Legal

Privacy Policy

Last updated: 28 September 2026

Raylec Logistics Limited (“Raylec Logistics”, “Raylec”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal information entrusted to us.

This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you visit our website, contact us, request a quotation, use our services, work or communicate with us as a customer, prospective customer, supplier, carrier, agent, consignee, consignor, business partner or other contact, or otherwise interact with Raylec.

Because Raylec provides international freight forwarding and logistics services, personal information may sometimes need to be shared with carriers, agents, customs authorities, delivery partners and other organisations in countries outside the United Kingdom.

This Privacy Policy also explains how we deal with international transfers and the privacy rights that may be available to you depending on where you are located.

This Privacy Policy is provided for transparency and does not create contractual rights beyond those provided by applicable law.

1. Who we are

Raylec Logistics Limited is a private limited company registered in England and Wales providing international freight forwarding, transport, exhibition and event logistics, customs support and related logistics services.

Website: www.rayleclogistics.com

Email: contact@rayleclogistics.com

Telephone: +44 (0)330 030 3456

For most processing described in this Privacy Policy, Raylec Logistics Limited acts as the controller of personal information. This means that we determine why and how that information is processed.

In some circumstances, another organisation involved in providing a service may act as an independent controller of information it receives. For example, a carrier, customs broker, payment provider or government authority may determine independently how it processes information provided to it.

In other circumstances, an organisation may process information on our behalf as our processor or service provider.

Privacy contact

Raylec has designated a Privacy Lead as the principal contact for privacy and data-protection matters.

Please use “Privacy Request” or “Data Protection Complaint” in the subject line where appropriate.

Raylec is not currently required to appoint a statutory Data Protection Officer. Where a jurisdiction requires us to make a particular privacy appointment or designation in the future, we will do so and update this Privacy Policy where appropriate.

2. Who this Privacy Policy applies to

This Privacy Policy may apply to personal information concerning:

• customers and prospective customers;
• employees and representatives of corporate customers;
• consignors and shippers;
• consignees and delivery recipients;
• collection and delivery contacts;
• suppliers;
• carriers, hauliers and couriers;
• drivers and operational contacts;
• freight and customs agents;
• exhibition organisers, venues and contractors;
• referral and commercial partners;
• people making enquiries through our website;
• people communicating with us by telephone, email, WhatsApp, other messaging apps or social media; and
• other individuals whose information is reasonably required in connection with our business or a shipment.

This Privacy Policy is principally intended for external contacts and website users.

Separate notices or arrangements may apply to employees, workers or job applicants where appropriate.

3. Privacy and data-protection laws

Raylec is established in the United Kingdom and our principal data-protection obligations arise under applicable UK legislation, including the:

• UK General Data Protection Regulation (“UK GDPR”);
• Data Protection Act 2018;
• Privacy and Electronic Communications Regulations (“PECR”);
• Data (Use and Access) Act 2025; and
• subsequent amendments to applicable UK privacy and data-protection legislation.

Depending upon the location of an individual and the nature of our activities, other privacy legislation may also apply, including:

• the EU General Data Protection Regulation (“EU GDPR”);
• applicable European national privacy and electronic-communications legislation;
• applicable United States federal and state privacy and consumer-protection laws;
• the California Consumer Privacy Act, as amended (“CCPA”), where applicable;
• the US CAN-SPAM Act;
• applicable US telephone, SMS and electronic-marketing requirements;
• Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”);
• applicable Canadian provincial private-sector privacy laws;
• Canada’s Anti-Spam Legislation (“CASL”); and
• Mexico’s Federal Law on Protection of Personal Data Held by Private Parties and associated requirements.

Where another jurisdiction’s privacy or data-protection law applies to our processing, we will apply any additional rights or protections required by that law.

4. Personal information we may collect

The information we collect depends on how you interact with Raylec and the services involved.

Identity and contact information

This may include:

• name;
• job title;
• employer, company or organisation;
• business or personal email address where provided;
• telephone or mobile number;
• postal address;
• business address;
• billing address;
• collection address;
• delivery address; and
• other contact information you provide.

Business and professional information

This may include:

• company name;
• job role or department;
• professional contact details;
• your relationship with Raylec;
• customer, supplier, carrier or agent information;
• service requirements; and
• information concerning your organisation’s logistics activities.

Enquiry and quotation information

When you contact us or request a quotation, information may include:

• collection and delivery locations;
• requested collection dates;
• required delivery dates;
• shipment descriptions;
• quantities;
• dimensions;
• weights;
• packaging details;
• commodity information;
• vehicle or equipment requirements;
• special handling instructions;
• exhibition or event details;
• event or project name;
• venue details;
• build-up or breakdown requirements;
• customer references;
• commercial requirements;
• quotation details;
• correspondence; and
• other information supplied in connection with your enquiry.

Shipment and logistics information

Where we arrange, coordinate or manage freight or logistics services, we may process information including:

• consignor or shipper details;
• consignee or receiver details;
• collection and delivery contacts;
• shipment and booking references;
• carrier information;
• driver contact information where necessary;
• vehicle information where necessary;
• collection and delivery instructions;
• tracking information;
• shipment status;
• estimated and actual collection times;
• estimated and actual delivery times;
• proof of collection;
• proof of delivery;
• signatures;
• CMRs and equivalent road-transport documents;
• airway bills;
• bills of lading;
• commercial invoices;
• packing lists;
• customs declarations;
• commodity information;
• import and export information;
• customs procedure information;
• ATA Carnet information;
• border documentation;
• venue access or delivery information; and
• other information reasonably necessary to arrange, monitor or document the movement of goods.

Information concerning a shipment is not necessarily personal information. However, where shipment information identifies or can reasonably be associated with an individual, we will treat it as personal information where applicable law requires.

Financial and transactional information

Where relevant, we may process:

• billing details;
• invoices;
• payment status;
• transaction details;
• bank or payment information;
• supplier and carrier charges;
• customer charges; and
• accounting records.

Where payment is handled through a specialist bank or payment provider, Raylec may not receive or store complete payment-card information itself.

Customs, regulatory and compliance information

International freight movements may require information for:

• customs clearance;
• import and export procedures;
• border controls;
• security procedures;
• sanctions and trade-compliance requirements;
• tax or duty requirements;
• customs declarations; and
• other regulatory processes.

The information required varies according to the shipment, commodity, destination and applicable law.

Communications

We may process and retain:

• emails;
• website enquiries;
• telephone communications;
• telephone call details;
• SMS messages;
• messaging-app communications, including WhatsApp communications;
• social-media communications;
• quotation discussions;
• customer-service correspondence;
• operational communications;
• complaints;
• instructions; and
• appropriate internal notes relating to our dealings with you.

Where telephone calls are recorded, transcribed or summarised using technology, we will provide any notice or obtain any consent required under applicable law.

WhatsApp and messaging services

If you choose to contact Raylec using WhatsApp, we may receive and process information including your name, telephone number, WhatsApp profile information made available to us, the contents of your messages and any documents, photographs or other information you choose to send.

We use this information to respond to enquiries, prepare quotations, communicate about collections, deliveries, shipments and other services, provide customer support, manage our customer and supplier relationships and maintain appropriate business records.

WhatsApp is a third-party messaging service provided to UK users by WhatsApp LLC, which is part of the Meta group of companies. When you use WhatsApp, information is also processed by WhatsApp in accordance with its own privacy policy.

WhatsApp and its service providers may process information outside the United Kingdom. Where applicable, such transfers are subject to appropriate safeguards under applicable data protection law. Further information about WhatsApp's processing and international transfers is available in the WhatsApp Privacy Policy.

Website and technical information

When you use our website or digital services, we may collect information such as:

• IP address;
• browser;
• device type;
• operating system;
• approximate location derived from IP information;
• referring website or source;
• pages viewed;
• date and time of visits;
• website interactions;
• form interactions;
• cookie and similar identifiers; and
• information used for website security, fraud prevention and bot detection.

Marketing information

This may include:

• marketing preferences;
• whether and when consent was obtained where applicable;
• the source of a business contact;
• marketing communications sent;
• interactions with communications where legally permitted;
• unsubscribe requests; and
• suppression-list information.

5. Sensitive and higher-risk personal information

Raylec does not ordinarily require special-category personal data or highly sensitive personal information to provide freight-forwarding services.

