This Privacy Notice set outs the basis on which we process personal information here at DX, whether that information is provided to us by you directly or from a third party.
This Privacy Notice does not apply to our employees, contractors, workers or candidates for employment or engagement (for whom we have separate, internal privacy notices).
Our contact details
DX (Group) Plc, a company registered in the United Kingdom, company number 08696699, whose registered office is at Ditton Park, Riding Court Road, Datchet, Slough, England SL3 9GL.
Dated January 2021
The type of personal information we collect
We currently collect and process the following information:
- Personal identifiers, contacts and characteristics (for example, name, contact details and physical address);
- Geographic Location;
- Telephone audio recordings;
- CCTV video recordings;
- Social media or other online identifying tokens or handles;
- Usernames and passwords; and
- Website usage data (for example, Internet Web browser type and version, operating system, referral source and pages visited)
How we get the personal information and why we have it
Most of the personal information we process is provided to us by organisations that enter into a contract with DX for DX to provide services to them for one or more of the following reasons:
- To enable us to provide collection, delivery and tracking services of letters, parcels and freight items to their customers;
- To enable us to provide delivery, or delivery and installation services of items to the organisations’ customers.
We also receive personal information directly from you for one or more of the following reasons:
- Where your organisation has assigned you a DX account to access any of our interactive online systems;
- When you communicate with us in the context of an employee or worker representing an organisation that has procured DX products and services;
- When you communicate with us directly as an individual or as a customer of an organisation that has procured DX products and services;
- When you communicate with us as an individual to exercise your rights;
- As a consequence of your usage of any of DX online services or mobile applications; and
- When video images are recorded by our CCTV equipment located in vehicles and buildings that are owned or operated by DX.
We use the information that you have given us in order to:
- enable DX online systems that you access to manage your login sessions, store and retrieve your preferences and send notifications to you as part of a registration process or other system events related to the operation of the system or provided services which may include resetting your password, notification of system maintenance, notification of password expiry, confirming a supplied email address is valid, sending you service consumption or other information you have requested;
- respond to communications from you relating to products and services we provide to an organisation you represent, directly to you as an individual or as a customer of an organisation;
- examine and identify website and mobile application usage patterns to enable DX to improve our products and services; and
- detect and prevent criminal activity and assist in claim management.
We may share the personal information
We do not sell or otherwise share personal information, except as described in this Privacy Notice. We may share shipping and tracking information with third parties such as senders and recipients to perform collection and delivery services. We also may share personal information with third parties who are instructed to perform services on our behalf.
We may share this information with the organisations listed in the “List of Sub-processors” which can be located here:
International transfers of personal information
We do not transfer personal information out of the United Kingdom or the European Economic Area.
Our lawful basis for processing personal information
Under the General Data Protection Regulation (GDPR) including the UK adopted post Brexit version, the lawful basis we rely on for processing this information will vary depending on the context of how the information was collected or provided to us and the purpose for which the information was provided:
Where the use of our or third-party systems required your consent prior to the collection and processing of your information our lawful basis is:
(a) Your consent.
You are able to remove your consent at any time and you can do this by contacting firstname.lastname@example.org
This may arise for example when you are completing online forms, using our mobile applications or webchat system.
Where we provide services directly to you our lawful basis is that:
(b) We have a contractual obligation.
This may arise for example when you request a premium delivery option directly from DX.
Where your information is provided to DX by an organisation whom DX provides products and services to, our lawful basis is:
(c) We have a legitimate interest.
This may arise for example when DX delivers a letter, parcel or other item addressed to you.
How we store your personal information
DX maintain operational, technical and physical safeguards designed to protect personal information against accidental, unlawful or unised destruction, loss, alteration, access, disclosure or use. This personal information is securely stored in ISO27001 certified UK datacentres.
Personal information that is located on the outside of a package or letter may be visible to others when not located in vehicles or facilities we operate.
How long we retain personal information for
Collection and delivery contact, event and proof of delivery information is retained for 12 months from the time of the activity completion. Thereafter such information will be anonymised in a manner so that it is not possible to reverse the anonymisation method or link with any other data to derive an individual’s identity.
CCTV recordings are retained for 90 days. The video files are deleted from all systems.
Personal information contained in communications you make with us as an individual are retained for 90 days from the date of receipt unless such information is the subject of a claim or any legal action. DX will then retain such information for up to 90 days post completion of the claim or legal action. Following this, such information will be deleted from our systems and all paper copies securely shredded.
Personal information contained in communications you make with us while acting on behalf of an organisation will be retained for 7 years from the date of contract termination. Following this, such information will be deleted from our systems and all paper copies securely shredded.
DX online interactive account and preference information will be retained for the duration of the service provision and then deleted 30 days after services provision ends.
Website and application usage information will be retained for 30 days. Thereafter such information will be anonymised in a manner so that it is not possible to reverse the anonymization method or link with any other data to derive an individual’s identity.
Your data protection rights
Under data protection law where you have provided your information directly to DX and not via another organisation you have rights that include:
Your right of access - You have the right to ask us for copies of your personal information where you have provided such.
Your right to rectification - You have the right to ask us to rectify personal information that you think is inaccurate. You also have the right to ask us to complete information that you think is incomplete.
Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation or to you in certain circumstances.
If you wish to exercise your rights and it relates to personal information you provided to another organisation that contracted with DX for DX to deliver an item to you then you must exercise your rights directly with that organisation.
You are not required to pay any charge for exercising your rights. If you do make a request we have one month to provide you with a response.
Please contact us at email@example.com if you wish to make a request.
How to complain
If you have any concerns about our use of your personal information you can make a complaint to us at firstname.lastname@example.org.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk