FedEx Privacy Notice

Your trust matters to us. That is why we protect your information and use it responsibly, while continuing to deliver the excellent services you expect from FedEx and its operating groups, subsidiaries and divisions (hereafter “FedEx”). At FedEx, we are committed to protecting your privacy and the security of information that can directly or indirectly be used to identify a natural person (hereafter “Personal Data”). FedEx has created this privacy notice (hereafter “Privacy Notice”) to explain how FedEx collects and uses Personal Data.

Effective date: April 12, 2017

The Effective Date of this Privacy Policy is set forth above. FedEx reserves the right to amend this Privacy Policy at any time with or without notice. Changes in the Privacy Policy become effective thirty (30) days after the first posting of any revised version. To stay abreast of these changes, please regularly check our Privacy Policy. FedEx understands the importance of protecting the privacy of recipients and users of FedEx digital communications. This Privacy Policy applies to: individually identifiable information about you ("Personal Information") that we collect via sites that link to this policy, including fedex.com, senseaware.com, FedEx mobile applications, and via FedEx-controlled widgets embedded in communication platforms, e.g., within Facebook or Twitter (collectively, “FedEx Digital Platforms”) and data about your computer or mobile device collected in connection with your use of the FedEx Digital Platforms ("Device Data"). Personal Information that may be collected may include name, physical and mailing address, email address, billing information, business profile, telephone number, credit/debit card number, purchasing history and product and service preferences.

FedEx uses the information collected via the FedEx Digital Platforms to:

• market and improve FedEx services,

• transact business with FedEx customers,

• improve the FedEx Digital Platforms and the content distributed through them,

• contact you with updates to and information about the FedEx Digital Platforms and FedEx services and activities, to help with fraud identification,

• conduct other FedEx marketing, promotional and informational activities,

• identify the type of digital and other content, messaging and information visitors to the FedEx Digital Platforms value most, assess and monitor certain user experience, and

• perform other activities as described in this Privacy Policy, and

• help FedEx understand the efficacy of the content, messaging and information provided through the FedEx Digital Platforms.

Your use of the FedEx Digital Platforms constitutes your agreement to FedEx's use of your information as described in this Privacy Policy If you choose not to provide Personal Information or Device Data, FedEx may not be able provide you with the products, services and information that it offers.

Certain features, including but not limited to FedEx Ship Manager® at fedex.com, FedEx InSight®, FedEx Return Manager®, FedEx® Billing Online, and FedEx® Global Trade Manager and My FedEx Rewards require registration or a password for access, or may require other information to use the FedEx Digital Platforms. Information obtained from registered users of these areas may also be used for the purposes stated in this Privacy Policy, and cookies may be used in those and other areas, as is described in this Privacy Policy. Information obtained in these areas may also be used in accordance with agreements governing access to and use of the specific areas, including but not limited to FedEx Ship Manager at fedex.com, FedEx Return Manager, etc. In addition, visitors to fedex.com may choose to register for a fedex.com Login user ID and password to simplify access to some interactive features on fedex.com.

Fedex.com login currently provides users with access to several FedEx applications such as FedEx Ship Manager at fedex.com and FedEx®Global Trade Manager. Other applications require separate registrations. In the future, FedEx may add other features to those accessed through fedex.com login.

This Privacy Notice answers the following questions:

This Privacy Notice applies to you if you are a customer of FedEx, a recipient of a package delivered by FedEx, a supplier of FedEx, or if you contact FedEx, for instance, by visiting www.fedex.com including any (sub)pages and mobile apps (hereafter “Websites”), using social media or if you receive emails from FedEx.

Our Websites are for a general audience and not aimed at children. In principle, we do not collect Personal Data from children under age 16. If you are under the age of 16 and you want to use our services, please rely on a parent or guardian to assist you.

If a child under the age of 16 may have disclosed Personal Data to us, the parent or guardian can contact us at dataprivacy@fedex.com and we will remove Personal Data if required.