However, customs, border, security or regulatory procedures may occasionally result in us receiving information such as:

• passport or other government-issued identification information;
• nationality information;
• identification numbers; or
• other information regarded as sensitive under particular privacy laws.

We will only process such information where reasonably necessary and lawfully permitted.

We do not use sensitive personal information to infer personal characteristics for behavioural advertising.

We ask customers and other contacts not to send unnecessary sensitive personal information to us.

6. How we obtain personal information

We may obtain personal information:

• directly from you;
• through our website;
• through enquiry and quotation forms;
• during telephone, email, WhatsApp, other messaging-app or social-media communications;
• from your employer or organisation;
• from our customers;
• from consignors and consignees;
• from carriers and hauliers;
• from freight or logistics agents;
• from customs brokers;
• from overseas agents;
• from warehouses;
• from exhibition organisers, venues and contractors;
• from freight-exchange or transport-management platforms;
• from suppliers and commercial partners;
• through referrals;
• through business events and exhibitions;
• from company websites;
• from professional networks and publicly available professional or business sources; and
• through technology used to operate our website and services.

If another person or organisation provides information about you, for example because you are a collection contact, delivery contact, consignee or carrier contact, we will handle that information in accordance with applicable law and this Privacy Policy.

Where required, we will provide privacy information to individuals whose information we obtain indirectly within the timeframe required by applicable law.

If you provide Raylec with personal information about another person, you should ensure that you have an appropriate basis for providing that information to us.

7. How and why we use personal information

We may use personal information to:

• respond to enquiries;
• understand logistics requirements;
• prepare quotations;
• discuss proposed services;
• enter into contracts;
• provide freight-forwarding and logistics services;
• arrange transport;
• organise collections;
• organise deliveries;
• manage international freight movements;
• manage exhibition and event logistics;
• arrange carriers and subcontractors;
• communicate with drivers and operational contacts;
• provide tracking and shipment-status information;
• manage delivery instructions;
• complete customs and border procedures;
• maintain customs and transport documentation;
• communicate with customs brokers and authorities;
• meet trade, sanctions and other regulatory obligations;
• maintain customer and supplier relationships;
• maintain CRM, operational and shipment records;
• provide customer support;
• process invoices and payments;
• pay suppliers and carriers;
• administer our accounts;
• manage complaints and disputes;
• investigate service issues;
• prevent and detect fraud;
• protect our website, email and business systems;
• prevent spam, bots and malicious activity;
• comply with legal and regulatory obligations;
• establish, exercise or defend legal claims;
• undertake appropriate business analysis;
• improve our services;
• develop our business; and
• communicate information about Raylec and our services where legally permitted.

8. Our lawful bases under UK and European data-protection law

Where UK GDPR or EU GDPR applies, we rely upon one or more appropriate lawful bases.

Contract and steps before entering into a contract

We may process personal information where necessary to:

• respond to a request for services;
• prepare a quotation;
• take steps before entering into a contract; or
• perform a contract with you.

Legitimate interests

We may process personal information where necessary for Raylec’s legitimate business interests, provided those interests are not overridden by the rights and interests of the individual.

Our legitimate interests may include:

• responding to business enquiries;
• arranging and managing freight and logistics services;
• communicating with customers, suppliers and operational contacts;
• managing customer and supplier relationships;
• providing customer service;
• maintaining appropriate commercial, shipment and operational records;
• improving our services;
• developing our business;
• protecting our website and systems;
• detecting fraud and misuse;
• managing disputes;
• recovering sums owed to us; and
• establishing, exercising or defending legal rights.

Where we rely upon legitimate interests, we consider whether the processing is necessary and proportionate and whether your interests, rights or freedoms override those interests.

Legal obligations

We may process personal information where necessary to comply with legal obligations relating to matters including:

• customs;
• import and export requirements;
• border controls;
• tax;
• accounting;
• trade restrictions;
• sanctions;
• regulatory requirements;
• court orders; and
• other applicable laws.

Consent

Where applicable law requires consent, we may rely upon your consent.

You may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

9. Information required to provide our services

Certain information may be necessary for us to:

• respond properly to an enquiry;
• prepare a quotation;
• enter into or perform a contract;
• identify a consignor or consignee;
• arrange a collection or delivery;
• fulfil customs requirements;
• satisfy security or border procedures;
• comply with legal or regulatory obligations; or
• process a payment.

