1. INTRODUCTION
1.1 Welcome to the SPX Express website and mobile application (the “Platform”) operated by SPX Xpress (Malaysia) Sdn. Bhd. and its affiliates (individually and collectively, "SPX Express”, "SPX", "we", "us" or "our"). We take our responsibilities under applicable privacy laws and regulations ("Privacy Laws") seriously and we are committed to protecting the personal data of users of the Platform (“Users”, “you” or “your”). This Privacy Policy (“Privacy Policy”) outlines how we collect, use, disclose and/or process personal data.
1.2 Please note that this Privacy Policy applies only to the extent that we are the data controller in relation to any personal data we collect about you. An example is when you directly engage SPX to provide pick-up, drop-off or delivery of parcels.
1.3 This Privacy Policy does not apply to the extent that we are the data processor that is processing your data on behalf of a data controller. An example is when you purchase items from an online merchant or on an e-commerce platform and where that online merchant or ecommerce platform engages SPX to perform the delivery services. We are not responsible for the data protection practices or privacy policies of such third parties (who are the data controllers) who have control over your personal data, and you are highly encouraged to refer to their privacy policies for more information.
1.4 "Personal Data" or "personal data" means data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which an organisation has or is likely to have access. Examples of personal data include name, identification number, contact information and/or vehicle information.
1.5 By using, downloading, installing, accessing, registering for an account or otherwise having an account on the Platform, you acknowledge and agree to the practices outlined in this Privacy Policy, and you agree to us collecting, using, disclosing and/or processing your personal data as described herein. IF YOU DO NOT CONSENT TO THE COLLECTION, USE, DISCLOSURE AND/OR PROCESSING OF YOUR PERSONAL DATA AS DESCRIBED IN THIS PRIVACY POLICY, PLEASE DO NOT USE AND/OR ACCESS THE PLATFORM.
1.6 If we amend our Privacy Policy, we will post the updated Privacy Policy here and may notify you in accordance with Privacy Laws. We reserve the right to amend this Privacy Policy at any time. To the fullest extent permissible under applicable law, your continued use of and/or access to the Platform shall constitute your acknowledgement and acceptance of the changes made to this Privacy Policy. This Privacy Policy applies in conjunction with other notices, contractual clauses, consent clauses that apply in relation to the collection, storage, use, disclosure and/or processing of your personal data by us and is not intended to override those notices or clauses unless we state expressly otherwise.
2. WHEN WILL SPX COLLECT PERSONAL DATA?
2.1 We collect personal data about you:
(a) when you register to create an account on the Platform or when an account on the Platform is being created for you;
(b) when you submit and/or provide documentation and information during the account registration process, or as part of our due diligence, identity verification processes and anti-fraud measures;
(c) when you submit any form, including, but not limited to, application forms or other forms relating to any of our products and services or any ancillary matter relating to our products and services including employment opportunities or contracting services whether online or by way of a physical form;
(d) when you use the Platform, such as when you create delivery, pick-up or drop-off assignments;
(e) when you use our electronic services, or interact with us via our application or use services on our Platform. This includes, without limitation, through cookies which we may deploy when you interact with our Platform;
(f) when you grant permissions on your device to share information with our Platform;
(g) when your bank account information or payment information is added on the Platform; and/or (h) when you provide us with feedback, complaints, request for customer support, or otherwise communicate with us such as via telephone calls (which may be recorded), letters, fax, face-to-face meetings, social media platforms and emails.
The above is not exhaustive and sets out some common instances of when personal data about you may be collected.
2.2 We may also collect personal data about you from our affiliates or other third parties including without limitation business partners (such as e-commerce, recruiters or payment, marketing service providers), other users of the Platform or publicly available sources. We will only do so in accordance with Privacy Laws and for the purposes as set out in this Privacy Policy.
2.3 In some situations, you may provide personal data of other individuals to us (including your family members and friends) for referral programmes. If you provide us their personal data, you represent and warrant that you have obtained their consent for their personal data to be processed in accordance with this Privacy Policy.
2.4 We may receive personal data from data controllers who have appointed us to perform logistics or delivery services. However, in this regard, we only do so as a data processor and we process personal data on behalf of the data controller. We are not responsible for the data protection practices or privacy policies of such data controllers who have control over your personal data, and you are highly encouraged to refer to their privacy policies for more information.
