DESCARTES SHIPRUSH PRIVACY POLICY

Effective Date of Policy: May 25, 2018

This document (the “Privacy Policy”) discloses the privacy practices of Descartes Systems (USA) LLC (“Descartes”) as it relates to Descartes’ ShipRush related products and services. This Privacy Policy applies to Descartes’ products and services including the My.ShipRush website located at my.shiprush.com (the “Website”). Please read the information below to learn what information Descartes collects and how it is used.
Please keep in mind that use of Descartes’ products and services are governed by agreements separate from this Privacy Policy. For example, My.ShipRush is governed by its Terms of Use and the ShipRush software is governed by its user license.

Descartes reserves the right to change this Privacy Policy at any time and the modifications, additions, or deletions are effective immediately. You can determine if this Privacy Policy has been revised by referring to the “Effective Date of Policy” date at the top of this page. Your continued use of the Website or any other product or service of Descartes after such modifications constitutes your agreement to be bound by the modified Privacy Policy.

1.Information Collected.

(a)In order to provide the agreed upon products and services Descartes will need to collect and process various types of information. Some information may include information that relates to an identifiable living person (“Personal Data”). Descartes will limit as much as reasonably possible the collection of Personal Data, however, due to the services provided some Personal Data is required. Personal Data that is collected by Descartes includes:

(1) Transactional information such as the name, postal address, telephone numbers, email address, and shipping information including the contents of the shipment for the ecommerce transactions stored and managed by the Website.

(2) User information including the name, email address, and contact information of users of the Website and/or ShipRush products and services.

(3) Technical information including IP Address, Uniform Resource Identifiers (“URI”) and other similar tracking information (e.g. Google Analytics) to identify the internet site that you came from or go to next as well as the time spent and types of interactions with the various pages of the Website, browser and operating system information, session or token information.

2. How Information is Used.

(a) Descartes may use Personal Data for the following reasons:

(1) to provide you the requested ShipRush services, either through the ShipRush software or the Website;
(2)to communicate with you about the ShipRush services, including confirming the provision of the services;
(3)to troubleshoot problems related to the ShipRush service;
(4) handling or preparing for disputes and litigation;
(5)to comply with all legal requirements including any obligations under local data privacy laws;
(6)to allow a shipping carrier or other Descartes partner (such as an ecommerce platform) investigate or enforce a breach or violation of their policies, procedures, or user agreements;
(7) to communicate with you about other potential Descartes products or services that Descartes believes would be beneficial to you.

3.How Information is Shared or Transferred.

(a)Descartes may provide transaction information to shipping carriers who you designate, have instructed us to proivde the information to, or ought reasonably expect the informatin be provided to in light of the circumstance. In most circumstances, such information will have already been provided to such shipping carrier in connection with a prior shipping transaction. Other than the shipping carriers, Descartes does not transfer, sell, trade, or rent Transaction Information to others as part of its normal business operations.

(b)Descartes may provide Personal Data to third parties who provide services for the benefit of Descartes or Descartes believes, in its sole discretion, will be useful or applicable to you or your business (collectively “Business Associates”). The use of your Personal Data by these Business Associates is restricted to using the information on behalf of Descartes or as otherwise directed by Descartes.

(c)Descartes reserves the right to transfer any and all information that it collects to third parties, in the event of a sale, merger or transfer by Descartes of all or any portion of its assets business.

(d)Descartes also will disclose information as required by law enforcement or judicial authorities, on receipt of a court order or subpoena, or to cooperate with a law enforcement investigation. Descartes reserves the right to report to law enforcement any activities that it, in good faith, believes to be unlawful.

(e) Where Descartes transfers Personal Data to or from a country that requires additional data privacy protection, Descartes will comply with any and all requirements to protect the information, including the use of commercially reasonable security measures and contractual protections such as the use of model clauses or requiring certification from the receiving party.