If required information is not provided, we may be unable to provide a quotation, arrange a shipment, complete customs procedures, deliver goods or provide some or all of the requested service.

We will not intentionally require personal information that is unnecessary for the relevant purpose.

10. Freight forwarding and logistics partners

International freight forwarding necessarily involves sharing information with organisations involved in transporting, clearing, storing, handling or delivering goods.

Depending upon the shipment, these organisations may include:

• road carriers;
• hauliers;
• couriers;
• airlines;
• shipping lines;
• rail operators;
• freight agents;
• overseas logistics partners;
• customs brokers;
• warehouses;
• fulfilment providers;
• ports;
• airports;
• customs authorities;
• border agencies;
• security authorities;
• exhibition organisers;
• exhibition venues;
• event contractors;
• delivery agents;
• consignors;
• consignees; and
• other organisations reasonably involved in providing the requested service.

For example, an international delivery may require us to provide a recipient’s name, delivery address, telephone number and delivery instructions to an overseas carrier or delivery agent.

We aim to limit information shared to what is reasonably necessary for the relevant service, regulatory obligation or lawful purpose.

Some of these organisations act as processors or service providers on our behalf.

Others, including many carriers, customs brokers, banks and government authorities, may act as independent controllers responsible for their own use of the information they receive.

Where another organisation acts as an independent controller, its own privacy notice and legal obligations may also apply.

11. Other organisations with whom we may share information

We may also share relevant personal information with:

• website providers;
• hosting providers;
• CRM providers;
• cloud-service providers;
• email providers;
• telephone and communications providers;
• analytics providers;
• workflow and automation providers;
• cyber-security providers;
• fraud-prevention providers;
• document-storage providers;
• payment providers;
• banks and financial institutions;
• accountants and bookkeeping providers;
• insurers and insurance brokers;
• auditors;
• solicitors and professional advisers;
• regulators;
• courts;
• law-enforcement bodies; and
• government authorities where legally required.

Where another organisation processes information solely on our behalf, we use appropriate contractual, confidentiality, security and data-protection arrangements where required.

We do not provide personal information to another organisation simply because it may find that information commercially useful.

12. International transfers

Raylec operates in international freight and logistics. Personal information may therefore need to be transferred to, disclosed in or accessed from countries outside the United Kingdom.

This may occur because:

• an international shipment requires an overseas carrier or agent;
• an overseas delivery partner needs recipient information;
• customs or border authorities require information;
• a consignor or consignee is located overseas;
• an exhibition or venue is overseas;
• a customer or supplier is overseas; or
• one of our technology or service providers processes information internationally.

Countries outside the United Kingdom may have different privacy and data-protection laws.

Where UK data-protection legislation treats a transfer as a restricted international transfer, we will use an appropriate legal mechanism where required.

Depending upon the circumstances, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement (“IDTA”);
• the UK International Data Transfer Addendum to approved EU Standard Contractual Clauses;
• another approved contractual or legal safeguard; or
• an applicable exception permitted by law.

Where an appropriate safeguard requires a transfer risk assessment or equivalent data-protection test, we will undertake the assessment required by applicable law.

Where EU GDPR applies, appropriate EU mechanisms may similarly be used, including adequacy decisions and approved Standard Contractual Clauses.

You may contact contact@rayleclogistics.com if you would like further information regarding safeguards applicable to a particular international transfer, subject to appropriate confidentiality protections.

13. European Union representative

Raylec is established in the United Kingdom rather than the European Union.

Where EU GDPR applies to Raylec and applicable law requires us to appoint a representative in the European Union, we will appoint an appropriate representative and publish the representative’s contact details as required.

14. Marketing and business development

Raylec may communicate with existing customers, prospective customers and relevant business contacts concerning:

• freight-forwarding services;
• transport and logistics;
• exhibition and event logistics;
• relevant service developments;
• useful logistics information;
• guides and resources;
• company news; and
• services that may reasonably be relevant to the recipient.

The rules governing business-to-business marketing vary according to the recipient, communication method and jurisdiction.

Where consent is required, we will obtain appropriate consent before sending the relevant communication.