3. WHAT PERSONAL DATA WILL SPX COLLECT?
3.1 The personal data that we may collect includes but is not limited to:
(a) account registration information (including your name, date of birth, email address, billing and/or delivery address, country, state, city, telephone number) and account identifiers;
(b) account verification or identity verification information (including photographs, government-issued IDs, personal identification numbers issued by regulatory or tax authorities, and company registration documents containing personal data and copies of such);
(c) parcel sender contact details and parcel pick-up information (such as name, telephone number, email address, sender or pick-up address);
(d) parcel recipient contact details and parcel drop-off information (such as name, telephone number, email address, delivery or drop-off address);
(e) parcel details (such as item description and transaction information);
(f) to the extent applicable, your bank account information (such as bank name, branch name, bank account holder name, bank account number) and copies of documents evidencing such information;
(g) to the extent applicable, payment-related information (such as payment or withdrawal amount, transaction time and date, mode of transaction);
(h) parcel tracking number;
(i) collection point information (including address), and collection point contact details;
(j) device information (such as device ID, device type, device name and related information sent by or associated with the device(s) used to access the Platform);
(k) information about your network (such as IP address and network provider);
(l) Platform usage information (such as login duration, last login time, call logs, message logs, amount of time spent on the Platform and pages on the Platform);
(m) location data (exact and approximate location);
(n) delivery assignment information (such as time of pickup, drop-off or delivery of parcels, sender’s, recipient’s, driver’s signature or acknowledgment of pickup, drop-off or delivery of parcels); and
(o) photographs, audio or video recordings, such as for proof of delivery or responding to any customer service issues.
3.2 You agree not to submit or provide any information which is false, inaccurate or misleading, and to inform us of any inaccuracies or changes to such information. We reserve the right at our sole discretion to require further documentation to verify any information provided by you.
3.3 If you do not want us to collect the aforementioned information/personal data, you may opt-out at any time by notifying our Data Protection Officer in writing at the email set out in Section 13 (Questions, Concerns or Complaints? Contact Us) below. Note, however, that opting-out or withdrawing your consent for us to collect, use, disclose or process your personal data may result in us not being able to provide the Platform to you.
4. COOKIES
We or third parties as authorized by us may from time to time use cookies or similar files (such as scripts, tags, pixels or other technologies) (“Cookies”) to allow us or third parties to collect or share information in connection with your interaction and/or use of the Platform. These features help us improve the Platform and help us offer new services and features through the Platform. You can control or delete cookies through your device settings. Most mobile devices and browsers allow you to refuse cookies or alert you when cookies are being set, or allow you to clear and delete cookies on your device. However, please note that if you do this you may not be able to use the full functionality of the Platform.
5. HOW DO WE USE THE INFORMATION YOU PROVIDE US?
5.1 We may collect, use, disclose and/or process your personal data for one or more of the following purposes:
(a) to consider and/or process your application / account registrations on the Platform and for identity verification, due diligence, know-your-customer purposes, and anti-fraud measures in accordance with legal or regulatory obligations or our risk management procedures required by law or put in place by us;
(b) to manage, operate, provide and/or administer your use of and/or access to the Platform and/or our services;
(c) contact you and manage delivery orders including processing delivery orders, updating you on the status of your delivery, payment administration and facilitating correspondence between you and the sender/recipient (as the case may be);
(d) to process any claim and payments that may arise under the SPX Express Terms of Service or other applicable policies;
(e) to analyse and improve efficiency of the delivery services being performed, transactions, interactions and/or communications with customers or third parties via the Platform;
(f) to ensure the integrity and security of the Platform;
(g) to maintain and administer any software updates and/or other updates and support that may be required from time to time to ensure the smooth running of the Platform and our services;
(h) to enforce the SPX Terms of Service or our rights under any contract, or to respond to legal processes or to comply with applicable law, governmental or regulatory requirements of any relevant jurisdiction;
(i) to prevent or investigate any actual or suspected violations of the SPX Terms of Service, fraud, complaints, unlawful activity, or misconduct, whether relating to your use of the Platform or any other matter arising from applicable agreements, contracts and/or terms and/or conditions entered into, as agreed or accepted by you in relation to you providing courier services or parcel delivery services;
(j) to deal with or facilitate customer support requests, respond to feedback, complaints, enquiries or other communications (including monitoring or recording phone calls and user interactions for quality assurance, employee training and performance evaluation);
(k) to conduct research, analysis and development activities (including, but not limited to, data analytics, surveys, product and service development and/or profiling), to analyse how you use our services, to recommend services relevant to your interests, to improve our services or products and/or to enhance your customer experience;
(l) for marketing and advertising, and in this regard, to send you by various channels and modes of communication marketing and promotional information and materials relating to products and/or services (including, without limitation, products and/or services of third parties whom SPX Express may collaborate or tie up with) that SPX Express (and/or its affiliates or related corporations) may be selling, marketing or promoting, including employment opportunities or contracting services, whether such products or services exist now or are created in the future. You can unsubscribe from receiving marketing information at any time by writing to our Data Protection Officer at the email set out in Section 13 (Questions, Concerns or Complaints? Contact Us) below or if applicable, by using the unsubscribe function within the Platform;
(m) to offer loyalty, partner and bonus programs and offers and other co-branded marketing efforts;
(n) to produce statistics and research for internal and statutory reporting and/or recordkeeping requirements;
(o) to store, host, back up (whether for disaster recovery or otherwise) of your personal data, whether within or outside of your jurisdiction;
(p) to facilitate a business asset transaction or a potential business asset transaction involving SPX, its affiliates, and/or related corporations, along with any third-party participants. A “business asset transaction” refers to the purchase, sale, lease, merger, amalgamation or any other acquisition, disposal or financing of an organisation or a portion of an organisation or of any of the business or assets of an organisation; and/or
(q) any other purposes which we notify you of at the time of obtaining your consent
(collectively, the “Purposes”).
