J&T Express Courier Operation Application Privacy Notice
Effective Date: May 9, 2026
J&T Express
Courier Operation Application Privacy Notice
This Privacy Notice (“Notice”) describes how J&T Express UK Ltd (“J&T Express”, “we”, “us” or “our”) will make use of your data when you interact with us and the express services provided by us. It also describes your data protection rights, including a right to object to some of the processing which J&T Express carries out. More information about your rights, and how to exercise them, is set out in the “Your Choice and Rights”.
This Notice applies to J&T Express’ individual client (“Individual Client”) and personnel from third parties (e.g. supplier) (“Third Party Personnel”). The data processing described in this Notice may be limited as required by applicable law.
This Privacy Notice applies only to the J&T Express Courier Operation Application. The personal data we collect and process may vary depending on the specific functions you use within this system. The relevant categories of personal data and processing purposes are described in this Notice.
We also may provide you with additional information when we collect personal data, where we feel it would be helpful to provide relevant and timely information.
Data Controller and Contact Information
The data controller for your personal data will be J&T Express UK Ltd.
If you have any questions regarding this Notice or your data protection rights, please contact our Data Protection Officer:
• Email: info@dataprivacyservices.co.uk
• Postal Address: Data Privacy Services, 124 City Road, London, EC1V 2NX
Purposes and Categories of Personal Data We Collect
We are required to have a legal basis in order to process your data. We explain these legal bases below. We also explain the purposes for which we process your data, the processing operations that we carry out, and the categories of data that we use for each purpose. We may obtain and process personal data of third parties from you (for example, the recipient or sender you provide), and we will also disclose the categories of such personal data in this Privacy Policy. Please ensure that you have enabled such third parties to read this Privacy Policy and obtained the consent of the data subjects before providing us with any personal data of third parties.
Legal Basis
Contractual performance – we have obligations under our agreement with you, depending on the nature of the contract. To fulfil these obligations we have to use your data.
Consent – in certain limited cases, we ask for your consent to use your data. Whenever we ask with your consent we will explain the situations where we use your data and for what purposes.
Legitimate interest – we can process your data when this is necessary for us to achieve a business purpose, or where this is necessary for someone else to achieve their purpose. We explain below what interests we, or others, are trying to achieve when we process your data. Where we process personal data on the basis of a legitimate interest, then – as required by data protection law – we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details at the end of the Notice.
Legal obligation – as an organisation we have obligations to comply with legal, regulatory and other requirements under applicable local laws. In certain cases, we will have to use your data to meet these obligations.
Purposes and Categories of Personal Data
We have set out below why we process your data and explain what data we use in each case.
2.1 Processing of Personal Data for Core Functions
2.1.1 Account Management & Staff Management
To provide account registration, login, and staff management services for courier station operations (including external partners, and clients), we will collect and process the following personal data:
For what purpose will personal data be used?
What categories of personal data will be used?
What’s the legal basis for this processing?
How long will the personal data generally be stored?
To provide account activation, registration, and login services for courier station users (including customers, staff, and partners).
( User code/employee number
( User name/employee name
( Mobile phone number
( Password (encrypted)
( Password salt
( Email address
( Agency area ID/code/name
( Network ID/code/name
( Role type/level
( Staff type/identity
Consent (UK GDPR Article 6.1(a)) for Third Party Personnel
Contractual performance (UK GDPR Article 6.1(b)) for Individual Client
Your personal data will be stored as long as you own a J&T Account.
To manage courier station staff information (including external partners).
( Staff name
( Staff phone number
( Staff ID card number
( Staff code
( Job position
( Department/agency area affiliation
( Login device ID
( Password modification time
( Last login time
Legitimate interest (UK GDPR Article 6.1(f)) in staff management
Your personal data will be stored as long as you own a J&T Account.
2.1.2 Waybill & Parcel Management
To facilitate waybill creation, parcel collection, delivery, and tracking, we process the following personal data based on your service usage:
For what purpose will personal data be used?
What categories of personal data will be used?
What’s the legal basis for this processing?
How long will the personal data generally be stored?
To create waybills and record parcel sender/receiver information.
( Sender name
( Sender mobile phone number (including encrypted version)
( Sender detailed address (province, city, district, town, street)
( Sender postal code
( Sender ID card number
( Receiver name
( Receiver mobile phone number (including encrypted version)
( Receiver detailed address (province, city, district, town, street)
( Receiver postal code
( Receiver company name
( Waybill number
( Order ID
( Parcel weight/volume
( Goods type/name
Contractual performance (UK GDPR Article 6.1(b)) for Individual Client
Consent (UK GDPR Article 6.1(a)) for non-client individual senders/receivers
The personal data will be stored as long as you own a J&T Account.