Where applicable law permits business communications based on another lawful basis, we will respect the recipient’s rights and any applicable electronic-marketing requirements.

You can unsubscribe from marketing at any time by:

• using the unsubscribe mechanism contained in the communication; or
• emailing contact@rayleclogistics.com.

Opting out of marketing does not prevent us from sending operational or service communications required to:

• respond to an enquiry;
• manage a quotation;
• administer an account;
• arrange or manage a shipment;
• communicate a service issue; or
• perform a contract.

We may retain limited suppression information after an opt-out so that your preference continues to be respected.

United States

Where applicable, commercial electronic messages sent to recipients in the United States will be handled in accordance with applicable US requirements, including CAN-SPAM.

Where telephone or SMS marketing is undertaken in the United States, we will apply any separate consent or other requirements relevant to those communications.

Canada

Where CASL applies, regulated commercial electronic messages will only be sent where appropriate consent, recognised implied consent or another lawful basis or exemption applies.

Where CASL requires it, unsubscribe requests will be actioned within the applicable statutory period.

15. Cookies, analytics and similar technologies

Our website may use cookies and similar storage, access, measurement or tracking technologies for purposes including:

• essential website operation;
• security;
• fraud prevention;
• bot prevention;
• remembering preferences;
• website functionality;
• measuring website performance;
• understanding use of our website;
• analytics; and
• marketing or advertising where introduced.

This may include technologies provided by third-party analytics, CRM, website and communications providers.

Where consent is required by applicable law, relevant non-essential technologies will not be activated before the required consent has been obtained.

Where applicable law permits a particular technology to be used without consent, we will meet any associated transparency, choice or opt-out requirements that apply.

Where we use cookies or similar technologies that require consent, we will provide appropriate controls allowing visitors to give, refuse or withdraw that consent.

More detailed information about the technologies actually used on our website, their purposes and applicable retention periods will be provided through our Cookie Policy.

16. Analytics, CRM and website interaction information

Raylec does not currently use analytics, advertising or profiling technologies of its own on this website that require consent. If we introduce analytics, advertising, profiling or similar non-essential technologies in future, we will update this Privacy Policy and our Cookie Policy and, where required, obtain consent before activating those technologies.

17. United States online privacy and tracking

Raylec does not sell personal information for monetary consideration.

Certain United States privacy laws use broader statutory definitions of terms such as:

• “sale”;
• “sharing”;
• “targeted advertising”; and
• “cross-context behavioural advertising”.

Depending upon the technology being used, contractual arrangements and applicable state law, some website advertising or analytics activity can potentially fall within those definitions.

If Raylec becomes subject to a US state privacy law and engages in processing carrying an applicable opt-out right, we will provide the notices and mechanisms required by that law.

Where required, we will also recognise qualifying browser-based opt-out preference signals, including Global Privacy Control (“GPC”).

We will not discriminate unlawfully against an individual because they have exercised an applicable privacy right.

18. Artificial intelligence and automation

Raylec may use automation and AI-assisted technology to support administrative and operational activities.

This may include:

• organising enquiries;
• routing enquiries or communications;
• summarising communications;
• producing internal notes or summaries;
• assisting customer service;
• assisting administrative work;
• supporting workflow automation; and
• improving operational efficiency.

AI-assisted output may be reviewed or used by human members of the Raylec team where appropriate.

Raylec does not currently use solely automated processing to make decisions about individuals that produce legal or similarly significant effects.

If this changes, we will provide any notices, explanations, safeguards, objection rights or human-review rights required by applicable law.

19. How long we keep personal information

We do not retain personal information for longer than reasonably necessary.

Our retention periods depend upon factors including:

• why the information was collected;
• the nature of the service;
• the duration of our relationship;
• contractual requirements;
• customs requirements;
• tax and accounting requirements;
• regulatory requirements;
• applicable limitation periods;
• dispute or insurance requirements; and
• legitimate operational requirements.

As a general guide:

Customer, shipment, contractual, accounting and transaction information may normally be retained for up to six years after completion of the relevant transaction or end of the relevant business relationship, unless a different period is required or justified.

Unsuccessful enquiries and quotations will normally be retained for up to 24 months after the last meaningful interaction unless there is a legitimate reason to keep the information longer.