5.2 Please note that we may employ automated decision-making processes in the course of your use of the Platform, such as to analyse and improve efficiency of the delivery services being performed, or to optimize delivery routes.
5.3 You acknowledge, consent and agree that SPX may access, preserve and disclose your information if required to do so by law or pursuant to an order of a court or by any governmental, law enforcement or regulatory authority having jurisdiction over SPX or in a good faith belief that such access preservation or disclosure is reasonably necessary to:
(a) comply with legal process;
(b) comply with a request from any governmental, law enforcement or regulatory authority having jurisdiction over SPX;
(c) enforce the SPX Terms of Service, rights of SPX, or this Privacy Policy;
(d) respond to any threatened or actual claims asserted against SPX or other claim that the rights of third parties have been violated;
(e) respond to your requests or enquiries; or
(f) protect the rights, property or personal safety of SPX, its employees, users and/or the public.
5.4 As the purposes for which we may collect, use, disclose or process your personal data depend on the circumstances at hand, such purpose may not appear above. However, we will notify you of such other purpose at the time of obtaining your consent, unless processing of the applicable data without your consent is permitted by the Privacy Laws.
6. INFORMATION ON CHILDREN
The Platform is not intended for children under the age of 13. We do not knowingly collect any personal data from anyone under the age of 13 nor is any part of the Platform directed to children under the age of 13. As a parent or legal guardian, please do not allow such children under your care to submit personal data to the Platform. In the event that personal data of a child under the age of 18 in your care is disclosed to Shopee, you hereby consent to the processing of the child’s personal data and accept and agree to be bound by this Policy on behalf of such child. We will close any accounts used exclusively by such children and will remove and/or delete any personal data we believe was submitted without parental consent by any child under the age of 13.
7. HOW DOES SPX PROTECT YOUR DATA?
7.1 We implement a variety of technical and security measures such as encryption of your data and strive to ensure the security of your personal data on our systems. The data that we hold is also contained behind secured networks and is only accessible by a limited number of employees who have been granted access rights to such systems.
7.2 However, there can inevitably be no guarantee of absolute security, for instance, when unauthorised disclosure, access, or use arises from malicious and/or sophisticated hacking by individuals or organisations through no fault of ours. Third parties may unlawfully intercept or access, or attempt to intercept or access, personal data transmitted to or contained on the Platform, or that technologies may malfunction or not work as anticipated. We will nevertheless deploy reasonable security arrangements to protect your personal data as required by Privacy Laws.
8. HOW LONG WILL SPX KEEP YOUR DATA?
We will retain personal data only in accordance with Privacy Laws, other applicable laws and this Privacy Policy. That is, we will destroy or anonymize your personal data when we have reasonably determined that
(a) the purpose for which that personal data was collected is no longer being served by the retention of such personal data;
(b) retention is no longer necessary for any legal or business purposes; and
(c) no other legitimate interests warrant further retention of such personal data. If you cease using the Platform, or your permission to use the Platform is terminated or withdrawn, we may continue storing, using and/or disclosing your personal data in accordance with this Privacy Policy and our obligations under Privacy Laws. Subject to applicable law, we may securely dispose of your personal data without prior notice to you.
9. DO WE DISCLOSE YOUR DATA TO THIRD PARTIES?
9.1 In the course of conducting our business and providing the Platform to you, we may need to disclose or transfer your personal data to third-party service providers, agents, affiliates, related corporations, and other relevant third parties for the Purposes as stated in this Privacy Policy. We are committed to ensuring that these third parties and our affiliates protect your personal data from unauthorized access, collection, use, disclosure, or processing, and retain it only for as long as it is necessary for the stated Purposes.
