Data protection LEGAL INFORMATION & DATA PROTECTION POLICY

Österreichische Post AG's Data Protection Policy

Mandatory information according to Art 13 and 14 DSGVO with a purely informative characte
Updated: August 2026

1. What information is available on this page?

Österreichische Post AG ("Austrian Post", "we", "us") processes your personal data exclusively in accordance with the provisions of data protection law, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act, the Austrian Postal Market Act, and all other applicable laws.

On this page, you will find information about data processing that concerns our entire company. This document includes the following sections:

• To whom is this information addressed? (item 2)
• Who is responsible for processing your data? (item 3)
• Information about possible data processing (item 4),
  
  • video surveillance systems, especially at our corporate facilities and branches (4.1)
  • data protection management and handling legal proceedings (4.2 to 4.3)
  • managing image, sound and video recordings for marketing purposes (4.4)
  • accounting and bookkeeping (4.5)
  • corporate compliance and Corporate Social Responsibility (4.6 to 4.11)
  • data and organisation management (database maintenance, real estate, vehicles, IT maintenance, statistical purposes) (4.12 to 4.20)
  • press relations (events, external communication  –  4.21 to 4.23)
  • address broker business (4.24)
  • management of a premises ban list (4.25)
• With whom are we allowed to share your data? (item 5)
• Automated decision-making and profiling (item 6)
• What rights do you have? (item 7)
• How can you get in touch with us? (item 8)
• Information about cookies (item 9)
• Legal notice (item 10)
• Employees (item 11)

If you are looking for information on specific postal products or services such as mail and parcel delivery, advertising and marketing or business customer relations, you will find it in the selection field on the right-hand side.
If you need printed copies of the information provided on this page or on additional pages, please contact the staff at our service locations.

2. To whom is this information addressed?

The information that you will find on this page is addressed to interested parties, customers, suppliers, and business partners.

If you are business partner of Austrian Post, you will find further information for business partners in the selection field on the right-hand side.

When you apply to Austrian Post, we will inform you at the beginning of the application process in which form we process your personal data. You will find the related information in the selection field on the right-hand side of this page.

When you apply to Austrian Post or are already an employee, we will inform you at the beginning of the application process in which form we process your personal data. You will find the related information in the selection field on the right-hand side of this page. The latest version of this policy is always available on the Intranet under Employees/data protection and on our information board.

3. Who is responsible for processing your data?

The responsible party for all processing described in the data protection policy available on this page is

Österreichische Post AG
Rochusplatz 1
1030 Vienna
Austria

4. Information about possible data processing

4.1. Video surveillance and recording
We may process your data as part of video surveillance and recording at our branches, administrative buildings, including the “Post am Rochus” shopping centre, as well as at our letter and parcel distribution centres and delivery bases, for the purposes of protecting our property and personnel and preventing, containing and investigating criminal conduct. The same applies, with regard to protection purposes, to the use of dashcams in Austrian Post vehicles. Video footage is reviewed and, where legally required, disclosed to public bodies such as authorities only in the event of a specific incident.

Which of your data can we process for this purpose?
Image, audio and video data, item data, personal master data

What is the legal basis for this processing?
The legal basis for this processing is our legitimate interest (Art. 6 (1)  (f) of the GDPR) in the self-protection of our administrative buildings and branches as well as in the prevention, control,
and clarification of criminally relevant conduct, insofar as this affects our area of responsibility.

How long can your data be stored?
Your data will be retained for the purposes of video surveillance and recording

•  in our administrative buildings, for no longer than 72 hours from the time of recording;
• at our delivery bases and letter and parcel distribution centres, for no longer than four months from the time of recording;
• at our branches, for no longer than three months from the time of recording. 

In individual cases, where the data needs to be disclosed to a public authority, it may be retained for a longer period (for no longer than one year from the time of recording in the case of administrative buildings).