Customs, regulatory and international transport documentation may be retained for the period required by applicable customs, tax, regulatory or legal requirements.

Marketing information may be retained while an appropriate marketing relationship continues.

Suppression information may be retained for longer where necessary to ensure that an opt-out continues to be respected.

Website and security information will be retained for an appropriate period having regard to its purpose and the technology involved.

Where information is no longer required, we will delete it, securely destroy it or anonymise it as appropriate.

20. Security

We use appropriate technical and organisational measures designed to protect personal information against:

• accidental loss;
• theft;
• unauthorised access;
• unauthorised disclosure;
• alteration;
• destruction; and
• misuse.

Depending upon the information and systems involved, measures may include:

• access controls;
• authentication;
• password controls;
• multi-factor authentication where appropriate;
• encryption where appropriate;
• security monitoring;
• system-security controls;
• backups;
• supplier assessment;
• confidentiality measures;
• data minimisation; and
• appropriate internal procedures.

No internet, email, telecommunications or electronic storage system can be guaranteed to be completely secure.

We therefore review safeguards having regard to the nature of the information and risks involved.

21. Personal-data breaches and security incidents

Raylec maintains procedures for identifying, assessing, investigating and responding to suspected personal-data breaches and security incidents.

Where applicable law requires notification to:

• a data-protection or privacy regulator;
• an affected individual;
• a customer;
• a contractual partner; or
• another authority,

we will make the notification required within the applicable timeframe.

22. Your UK and European privacy rights

Where UK GDPR or EU GDPR applies, you may have rights including the right to:

• be informed about how your personal information is used;
• obtain confirmation that we process your personal information;
• access personal information we hold about you;
• have inaccurate information corrected;
• have incomplete information completed;
• request deletion in applicable circumstances;
• request restriction of processing in applicable circumstances;
• receive certain information in a portable format;
• object to certain processing;
• withdraw consent where processing relies upon consent; and
• complain to an appropriate supervisory authority.

These rights are subject to applicable conditions, limitations and exemptions.

Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.

Your right to object

You have the right to object to certain processing carried out on the basis of legitimate interests.

You have an absolute right to object to the use of your personal information for direct marketing. If you object to direct marketing, we will stop using your personal information for that purpose.

23. United States privacy rights

Residents of certain US states may have additional privacy rights where the relevant state privacy legislation applies to Raylec.

Depending upon applicable law, these may include rights to:

• know or confirm whether personal information is processed;
• access personal information;
• obtain information about categories of information collected;
• correct inaccurate information;
• request deletion;
• obtain certain information in a portable format;
• opt out of certain sales of personal information;
• opt out of certain sharing;
• opt out of targeted advertising;
• opt out of certain forms of profiling;
• limit certain uses or disclosures of sensitive personal information;
• not receive unlawful discriminatory treatment for exercising privacy rights; and
• appeal certain privacy-request decisions.

To exercise an applicable US privacy right:

Please identify your state of residence and the right you wish to exercise.

We may request information reasonably necessary to verify your identity and protect information from unauthorised disclosure.

Where applicable law permits an authorised agent to submit a request, we may request appropriate evidence that the agent is authorised to act for you.

California

Where the CCPA applies to Raylec, California residents may have rights including the rights to:

• know;
• access;
• correct;
• delete;
• opt out of applicable sale or sharing;
• limit certain uses of sensitive personal information; and
• receive non-discriminatory treatment when exercising applicable rights.

Raylec does not currently sell personal information for money.

If Raylec becomes a business subject to the CCPA and our website or other activities involve processing classified as a “sale” or “sharing” under California law, we will provide the notices, point-of-collection information, opt-out functionality and handling of applicable recognised preference signals required at that time.

24. Canadian privacy rights

Where Canadian privacy legislation applies, Raylec will handle personal information having regard to applicable principles concerning:

• accountability;
• identified purposes;
• meaningful consent;
• limiting collection;
• limiting use;
• limiting disclosure;
• limiting retention;
• accuracy;
• safeguards;
• openness;
• individual access; and
• mechanisms for challenging compliance.

Raylec’s Privacy Lead is the principal operational contact for privacy enquiries.