To track parcel status (including collection, storage, sorting, and delivery).
( Waybill number
( Parcel status (inbound, outbound, pending delivery, delivered, etc.)
( Scan time
( Scanner ID/code/name
( Network ID/code/name (collection/delivery points)
( Sorting code (first/second/third segment codes)
( Sign-in time
( Sign-in person name
Contractual performance (UK GDPR Article 6.1(b)) for Individual Client
Consent (UK GDPR Article 6.1(a)) for non-client senders/receivers
The personal data will be stored as long as you own a J&T Account.
To handle special parcel services (insured, cash on delivery, etc.).
( Insured amount
( Insured fee
( COD amount
( COD service capability flag
Contractual performance (UK GDPR Article 6.1(b)) for Individual Client
Your personal data will be stored as long as you own a J&T Account.
2.1.3 Financial Settlement & Billing
To process fees, settlements, and billing related to courier services, we collect and process the following personal data:
For what purpose will personal data be used?
What categories of personal data will be used?
What’s the legal basis for this processing?
How long will the personal data generally be stored?
To calculate and collect service fees (freight, insurance, COD, etc.).
( Waybill number
( Freight amount
( Insurance fee
( COD amount
( Other fees (fuel surcharge, remote area fee, overweight fee, etc.)
( Discount amount
( Coupon code/amount
( Currency type
( Tax amount
Contractual performance (UK GDPR Article 6.1(b)) for Individual Client
Your personal data will be stored as long as you own a J&T Account.
2.2 Processing of Recipient’s Personal Data
If you are the recipient of the parcel, we will need you to sign in the app upon delivery. In this scenario, we will collect the following personal data.
For what purpose will personal data be used?
What categories of personal data will be used?
What’s the legal basis for this processing?
How long will the personal data generally be stored?
To confirm the delivery of the parcel and maintain delivery records.
( Recipient name
Legitimate interest (UK GDPR Article 6.1(f)) in business management
Your personal data will be stored as long as you own a J&T Account.
To verify the parcel delivery location at the time of signing and maintain proof-of-delivery records.
( Waybill number
( Recipient name
( Device location information at the time of signing
Consent (UK GDPR Article 6.1(a))
Your personal data will be stored as long as you own a J&T Account.
2.3 Customer Support & Feedback
To provide after-sales support, handle complaints, and collect user feedback, we process the following personal data upon your request or authorization:
For what purpose will personal data be used?
What categories of personal data will be used?
What’s the legal basis for this processing?
How long will the personal data generally be stored?
To provide parcel-related consultations, complaints, and problem resolution (e.g., lost, damaged, delayed parcels).
( Customer name
( Customer mobile phone number
( Waybill number
( Parcel problem description
( Problem type/code
( Problem images
( Handling result
( Call duration
( Call recording path
Consent (UK GDPR Article 6.1(a))
Your personal data will be stored as long as you own a J&T Account.
To handle issue shipments more efficiently, you can upload an image of the shipping label through this APP. During this process, we will request access to certain device permissions as needed for specific functions, including the camera (for taking photos and uploading), photo library/storage (for accessing local images), and Bluetooth (for connecting to related devices).
( Waybill number
( Shipping label image
Consent (UK GDPR Article 6.1(a))
Your personal data will be stored as long as you own a J&T Account.
2.4 System Operation & Maintenance
To ensure the normal operation, technical maintenance, and function optimization of the Courier Operation Application, we process the following data:
For what purpose will personal data be used?
What categories of personal data will be used?
What’s the legal basis for this processing?
How long will the personal data generally be stored?
To monitor system operation and troubleshoot technical issues.
( Device ID (PC, scanner, etc.)
( Device code/model
( Network ID/code/name
( System version
( Operation logs
( Error reports
( Login device information
( IP address
( MAC address
Legitimate interest (UK GDPR Article 6.1(f)) in system security and stability
Your personal data will be stored as long as you own a J&T Account.
To optimize system functions and improve service efficiency (e.g., sorting, route planning).
( Geographic location information (courier station longitude/latitude)
( Google Maps mapping information (address, coordinates)
Legitimate interest (UK GDPR Article 6.1(f)) in service optimization
Your personal data will be stored as long as you own a J&T Account.
To manage system versions and updates.
( APP ID/name
( Version number
( Upgrade package size
( Download URL
( Update log
( Release time
( Publisher ID/code/name
Legitimate interest (UK GDPR Article 6.1(f)) in system function improvement
Your personal data will be stored as long as you own a J&T Account.