With whom are we allowed to share your data?
For the purpose of video surveillance and recording in our administrative buildings, your data may be transferred to the following categories of recipients:

Processors
Public authorities

Other information about this processing:
You are under no contractual or legal obligation to provide your data for video surveillance and recording in our administrative buildings. All monitored areas are marked.

4.2. Data protection management
We process your data as part of our data protection management (data subject rights and possible data protection incidents) in order to comply with our legal obligations regarding the security of your personal data and the prompt and proper processing of your data subject rights.

Which of your data can we process for these purposes?
Depending on the scope of the specific incident or data subject rights request, this may, in principle, include any categories of data affected by it.

What is the legal basis for this processing? 
The legal bases for this processing are our legal obligations under the General Data Protection Regulation (Article 6(1)(c) GDPR)

• to document personal data incidents and, where required pursuant to Articles 33 and 34 GDPR, notify the Data Protection Authority and/or the affected individuals within 72 hours;
• to receive and process requests relating to data subject rights pursuant to Articles 12–22 GDPR within the applicable time limits.
• Special categories of personal data are also processed on the basis of Article 9(2)(f) GDPR where processing is necessary for the establishment, exercise or defence of legal claims.

How long can your data be stored?
For the purpose of managing data protection incidents and data subject rights, your data will be stored for a maximum of 3 years and one month from receipt of the request or notification of the data protection incident.

With whom are we allowed to share your data? 
For the purpose of data incident management, your data may be disclosed to the following categories of recipients:

Public authorities
Data protection officer

For the purpose of the management of data subject rights, your data may be disclosed to the following categories of recipients:

Processors
Data protection officer

Other information about this processing:
If you do not provide us any or insufficient data to respond to data subject rights, we will not be able to respond to your requests.

4.3. Handling of legal matters and disputes and investment management
We process your data when handling legal matters and disputes in order to benefit from the full scope of legal advice provided to Austrian Post as well as to avoid and defend against legal claims.

Which of your data can we process for this purpose?
Address data, contact details, personal master data, other documents, functional data, procedural data, order and invoice data, contractual agreements, official documents, image, audio and video data, vehicle data, creditworthiness data, financial benefits and obligations

What is the legal basis for this processing?
The legal basis is our legitimate interests in asserting our legal claims and positions and/or in being able to exercise our rights as parties in legal proceedings.

How long can your data be stored?
Your data will generally be retained for a maximum of three years for the purpose of handling legal matters and disputes. Court or administrative decisions and the associated case files may be retained for up to 30 years for documentation and research purposes.

With whom are we allowed to share your data?
Your data may be disclosed to the following categories of recipients for the purpose of handling legal matters and disputes:

Public authorities
Notaries, tax advisors, and lawyers

4.4. Management of image, audio and video recordings for marketing and advertising purposes
We may process your data in connection with the management of image, audio and video recordings and may use the resulting material for marketing and advertising purposes as well as for editorial reporting. Where the material is used for advertising purposes, we rely on a grant of rights agreed with you, which provides you with detailed information about the specific purposes and recipients.

Which of your data can we process for this purpose?
Personal master data, address data, image, audio and video data, signatures and digital signatures, contractual agreements

What is the legal basis for this processing?
The legal basis for this processing is

• The granting of rights, which we conclude with you where appropriate (Art. 6 (1)  (b) of the GDPR);
• And our legitimate interest (Art. 6 (1)  (f) of the GDPR) in the recording of images, sound and video for editorial reporting or in the central, legally compliant management of all image, sound and video material.

How long can your data be stored?
If we agree a grant of rights with you, it will contain more detailed information about how long the resulting image material will be retained. In general, your data may be retained for marketing and advertising purposes for up to 10 years from the date the image material is created, depending on the relevant data category.

With whom are we allowed to share your data?
If we agree a grant of rights with you, it will contain more detailed information about the recipients of the resulting image material. In general, your data may be disclosed to the following categories of recipients for the purpose of managing image, audio and video material:

Processors
Photographers
Graphic designers

Other information about this processing:
If you do not provide the aforementioned data, we cannot enter into an agreement with you.