9.2 The third parties to whom we may disclose your personal data include, but are not limited to:
(a) Our subsidiaries, affiliates, and related corporations that process your personal data in the course of providing the Platform to you;
(b) Contractors, agents, service providers, and other third parties we engage to support the Platform or services offered on the Platform, including, but not limited to, financial service providers, manpower agencies telecommunications companies, IT providers, insurance companies, service providers whom we have authorized to administer or manage any referral programmes on our behalf, and data centres;
(c) Governmental, law enforcement, regulatory, or judicial authorities with jurisdiction over SPX, or other third parties, for reasons of safety, security, or compliance with applicable laws; and
(d) A buyer, potential buyer, or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of SPX’s assets, whether as part of a going concern or as part of bankruptcy, liquidation, or similar proceedings. This includes personal data held by SPX that is transferred as part of such a transaction, including any business asset transaction involving SPX or its affiliates.
9.3 The Platform uses Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses cookies, which are text files placed on your device, to help the Platform analyse how Users use the Platform. The information generated by the cookie about your use of the Platform (including your IP address) will be transmitted to and stored by Google. Google will use this information for the purpose of evaluating your use of the Platform, compiling reports on website activity for website operators and providing other services relating to website activity and Internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf.
9.4 For the avoidance of doubt, where Privacy Laws or applicable regulations permit us to collect, use, disclose, or otherwise process your personal data without your consent (for example, pursuant to legal processes such as subpoenas, court orders, or search warrants), we will continue to rely on such legal permissions. We may process your personal data on established legal grounds, including to fulfil legal obligations, protect our rights, perform contracts, pursue our legitimate interests, or in relation to legal claims.
10. USE OF THIRD-PARTY SERVICES OR APIs
10.1 The Platform uses and incorporates third party services or application programming interfaces (“APIs”). For example, we integrate third party maps, traffic or navigation APIs developed and provided by third parties such as Google, Inc. (Google Maps), or providers of payment solutions. We may also engage other third parties to offer other services and features to you through the Platform.
10.2 These third parties have separate and independent privacy policies as well as their own security arrangements. You are encouraged to review the privacy policies of these third parties on your own. Even if the third party is affiliated with us, we have no control over these linked sites, each of which has separate privacy and data collection practices independent of us. Data collected by these third parties (even if offered on or through our Platform) may not be received by us. We are not responsible or liable for the privacy practices or security arrangements of these third parties that provide services or APIs on the Platform.
11. WILL SPX TRANSFER YOUR DATA OVERSEAS?
In the course of providing the Platform to you, your personal data may be transferred to, stored or processed outside of jurisdiction that you are based in for one or more of the Purposes as stated in this Privacy Policy. However, we will only transfer your data overseas in accordance with Privacy Laws and this Privacy Policy.
12. HOW CAN YOU EXERCISE YOUR RIGHTS OVER YOUR PERSONAL DATA?
You have the right to withdraw your consent for the collection, use and/or disclosure of your personal data in our possession or under our control. You can do so by sending an email to our Data Protection Officer at the email set out in Section 13 (Questions, Concerns or Complaints? Contact Us) below, and we will process such requests in accordance with Privacy Laws. However, the withdrawal of consent may mean that we will not be able to continue providing the Platform to you and we may need to cancel your existing relationship, deployment, agreement you have with us, where applicable. Do note that we may retain your personal data where applicable laws permit us or require us to do so.
(a) You have the right to access your personal data, how we use it and who we share it with. Where available, you can access the personal data you have made available to us through your account on the Platform. You may also write to our Data Protection Officer at the email set out in Section 13 (Questions, Concerns or Complaints? Contact Us) below for access to your personal data that is in our possession or under our control.
(b) We may charge you a reasonable fee for the handling and processing of your requests to access your personal data. If we so choose to charge, we will provide you with a written estimate of the fee we will be charging. Please note that we are not required to respond to or deal with your access request unless you have agreed to pay the fee.
(c) We reserve the right to refuse access of or the correction your personal data in accordance with Privacy Laws where we are entitled to do so in stated circumstances, such as if access would cause immediate or serious harm, or threaten an individual’s safety, physical or mental health.
You have the right to request to correct an error or omission, or any inaccurate information in your personal data currently in our possession or under our control. Where available, you can either correct your personal data through your account management settings on the Platform, or by writing to our Data Protection Officer. Do note that we may need further information from you to ascertain your identity or verify your particulars to process your request.
13. QUESTIONS, CONCERNS OR COMPLAINTS? CONTACT US
If you have any questions or concerns about this Privacy Policy or our privacy practices, or wish to exercise your rights under applicable Privacy Laws, we welcome you to contact our Data Protection Officer by email at dpo.my@spxexpress.com.