Handling of Personal Information at M&P

1. Introduction
The Privacy Policy explains how personal information obtained by M&P from customers is utilized. Please read this Privacy Policy carefully when using M&P's services and products. Your use of M&P's services and products will be deemed to mean you have fully understood and agreed to this Privacy Policy.

2. Scope of application

1. The Privacy Policy will apply when customers use M&P's services and products.
2. This Privacy Policy applies to personal information collected by M&P from Corporate customers, Walk in customer etc. customers using the Services pursuant to a written agreement or Consignment Note/Airway Bill .

3. Purpose of using personal information
M&P utilizes personal information obtained from customers for the following purposes:

1. (1) Acceptance of offer, provision and communication with respect to M&P services and products
2. (2) Guidance, provision, and management of other services and products offered by M&P
3. (3) All operations incidental or related to the above (1) - (2)
4. (4) Implementation of questionnaires concerning services and products offered by M&P
5. (5) Development of new services and products
6. (6) Guidance, operation, management and information provision for various events and campaigns
7. (7) Notification of services and products offered by M&P
8. (8) Complaint handling &Response to inquiries and requests

4. Acquisition of personal information
M&P will obtain the following personal information by fair and appropriate means for the purpose of achieving the previously mentioned purposes.

1. (1) Personal information provided to 'M&P by the customer to apply for M&P's services, etc. The customer's & Consignee's name, Address, Computerized National Identity Card number(CNIC) & copy of CNIC, NTN( National Tax Number), fax number, email address, business contact, mailing address and any other information required for provision of M&P's services and all operations incidental to provision of services.

M&P will never obtain and use information of a sensitive nature to the customer (hereinafter, "sensitive information"), such as information on race, beliefs, social standing, history of illness, crime records, and history of having suffered harm from a crime, unless required by laws and regulations or by the consent of the customer.

5. Choice by the customer
Information such as Name, address, telephone number, CNIC number, copy of CNIC is mandatory for provision of M&P's services without which it cannot provide any of its's services to customers. Customers may not be able to avail the services of M&P if they refuse to provide their personal information. Customers will also be unable to receive campaign notices and other M&P information if they do not provide personal information.

6. Disclosure and provision of information to a third party
provision of information to data-sharing partners and business-entrusted companies is not deemed to constitute disclosure or provision to third parties. M&P will not disclose or provide customers personal information including sensitive information to any third parties except under the following circumstances,

1. (1) If required by any law enforcing agency, court or any legal forum constituted under the Law.
2. (2) Customer consent has been obtained.
3. (3) Disclosure or provision is required within the scope allowed by laws or regulations.
4. (4) Disclosure is required to protect human life, health, or property in cases where obtaining customer consent is difficult.
5. (5) Disclosure is required to cooperate with the public affairs of national or local governments, and when obtaining customer consent is likely to hinder the administration of public affairs.
6. (6) Disclosure or provision of information as statistical data (in a form whereby the customer cannot be identified).
7. (7) Provision of information as a result of the succession of business due to a merger, company split, transfer of business or otherwise.
8. (8) Provision of information in accordance with the procedures based on laws and regulations, under the condition that the following information can be easily checked by the customers themselves through the M&P website, etc., and that the customers have not declared their wish to refuse provision of their information.
1. 1) The purpose of obtaining information is to provide such information to a third party
2. 2) Specific personal data items to be provided to a third party
3. 3) The means by which such personal information is provided to a third party
4. 4) Provisions of information will be suspended upon the customers' request
5. 5) Methods for accepting requests from customers

7. Data sharing
M&P will share customer information as follows.
Scope of Data Sharing
Purpose of use by the user

1. (1) For development of new services and products, etc.
2. (2) For notification of products and services by direct mail, etc.
3. (3) For delivery and transfer to relevant company in the event of an inquiry, application for use or other request from a customer regarding products and services provided by M&P .
4. (4) For appropriate and smooth fulfillment of other transactions with customers, etc.

Personal information items to be shared
Customers AWB number, customer name, gender with written consent of customer, date of birth if available, address, telephone number, fax number, email address, business contact (name of company, department, title, address, telephone and fax numbers), mailing address, content of transactions etc. Party responsible for management of personal information M&P Express Logistics ( Private) Limited.

8. Business entrustment
In providing products and services to customers, M&P may entrust part of its business operations to third parties to which personal information may also be disclosed to the extent required to achieve the purpose of the entrustment. In these cases, M&P will implement all appropriate measures in managing and supervising such third parties to safeguard the handling of customers personal information, including establishing agreements on the handling of such personal information.

9. Transfer to outside of Pakistan If M&P provides customers personal information to third-party business operators outside of Pakistan, including business-entrusted companies and data-sharing partners, M&P will take necessary and appropriate measures in keeping with laws and regulations.