Depending upon applicable Canadian law, you may have rights to:

• request access to personal information;
• request correction of inaccurate information;
• ask how personal information has been collected, used or disclosed;
• withdraw consent where legally available; and
• make a privacy complaint.

Québec

Where Québec privacy legislation applies, additional requirements may apply concerning matters including:

• privacy governance;
• transparency;
• complaint handling;
• profiling;
• automated processing;
• privacy impact assessments; and
• transfers of personal information outside Québec.

Where those requirements apply to Raylec, we will make any formal privacy appointment or written delegation required and publish the appropriate title and contact details.

25. Mexico privacy rights

Where Mexican private-sector privacy legislation applies, this Privacy Policy is intended to provide comprehensive privacy information alongside any additional or simplified privacy notice required at the point information is collected.

Individuals may have rights commonly referred to as ARCO rights:

• Access;
• Rectification;
• Cancellation; and
• Opposition.

Where applicable, an individual may also have rights to:

• withdraw consent;
• limit particular uses or disclosures of personal information; and
• obtain information concerning relevant transfers.

Requests can be sent to:

We may request information reasonably necessary to verify identity and process the request.

26. Children’s privacy

Raylec provides business and commercial logistics services.

Our website and services are not directed at children.

We do not knowingly seek to collect personal information from children for marketing or behavioural-advertising purposes.

If you believe that information relating to a child has been provided to us inappropriately, please contact us.

27. Business transfers

If Raylec undergoes a:

• merger;
• acquisition;
• restructuring;
• investment;
• financing;
• sale;
• insolvency process; or
• transfer of some or all of its business or assets,

relevant personal information may be disclosed to professional advisers, prospective or actual purchasers, investors, financiers and other relevant parties where lawful and reasonably necessary.

Appropriate confidentiality and privacy protections will be used where required.

28. Third-party websites and services

Our website or communications may contain links to websites and services operated by independent organisations.

Those organisations are responsible for their own privacy practices.

Raylec is not responsible for how an independent third-party website or service handles information after you leave our website or interact directly with that third party.

We recommend reviewing the privacy information supplied by the relevant organisation.

29. Exercising your privacy rights

You can submit a privacy request to:

Please provide sufficient information to allow us to:

• identify you;
• understand your request;
• locate relevant information; and
• protect personal information against unauthorised disclosure.

We may request reasonable evidence of identity where necessary.

We will respond within the timeframe required by the law applicable to the request.

There is normally no charge for exercising privacy rights.

Applicable law may permit us to refuse a request or take additional measures in limited circumstances, for example where a request is manifestly unfounded, excessive or repetitive.

30. Data-protection complaints

If you have a concern or complaint about how Raylec has collected, used, disclosed, stored or otherwise handled your personal information, please contact us first:

For complaints falling within the UK statutory data-protection complaints regime, we will:

• provide a clear method for making a complaint;
• acknowledge receipt of the complaint within 30 days;
• take appropriate steps to investigate it;
• keep you informed where appropriate; and
• communicate the outcome of our investigation without unjustifiable or excessive delay.

United Kingdom

You also have the right to complain to the UK’s data-protection supervisory authority:

Telephone: 0303 123 1113

Make a complaint to the ICO

European Economic Area

Where EU GDPR applies, you may have the right to complain to the relevant supervisory authority in the applicable EEA jurisdiction.

United States

Where applicable law provides it, you may have rights to seek assistance or make a complaint to an applicable state Attorney General, privacy regulator or other competent authority.

Canada

Depending upon applicable law, you may have the right to complain to the Office of the Privacy Commissioner of Canada or the appropriate provincial privacy authority.

Mexico

Where applicable, you may exercise rights or seek review through the competent Mexican privacy or data-protection authority.

31. Changes to this Privacy Policy

We may update this Privacy Policy periodically.

Changes may be made to reflect:

• changes to our services;
• changes to our technology;
• new business systems;
• new suppliers;
• new countries or markets;
• changes in how we process personal information;
• changes in applicable law; or
• regulatory guidance.

The latest version will be published on www.rayleclogistics.com.

The “Last updated” date at the beginning of this Privacy Policy shows when this version was most recently revised.

Where applicable law requires additional notice of a material change, we will provide that notice.

32. Contact us

For questions, privacy-rights requests or data-protection complaints: