’s services and applications (“SPED Services”) and providing delivery services on our platform, whether as:

1. An independent courier partner (“Courier Partner”),
2. A delivery service provider (“Fleet Partner”), or alternatively,
3. Engaged by the aforementioned (“Fleet Courier”).

Collectively, Courier Partners, Fleet Partners, and Fleet Couriers are collectively referred to as couriers (“Couriers”).

SPED Tech Oy, local country-specific SPED entities, and SPED Tech Oy., all part of the same group of companies, collectively referred to as “SPED” or “we,” process the personal data of Couriers (also referred to as “you”).

This Courier Privacy Statement also extends to Couriers’ substitutes. It is essential to ensure that your substitute has familiarised themselves with this Courier Privacy Statement before performing services on your behalf. Both you and your substitute may access each other’s information, including details of performed deliveries, through the SPED Partner application. Please note that in some countries, we may have a separate privacy statement specific to Couriers. You can find the country-specific privacy statement by selecting the respective country at the top of this webpage.

This Courier Privacy Statement may undergo updates periodically to reflect changes in SPED’s data processing practices or other reasons. The current version can be accessed on SPED’s website or Partner application. We will not make substantial changes to this Courier Privacy Statement or reduce the rights of Couriers outlined herein without providing prior notice.

1.2. Data controllers within SPED

This Courier Privacy Statement pertains to the processing of personal data conducted by SPED.  SPED is a part of Sped Tech, Inc., a technology company headquartered at Joensuu Finland. We operate as a unified team, and decisions regarding the processing of personal data are sometimes made collectively.

In processing your personal data, all local SPED entities listed below act as joint controllers. However, for practical purposes, Sped Tech Oy (Company ID, Joensuu, Finland, email: support@sped.delivery) has been designated as responsible for managing all data subject requests and inquiries related to the personal data processing of the SPED group on behalf of the local joint controllers. This means that concerning the processing of your personal data, both SPED Tech Oy and the local SPED group company in the country where you provide services jointly determine the purposes and methods of personal data processing.

When processing the personal data of Couriers who provide courier partner services to SPED Tech Oy, SPED Tech Oy acts as the sole data controller.

1.3. How can you contact us?

For any inquiries regarding personal data concerning current, past, or prospective courier partnerships, please contact Support through the application or via email at support@sped.delivery.

Data Protection Officer: SPED has appointed a Data Protection Officer whom you can reach using the aforementioned contact details..

2. PERSONAL DATA PROCESSING PRINCIPLES

2.1. The purposes and grounds for processing

We process personal data only to the extent necessary and appropriate for specific processing purposes. Please note that one or more of the following purposes and legal grounds may apply simultaneously.

2.1.1. Contractual obligations

Firstly, we process your personal data to comply with our contractual obligations, such as:

• Paying remuneration to you and fulfilling other obligations under the service agreement between you and SPED.
• Providing services to SPED’s users by furnishing them with necessary information for the delivery of their orders.
• Communicating changes to the service agreement, privacy policies, or other important changes related to our cooperation, and addressing your questions or support cases.
• Ensuring compliance with the service agreement by processing necessary personal data, like location data, to verify your adherence to the agreement.

2.1.2. Legitimate interest

Secondly, we may process your personal data based on legitimate interests to run, maintain, and develop our business or create and maintain courier relationships. We assess our interests against your right to privacy, providing opt-out options and using pseudonymized or non-personally identifiable data where possible. Examples include:

• Contacting you regarding the service agreement or SPED Services, informing you of changes, and soliciting your feedback.
• Claims handling, debt collection, legal processes, and prevention of fraud and misuse of services.
• Investigating incidents related to service agreement breaches and recording your communications with SPED support.
• Developing our business, services, products, cooperation with couriers, and improving SPED Services through trend analysis and behavior assessment.
• Processing data within the SPED group of companies in accordance with this Courier Privacy Statement.

2.1.3. Consent

In some instances, we may request your consent for processing personal data, such as accessing location services through your mobile operating system or browser when performing courier services. Consent may also be required for processing facial identification or video recordings containing facial images for identification purposes.

2.1.4. Legal obligation

We process personal data to fulfill our legal obligations, including obligations under law, bookkeeping, and providing information to relevant authorities like tax and law enforcement authorities.

2.1.5. Automated decision-making

We may use automated means, including automated decision-making, for providing SPED Services and other purposes. For instance, automated decisions may be made for task assignment, matching couriers with deliveries, and paying fees according to the service agreement. These decisions are based on location, vehicle capabilities, delivery details, and other relevant factors, not personal attributes or past performance. You can always contact us for questions or assistance regarding task offerings.

2.2. Personal Data Processed

We collect and process a range of personal data about Couriers, ensuring it’s only utilized to the extent necessary for specific processing purposes outlined in this Courier Privacy Statement. Here’s a breakdown of the information we may collect and process:

Identification and Account Information:

• Full name
• Identification documents
• Facial images or videos
• Company name and company ID
• Address
• Hometown
• Phone number
• Email address
• Personal identity code/social security number
• Courier ID and Courier bag ID
• Language
• Date of birth
• Nationality
• Permits and licenses (e.g., driver’s license, work permit, licenses/permits related to food safety, business license)

Contractual Obligations:

• Personal bank account information
• Information on remuneration payable to Courier and payment details
• Tax card
• VAT or tax ID

Communication:

• Feedback and service level data
• Communication records (including phone recordings) between Couriers, SPED, users, and other SPED partners
• Information related to the provision and usage of services

Location Data:

• Access and usage data of SPED’s services/applications (including location and availability when providing courier services to SPED)
• Delivery equipment identification number
• Data provided by Couriers when using SPED’s services/applications
• Video camera surveillance data on SPED premises

When using SPED Services for courier services, we collect, use, and share data on your exact or approximate location, including real-time geographic location of your mobile phone, for purposes such as providing services to SPED’s users, estimating accurate delivery times, and confirming payments. We may also process location data (including dropoff location) collected during delivery performance for resolving user complaints and incidents related to breaches of the service agreement.

We process camera surveillance data on our premises to monitor safety, investigate security incidents, and ensure compliance with applicable laws.

Device and Application Data:

• Information describing devices or browsers and SPED’s applications, including versions, features, capabilities, and settings
• Information about operators, internet service providers, and network connection types, including IP addresses
• Identifiers provided by devices or third parties, or created by SPED
• Country, locale, time zone, and geo-IP level location information
• Details of interactions with, and usage of, SPED Services, including usage patterns, features used, and order information
• Data for tracking and reporting transactions initiated by advertising partners, including timestamps and identifiers

2.3. Cookies and Other Technologies

We utilize various technologies to collect and store usage and analytics data when users visit SPED Services, including cookies, storing website data, and using web and application telemetry.

Cookies and Website Data:

• Cookies and other website data stored on devices to identify visitors, facilitate website usage, and generate aggregate visitor information
• Cookies help tailor SPED Services and the information provided according to individual user interests
• Users can manage cookie preferences through browser settings, though refusal may affect some SPED Services functionalities

Pseudonymized Identifiers and Tracking:

• Pseudonymized identifiers to track and predict app and service usage and preferences
• Session-only third-party tracking technologies for verifying and reporting transactions initiated by advertising partners
• Users can manage cookie preferences through the cookie banner on SPED websites
• Visitor identifiers can be disabled on iOS and Android mobile devices, and advertising identifiers can be disabled on iOS devices

Third-Party Services:

• We use various third-party analytics, telemetry, marketing, and affiliate services integrated into our user software to enhance functionality and provide better service
• Not all listed vendors may be used at any given time or in all market areas

Please note that not all of the above vendors are necessarily being used at any given time, or in all market areas.

2.4. Sources of Data

We primarily collect personal data directly from you. Additionally, we may obtain your personal data from tax authorities, relevant authorities, users, partners, and service providers when there are legitimate grounds to do so.

SPED may also operate a referral program where Couriers can invite others to join the platform. Through this program, Couriers can send referral links via SMS to their contacts.

2.5. Storage Period

SPED does not retain your personal data longer than legally permitted and necessary for the purposes for which it was collected. The storage period varies depending on the nature of the information and processing purposes. We take steps to ensure data accuracy and delete incorrect or unnecessary personal data.

After termination of the service agreement, personal data may be retained only as long as required by law or reasonably necessary for legal obligations or legitimate interests, such as claims handling and bookkeeping.

We regularly assess the storage period for personal data to ensure it’s stored only for necessary durations.

2.6. Recipients of Personal Data

We do not share your personal data with third parties outside our group companies unless under specific circumstances:

• For legal reasons: Personal data may be shared with third parties if reasonably necessary to meet legal requirements or address crime/security issues. We strive to inform you about such processing whenever possible.
• To users, authorized service providers, and third parties: Personal data may be shared with authorized service providers to fulfill legal and contractual obligations, manage personnel-related obligations, and provide services. This includes sharing necessary data with SPED’s users for delivery purposes and with partners offering products through SPED Services. Personal data may also be shared with insurance companies for accident/liability coverage, subject to your participation in SPED’s insurance program.
• With your explicit consent: Personal data may be shared with third parties outside our group companies when we have your explicit consent. You have the right to withdraw such consent at any time.
• For other legitimate reasons: In case of mergers, acquisitions, or asset sales involving SPED, personal data may be transferred to involved third parties while ensuring confidentiality and notifying affected Couriers.

2.7. Data Transfers to Countries Outside the European Union

While SPED primarily stores personal data within the European Economic Area, we may transfer or process data outside this area due to service providers, operations, and group companies located in various jurisdictions. We take measures to ensure adequate protection for transferred personal data, such as using Standard Contractual Clauses or other safeguards in agreements with service providers.

For more information on data transfers, you can contact us using the provided addresses.

3. YOUR RIGHTS

3.1. How Can You Access, Change, or Delete Your Personal Data?

• Right to Access: You have the right to request access to the personal data we process about you, including purposes and records of data provision to authorized service providers and third parties.
• Right to Withdraw Consent: You may withdraw consent for processing based on your consent at any time.
• Right to Correct: You can request correction or completion of incorrect, incomplete, outdated, or unnecessary personal data.
• Right to Deletion: You may ask for deletion of your personal data, except when legitimate grounds exist to retain it.
• Right to Restriction of Processing: You can request suspension of processing while certain requests are pending or when we lack legitimate grounds for processing.
• Right to Object: You may object to processing based on legitimate interests, unless legitimate grounds exist for continued processing.
• Right to Data Portability: You have the right to receive personal data you provided in a structured, commonly used format.

Please note that restricting or objecting to data processing may affect your ability to work as a Courier on SPED’s platform.

3.2. How to Use Your Rights?

You can exercise your rights by contacting SPED support or sending a letter or email to the address provided above. If you have a SPED account, we recommend using SPED support to facilitate identification. We may ask for additional information to confirm your identity.

We reserve the right to reject requests that are unreasonably excessive or manifestly unfounded.

4. Information Security

We employ administrative, organizational, technical, and physical safeguards to protect the personal data we collect and process. These measures include encryption, pseudonymization, firewalls, secure facilities, and access control systems. Our security controls aim to maintain data confidentiality, integrity, availability, resilience, and ability to restore data. Regular testing of SPED Services, systems, and assets for security vulnerabilities is conducted. Access to personal data by SPED employees is restricted to what is necessary for their work assignments.

5. Direct Marketing

You have the right to opt out of the use of your personal data for direct marketing purposes, market research, and profiling for direct marketing. You can do so by contacting us at the provided addresses or using the unsubscribe option in direct marketing messages.

6. Lodging a Complaint

If you believe our processing of your personal data is inconsistent with applicable data protection laws, you may lodge a complaint with the local supervisory authority for data protection. In Finland, the local supervisory authority is the Data Protection Ombudsman (www.tietosuoja.fi).