In the course of its business activities and providing the services, FedEx will need to process Personal Data. Without your Personal Data, we will not be able to provide you with the requested services. As a rule, the Personal Data that you provide directly or indirectly to FedEx when using our services and visiting our Websites are:

• Contact information.
  This will include your name, address, e-mail address and phone number;


• Financial information.
  This will include your bank account number, payment status, and invoices;


• Identification information.
  This will include your driver’s license number. If you don’t have a driver’s license, another identification method will be used that ensures us that we can identify you, but is the least privacy invasive as possible;


• Account information.
  This will include log-in details, including your email address, and other information provided through your account;


• Information related to shipment and services.
  This will include shipment tracking number, shipment routing information, location data, status of a shipment, delivery location, packaging type, number of pieces, weight, picture of the parcel, and customs information;


• User and preference information.
  This will include – as applicable – shipping amounts, complaints, history of purchases and related commercial activities, communication, survey information, and shopping preferences.


• Automatically generated information.
  This will include IP address, unique device or user ID, system and browser type, date and time stamps, referring website address, content and pages you accessed on our Websites or mobile apps, dates, times and locations actions take place, websites you visit (if you connect to our in-store wireless services), click-stream information and device location (if you turn on the feature in the mobile app).

Yes, FedEx uses cookies and similar technologies on its Websites. Through these cookies, FedEx automatically obtains Personal Data as listed above when you visit our Websites. To learn more about the cookies and similar technologies, please consult our cookie notice.

Personal Data shall be collected, used, stored or otherwise processed when necessary within the framework of responsible, efficient and effective business management of FedEx. FedEx processes Personal Data based on applicable legal ground(s). The legal ground is often intrinsically linked to the business purpose. This means, for example, that the performance of an agreement can be both a legal ground and a business purpose for FedEx.

Therefore, we will first clarify the legal ground(s) on which FedEx processes your Personal Data and, subsequently, the business purpose(s) that we use your Personal Data for:

Legal Grounds

In general, FedEx processes your Personal Data based on one of the following legal grounds:

• The processing is necessary to perform an agreement between you and FedEx,


• The processing is necessary for us to comply with our legal obligations,


• The processing is necessary to protect your vital interests or of other individuals,


• The processing is necessary for the legitimate interests of FedEx, except where such interests are overridden by your interests or fundamental rights and freedoms, or


• Where appropriate and required, we will ask for your consent.

Business Purposes

FedEx shall only collect, use or otherwise process Personal Data if the processing falls within the scope of one (or more) of the legitimate business purposes listed below:

1. Product development, research and improvement of FedEx products and/or services. FedEx processes Personal Data as necessary for the development and improvement of FedEx products and/or services, research and development (e.g. analyse information related to the shipment and services to improve our services).


2. Performing agreements. This includes shipping services, tracking FedEx services, communication with individuals and other parties regarding services, responding to requests for (further) information, dispute resolution and preparing agreements (e.g. link the shipment tracking number to your account to enable you to follow your shipment).


3. Relationship management and marketing for commercial activities. In general, FedEx processes Personal Data as necessary for the development and improvement of FedEx products and/or services, account management, client services and the performance of (targeted) marketing activities in order to establish a relationship with a client and/or maintaining as well as extending a relationship with a client, business partner or supplier and for performing analyses with respect to Personal Data for statistical and scientific purposes (e.g. deliver advertising, communications and content from us on our sites and those of third parties more specific to your interests).


4. Business process execution, internal management and management reporting. This includes addressing activities such as managing company assets, conducting internal audits and investigations, finance and accounting, implementing business controls, provision of central processing facilities for efficiency purposes, managing mergers, acquisitions and divestitures and Processing Personal Data for management reporting and analysis (e.g. conduct investigations into shipping accounts to detect fraud).


5. Safety and security. Personal Data shall be included in the processing for activities such as those involving safety and health, the protection of FedEx and customer, supplier or business partner assets and the authentication of customer, supplier or business partner status and access rights (e.g. provide a safe and secure services for online and offline transactions).


6. Protecting the vital interests of individuals. This includes processing data when necessary to protect your vital interests or of other individuals (e.g. for urgent medical reasons).

Compliance with legal obligations. This addresses the processing of Personal Data as necessary for compliance with laws, regulations and sector specific guidelines to which FedEx is subject (e.g. matching names of clients, suppliers and business partners against denied parties’ lists).

• With its affiliates, operating groups, subsidiaries and divisions, or with third parties if such is necessary for the purposes as listed above. If appropriate, FedEx will require third parties to conduct activities in a


• manner consistent with FedEx policies and guidelines in relation to data protection.


• With data processors, i.e. parties processing Personal Data on our behalf. In such cases, these third parties only use your Personal Data for the purposes described above and only in accordance with our instructions. FedEx will only use processors which provide sufficient guarantees to implement appropriate technical and organizational measures and ensure the protection of the rights of data subjects.


• With its employees if and to the extent necessary for the performance of their tasks. In such a case, access will be granted only if and to the extent necessary for the purposes described above and only if the employee is bound by confidentiality.


• If and when required to do so by law, court order, or other legal process, for example, with law enforcement agencies or other governmental agencies, to establish or exercise our legal rights or in connection with a corporate transaction, such as a divesture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.

We will retain your Personal Data no longer than necessary for the purpose(s) for which we process your Personal Data. After the retention period we will delete or anonymize your Personal Data, unless we need to retain certain of your Personal Data for another purpose. We will only do so if we have a legal ground to retain your Personal Data. We will also ensure that Personal Data are only accessible for that other purpose.

For example, we need your Personal Data to perform the customs clearance process. Customs laws dictate that we have to retain/store - certain of - those Personal Data. Generally, this period varies from 3 to 7 years, depending on the applicable country and customs laws. In those cases, we will only store the Personal Data necessary to meet our legal obligations.

Please contact us using the contact details above if you have questions about specific retention periods.

FedEx has taken appropriate technical and organizational measures to protect your Personal Data against accidental or unlawful processing, including by ensuring that:

• Your Personal Data is protected against unauthorized access;


• The confidentiality of your Personal Data is assured;


• The integrity and availability of your Personal Data will be maintained;


• Personnel is trained in information security requirements; and


• Actual or suspected data breaches are reported in accordance with applicable law.

Due to the nature of our business and the services we provide to our clients, FedEx may need to transfer your Personal Data to locations outside the country where you reside. In any case where we transfer Personal Data, FedEx shall ensure that such a transfer is subject to appropriate safeguards. For the European Economic Area, such transfers to third parties (outside the European Economic Area) will be governed by a contract based on the model contractual clauses for data transfers approved by the European Commission or other appropriate safeguards. For more detailed information about these safeguards, please contact dataprivacy@fedex.com.

Yes, FedEx uses select advertising companies to serve relevant FedEx ads on third party Internet sites. Currently FedEx uses Google (and its affiliates like DoubleClick), Adobe, Accuen, Salesforce, and Facebook. FedEx does not provide any Personal Information to these advertising companies to allow them to use such data for their own purposes, or for the benefit of any other party. These advertising companies may, however, place their own cookies or third party cookies on your browser to personalize your FedEx related experience on third party sites.

You can choose not to allow these advertising companies to use their cookies to serve you ads on third party Internet sites. Several of these companies are members of the Digital Advertising Alliance (“DAA”). You can opt-out of ad targeting from DAA member companies at a single location. To learn more, please click here.

For more information about marketing cookies and other technologies, and to opt-out, go to the following sites:

http://www.networkadvertising.org/optout_nonppii.asp

http://www.aboutads.info/

http://metrics.fedex.com/optout.html

Except as otherwise stated in this Privacy Policy, FedEx Digital Platforms do not generally follow do not track or comparable signals sent by web browsers.

Questions or complaints regarding the processing of your Personal Data can be directed to FedEx by using the contact information as provided at the top of this Privacy Notice.

You also have the right to lodge a complaint with the competent (local) data protection authority in the jurisdiction where you work, where you live or where an alleged infringement takes place. As a rule, the lead supervisory authority for FedEx in the European Economic Area is the Dutch Data Protection Authority (Dutch DPA), unless the alleged infringement is purely a local matter. A listing of the European Data Protection Authorities can be found here.

FedEx may update this Privacy Notice from time to time. If an amendment will have a serious impact, FedEx will endeavor to actively inform you about such amendments. FedEx will publish an up-to-date Privacy Notice on the Websites at all times indicating the latest amendments.

Our postal address is: FedEx Corporation P.O. Box 727 Memphis, TN 38194-1062 We can be reached via email at webmaster@fedex.com or by telephone at Tel: 264.497.2719.

(c) 2019 FedEx