STEP UP PRIVACY NOTICE

STEP UP is an internship program managed by FedEx and offered in collaboration with other participating companies.

Your trust matters to us. That’s why we protect your personal data and use it responsibly at FedEx Express International B.V. and its operating groups, subsidiaries and divisions, including any TNT company (“FedEx”).

At FedEx, we are committed to protecting your privacy and the security of your personal data. FedEx has created this privacy notice (“STEP UP Privacy Notice”) to explain how FedEx collects and uses personal data, which is any information that relates to an identified or identifiable natural person (“Personal Data”).

Last update: 9 June 2023

When this STEP UP Privacy Notice mentions “FedEx”, “we”, “us”, or “our”, FedEx is referring to the FedEx company that is deciding on the purposes and means of the processing of your Personal Data under this STEP UP Privacy Notice. Your Personal Data is controlled by FedEx Express International B.V.

Notwithstanding your right to contact the local FedEx company, you always have the right to contact the following FedEx company directly, which are also available to deal with requests for information, applications or complaints:

FedEx Express International B.V.
Attn: Legal Department
Taurusavenue 111
2132 LS Hoofddorp
The Netherlands

Please use this link and let us know if you are a STEP UP Inclusive Internship Program Applicant if you would like to exercise any of your rights related to your Personal Data.

This Privacy Notice answers the following questions:

1. Does this STEP UP Privacy Notice apply to you?
2. What Personal Data does FedEx collect?
3. Does FedEx use cookies?
4. Why does FedEx process Personal Data?
5. Who has access to your Personal Data?
6. How long will FedEx process your Personal Data for?
7. What measures does FedEx take to protect your Personal Data?
8. Where does FedEx store or transfer your Personal Data?
9. What rights can you exercise in relation to your Personal Data?
10. What if you have other questions or complaints?
11. Will there be updates to this Privacy Notice?

The STEP UP Privacy Notice applies to you when you visit the STEP UP Program Website, such as https://www.stepup-program.com/, including any (sub)pages (hereafter “Website”) and/or apply for the STEP UP Inclusive Internship for Law Students Program.

FedEx may ask you to submit the following Personal Data when you visit our Website and you apply for a position in the STEP UP Program:

• Contact information. Such as your name, address, e-mail address and phone number;
• Personal details, which includes gender, date of birth and nationality;
• Cover or application letter;
• (Content of) C.V. / résumé;
• Personal statement;
• Information related to education, training and career development, which includes your educational and professional background, any courses or trainings you may have followed or certifications you may have attained;
• Correspondence and communications data between FedEx and you, which includes email correspondence, internet traffic data and your IP address.
• Automatically generated information. This will include IP address, unique device or user ID, system and browser type, date and time stamps, referring website address, gender, age, origin country and on-site/app activities, such as content and pages you accessed on our Websites or mobile apps, dates, times and locations actions take place, click-stream information and device location (if you turn on the feature in the mobile app).

Yes, FedEx uses cookies and similar technologies on its Websites. Through these cookies, FedEx automatically obtains Personal Data as listed above when you visit our Websites. To learn more about the cookies and similar technologies, please consult our Cookie Notice.

FedEx will only collect and process Website visitor information based on your informed consent and on our legitimate interest for the business purposes of improving our marketing and communications strategy.

FedEx will use the Personal Data which you voluntarily submit as a STEP UP candidate for the sole purpose of the application procedure. FedEx is allowed by data protection laws and regulations to use your Personal Data for this purpose in order to pursue our legitimate business interests to recruit new employees and to take preparatory steps prior to entering into a contract with you on the basis of the legal grounds set out below.

Personal Data shall be collected, used, stored or otherwise processed when necessary within the framework of responsible, efficient and effective business management by FedEx. FedEx processes Personal Data based on applicable legal ground(s). This legal ground might be intrinsically linked to the business purpose. This means, for example, that the steps taken at your request prior to entering into an agreement with you can be both a legal ground and a business purpose for FedEx to process Personal Data. Therefore, we will first clarify the legal ground(s) on which FedEx processes your Personal Data and, subsequently, the business purpose(s) that we use your Personal Data for.

