INFORMATION ON PERSONAL DATA PROTECTION
With the coming into force of the EU Regulation no. 679/2016, "relative to the protection of
natural persons as regards the processing of personal data, as well as the free circulation of
such data and abrogating the directive 95/46/EC" (hereafter "Regulation" or "GDPR"), the
Company indicated in the bill of lading letterhead, as Data Controller, is bound to provide
information concerning the methods and purposes of processing personal data.
The table below gives a brief summary of the content of the information notice subsequently
||The Company indicated in the bill of lading
||Conclusion, management and execution of
goods transport contract
||Fulfilment of the contract and legal
||Possible, where adequate guarantees
safeguarding the data subject's rights exist
|Data subject's rights
||a. to access personal data;
b. to obtain the rectification or erasure of
data or limit the processing thereof;
c. to object to the processing of personal
d. to obtain the portability of such data;
e. to complain to the appropriate control
authority (e.g. Data Protection Authority);
rights which can be exercised by writing to:
The Data Controller has designated a Data Protection Officer (DPO), having specialist
knowledge of legislation and standard practices in the matter of data protection, who is
therefore qualified to perform the tasks as per Article 39 of EU Regulation no. 679/2016
1. Subject of the processing
We would hereby inform you, in accordance with Art. 13 GDPR, that the identifying, non-
sensitive personal data (i.e. name, surname, tax ID, VAT number, e-mail, telephone no. etc.)
provided by you to this Company, or otherwise acquired by the same in compliance with the
current legislative and contractual provisions - concerning, related and/or instrumental to the
freight transport contract - may be subject to processing in compliance with the
aforementioned legislation and requirements of confidentiality.
The processing operations concern:
- personal and contact data of Shippers, Consignees and Notifiers, Customers, Invoice
2. Purposes of the processing which the data is intended for (Art. 24 letters a, b, c
Personal data Protection Code and Art. 6 letter b, and GDPR)
Such data will be processed for purposes related to the mutual obligations deriving from the
freight transport contract in force with you.
In particular, the data will be processed:
- to manage requests for quotes;
- for the conclusion, management and execution of the operations connected with the
freight transport contract;
- to send logistical information on the journey (e.g. delays, departure quay, etc.);
- for the transmission of your data to shipping agencies, terminals and port authorities,
legal authorities and police forces;
- for the extraction of statistical information in anonymous form.
3. Data processing methods (Art. 4 Personal Data Protection Code and Art. 5
We also inform you that the personal data concerning you will be processed, including using
electronic means, in compliance with the methods indicated in the GDPR, which provides,
among other things, that the data must be:
- processed according to the principles of lawfulness, transparency and fairness;
- collected and recorded for specific, explicit and legitimate purposes ("purpose
- adequate, relevant, and limited to what is necessary in relation to the purposes for
which they are processed ('data minimisation');
- accurate and kept up to date ("accuracy");
- kept for no longer than is necessary for the purposes for which the personal data are
processed ("retention limitation");
- processed using instruments that ensure the security and confidentiality of the
personal data, including protection against unauthorised or unlawful processing and
against loss, destruction or damage, or accidental damage ('integrity and
Personal data is stored as shown in the table below.
||Purpose of storage
Address of residence
Vehicle number plate
Vehicle make and model
|10 years from end of
||For accounting purposes, and
to challenge any disputes that
may be raised against the
4. Legal basis
The legal basis of the processing listed above from point 1 to point 3 of paragraph 2 "Purpose
for which the data will be processed" lies in the fulfilment of contractual obligations,
precontractual measures and the law in order to manage the freight shipping contract.
With regard to point 4 of paragraph 2 "Purposes of processing that the data is intended for",
this falls within the scope of the data controller's obligations in terms of the law and public
interest in protecting port security.
5. Data transfer
Please note that your data may be disclosed, as well as to other companies belonging to the
Grimaldi Group, also to entities established in third countries, even outside the territory of the
European Union, subject to compliance with specific procedures.
With reference to EU countries, your data may be disclosed to the port authorities, judicial
authorities, and police forces, shipping agents and terminals situated in the whole EU.
With regard to countries outside of the EU, data may be transferred to the recipients listed
above operating in:
Great Britain, Switzerland, Russia, Tunisia, Algeria, Morocco, Libya, Egypt Turkey, Israel,
Syria, Lebanon, Senegal, Benin, Nigeria, Ghana, Ivory Coast, Gambia, Guinea, Sierra Leone,
Liberia, Togo, Cameroon, Gabon, Congo, Angola, Burkina Faso, Mauritania, Equatorial
Guinea, Central African Republic, Chad, Madagascar, Saudi Arabia, United Arab Emirates,
Abu-Dhabi, Qatar, South Korea, Japan, USA, Canada, Mexico, Brasil, Uruguay, Argentina,
In the case of emergency stopovers, your data could be communicated to countries other than
those listed above.
More specifically, disclosure of your data to shipping agencies could take place insofar as it
acts in representation of the shipowner in transferring data to the Competent Authorities (e.g.
Port Authorities, Financial Police Force and Customs).
Additionally, the Company may disclose data directly to the Authorities specified.
As regards the terminal, on the other hand, there is an obligation whereby it must carry out
specific controls on objects to be embarked or disembarked.
With reference to transfers that may take place in countries like Israel, Uruguay, Argentina,
the USA and Canada, the European Commission has ruled that the transfer shall be legitimate
by specific decision of adequacy in accordance with Article 25, paragraph 6 of Directive
In other countries, however, where the GDPR applies, data transfer will be regulated in
accordance with the principles established by the Regulation in the contractual relations
carried out by the Company indicated in the bill of lading letterhead.
6. Data disclosure
Please also note that said personal data processing relating to, connected with and/or
instrumental to the freight shipping contract may envisage access to said data by:
- public authorities;
- legal authorities and police forces;
- ticket offices, terminals and shipping agencies for the organisation of
- law firms, if disputes should arise;
- insurance companies;
- experts in the event of a claim;
- companies, including Grimaldi Group companies supplying other essential services to
freight shipping provisions, such as roadside maintenance, repair and assistance, the
hosting of web systems and sites, e-mail services, audit services and data analysis.
It may also be necessary for you - on the basis of laws, legal proceedings, disputes and/or
requests made by public or government authorities within or outside your country of
residence, purposes of national security or other matters of public importance - to disclose
your personal data. Where lawfully possible, we will inform you before any such disclosure.
We may also disclose your personal data if we establish in good faith that said disclosure is
reasonably necessary in order to enforce and protect our rights and activate available
7. Data Subject's Rights (Art. 7 Personal Data Protection Code and Arts 15 - 21
Lastly, we inform you that the data subject may, at any time, exercise the rights:
a. access to personal data, requiring that such data be made available to you in an
intelligible form, as well as the purposes of the processing (former Art. 15);
b. to obtain the rectification (former Article 16) or the erasure (former Art. 17) of the
same or the limitation of processing (former Art. 18);
c. to data portability (pursuant to Art. 20);
d. to object to data processing (pursuant to Art. 21);
e. to lodge a complaint with the competent supervisory authority.
The above rights can be exercised by e-mailing a request to email@example.com
In this regard, please also note that the Data Protection Officer appointed by the Company
can be contacted by e-mail at DPO@aclcargo.com
8. Nature of data provision and consequences of a potential failure to disclose the
Data provision is necessary in order to ensure the correct fulfilment of our contractual and
precontractual obligations; failure to supply such will make it impossible to stipulate the
freight transport contract you have requested and to properly fulfil legal obligations and those
deriving from the public interests in protecting security at ports.