.png)
PRIVACY POLICY
PALL-EX GROUP PRIVACY POLICY
Version 6 – 15th October 2026
Pall-Ex is the pallet shipping network trusted by thousands of customers to ensure safe, swift and certain pallet delivery to destinations all over the UK, throughout Europe and across the globe.
This policy is applicable to Pall-Ex Group and all its legal entities:
-
Pall-Ex Group Limited
-
Pall-Ex (UK) Limited
-
Pall-Ex International Limited
-
Pall-Ex Logistics Limited
Pall-Ex are committed to safeguarding the privacy of physical and digital personal data about our visitors, customers, suppliers and workforce; this privacy policy tells you what to expect when Pall-Ex collects personal information and how we process your data.
The Pall-Ex entity responsible for deciding how and why your personal information is processed will be the controller of that information. The relevant entity will depend on the service you receive or the relationship you have with us. You may contact our Data Protection Officer if you require confirmation of which Pall-Ex entity is the controller of your personal information.
Legal Basis
The legal basis that we rely on for processing your data will depend upon the circumstances in which it is being collected and used, but will in most cases fall into one of the following categories:
-
Where you have provided your consent to allow us to use your data in a certain way;
-
Where the processing is necessary to carry out for the performance of a contract with you;
-
Where the processing is necessary for us to comply with a legal obligation;
-
Where we have a legitimate interest to process the data.
Where we rely on legitimate interests, those interests may include operating and improving our logistics network and services; communicating with customers, consignees, suppliers and subcontractors; protecting our people, premises, vehicles, freight, systems and property; preventing and investigating fraud, crime, loss and misuse; managing complaints and legal claims; maintaining accurate business records; and where permitted by law, promoting our services. We balance these interests against the rights and freedoms of the individuals concerned before proceeding.
Disclosures
We may disclose information about our employees, officers, agents, suppliers or subcontractors in the following circumstances:
-
where we have the individual’s permission;
-
to the extent that we are required to do so by law, or in connection with any legal proceedings or prospective legal proceedings;
-
in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk);
-
to deliver our service or comply with our contractual obligations;
-
for analytical, statistical or historical purposes;
-
to the purchaser (or prospective purchaser) of any business or asset which we are (or are contemplating) selling.
Depending on the relevant processing activity, we may share personal information with Pall-Ex group companies, network members, depots, subcontractors, couriers, professional advisers, insurers, payment and financial service providers, IT and hosting providers, communications and marketing providers, analytics providers, government departments, regulators, law-enforcement bodies, courts and prospective purchasers of our business or assets or legal and professional advisors. We share only the information reasonably necessary for the relevant purpose and require recipients to protect it appropriately.
Except as provided in this privacy policy, we will not provide your information to third parties. We can assure you that we do not rent, swap, share or sell your personal data to third parties. Occasionally, if we feel it is of your interest to introduce you to a third party, we will ask you first and only introduce you if you are interested.
Service providers
We use service providers, such as software platform and IT support providers, known as Processors, to help deliver our services to you. We may give authorised individuals within these Processors access to your personal information, but only where necessary for them to provide services on our behalf. We carry out due diligence checks on Processors to ensure your data is processed confidentially and with appropriate security measures.
How we use personal data
This Privacy Policy explains how we collect, use and manage personal information. We collect information in the following ways:
-
Visitors to our website;
-
People who use our services or ask for information, such as newsletters, events or updates;
-
People involved in employment, product or service contracts.
Where we request personal information because it is required by law or needed to enter into or perform a contract, we will identify the information that is mandatory. If you do not provide the required information, we may be unable to provide the relevant service, complete a collection or delivery, administer an account, process an application or meet our legal obligations.
Visitors to our website
When someone visits our website we collect standard internet log information such as their IP address, device details and approximate location and details of visitor behaviour patterns, for example, what pages they visit and how long they stay on each page. We do this to help us improve our website, service and user experience.
We use website usage information to understand how visitors use our site and to improve our website, services and user experience. Depending on the information collected and the technologies used, this data may constitute personal data even where we do not directly identify the visitor. We do not use this information to identify individual visitors unless this is necessary for security, fraud prevention or compliance with legal obligations.
Where we want or need to collect information that can identify an individual, we shall make clear at the time the information is requested why it is needed and how it will be used, for example, if you sign up to our electronic newsletter. We do not always need your consent to capture personal data but where appropriate we shall ask for it.
Cookie Policy
We use several essential and non-essential cookies on this website; you can find out more about them by visiting https://policies.pallex.com/cookie/index.htm.
Artificial Intelligence (AI)
To provide a better user experience and deliver a more efficient service, we may use artificial intelligence or automated tools to support our operations. We will explain when a decision that produces legal or similarly significant effects is made solely by automated means, including the logic involved, the significance and the expected consequences for you. Where applicable, you will have the right to request human intervention, express your point of view and challenge the decision. Our AI systems are designed to process personal information securely and in accordance with applicable data protection laws.
People who use our services (Processing Activities)
Below are examples of the processing activities that we may carry out and for which we would use your personal data for:
Marketing Activities - Competitions or promotions, subscriptions to one of our services, requests for an audit, completion of a survey, enquiry or register for one of our events.
Business Activities - Personal data will be processed to manage general enquiries, customer, supplier and subcontractor accounts and communications, order processing and fulfilment, delivery tracking and proof of delivery, this will include photographs of pallets in location and signatures.
Administrative Activities - Personal data will further be processed to manage IT systems and cybersecurity, security and access controls, warehouse and inventory operations, driver and vehicle allocation, route planning and optimisation, fleet, driver, and health and safety management, complaints and claims, billing and payments, HR and payroll administration, regulatory and legal compliance, customs and international shipping, business reporting and analytics, and footage from CCTV and in-vehicle cameras
Who do we collect information about?
Customers - A 'Customer' is a person or organisation who has a contract with Pall-Ex Group (or one of its subsidiaries) to deliver pallets to or collect pallets from a Consignee. The Customer shares Consignees personal data with Pall-Ex Group for the purpose of providing a delivery service.
Consignee - A 'Consignee' is someone who is intended to have a collection or delivery from Pall-Ex Group (or one of its subsidiaries) or one of our Customers.
Driver - A ‘Driver’ is someone who uses the NexusGO application to collect or deliver freight to a Customer or Consignee from Pall-Ex Group (or one of its subsidiaries) or one of our Customers.
General Public - A 'Member of the General Public' is an individual excluding Customers or Consignees whose personal information may be collected by Pall-Ex Group. For more information about how we use the personal information of a member of the general public, please see the ‘General Public’ section of this Privacy Notice.
We may receive personal information directly from you or from other sources. These sources may include our customers, consignees, network members, subcontractors, couriers, recruitment agencies, service providers, publicly available sources and other organisations involved in arranging or completing collections and deliveries. Where information is provided by another organisation, that organisation is responsible for ensuring that it is permitted to share the information with us.
Pall-Ex Group is not a processor for any personal data contained within the packages they deliver as we only have access to details of senders and recipients.
Pall-Ex Group adheres to the data protection laws that apply both to where we are based and where the person whose data we process is located.
The following table provides a clear overview of the types of personal data collected, their uses, legal bases, storage, and retention periods for each category.
Consignee
What Information is it?
How We Use the Information
Legal Basis for Processing
Where is it stored/ Accessed?
Data Retention Period
Full Name
To deliver the pallet(s) to the named person
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Delivery Address
To deliver the pallet(s) to the address provided
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Telephone Number
To contact in the event assistance is required to deliver the pallet(s) & provide delivery notifications
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Email Address
To provide delivery notifications
Contract
Nexus suite of products database
7 Years + 1 additional year backup
POD / ePOD
To confirm delivery
Contract
Nexus suite of products database
7 Years + 1 additional year backup
What3words Location
To assist with delivery / collection of pallets
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Photo of Collection / Delivery Location
Investigate the loss of pallets not received
Consent
Nexus suite of products database
7 Years + 1 additional year backup
Records of Enquiries, etc.
Held within delivery systems, emails, etc.
Legitimate Interest/Consent
To keep an historical record of enquiries.
Nexus suite of products database
7 Years + 1 additional year backup
Customer OR PROSPECT
What Information is it?
How We Use the Information
Legal Basis for Processing
Where is it stored/ Accessed?
Data Retention Period
Individual & Business Contact Name
To enter a contract for collections and deliveries
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Billing Address
To enter a contract for collections, deliveries & invoicing
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Business Email Address
Contact purposes
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Telephone Number
Contact purposes
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Authorised Signatory
Legal sign off
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Nexus Suite of Products Login Data
To assist with technical issues
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Nexus Suite of Products Username & Password
To assist with technical issues
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Name, Company, Email, email broadcast history, IP address, device details, geographical location, consent, email interaction including links opened. mailing preferences.
To capture client and prospect data to add to our mailing list and send email broadcasts.
Consent
Legitimate interest
For direct marketing
HubSpot
2 years after user stops interacting with the email broadcast.
Driver
What Information is it?
How We Use the Information
Legal Basis for Processing
Where is it stored/ Accessed?
Data Retention Period
Driver Name
To provide a contact name to the depot.
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Mobile Number
To contact in the event of issues or providing an update about delivery or collections.
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Location Data
In order to track a delivery, provide accurate ETA’s and confirm delivery/collection location’s.
Contract
Nexus suite of products database
7 Years + 1 additional year backup
Registration no.
To provide unique a unique vehicle reference
Contract
Nexus suite of products database
7 Years + 1 additional year backup
General Public
Information
What could this include
How we use the information
Legal Basis
Data Retention Period
Your identity and contact details Records of enquiries, complaints
Full Name, Address, Mobile, Email, letters and personal info in systems.
To assist with, and where necessary investigate, queries, claims and complaints.
Consent / Legitimate interest
Where it is not possible or practical to obtain your consent.
7 Years + 1 additional year backup
CCTV footage & audio recordings
Images, road environments, call recordings
Prevention/detection of crime, insurance, training, to keep the environment safe for visitors
Consent / Legitimate Interest/ to protect our staff, visitors and property.
Recognised Legitimate Interest’s for · Disclosures to public bodies
· Safeguarding vulnerable individuals
necessary for the purposes of detecting, investigating or preventing a crime.
30 days unless required for specific incidents
Recruitment & Candidates
Information
What could this include
How we use the information
Legal Basis
Data Retention Period
Job Application
Name, contact details
To manage the recruitment process
Consent
1 Year
Information to facilitate interview attendance
Health information
To manage the recruitment process
Consent
1 Year
Where we process special category personal data, such as health information, we will identify both an Article 6 lawful basis and an additional condition under Article 9 of the UK GDPR. Where we process information about criminal convictions or offences, we will also identify an appropriate condition under the Data Protection Act 2018. We will process this information only where it is necessary and subject to appropriate safeguards.
Third Party Organisations
Third-Party
What could this include
How we use the information
Legal Basis
Retention Period
Collection & Delivery Subcontractors, Couriers
Name, contact details
To manage the collection and delivery process
Contract
7 Years
Address
To retrieve the longitude and latitude of the collection and delivery address to calculate an estimated time of arrival (ETA)
Legitimate interests
7 Years
Where a specific retention period is not stated, we retain personal information only for as long as necessary for the purpose for which it was collected. In deciding the appropriate period, we consider the nature, volume and sensitivity of the information; the risk of harm from unauthorised use or disclosure; the purposes of the processing; whether those purposes can be achieved by other means; and applicable legal, regulatory, tax, accounting, insurance and limitation requirements. Information may be retained for longer where this is necessary for an actual or anticipated legal claim, investigation or regulatory requirement.
How we protect your personal information
Pall-Ex Group is committed to protecting your personal information. We place a lot of time and effort into ensuring that we have adequate technical and organisational measures in place to do so.
Pall-Ex Group IT is certified to ISO27001:2022. A copy of the current certificate is available on request.
ISO 27001 is the leading international standard for information security management systems (ISMS), providing a framework to protect data confidentiality, integrity, and availability. It enables organisations of all sizes to manage risks, comply with legal requirements and secure assets through a risk-based approach. Complying with the requirements of ISO 27001 enables us to manage the security of our data assets such as financial information, intellectual property, and personal and confidential information entrusted to us by our Customers and Consignees.
ISO 27701 is one element of demonstrating to our Customers, Consignees, general public, external organisations and internal stakeholders, that mechanisms are in place to keep personal information safe and to comply with the data protection laws.
The sending of information via the internet or email is fundamentally insecure, and we cannot guarantee the security of personal information sent using these methods. Once we have received your information, we will use strict procedures and security features to prevent unauthorised or unlawful processing and accidental loss, destruction, or damage of your personal information.
Where we have given you (or where you have chosen) a password that enables you to access certain parts of our service, you are responsible for keeping this password confidential. We strongly recommend you do not share your password with anyone.
In the event of a personal data breach, we will follow our incident-response procedures and assess the risks to affected individuals. Where the breach is likely to result in a risk to individuals’ rights and freedoms, we will notify the Information Commission’s Office or other competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to affected individuals, we will also notify those individuals without undue delay, unless an applicable legal exception applies.
International data transfers
To enable us to deliver services globally, personal information may be transferred to countries outside the UK. Where the destination is not covered by UK adequacy regulations, we will use an appropriate safeguard permitted by data protection law, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another legally recognised transfer mechanism. We will also carry out any required transfer risk assessment and implement supplementary measures where appropriate. You may contact our Data Protection Officer for further information about the safeguards applying to a particular transfer and how to obtain a copy of them.
