Privacy policy

Hallmark Logistics Solutions ("Hallmark", "we", "our", "us") is the data controller for any personal data collected through our website, mobile application, and customer-service interactions.

Our registered office is at 50 avenue des Champs-Élysées, 75008 Paris, France. Our data-protection officer can be reached at dpo@hallmark-logistics.com.

This privacy policy applies to all personal data we collect from individuals interacting with Hallmark — visitors of our website, customers using our forwarding, consolidation or fulfillment services, recipients of parcels, and business contacts.

It explains what we collect, why we collect it, on what legal basis, how we use and share it, how long we keep it, and the rights you have under applicable data-protection law — primarily the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") and the French Data Protection Act of 6 January 1978 as amended.

We process the following categories of personal data, depending on your interaction with us:

• Identification data: first name, last name, date of birth (when required by customs), national identifier (CPF for Brazilian recipients, CURP for Mexican recipients, RUT for Chilean recipients, etc.).
• Contact data: postal address, billing address, delivery address, e-mail address, telephone number.
• Account data: username, hashed password, account preferences, language and currency.
• Transactional data: order history, shipment history, declared values, customs declarations, payment receipts (we do not store full card numbers — processing is delegated to a PCI-DSS compliant gateway).
• Behavioural data: pages visited, clicks, search queries, device type, IP address, cookies and similar identifiers (see our Cookies policy).
• Customer-service data: e-mail content, chat transcripts, call recordings (with prior notification), satisfaction surveys.

We process personal data for the following purposes and on the following legal bases:

• To open and maintain your Hallmark account — performance of a contract (Article 6(1)(b) GDPR).
• To handle the shipping, customs clearance and delivery of your parcels — performance of a contract.
• To comply with our legal obligations as a freight forwarder, importer of record and tax-paying entity — legal obligation (Article 6(1)(c)).
• To prevent fraud and money laundering — legitimate interest (Article 6(1)(f)) and legal obligation.
• To improve our services, run analytics and benchmark performance — legitimate interest, in a way that respects your fundamental rights.
• To send marketing communications about our services — consent (Article 6(1)(a)), revocable at any time via the unsubscribe link.

We never sell your data. We share it only with the parties strictly required to perform our service or to comply with our legal obligations:

• Carriers: Air France Cargo, Latam Cargo, DHL Express, FedEx, UPS and the local last-mile partners in each destination country.
• Customs authorities: the relevant authority in the country of import (e.g., Receita Federal in Brazil, SAT in Mexico, AFIP in Argentina) receives the declared shipment information.
• Payment service providers: Stripe Payments Europe Limited, processing card and bank-transfer payments under PCI-DSS standards.
• Cloud and IT providers: Vercel (hosting), Amazon Web Services (data storage in the EU region), Datadog (observability, limited to logs without payload).
• Professional advisers: lawyers, auditors and accountants, bound by confidentiality.

Whenever data is transferred outside the European Economic Area, we rely on appropriate safeguards under Articles 44–49 GDPR, primarily Standard Contractual Clauses and, where applicable, supplementary measures.

We keep personal data only as long as necessary for the purposes for which it was collected and to comply with our legal obligations:

• Account data: for the duration of the account, then 3 years after the last activity for prospection purposes.
• Customer transactional data: for 10 years after the last shipment, as required by French commercial and tax law.
• Customs documentation: for 5 years, in line with article 51 of the EU Union Customs Code.
• Marketing data: for 3 years from the last interaction.
• Cookies and similar identifiers: for a maximum of 13 months from collection.

Under the GDPR and the French Data Protection Act, you have the right to access, rectify, erase, restrict and port your personal data, and to object to its processing on grounds related to your particular situation. You may also withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

You can exercise these rights by writing to dpo@hallmark-logistics.com, attaching a copy of an identity document for verification purposes. We respond within one month, extendable by two months for complex requests.

If you consider that our processing of your data infringes the GDPR, you may lodge a complaint with the French data-protection authority (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS 1.2+), encryption at rest, role-based access controls, principle of least privilege, multi-factor authentication for staff, periodic security audits, and a documented incident-response procedure.

In the event of a personal-data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in accordance with Article 34 GDPR.

We may update this policy from time to time to reflect changes in our services, applicable law or industry best practice. Significant changes will be communicated by e-mail or prominent notice on the website at least 30 days before they take effect. The version in force is dated at the top of this page.