Privacy Policy

1. Identity of the Data Controller

This Privacy Policy applies to personal data processed by the following controllers, depending on where the person is located:

For leads in France: Citibox France SAS — SIRET / RCS number: 853265577 — Registered office: 43, Avenue de la Grande Armée, 75116 Paris (France) — Email address: citiboxfr@citibox.com.

For leads in Germany: Citibox DE GmbH — Commercial register number: [LEGAL_TODO_DE_REGISTER: to be supplied by legal] — Registered office: [LEGAL_TODO_DE_ADDRESS: to be supplied by legal] — Email address: citiboxde@citibox.com.

2. Data processed and individuals concerned

Citibox France SAS (France) and Citibox DE GmbH (Germany) each operate a network of Pick-Up/Drop-Off Points ("PUDOs"), in partnership with carriers (including Amazon Hub Counter), allowing parcel recipients to collect their shipments at partner local stores.

2.1 Managers and employees of partner stores (PUDOs) — Acting as data controller, Citibox France SAS (France) or Citibox DE GmbH (Germany) collects: surname, first name, store company name, postal address, email address, phone number, bank details required to pay the remuneration (€0.25 per parcel handled), volume of parcels handled, opening hours, storage capacity.

2.2 Parcel recipients (end users) — As part of its activity as a pick-up point network on behalf of partner carriers (in particular Amazon Hub Counter), Citibox France SAS or Citibox DE GmbH may process, as a data processor: parcel identifier, collection code, drop-off and pick-up timestamps, contact details transmitted by the partner carrier in case of incident.

2.3 Website visitors — Through browsing and the use of cookies, Citibox France SAS or Citibox DE GmbH collects browsing data in accordance with its Cookie Policy.

2.4 Persons who submit the contact form (Leads) — When you submit the "Become a pickup point" form, Citibox France SAS (leads in France) or Citibox DE GmbH (leads in Germany) collects: name, business name, postal address, email and phone in order to be contacted by the sales team.

3. Purposes and legal bases of processing

3.1 Management of the PUDO network (store managers) — Purpose: management of contractual relationships, payment of remuneration, incident management, operational support. Legal basis: performance of the contract (Art. 6.1.b GDPR); legal obligation (Art. 6.1.c GDPR) for accounting and tax data.

3.2 Parcel handling on behalf of partner carriers — Purpose: operational handling, traceability, incident management. Legal basis: performance of the data processing agreement (Art. 6.1.b GDPR).

3.3 Operation of the website and cookies — Purpose: ensure proper technical operation, analyse audience, improve user experience. Legal basis: legitimate interest (Art. 6.1.f GDPR) for strictly necessary cookies; consent (Art. 6.1.a GDPR) for analytics and marketing cookies.

3.4 Handling of requests and complaints — Purpose: respond to information requests, complaints, and the exercise of rights. Legal basis: legitimate interest (Art. 6.1.f GDPR) and legal obligation (Art. 6.1.c GDPR).

3.5 Handling of partnership applications (contact form) — Purpose: contact stores who have expressed an interest in joining the network, share eligibility conditions, schedule a sales call, and send you the emails of the onboarding journey. Legal basis: consent given via the checkbox (Art. 6.1.a GDPR) for the Lead Welcome Email; pre-contractual steps taken at your request (Art. 6.1.b GDPR) for the Onboarding Reminder and the Invalid Document Notice.

4. Data retention period

PUDO managers' data (contractual data): duration of the contractual relationship, then 5 years from the end of the contract (statute of limitations under ordinary law, Art. 2224 of the French Civil Code).

Accounting and tax data: 10 years in accordance with the French Commercial Code.

Operational parcel traceability data: duration set by the partner carrier under the data processing agreement.

Browsing data and cookies: in accordance with the Cookie Policy (maximum 13 months as recommended by the CNIL).

Partnership-application data (Leads): 12 months from the last sales interaction, then deleted unless converted into a contractual relationship.

Incident-recovery log for the contact form (failure cases only): 30 days maximum, on a restricted-access log bucket, used solely to recover the Lead. See section 5 for details.

5. Recipients, international transfers and technical processors

Personal data processed by Citibox France SAS or Citibox DE GmbH may be disclosed to the following categories of recipients:

— Partner carriers (including Amazon Hub Counter): for the operational management of parcels, under data processing agreements.

— Technical and IT service providers: Google Cloud Platform (hosting), Odoo (CRM, processing of the leads submitted through the contact form), Cloudflare Turnstile (anti-bot verification of the contact form), and PostHog (audience measurement, hosted in the European Union), used only after you consent via the cookie banner. Each processor operates under a GDPR-compliant Data Processing Addendum.

— Competent authorities: insofar as disclosure is required or mandatory under applicable law (judicial authorities, tax administrations).

International data transfers: Citibox France SAS and Citibox DE GmbH undertake to transfer personal data to third countries only where appropriate safeguards are in place, in accordance with Articles 44 to 49 of the GDPR (adequacy decisions, European Commission standard contractual clauses, etc.).

Incident-recovery log for Lead recovery: if our submission infrastructure fails to record your contact-form request, we may temporarily store the form contents (name, email, phone, business name, address) in our incident-response logs for up to 30 days, solely to manually recover the Lead. Access to these logs is strictly limited to our SRE team and audit-logged. This measure is based on legitimate interest (Art. 6.1.f GDPR) in honouring a request you initiated with us.

6. Rights of data subjects

In accordance with the GDPR and the French Data Protection Act, any person whose data is processed by Citibox France SAS or Citibox DE GmbH has the following rights: right of access (Art. 15), right to rectification (Art. 16), right to erasure (Art. 17), right to restriction of processing (Art. 18), right to data portability (Art. 20), right to object (Art. 21), right to withdraw consent at any time.

To exercise these rights, you may send your request by email to citiboxfr@citibox.com (leads in France) or citiboxde@citibox.com (leads in Germany), stating the right you wish to exercise and attaching a copy of an identity document.

The response time is one (1) month from receipt of the request, which may be extended by two additional months in the case of complex or numerous requests (Art. 12 GDPR).

If you consider that your rights are not being respected, you may lodge a complaint with the French Data Protection Authority (CNIL): www.cnil.fr — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

7. Security measures

Citibox France SAS and Citibox DE GmbH implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. These measures include in particular data encryption in transit and at rest, access control based on the principle of least privilege, and security incident management procedures.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of the persons concerned, Citibox France SAS and Citibox DE GmbH undertake to notify the competent supervisory authority (the CNIL for Citibox France SAS) within 72 hours in accordance with Article 33 of the GDPR.

8. Amendments to the privacy policy

Citibox France SAS and Citibox DE GmbH reserve the right to amend this Privacy Policy at any time, in compliance with applicable regulations. Any substantial amendment will be communicated to the persons concerned through publication on the Site or by any other appropriate means of communication.