NexusGo & NexusTrunk
NexusGO is a bespoke Pall-Ex Group App to allow drivers to fulfil collection and delivery services.
When using NexusGO, Information such as location will be used in order to confirm a collection and delivery location, along with generating ETA’s.Location information is also used to provide a ‘snail trail’ of the collections and deliveries performed during the period of the assigned manifest which can be accessed by the delivering/collecting depot and its users.
Drivers are required to allow access to mobile devices cameras to scan and photograph freight at collection and delivery locations, receive signatures and scan manifests at Pall-Ex hub locations. Pall-Ex Group are the Controller for any images taken or data processed and neither may be used by any other person or third party for any other purpose.
NexusTrunk is a bespoke Pall-Ex Group App to allow drivers to fulfil the collection and delivery of pallets in and out of Pall-Ex sortation hubs across the UK and Europe.
When using NexusTrunk, Information such as location will be used to confirm a trunk location, along with generating ETA’s.
Location information is also used to improve efficiency within each of the Pall-Ex hubs by identifying early and late trunks. It also allows the hubs to manage roadworks and situations which can have a negative impact on service.
Pall-Ex Group is relying on our legitimate interests to process data in the NexusGO and NexusTrunk apps.
Location Information
When drivers use NexusGO, NexusTrunk or another service that requires precise location information, we collect GPS location data to support collections and deliveries, generate estimated arrival times, confirm locations, provide an operational journey record and improve service efficiency. The applicable lawful basis is our legitimate interests in operating and improving our logistics services, as described above. Device permissions control whether the application can access location information, but they do not determine the lawful basis for processing. Disabling location access may prevent some application features or services from functioning correctly.
This information will be uploaded to our company and/or service providers servers.
You can manage access to location information through your mobile device settings. However, location services must be enabled while you are carrying out paid duties for Pall-Ex.
Your Rights
Under the relevant Data Protection legislation you have several data protection rights, these include the right to:
-
Be informed about how your data is being used
-
Access your personal data
-
Have incorrect data updated
-
Have data erased (also called the right to be forgotten)
-
Stop or restrict the processing of your data
-
Withdraw your consent at any time
-
Data portability (allowing you to get and reuse your electronic data for different services)
-
Object to how your data is processed in certain circumstances
-
Complain (see below)
You also have the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects or similarly significantly affects you, except where an applicable legal exception applies. Where such processing is permitted, appropriate safeguards will be provided.
These rights are not absolute and may not apply in every circumstance. We may need to retain or continue processing some information where this is required or permitted by law. We will explain our decision if we are unable to fulfil a request in whole or in part. You will not usually be charged a fee for exercising your rights, although a reasonable fee may be charged, or a request may be refused, where a request is manifestly unfounded or excessive.
If you wish to; access, update, restrict, remove, object to or no longer want to hear from us please contact us by one of the channels below and we will process your enquiry as swiftly as possible and, unless a good reason exists, within one calendar month.
Changes to our Privacy Notice
As our processing activities evolve and change it will be necessary for us to update this Privacy Notice. If a significant change occurs we shall notify you by email.
We may also notify you in other ways from time to time about the processing of your personal information.
Complaints
If you contact us about how your personal data is being processed, we will do our best to deal with your enquiry quickly and fairly. If you are not satisfied with our response, you have the right to make a complaint. You can do this by:
-
Completing our online registration form (clicking here)
-
Contacting us using any of the channels listed below.
We will acknowledge your complaint promptly and within 30 days and deal with it fairly and without undue delay. Before assisting you, it may be necessary to confirm your identity. If you remain dissatisfied, you may lodge a complaint with the Information Commission’s Office using the contact details below.
Data Protection Contact
01530 239 000
Pall-Ex (UK) Ltd, Pall-Ex House, Victoria Road, Ellistown, Leicester LE67 1FH
Pall-Ex Group IC References:
Z8483627 – Pall-Ex (UK) Limited
Z8483658 – Pall-Ex International Limited
ZB765559 – Pall-Ex Logistics Limited
INFORMATION COMMISSION’S OFFICE
Finally, if you are unhappy with how we have processed your information or dealt with your compliant, you have the right to lodge a complaint with the The Information Commission, contact details below:
Information Commission
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF
Helpline: 0303 123 1113 (local rate) or +44 1625 545 745
Website: ico.org.uk
How to contact us
Further details of our data protection arrangements can be obtained by writing to our Data Protection Officer, or by contacting our head office:
Pall-Ex Group Limited, Pall-Ex House, Victoria Road, Ellistown Leicestershire LE67 1FH
Email: DPO@pallex.co.uk
Last Updated: 24/04/2026