10. Management of personal information
In receiving customers personal information, M&P will manage such information according to the strictest standards and take the utmost care to prevent leaks, loss, or alterations thereof. M&P ensures that the board members and employees are properly trained regarding appropriate handling to safeguard the security of information identifying individual customers. Retention period for personal information is 90 days or the purpose for which it is used unless agreed through a contract with the Customer for retaining more than 90. After the purpose of the information has been achieved, M&P will dispose of the information in question by appropriate methods.

11. Request about handling of Personal Information If M&P receives a request from a customer, submitted in the manner specified, for the disclosure, correction, deletion, addition, discontinuance, or erasure (hereinafter, "disclosure, etc.") of the customers personal information stored in a database held by M&P, the request will be handled as follows, within a reasonable timeframe and scope, after confirming that the request was submitted by the customer himself/herself.

1. (1) Request for disclosure
2. Personal information items will be disclosed in accordance with rules & regulations and the customers request.
3. (2) Request for correction, deletion, or addition
   
4. Correction, deletion, or addition of personal information will be undertaken to the extent possible after conducting a due review of the request.
5. (3) Request for discontinuance or erasure
   
6. The use of personal information items designated by the customer will be discontinued, and the relevant information erased if so desired according to rules & regulations and in accordance with the submitted request.

However, please note that such requests may prevent customers from being provided with services that they had utilized, or may impede the provision of services in accordance with their wishes. Please agree to the occurrence of such disadvantages before making the request.
M&P may not be able to fulfill the customers requests if compliance with such requests would seriously impact M&Ps business operations, or result in a violation of laws and regulations.

12. Method for submitting request for disclosure, etc.
The method for submitting requests for disclosure, etc., or notification of purpose of use of personal information (hereinafter, "requests for disclosure, etc.") received by M&P from customers, is as follows.

1. Method for submitting request

Please send your request by postal mail to the address below.
Address: M&P Express (Private ) Limited ,C-17, DHA Phase 2 Extension, Korangi Road Karachi.
Attention:

13. Modification of the Privacy Policy
M&P may make modifications to this Privacy Policy. If modifications are made, details will be posted on the M&P website (www.mulphilog.com), so please be sure to carefully read the contents of any changes that have been made.

Handling of personal information of EEA( European Economic Area) residents by M&P

Handling of personal information of persons residing in the European Economic Area (hereinafter referred to as "EEA") based on the REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive "95/46/EC" shall be applied. In the event that any provisions of this chapter contradict those of chapter 1, the provisions of this chapter shall prevail.

1. Introduction
A guardians consent or permission must be obtained in the event that a customer under the age of 16 uses M&Ps service and consents to this Privacy Policy. The data subjects consent to the M&Ps Privacy Policy must be obtained in the event that a person such as a family member applies for M&Ps service on behalf of the data subject.

Request about handling of Personal Information
If M&Ps receives a request from an EEA resident, submitted in the manner specified, in respect of his/her customers personal information held by M&P, the request will be handled as follows, within a reasonable timeframe and scope in addition to Chapter 1, Article 11 (Request about handling of Personal Information). M&P will handle such request after confirming that the request was submitted by the customer himself/herself.

1. (1) Request for withdrawal
2. Personal information will be deleted or suspended in accordance with the customers request, wherever possible and appropriate, after due review of the request.
   However, please note that such requests may prevent customers from being provided with services that they had utilized, or may impede the provision of services in accordance with their wishes. Please agree to the occurrence of such disadvantages before making the request.
3. (2) Request for data portability
4. A copy of the personal information held by M&P will be provided in accordance with the customers request, wherever possible and appropriate, after due review of the request.
5. (3) Objection to data processing
6. The use of personal information will be suspended, wherever possible and appropriate, after due review of the request.
7. (4) Method for submitting request
8. Customers may submit above by the method provided in Chapter 1 Article 12. Customers may use the following forms for submission.

Transfers
M&P may provide the customers personal data to third parties, such as its affiliates, cloud vendors and its outside contractors, etc. to implement the purposes of use specified above. Since countries located outside the EEA (including, without limitation, Japan, the U.S., the same shall apply hereafter) are among the locations of third parties to whom M&P will disclose the personal data of the customers, the customers shall be deemed as having consented to the following matters by consenting to the Privacy Policy:

1. (1) In the case that the country in which the third party is located is outside the EEA, such country does not have the same data protection laws as the EEA, many of the rights provided in the EEA to the data subjects of the data will not necessarily be provided.
2. (2) The customers personal data may be provided for the purposes specified above to the subsidiaries and affiliates of M&P or third parties outside the EEA.

Change of purposes of use of personal data
In the case of a change to the purposes of use of customers personal information, M&P will announce the revised Privacy Policy in advance on M&Ps website (_______).

Lodging a complaint with an authority
Customers have the right to lodge a complaint on the processing of their personal data with the data protection authority having jurisdiction over their residence. Please use the following URL to contact the authority having jurisdiction over your residence: (http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080)

(as of May 2018)