Legal Grounds
FedEx processes your Personal Data during its application process, based on one of the following grounds:

• The processing is necessary to perform our contractual obligations with you or in order to take steps at your request prior to entering into a contract.
• The processing is necessary for us to comply with our legal obligations (laws, regulations and sector specific guidelines to which FedEx is subject).
• The processing is necessary to protect your vital interests or of other individuals.
• The processing is necessary for the legitimate interest of FedEx, except where such interests are overridden by your interests or fundamental rights and freedoms, or
• Where appropriate and required, we will ask for your consent.

Business Purposes

FedEx shall only collect, use or otherwise process Personal Data if the processing falls within the scope of one (or more) of the following legitimate business purposes:

1. Recruitment. This includes recruitment activities necessary to attract possible candidates to apply for a position with FedEx, to conduct the application process and take such steps as necessary prior to entering into a contract with you.
2. Pre-Employment Screening. This includes processing that is necessary in order to assess whether your employment at FedEx will violate any applicable laws, will expose FedEx to any financial, legal or other risks; and/or whether your representations to us regarding your employment history and education background have been truthful.
3. Compliance with legal obligations. This addresses the processing of Personal Data as necessary for compliance with laws, regulations and sector specific guidelines to which FedEx is subject and the processing of Personal Data that is necessary for compliance with internal FedEx policies. This includes processing that is necessary as part of whistle-blowing obligations, the Pre-Employment Screening and the matching of the names of employees with names on so-called designated party lists.

Conditions for the processing of special Personal Data
FedEx will only process special categories of Personal Data for Pre-Employment Screening purposes (as mentioned in paragraph 2) if it has a legal ground to do so. Furthermore, FedEx will meet one or more of the following separate conditions:

• The processing is necessary for the purposes of carrying out the obligations and exercising specific rights of you or FedEx in the field employment and social security and social protection law;
• The special Personal Data was manifestly made public by you;
• The processing is necessary for reasons of substantial public interest; or
• The processing is necessary for the establishment, exercise or defense of legal claims or whenever courts are acting in their judicial capacity.

FedEx shares your Personal Data with third parties in the following circumstances:

• When we have obtained your consent, with partner companies that are part of the STEP UP internship program;
• With its affiliates, operating groups, subsidiaries and divisions, or with third parties if such is necessary for the purposes as listed above, which includes performing Pre-Employment Screening.

If appropriate, FedEx will require third parties to conduct activities in a manner consistent with FedEx policies and guidelines in relation to data protection.

• With data processors, i.e. parties processing Personal Data on our behalf. In such cases, these third parties are only allowed to use your Personal Data for the purposes described above and only in accordance with our instructions. FedEx will only use processors which provide sufficient guarantees to implement appropriate technical and organizational measures and ensure the protection of the rights of data subjects.
• With its employees if and to the extent necessary for the performance of their tasks. In such a case, access will be granted only if and to the extent necessary for the purposes described above and only if the employee is bound by confidentiality.
• If and when required to do so by law, court order, or other legal process, for example, with law enforcement agencies or other governmental agencies, to establish or exercise our legal rights or in connection with a corporate transaction, such as a divesture, merger, consolidation, or asset sale, or in the unlikely event of insolvency.

We will retain your Personal Data no longer than necessary for the purpose(s) for which we process your Personal Data in accordance with our retention policies and in accordance with (local) law. After the retention period we will delete or anonymize your Personal Data, unless we need to retain certain of your Personal Data for another purpose. We will only do so if we have legal grounds to retain your Personal Data. We will also ensure that Personal Data are only accessible for that other purpose.

For example, we need your Personal Data to complete the STEP UP application process if you apply for a STEP UP internship position at FedEx. FedEx retains your Personal Data which you submit when applying for a position until four weeks after the application process has ended, or – with your consent – for two years after the application process has ended.

Please contact us using the contact details above if you have questions about specific retention periods.