2.5 Third-parties
Third-party services integrated into this systems (such as Google Maps for address mapping and Tencent CAPTCHA for slider verification) are provided by independent data controllers. Their processing of personal data is subject to their respective privacy policies. We have no control over such processing.
Data Sharing
Due to the size and complexity of data processing by J&T Express, it is not possible to list each recipient of your personal data individually in this Notice, which is why only categories of recipients are usually listed.
Within J&T Express, those departments receive your data that require it in the course of their work (e.g. Human Resources, Administration, Finance, and IT departments).
Service providers engaged by us and working on our behalf (so-called processors) may also receive data for the purposes described in Section 3 of this Notice. These processors include:
cloud service provide.
We may also transfer the recipient’s information (including signatures, location coordinates, specific addresses and other related data) to our partner platform customers for the purposes of signature confirmation, exception handling, claims settlement and dispute resolution. In this context, the third-party platform customer acts as the controller of such data, while we merely serve as the processor.
In addition, we transfer your personal data to the following recipients or categories of recipients who act as controllers:
J&T Express’s affiliates,
external consultants (e.g. law firms, auditing firms),
authorities within the scope of their responsibility (e.g. tax office, police, public prosecutor’s office, social insurance institutions),
courts,
other third parties, insofar as you instruct us to transfer data or provide your consent.
International transfer
Your personal data will be stored in data center located in Europe. For transfers between the UK and EEA we rely on appropriate adequacy decisions by the European Commission. Under normal circumstances, your personal data shall only be processed within the European Economic Area (EEA) and shall not be transferred to third countries outside the EEA.
In general, for transfers of data subject to the GDPR to areas other than the EEA or UK , we (i) will conduct the transfer based on an adequacy decision (GDPR Article 45) in the countries where the adequacy decision is adopted or (ii) where required, will take appropriate protection measures by executing the standard data protection clauses approved by the European Commission (GDPR Article 46, Paragraph 2, Item (c) and Paragraph 5) or the standard data protection clauses approved by the ICO (UK GDPR Article 46, Paragraph 2, Item (d)) with the party receiving personal data in the countries where an adequacy decision is not adopted.
Storage Period
We retain your personal data we collect for as long we continue to make the relevant services available to you, for as long as it is required to fulfil the purposes of the processing of personal data, or as required by law.
If you withdraw consent for our processing of personal data where we have asked for your consent, then we make sure your personal data is not available shortly after receiving the request (to allow us to implement your requests).
You may find our specific retention periods for the respective processing activities in Section 2 of this Notice.
Your Choice and Rights
You have certain rights regarding your personal data. These rights are described in more detail below.
If you have given us your consent, you can withdraw it at any time (Art. 7 (3) UK GDPR). The withdrawal of your consent does not affect the lawfulness of the processing carried out on the basis of the consent prior to the withdrawal.
Generally, you also have the right to request us to:
access and obtain a copy of your personal data that we store (Art. 15 UK GDPR),
object to the processing of your personal data by us in certain circumstances, if we process your data based on Article 6 (1) (e) or (f) UK GDPR (including profiling) (Art. 21 (1) UK GDPR).
provide some of your personal data to you or another data controller in a commonly used, machine-readable format (Art. 20 UK GDPR),
update or correct your personal data if it is inaccurate (Art. 16 UK GDPR),
delete your personal data (including your account) from this system under certain circumstances (Art. 17 UK GDPR),
restrict the processing of your personal data under certain circumstances (Art. 18 UK GDPR).
We will consider all the above requests and provide our response within a reasonable period (and in any event within any time required by applicable law). These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep. If an exception applies, we will tell you this when responding to your request. We may request you provide us with information necessary to confirm your identity before responding to any request you make.
Right to lodge a complaint
You also have the right to lodge a complaint with a data protection authority (Art. 77 UK GDPR) in the UK if you believe we have not complied with applicable data protection laws. The Information Commissioner’s Office (ICO) which is the competent data protection authority in UK, established under the UK GDPR and UK Data Protection Act. You can contact the ICO via these details:
Information Commissioner’s Office
Address: Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/
Changes and Updates
We reserve the right to update this statement from time to time due to legal, regulatory, or business needs. Updated versions will be published within this system, on the relevant website page, or otherwise notified to you through appropriate means, and the latest version shall prevail. Historical versions will be archived for compliance review.
This Privacy Notice may be made available in multiple languages. In the event of any inconsistency or conflict between different language versions, the English version shall prevail.