4.Updating Information. Account information provided during registration for a product or service becomes part of Descartes’ business records and cannot be deleted or changed. Without limiting the prior sentence, the Website does provide a feature for a user to update account information. Descartes may retain past information because some residual information will be part of other business records such as computer storage backups.

5.Third Party Privacy Policies and Data Collection. This document only addresses the collection, use and disclosure of information by Descartes and does not cover third party practices. For example, shipping carriers and ecommerce platforms each have their own user agreements, practices as to the collection, use and disclosure of data, and policies governing the privacy aspects of that data. Descartes is not responsible for the policies or practices of any third party.

6.Children Under 13. This website is directed to adults and is not directed to children under the age of 13. Descartes does not knowingly collect or use personally identifiable information from anyone under the age of 13.

7. Personal Data Belonging to Natural Persons in the European Union

(a) In the event any Personal Data provided by you to Descartes is subject to the European Union’s General Data Protection Regulation 2016/679 (“GDPR”), Descartes agrees to the additional obligations contained in this section as it applies to that Personal Data only. The terms “Data Controller”, “Data Processor”, “Process”, and “Procesing” shall have the same meaning as defined under the GDPR.

(b)Descartes agrees to provide you reasonable assistance to comply with the GDPR and respond to requests you may receive from data subjects, provided you agree to pay our reasonable costs for any assistance you require that is above and beyond the level of assistance we generally provide to other customers or requires additional resources not already used in providing you the Services.

(c)Descartes will employ appropriate and commercially reasonable technical and organizational security measures, taking into account the state of the art, the cost of implementation, and the risk arising based on the nature, scope, and purpose of the Personal Data and the processing. To that end Descartes will ensure its employees with access to Personal Data have committed themselves to confidentiality.

(d)Descartes will make available, on request, all information reasonably required to demonstrate compliance with Descartes’ security obligations as a Data Processor under the GDPR. You may mandate an inspection of our security measures only if:

(1)at the time of the audit or inspection Descartes is Processing Personal Data that is subject to the GDPR for which you are the Data Controller;
(2)the requested audit or inspection scope is not covered by any recent third-party audit results;
(3)you agree to pay for all costs associated with the audit or inspection; and
(4)the audit or inspection is conducted by an independent third-party that is mutually agreeable to both you and Descartes.

(e)In the event of a data breach occurring which involves or affects any Personal Data controlled by or belonging to you, Descartes will notify you of the data breach without undue delay.

(f)At any time you may request that we destroy any Personal Data provided that:

(1)Descartes is not required by law, contract, or other such obligations to retain the Personal Data;
(2)the Personal Data is not part of any system or historical records or where the deletion or destruction of the Personal Data would not reasonably result in any other data being adversely affected or preventing the Services or the Website from functioning as designed;
(3)the Personal Data would not be relevant to any potential litigation or is beyond any applicable limitation period;
(4)Descartes shall be required to use only commercially reasonable methods and comply with commercially reasonable timelines in deleting or destroying any Personal Data.

(g)You agree that Descartes may employ any affiliate of Descartes as a subprocessor to store, manage, or otherwise Process the Personal Data. All data transfers such affiliates will be performed in accordance with the GDPR and employ, where required, contracts based on the model clauses. Furthermore, you agree that Descartes may employ third-party hosting services to host servers, whether real or virtual, that support the Services. Should Descartes wish to retain any additional subprocessors other than those described herein, we will provide notice via email or by updating these Terms of Use 30 days in advance. You agree that continued use of the Services will constitute acceptance by you of the change. If you object to any subprocessor and advise Descartes of your objection in writing, Descartes will attempt to find a commercially reasonable replacement, failing which your use of the Services will immediately terminate as set out under these Terms of Use.

8.Additional Information. If you have any questions about this Privacy Policy, please contact Descartes at:
Descartes Systems (USA) LLC
Attn: Contract Administration
120 Randall DriveLakeside Avenue, Suite 101
Waterloo, Ontario, Canada N2V 1C6
Email: info@descartes.com