Privacy Policy for the GLS App

We are the data controller – how can you contact us?

The GLS app is a service offered by GLS Denmark A/S, CVR no. 10549744, Kokmose 3, 6000 Kolding.

Contact information:

Customer Service
Phone: +45 76 33 11 11
Email: For written enquiries, please visit our website, www.gls.dk , and complete the relevant contact form.

Data Protection Manager:
Email: data-protection@gls-denmark.com

What personal data do we process?

Personal data means any information about a person from which that person can be identified.

The personal data we collect about you and process may include:

• Your name
• Your email address (or several, if you add more than one)
• Your mobile number (or several, if you add more than one)
• Your date of birth
• Your address (optional)
• Your postcode and city (optional)
• Your user ID; if you create a profile, your email will be linked with your user ID
• Your password, if you create a profile
• Parcel number (optional)
• Track & Trace information on your parcels (optional)
• Your purchase history, if you buy labels in the app (optional)
• Information about your device (model, operating system, version, IP-address etc.)
• Your use of the app’s features and duration of your stay on various app pages, including inactivity (if you give us your consent)
• Date and time of registration/login attempts
• Information on whether the registration/login attempt was successful

If you use the label purchase feature in the app, we will, in addition to your information as shipper, also process the consignee’s information:

• Name
• Address (or address of Parcel Shop, if Parcel Shop is selected)
• Mobile number
• Email

What do we use your information for?

We collect the information for the purpose of making the app and its features available to you and presenting content about GLS to you.

Whether or not you create a profile, we use information to manage your registration and add your parcels to the GLS app.

You will be assigned a user ID once you have accepted the terms of use. The user ID will be available to you under your profile.

If you create a user profile, your user ID will be linked with the email you provided when creating the user profile.

We also use your personal data with a created user profile for the following functions:

• Verification of your information in connection with profile creation and any password reset/change
• Automatic addition of parcels in the app
• Shipment history of your parcels
• Display of QR codes directly in the app when purchasing labels
• Automatic display of (profile) information when creating labels

The legal basis for the processing of personal data is the agreement we enter into, cf. Article 6(1)(b) of the General Data Protection Regulation (GDPR).

If we have obtained your consent for data processing, e.g. for the collection and use of your analytical data, the legal basis is Article 6(1)(a) GDPR.

If you have given consent to marketing, your mobile number and email are used for statistics and marketing activities. Furthermore, if you have given consent to push notifications, these will also be used for marketing.
The legal basis for processing your personal data in connection with direct marketing is your consent, cf. GDPR Article 6(1)(a). You can withdraw your consent at any time via the profile function in the app, regardless of whether you have created a user profile or continued with a guest profile. Here you can see what you have consented to and change or withdraw it. You can also click the unsubscribe link in our communication or contact us.

Please note that withdrawal of consent only applies to future data processing and does not affect past data processing.

We also send you service messages that convey a specific message not related to marketing purposes. We rely on GDPR Article 6(1)(f), as it is in both our and your interest to communicate with you in these cases.

When you purchase a label in the app, we process data based on GDPR Article 6(1)(b).

When you use our Track & Trace feature, you can see the parcel’s journey from shipper to consignee, cf. GDPR Article 6(1)(f).

We use your date of birth to provide a more personal experience and to ensure that you are at least 15 years old, cf. GDPR Article 6(1)(f).

If we suspect fraud or misuse of your use of the app or in relation to a parcel delivery or related payments, we will use your personal data to investigate this. The legal basis for processing your personal data is our legitimate interest in preventing and detecting irregularities that may lead to losses for us or third parties, cf. GDPR Article 6(1)(f).

Your data may be included in various analyses and statistics which we use to understand and develop our products and services, but in most cases, your personal data will be aggregated or anonymised.
The legal basis for processing your personal data in connection with analysis and statistics is our legitimate interest in understanding and developing our business, cf. GDPR Article 6(1)(f).

You may participate in various competitions and events via the app. Unless otherwise stated in the respective competition, your data will be used in connection with participation in the competition for the purpose of managing the competition (e.g. selecting the winner, notifying the winner, sending the prize).
This is done based on GDPR Article 6(1)(b).

Who do we share your personal data with?

Your personal data may be shared with external partners (data processors) who process the information on our behalf – for example, by sending our newsletters to you, creating content, performing analyses, or storing your personal data. We enter into data processing agreements with these data processors to continue to guarantee the security and integrity of your data.

Some of your personal data may be handled by our partners (data processors) outside the EU. In such cases, we always ensure that your personal data remains subject to an adequate level of data protection. We have partners located in the USA, and data transfers are protected by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

We may also disclose data to other data controllers to the extent necessary to provide the service you have chosen. This includes the specified payment methods when purchasing a label.

How long do we store your data?

Your personal data is deleted when we no longer need it and are not legally obligated to retain it. Please note that different storage purposes may mean that we store your information for a longer period. This especially applies to legal requirements under accounting or tax law (e.g. the Purchase Act, tax legislation, bookkeeping legislation, etc.). If there are no additional retention requirements, your personal data is deleted once the purpose for which the data was collected has been fulfilled.

We store parcel data for 13 months, after which our purpose expires, and the data is deleted, unless the parcel information must be retained longer to comply with our legal obligations or when processing is necessary for legal claims to be established, exercised, or defended.

If you delete your profile, we will delete the information we are not legally obligated to retain. However, for documentation purposes, we may retain information about your possible consent for up to 2 years.

When you create a user profile, you will be asked to verify your registration through a verification link sent to the email you used for creating your profile. If the registration is not verified within 24 hours, the ID generated during registration will be deleted. In such case, you must initiate a new registration process if you wish to create a user profile.

Google Firebase

Authentication

To protect our registration and login process against attacks or misuse, we use the Google Firebase function Authentication.

When you create a user profile, your registration is assigned an ID in Firebase, which is linked to your email. Your profile registration is only completed once the verification link has been verified.

If you continue as a guest in the app with a guest profile, an ID is also assigned. The ID is assigned when you accept the terms of use.

The legal basis for this data processing is GDPR Article 6(1)(f). Our legitimate interest arises from the purposes of the processing described above.

Analytics

We also use Firebase Analytics, which provides insights into how users interact with the GLS App. We can see which features are used most frequently, how long users stay in the app, and where they exit the app – for the purpose of developing new features and making the app more user-friendly.

We measure the following with analytics:

• Which actions users perform (Events)
• How long users are active
• Which pages they visit
• Device information (Model, operating system, version, etc.)
• How often users open the app
• How often they have parcels in the app
• Label purchases
• Number of active and inactive users
• Number of daily, weekly, and monthly users of the app
• Clicks on campaign banners
• Clicks on buttons in the app
• Visits to individual app pages
• We also use Analytics to test which push notifications perform best or which menu button placement works best.

Processing takes place based on your ID unless you are logged in with a user profile, in which case the ID is linked to a user profile.

The legal basis for this data processing is GDPR Article 6(1)(a).

Crashlytics

Finally, we use Firebase Crashlytics. Crashlytics is a tool that automatically collects and reports app crashes and errors. It helps us identify, analyse, and resolve issues to improve app stability and user experience.

Crashlytics collects the following information:

• Device information: Device ID, model and type, name and version of operating system, and device language

The legal basis for this data processing is GDPR Article 6(1)(a).

Your Rights

To ensure transparency in the processing of your personal data, we as the data controller must inform you of your rights.

Right of access

You have the right to access the personal data we process about you, including which data we have registered about you, the purposes of the registration, which categories of personal data and any recipients the data may be shared with, and information on the source of the data.
You have the right to receive a copy of the data we process about you.
You may send a written request to data-protection@gls-denmark.com.
You will be asked to verify your identity.

Right to rectification

You have the right to have inaccurate personal data about yourself corrected.
If you become aware of any errors in the information we have registered about you, we encourage you to contact data-protection@gls-denmark.com so the information can be corrected.

Right to erasure

In certain cases, you have the right to have all or some of your personal data deleted. This may be the case where you withdraw your consent, and we no longer have another legal basis for processing. To the extent that continued processing is necessary, e.g. to comply with our legal obligations or to establish, exercise, or defend legal claims, we are not required to delete your data. If you contact data-protection@gls-denmark.com to request deletion, you will be asked to verify your identity.

Right to restriction of processing

In certain cases, you have the right to request that the processing of your personal data is restricted to storage only. You must contact data-protection@gls-denmark.com if you wish to exercise this right.

Right to data portability

You have the right to receive the personal data about you that we process based on your consent or in connection with the performance of a contract, in a structured, commonly used, and machine-readable format. If you request a direct transfer to another controller or entity, this will only be carried out if technically possible.

Right to object to collection of personal data under special circumstances and to direct marketing

If the processing of personal data is based on GDPR Article 6(1)(a) or (f), you have the right to object at any time to the processing of your personal data due to reasons related to your particular situation. This also applies to profiling based on these provisions. The respective legal bases can be found in this privacy policy.

If you object, we will no longer process the relevant personal data, unless we have compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing is necessary for legal claims to be established, exercised, or defended.

If your personal data is processed for direct marketing purposes, you have the right to object at any time. If you do so, your personal data will no longer be used for direct marketing.

Withdrawal of your consent to processing of personal data

If you have given your consent to the processing of certain personal data, you may withdraw this consent at any time. You can do so by deactivating consent in the "Profile" function in the App or by sending us an email at data-protection@gls-denmark.com.

If you choose to withdraw your consent, it will not affect the legality of our processing based on your previously given consent up until the time of withdrawal. Withdrawal will therefore only take effect from that time.

Right to lodge a complaint with the competent supervisory authority
If you wish to complain about how we handle your personal data, you may always contact us at data-protection@gls-denmark.com.
You may also submit a complaint to your local data protection authority. (You can find the contact details for the Danish Data Protection Agency at www.datatilsynet.dk )