Personal data and cookies

Legal bases

Version No. 001 dated 06/11/2025

Department responsible for publication: Hexa-GO

1. Who processes your personal data?

Hexa-GO (hereinafter “we” or “the Company”) places the protection of your personal data at the heart of its priorities.

This Privacy Policy sets out the principles and guidelines for the protection of your Personal Data and aims to inform you about:

• The Personal Data we collect and why we collect it,
• How your Personal Data is processed,
• Your rights regarding your Personal Data.

We are committed to complying with applicable personal data regulations, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”), as well as all applicable national regulations (“the Regulation”).

2. What personal data is processed by our services?

We commit to collecting only the data that is strictly necessary for the direct or indirect provision of the subscribed services when these require the processing of personal data of our clients (or our clients’ customers). When optional data is requested, we will clearly inform you which Personal Data is required and which is voluntarily provided by you.

The Company mainly processes Personal Data collected directly from you, such as:

• Identification data: title, last name, first name, postal address, email address, phone number. For business clients: the above + company name, VAT number.
• Connection data: logs, browsing data, etc.

3. Why do we process your personal data?

We commit to processing your personal data for specific, explicit, and legitimate purposes, and not to process it in a manner incompatible with those purposes.

Legal bases:

Each processing activity carried out by the Company, as Data Controller, is based on at least one of the legal bases defined by the Regulation:

• Performance of a contract to which the data subject is a party, or pre-contractual measures taken at their request,
• Compliance with legal and regulatory obligations applicable to the Company,
• Protection of vital interests of the data subject or another natural person,
• Performance of a task carried out in the public interest,
• Legitimate interests pursued by the Company, provided that the interests, freedoms, and fundamental rights of the data subject are respected,
• And/or the consent of the data subject for one or more specific purposes.

Purposes:

We process your Personal Data for the following purposes, based on the legal grounds detailed in the table below:

• Managing the commercial relationship between clients and Hexa-GO
• Allowing clients and visitors to contact customer support
• Managing clients’ address books
• Allowing clients to submit claims
• Providing clients access to their secure account
• Allowing clients to track the receipt of their parcels
• Allowing clients to request parcel consolidation
• Allowing clients to request a parcel photo verification
• Allowing clients to subscribe to a Premium plan
• Allowing clients to request and track parcel shipments
• Conducting statistics and satisfaction surveys
• Carrying out commercial prospecting
• Sending newsletters and/or automated emails (subject to prior consent)
• Complying with international regulations regarding embargoes and economic/financial sanctions targeting terrorism, fraud, money laundering, arms and drug trafficking
• Managing rights requests

4. How long is your personal data stored?

The retention period of your personal data depends on the subscribed products and services and the processing carried out by the Company. We commit not to retain your Personal Data longer than necessary to provide those services, in accordance with your contract.

Some of your Personal Data may be retained for longer periods in compliance with legal or regulatory obligations, or to respond to requests from authorities or authorized third parties.

When Personal Data is used for several purposes and subject to different retention periods, the longest retention period applies.

After these periods, we delete your Personal Data in accordance with our internal policy or anonymize it for statistical purposes.

5. How is your Personal Data protected?

In accordance with applicable regulations, we commit to implementing all appropriate technical and organizational measures to ensure a level of security adapted and proportionate to the risks. These measures (e.g., segmentation, anonymization, encryption, restricted access) aim to guarantee the confidentiality, integrity, availability, and resilience of your Personal Data.

The Company ensures that data protection is integrated “by design” into new products and services.

As the data controller, we notify the competent authority—the CNIL—of any personal data breach without undue delay, and where feasible within 72 hours after becoming aware of it. Any breach likely to result in a high risk to your rights and freedoms will also be notified to you without delay.

6. With whom is your Personal Data shared?

Your Personal Data is collected directly from you and used only for purposes that have been communicated to you.

It may be shared with:

• Subsidiaries of the Company and internal departments responsible for providing the subscribed services (Customer Service, Commercial Department, etc.)
• Subcontractors, partners, or service providers acting on your behalf or ours
• Commercial partners (after informing you and allowing you to consent via a checkbox)
• Authorized administrative or judicial authorities or other authorized third parties (lawyers, auditors, etc.) to comply with legal obligations

Some Personal Data may be collected indirectly from:

– Clients (information about subscribers, beneficiaries, contacts, recipients), necessary for providing subscribed services

– Third parties such as anti-fraud organizations, data providers, international organizations (World Customs Organization), members of the Universal Postal Union

In case of indirect collection, the Company commits to informing individuals as required under Article 14 of the GDPR.

Some services may be used by minors. In such cases, minors must obtain consent from their parents or legal representatives.

7. Is your Personal Data transferred outside the European Union?

We process all Personal Data within the European Union.

However, for certain specific services, we may use subcontractors, partners, or subsidiaries located outside the EU. In such cases, Personal Data is transferred strictly as needed to perform their tasks.

We commit to implementing all appropriate safeguards required by applicable regulations to secure such transfers.

8. What are your rights and how can you exercise them?

When we collect your Personal Data, you receive clear and transparent information on how your data is processed and how you can exercise your rights. You may exercise these rights under the conditions defined by the Regulation.

Your rights include:

• The right to access your Personal Data, including requesting information about:
• the categories of data processed,
• the purposes of the processing,
• the recipients or categories of recipients of your data,
• when possible, the data retention period, or where not possible, the criteria used to determine it;
• The right to have inaccurate or incomplete Personal Data corrected;
• The right to object at any time to the processing of your Personal Data;
• The right to be forgotten (erasure of your Personal Data);
• The right to request restriction of processing;
• The right to request your Data in a structured, commonly used, machine-readable format to transmit it to another controller (data portability);
• The right to define instructions regarding the handling of your Personal Data after your death;
• The right to withdraw your consent at any time (for processing based on consent), including for commercial prospecting.

Any request must include your first name, last name, and the address to which you wish to receive the response. Proof of identity may be required.

You may exercise your rights:

– By email: contact@hexa-go.com

– By post: 33 boulevard Tisseron, 13014 Marseille, France

The Company commits to responding as soon as possible and within legal deadlines.

If you believe, after contacting us, that your rights are not respected, you may lodge a complaint with the CNIL:

CNIL – 3 place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07

Or by phone: 01 53 73 22 22

You are informed of the “Bloctel” telephone marketing opt-out list: https://conso.bloctel.fr

9. How to contact our Data Protection Officer (DPO)?

Hexa-GO has appointed a Data Protection Officer (DPO) registered with the CNIL.

You may contact the DPO at:

Data Protection Officer

Juliette Pairé, admin@hexa-go.com, 04 12 33 30 31

Glossary

“Personal Data”: Any information relating to an identified or identifiable natural person.

“Recipient”: Any service, company, or organization that receives and can access your Personal Data.

“The Company”: The legal entity responsible for drafting this Policy.

“Privacy Policy / Personal Data Protection Policy”: This document outlining the measures implemented for processing and managing your Personal Data.

“Data Controller”: The Company responsible for processing your Personal Data.

“Processing”: Any operation or set of operations performed on Personal Data.

“Personal Data Breach”: Any breach resulting in accidental or unlawful destruction, loss, alteration, disclosure, or unauthorized access.

“Processor”: Any natural or legal person, public authority, service, or organization processing personal data on behalf of the data controller.