FedEx has taken appropriate technical and organizational measures to protect your Personal Data against accidental or unlawful processing, including by ensuring that:

• Your Personal Data is protected against unauthorized access;
• The confidentiality of your Personal Data is assured;
• The integrity and availability of your Personal Data will be maintained;
• Personnel are trained in information security requirements; and
• Actual or suspected data breaches are reported in accordance with applicable law.

Due to the fact that we operate in many countries around the world and have international systems for employees in place, FedEx may need to transfer your Personal Data to locations outside the country where you reside. In any case where we transfer Personal Data, FedEx shall ensure that such a transfer is subject to appropriate safeguards.

Transfers of Personal Data originating from the European Economic Area (‘EEA’) to operating groups, subsidiaries and divisions within FedEx outside the EEA are governed by the Binding Corporate Rules as laid down in article 47 of the EU General Data Protection Regulation (‘GDPR’).

Transfers to third parties (outside the EEA) will be governed by a contract based on the model contractual clauses for data transfers approved by the European Commission or other appropriate safeguards as laid down in article 46 of the GDPR. For more detailed information about these safeguards, please use this link to contact us.

Based on the law applicable to the use of your Personal Data, you have rights in relation to your Personal Data. Note that we will have to balance your rights and your request to exercise them against our rights and obligations to process your Personal Data and to protect the rights and freedoms of others. A number of the rights you have in relation to your Personal Data, as applicable in the European Economic Area, are explained below:

Right of access
You are entitled to a copy of the Personal Data we hold about you and to learn details about how we use it. Your Personal Data will usually be provided to you digitally. We may require you to prove your identity before providing the requested information.

Right to rectification
We take reasonable steps to ensure that the information we hold about you is accurate and complete. However, if you believe this is not the case, you have the right to request that any incomplete or inaccurate Personal Data that we process about you is amended.

Right to erasure
You have the right to ask us to erase your Personal Data, for example where the Personal Data is no longer necessary for the original purpose for which they were collected, where Personal Data has become obsolete or where you withdraw your consent to the grounds on which data is processed. However, this will need to be balanced against other factors. For example, we may not be able comply with your request due to certain legal or regulatory obligations.

Right to restriction of processing
You are entitled to ask us to stop using your Personal Data, for example (temporarily) where you think that the Personal Data we hold about you may be inaccurate or where you think that we no longer need to use your Personal Data.

Right to data portability
You may have the right to ask that we transfer Personal Data that you have provided to us to you or to a third party of your choice. This right can only be exercised when you have provided the Personal Data to us, and when we are processing that data by automated means on the basis of your consent or in order to perform our obligations under a contract with you.

Right to object
You have the right to object to processing which is based on our legitimate interests. You may also ask us to stop using your Personal Data for marketing purposes at any time, and if you do so, FedEx will immediately cease to use your Personal Data. For other purposes based on our legitimate interests, we will no longer process the Personal Data on that basis when you file an objection, unless we have a compelling legitimate ground for the processing. Note, however, that we may not be able to provide certain services or benefits if we are unable to process the necessary Personal Data for that purpose.

Rights relating to automated individual decision-making
You have the right not to be subjected to a decision based solely on automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you. If you have been subject to an automated decision and do not agree with the outcome, you can contact us using the details below and ask us to review the decision.

Right to withdraw consent
We may ask for your consent to process your Personal Data in specific cases. When we do this, you have the right to withdraw your consent at any time. FedEx will stop the further processing as soon as possible after the withdrawal of your consent. However, this does not affect the lawfulness of the processing before consent was withdrawn.

Questions or complaints regarding the processing of your Personal Data can be directed to FedEx by using the contact information as provided at the top of this STEP UP Privacy Notice.

You also have the right to lodge a complaint with the competent (local) data protection authority in the jurisdiction where you work, where you live or where an alleged infringement takes place. As a rule, the lead supervisory authority for FedEx in the European Economic Area is the Dutch Data Protection Authority (Dutch DPA), unless the alleged infringement is purely a local matter in which case you should contact your local Data Protection Authority. A listing of the European Data Protection Authorities can be found here.

FedEx may update this STEP UP Privacy Notice from time to time. If an amendment will have a serious impact, FedEx will endeavour to actively inform you about such amendments.

© 2023 FedEx