4.5. Accounting and bookkeeping
We may process your data as part of our accounting and bookkeeping activities in order to manage the Group’s payment transactions, create orders, and issue and process invoices. In this context, we manage and keep up to date the master data of our debtors and creditors (including, in particular, by cross-checking it against public registers). For business customers, we also carry out creditworthiness checks via an interface with KSV. We also manage the Group’s receivables, mitigate the risk of bad debts and handle insolvency cases involving our customers and suppliers. We additionally review payments and remuneration made to suppliers and recover any excessive or unauthorised payments from the suppliers concerned. The purposes of the processing also include liquidity planning and financing, monitoring payment transactions and bank accounts, transaction and account management, risk management, and ensuring the Group’s solvency. We also provide support to our customers and suppliers and handle internal and external inquiries relating to invoicing, complaints and receivables management by telephone, post, email, fax, etc.

Which of your data can we process for these purposes?
Personal master data, contact details, address data, payment data, other documents, creditworthiness data, contractual agreements, financial benefits and obligations, company data, procedural data, order and invoice data, tax-related data, reference numbers, signatures and digital signatures

What is the legal basis for this processing?

The legal basis for this processing is

• our legitimate interests in ensuring that payments are processed correctly, recovering excessive or unauthorised payments, documenting business transactions, efficiently managing the company’s cash flows by maintaining an overview of income and expenditure, ensuring efficient receivables management and thereby reducing the risk of bad debts, preventing payment shortfalls, and providing you with efficient customer and supplier support.   We also process your signature when collecting payments for evidentiary purposes on the basis of our legitimate interests (Article 6(1)(f) GDPR);
• our business relationship with you (Article 6(1)(b) GDPR).

How long can your data be stored?
Your tax-related data will be retained in accordance with the statutory retention periods set out in Section 132 of the Austrian Federal Tax Code  and Section 212 of the Austrian Commercial Code. Where there are additional legal grounds for retention or pending legal proceedings, the relevant data may be retained for a longer period where necessary.

In the case of property purchases, your data may be retained for up to 22 years from the end of the calendar year to which it relates.

With whom are we allowed to share your data?
Your data may be disclosed to the following categories of recipients for the aforementioned purpose:

Processors
KSV1870 Holding AG
Our subsidiaries

4.6. Investigation service
Austrian Post’s investigation service investigates suspected criminal acts involving Austrian Post employees, Austrian Post Partners, suppliers and, where applicable, customers, for the purposes of investigation and prevention. Personal data is processed in the course of these investigations and any subsequent follow-up activities.

Which of your data can we process for this purpose?
Address data, contact details, personal master data, payment data, data relating to criminal convictions and offences, company data, order and invoice data, social security data, internet and online usage data, telephony data, location data, access data, image, audio and video data, other documents, records of conversations and/or correspondence, procedural data.

What is the legal basis for this processing?
The legal basis for this processing is:

• our legal obligation pursuant to Section 82 of the Austrian Stock Corporation Act to implement an internal control system (Art. 6 (1) (c) of the GDPR);
• as well as our legitimate interest in establishing, exercising and defending legal claims (Art. 6 (1)  (f) and Art. 9 (2) (f) of the GDPR).

How long can your data be stored?
Your data will generally be deleted, depending on the relevant data category, within one month after the internal investigations have been discontinued or after any legal proceedings have been concluded with final effect. In any event, your data will be deleted no later than three years after the commencement of the internal investigations, unless pending proceedings continue beyond this period.

Your data may be disclosed to the following categories of recipients for the purposes of the investigation service:

Courts, public prosecutors’ offices and the police
Processors 

4.7. Cash audits

For the purpose of ensuring that accounts are settled correctly, we carry out cash audits at locations including Austrian Post branches, delivery bases, petty cash points, Philately offices and Austrian Post Partners.  Personal data is also collected in the course of these audits.

Which of your data can we process for this purpose?
Personal master data, contact details, order and invoice data

What is the legal basis for this processing?
The legal basis for this processing is our legitimate interest pursuant to Art. 6 (1)  (f) of the GDPR in the correctness of transactions and in the prevention of irregularities.

How long can your data be stored?
For the purpose of cash audits, your data will be stored for a maximum of 10 years from the date of the report, depending on the category.

For cash audit purposes, your data may be transmitted to the following categories of recipients:

Public authorities
Affiliated group companies
Processors

4.8. Compliance management
The purpose of data processing is to fulfill obligations under capital market law in accordance with the Market Abuse Regulation and the Austrian Stock Exchange Act, in particular to prevent the misuse of insider information. We also process data for documentation purposes as part of regulatory and mandatory compliance training. If we receive inquiries/reports/complaints or notifications on compliance issues, in particular through our whistleblower system, we may also process your data to handle and process these messages.

In addition, we process data in the context of recording and reporting obligations, compliance with legal and other requirements, such as income tax and social security deductions, audits and inspections by authorities/government.  Data processing is also possible for the purpose of pursuing legal rights/remedies and for the purpose of investigations and to ensure compliance with policies/procedures.

Which of your data can we process for this purpose?
For this purpose, we process the following data:
Address data, personal master data, contact details, data relating to criminal convictions and offences, other documents, order and invoice data, supporting documents, records of conversations and correspondence

What is the legal basis for this processing?
The legal basis for this processing is

• our legal obligation pursuant to Section 119 (4) of the Austrian Stock Exchange Act, Art. 17 (1), Art. 18 (5) and Art 19 of the Market Abuse Regulation (Art 6 (1) (c) of the GDPR); Art. 4 (2) (3) of the GDPR and the Whistleblower Act
• as well as our legitimate interest in establishing, exercising and defending legal claims (Art. 6 (1)  (f) and Art. 9 (2)  (f) of the GDPR).

How long can your data be stored?
Depending on the category, your data will be stored for compliance management purposes for a maximum of 7 years from receipt of the request and from the end of the respective calendar year.

With whom are we allowed to share your data?
For compliance management purposes, your data may be transmitted to the following categories of recipients:

Other external recipients
Courts, authorities and commissions
Processors

4.9. Internal audits
We may process your data as part of our internal audits. Internal and IT audits provide independent and objective auditing and consulting services based on the rules of procedure for Group auditing.

Which of your data can we process for this purpose?
Address data, contact details, personal master data, payment data, data relating to criminal convictions and offences, attendance and absence data, functional data, image, audio and video data, login and account data, health data, other documents.

What is the legal basis for this processing?
The legal basis for this processing is:

• the fulfillment of legal obligations pursuant to Art. 6 (1)  (c) as well as Section 82 of the Austrian Stock Corporation Act, Article 22 (1) of the Austrian Act on Limited Liability Companies, Section 243a (2) of the Austrian Stock Corporation Act (internal control and audit systems);
• as well as our legitimate interest in establishing, exercising and defending legal claims (Art. 6 (1)  (f) and Art. 9 (2)  (f) of the GDPR).

How long can your data be stored?
For the purpose of internal auditing, your data will be stored for 10 years from the date the reports were sent, depending on the category.

For internal auditing purposes, your data may be transmitted to the following categories of recipients:

Processors
Public authorities (Court of Auditors)
Auditors
Affiliated group companies

4.10. Group insurance management
We process your data within the framework of group insurance management, for the purposes of concluding and maintaining insurance contracts, fulfilling legal obligations and for risk protection as well as to properly process insurance claims.

Which of your data can we process for this purpose?
Address data, contact details, personal master data, health data, payment data and data relating to criminal convictions and offences, image, audio and video data, order and invoice data, identity document data, vehicle data, official documents, insurance-related data, other documents

What is the legal basis for this processing?
The legal basis for this processing is

• our legal obligation pursuant to the Austrian Insurance Contract Act, the Austrian Social Security Act, the General Social Security Act for the processing of insurance claims, conclusion and maintenance of insurance contracts (Art. 6 (1) (c) of the GDPR);
• our legitimate interest pursuant to Art. 6 (1) (f) of the GDPR in the risk coverage for Austrian Post in cases of damage.

How long can your data be stored?
Your data will be retained for insurance management purposes, depending on the relevant data category, for three years after any proceedings have been concluded with final effect or after our legal claims have become time-barred.

Your tax-related data will be retained in accordance with the statutory retention periods set out in Section 132 of the Austrian Federal Fiscal Code  and Section 212 of the Austrian Commercial Code. Where there are additional legal grounds for retention or pending legal proceedings, the relevant data may be retained for a longer period where necessary.

With whom are we allowed to share your data?
For the purpose of insurance management, your data may be transmitted to the following categories of recipients:

Courts and public authorities 
Lawyers/notaries/tax advisers
Experts
Social security institutions
Insurance brokers
Insurance companies

4.11. Environmental management
We may process your data as part of our environmental management activities. The purpose of this processing is to comply with the obligations under the Austrian Sustainability and Diversity Improvement Act and to safeguard Austrian Post’s reputation as a responsible and sustainable company.

Which of your data can we process for this purpose?
Personal master data, contact details, address data, other documents, shipment data, supporting documents.

What is the legal basis for this processing?
The legal basis for this processing is:

• our legal obligation pursuant to Section 11 of the Austrian Waste Management, Art. 1 and Art. 2 of the Austrian Sustainability and Diversity Improvement Act for environmental management and the preparation of sustainability reports (Art. 6 (1)  (c) of the GDPR);
• our legitimate interest pursuant to Art. 6 (1)  (f) of the GDPR in safeguarding the reputation of Austrian Post as a responsible and sustainable company.

How long can your data be stored?
For the purpose of environmental management, your data will be deleted within 10 years of publication of the sustainability report at the latest, depending on the category.

For the purpose of environmental management,your data may be transmitted to the following categories of recipients:

Processors

4.12. Data governance
We may process your data as part of our data governance activities in order to continuously monitor data quality (in particular with regard to whether data is up to date, consistent and accurate) and make adjustments where necessary. For this purpose, we use appropriate software and analytical methods, including for the purpose of identifying and eliminating duplicate records. To improve data quality, these methods also draw on statistical, non-personal data (e.g., data from Statistics Austria).

Which of your data can we process for this purpose?
For this purpose, we may process data from various Austrian Post systems, insofar as these need to be checked for quality on an ongoing basis.

What is the legal basis for this processing?
The legal basis for this processing is our legitimate interest (Art. 6 (1)  (f) of the GDPR) to increase thetransparency of data management (data catalogue) and of data flows, as well as our legitimate interest in the centralised quantification of data quality.

How long can your data be stored?
As long as the verified data are present in our data files, they can be processed as part of our data governance activities.

With whom are we allowed to share your data?
For the aforementioned purpose, your data may be shared with the following categories of recipients:

Processors

4.13. Historical research and loans

We may process your data in connection with historical research for the purpose of responding to inquiries concerning Austrian Post’s historical records (extracts from books, registers, newspaper articles, etc.) or for the loan of historical items.

Which of your data can we process for this purpose?
Contact details, personal master data, address data, other documents, contractual agreements, signatures and digital signatures

What is the legal basis for this processing?
The legal basis for the aforementioned processing is

• the contract for the loan of historical materials (Art.6 (1)  (b) of the GDPR) that we have signed with you or that we might sign;
• Our legitimate interests (Article 6(1)(f) GDPR) in ensuring that enquiries relating to historical research are handled properly.

How long can your data be stored?

For the aforementioned purpose, your  may be stored for a maximum of 3 years from the last contact.

4.14. Access control systems at Group properties
We may process your data in connection with the access control systems at our Group properties in order to ensure controlled access to buildings, sensitive areas and designated security zones for security and protection purposes. Visitor data is recorded in the reception log.

Which of your data can we process for this purpose?
Contact details, personal master data, attendance and absence data, access data, signatures and digital signatures, image, audio and video data

What is the legal basis for this processing?
The legal basis is our legitimate interest (Art. 6 (1)  (f) of the GDPR) to effectively ensure controlled access to our buildings and sensitive premises.

How long can your data be stored?
As a general rule, your data can be stored for this purpose for a maximum of 1 month after you leave the respective building. If you have received a personalised access card, the data processed for it will be deleted no later than 6 months after the card has been returned.

With whom are we allowed to share your data?
For the aforementioned purpose, your data may be shared with the following categories of recipients:

Processors
Public authorities

Your data may also be transferred outside the EU or EEA to processors in Switzerland. The European Commission has declared the data protection level in Switzerland, the United Kingdom, and Canada to be adequate.

Other information about this processing:
If you do not provide the aforementioned data, you will not be able to enter our buildings and other properties.

4.15. Management of prospective customer data for the purchase/sale and rental/letting of properties 
We may process your data in connection with the purchase or sale and rental or letting of properties. This includes managing data relating to prospective customers interested in Austrian Post properties offered for rent or sale. Prospective customers may express their interest in a specific Austrian Post property and in receiving further information about it via the contact form, by e-mail or telephone, or during an in-person meeting at the property. They will subsequently be recorded as an interested party for the property in question and will receive the relevant property information electronically or be contacted by telephone.   If a property is subsequently purchased or sold, rented or let, we may process your data in order to take steps prior to entering into a contract and for the conclusion of the contract.

Which of your data can we process for these purposes?
Address data, contact details, personal master data, creditworthiness data, functional data, login and account data, other documents, contractual agreements, payment data

What is the legal basis for this processing?
The legal basis for the aforementioned processing is

• the contract for the rental/letting or purchase/sale of a property (Article 6(1)(b) GDPR) that we have entered into or may potentially enter into with you;
• our legitimate interests in the proper management of our properties (Article 6(1)(f) GDPR); or
• in the case of prospective customers who expressed their interest on or before 1 May 2023, your explicit consent (Article 6(1)(a) GDPR), which we obtain in accordance with the applicable legal requirements at the appropriate stage. You may withdraw this consent at any time, without giving reasons, with effect for the future.

How long can your data be stored?
For property sales and rentals, your data may be stored for up to 30 years from the conclusion of the sales process and for up to 3 years from the final contact in the case of prospect management.

If prospective customer data is not provided in full, it will be deleted after 14 days.

With whom are we allowed to share your data?
Your data may be disclosed to the following categories of recipients for the purpose of property transactions:

Processors
Lawyers/notaries
Public authorities

Other information about this processing:
If you do not provide the aforementioned data, it will not be possible to conclude a contract for real estate purchases/rentals.

4.16. Property construction and management
We may process your data in connection with property construction and property development. For construction projects, the necessary documents are submitted to the competent building authorities. Property development includes the management of Austrian Post’s property portfolio, in particular the conclusion and administration of contracts with service providers, the management of their contact details, and the processing and documentation of settlements and payment requests.

Which of your data can we process for these purposes?
Address data, contact details, personal master data, payment data, order and invoice data, functional data, official documents, other documents, social security data, tax-related data, signatures and digital signatures, contractual agreements.

What is the legal basis for this processing?
The legal basis for the aforementioned processing is

• the contract relating to property construction and development (Article 6(1)(b) GDPR) that we have entered into or may potentially enter into with you;
• our legitimate interests in the proper management of our properties (Article 6(1)(f) GDPR);
• our legal obligation (Article 6(1)(c) GDPR) under the applicable provincial building regulations to disclose data to the competent building authorities to the extent necessary.

How long can your data be stored?
Your tax-related data may be retained in connection with property construction and property management in accordance with the statutory retention periods set out in Section 132 of the Austrian Federal Tax Code  and Section 212 of the Austrian Commercial Code. Where there are additional legal grounds for retention or pending legal proceedings, the relevant data may be retained for a longer period where necessary.

With whom are we allowed to share your data?
For the purpose of managing our properties, your data may be disclosed to the following categories of recipients:

Processors
Lawyers, notaries and tax advisers
Public authorities

4.17. Management of undeliverable items and other lost property
We process your data in connection with the management of lost property for the purpose of receiving into and releasing from storage undeliverable items and other lost property.

Which of your data can we process for this purpose?
Personal master data, address data, image, audio and video data, other documents, item data

What is the legal basis for this processing?

The legal basis for this processing is the protection of the legitimate interests of the controller (Art. 6 (1) (f) of the GDPR) for the purpose of storage and retrieval of undeliverable items.How long can your data be stored?

Your data collected for the purpose of item inquiry will be deleted no later than 1 month after the inquiry was made, depending on the category.

4.18. Sale of vehicles
We process your data in connection with the sale of vehicles.

Which of your data can we process for this purpose?
Personal master data, address data, contact details, contractual agreements, order and invoice data.

What is the legal basis for this processing?
The legal basis for this processing is

• the contract for the sale of vehicles (Article 6(1)(b) GDPR);
• our legitimate interests in facilitating the sale of vehicles (Article 6(1)(f) GDPR).

How long can your data be stored?
Your tax-related data will be retained in accordance with the statutory retention periods set out in Section 132 of the Austrian Federal Tax Code  and Section 212 of the Austrian Commercial Code. Where there are additional legal grounds for retention or pending legal proceedings, the relevant data may be retained for a longer period where necessary.

Other information about this processing:
If you do not provide the aforementioned data, we will not be able to conclude a contract for the purchase of a vehicle.

4.19. IT applications and IT systems
As part of the processing activities described in our data protection policy, we use Austrian Post’s IT applications and IT systems and continuously ensure their operation. Many of our processing activities rely on our IT systems. The data we process, the legal basis on which we rely and the period for which we are required to retain the data vary depending on the purpose of the processing. You can therefore find the relevant data categories, legal bases and retention periods in the other paragraphs under item 4 of this data protection policy or in the more detailed data protection policy referred to therein.
As part of the processing activities described in our data protection policy, we use both manual and automated processing methods. These also include new and innovative technologies (including Artificial Intelligence).

With whom are we allowed to share your data?
We use external service providers in some cases to maintain our IT infrastructure and ensure the security of our technical systems. Where legally required, we enter into legally compliant data processing agreements with all service providers. Further information on potential recipients of your data can be found in item 5 of this data protection policy.

4.20. Anonymisation for statistical purposes
As part of the processing activities described on this page, we may anonymise your data in order to produce statistics. In doing so, we remove any link to you as an individual so that the data can no longer be used to identify you.

4.21. External communication & press relations
We may process your data as part of our external communications and press relations activities in order to provide information for radio, television, the press, the internet and social media as part of Austrian Post’s media relations activities. The content is made available to media outlets in Austria, but may also be accessed by users worldwide. This includes information about the company’s business activities and performance, as well as statements in response to various reports in different media. We also proactively place our own messages in the media. Austrian Post’s social media influencers publish their content on various social media platforms.

Which of your data can we process for this purpose?
Personal master data, contact details, social media content, image, audio and video data, records of conversations and/or correspondence, other documents, login and account data.

What is the legal basis for this processing?
The legal basis for this processing is

• our legitimate interest (Art. 6 (1)  (f) of the GDPR) in external communication and press relations;
• or your express consent (Art. 9 (2)  (e) of the GDPR), which we obtain where needed in accordance with the law;
• or the contract (service contract) (Art. 6 (1)  (b) of the GDPR) that we have concluded with you.
  
  

How long can your data be stored?
Your data will be deleted for the purpose of external communication and press relations after a maximum of 3 years after the last contact, depending on the category

With whom are we allowed to share your data?
For internal information management purposes, your data may be transmitted to the following categories of recipients:

Print media
Online media
Media index

Other information about this processing:
You are under no contractual or legal obligation to provide your data for the purpose of external communication and press relations.

4.22. Stakeholder management
We may process your data as part of stakeholder management activities to conduct targeted lobbying activities with public decision makers.

Which of your data can we process for this purpose?
Personal master data, image, audio and video data, contact details, other documents

What is the legal basis for this processing?
The legal basis for this processing is our legitimate interest (Art. 6 (1)  f of the GDPR) to conduct stakeholder management and lobbying activities.

How long can your data be stored?
For the purpose of stakeholder management, your data will be stored for a maximum of 3 years after initial contact, depending on the category.

With whom are we allowed to share your data?
For stakeholder management purposes, your data may be transmitted to the following categories of recipients:

Processors
Lobbying registers

Other information about this processing:
You are under no contractual or legal obligation to provide your data for the purpose of stakeholder management.

4.23. Organisation of events
We may process your data in connection with the organisation of events.

Which of your data can we process for this purpose?
Personal master data, address data, contact details, information about allergies, image, audio and video data, official documents, vehicle data.

What is the legal basis for this processing?

The legal basis for this processing is 

• our legal obligation (Art. 6 (1) (c) of the GDPR);
• our legitimate interest (Art. 6 (1) (f) of the GDPR);
• or the contract pursuant to Art. 6 (1) (b) of the GDPR that we have concluded with you.

How long can your data be stored?
For the purpose of organising events, your data will be stored for a maximum of 3 years, depending on the category.

With whom are we allowed to share your data?
Your data may be transferred to the following categories of recipients for the purpose of organising events:

Processors
Other external recipients

We may also use a processor in the USA to conduct surveys. The IP address of the participating device and the survey results may be transferred to this processor. As part of the respective event, you may give your explicit consent to the transfer pursuant to Article 49(1)(a) GDPR.

The European Commission does not consider companies in the USA to provide an adequate level of data protection unless they participate in the Data Privacy Framework Program. In particular, there is a risk that your data may be accessed by US authorities for monitoring and surveillance purposes and that no effective legal remedies are available to you.
In such cases, additional protection for your personal data is ensured, following a documented case-by-case assessment, by entering into EU Standard Contractual Clauses (appropriate safeguard pursuant to Article 46 GDPR). These are available upon request at post.at/sonstigedatenschutzanliegen.

Other information about this processing:
You are under no contractual or legal obligation to provide your data.
If you do not provide the aforementioned data, you cannot participate in our events.

4.24. Address data
We process address data in connection with the Address Data product in order to ensure that postal addresses are kept up to date for reference purposes. It is ensured that at no point is this data linked, or capable of being linked, to a natural person.

Which of your data can we process for this purpose?
Address data, demographic characteristics.

What is the legal basis for this processing?
The legal basis for this processing is our legitimate interest (Art. (6) (1)  (f) of the GDPR) to prepare the address data in a standardised manner for reference purposes.

How long can your data be stored?
The data in question will be deleted no later than 1 month after the generation process.

4.25. Management of a premises ban list
To protect our property and the physical safety of our employees, we may process your data in connection with issuing a premises ban, maintaining a premises ban list and enforcing the ban through access restrictions.

Which of your data can we process for these purposes?
Personal master data, other documents: written notice of the premises ban

What is the legal basis for this processing?
The legal basis is the controller’s legitimate interest pursuant to Article 6(1)(f) GDPR in exercising its rights as occupier of the premises, maintaining a premises ban list, restricting unauthorised persons’ access to its business premises, and protecting its employees and property.

How long can your data be stored?
Your data will be retained for the purpose of managing our premises ban list until the premises ban expires.

With whom are we allowed to share your data?
Your data will not be disclosed to any third parties for the purpose of managing our premises ban list.

Other information about this processing:
No automated decision-making or profiling pursuant to Article 22(1) and (4) GDPR takes place as part of this processing. Nor are any special categories of personal data or data relating to criminal convictions and offences processed.

 

5. With whom are we allowed to share your data?

Below, you will find information about the general categories of recipients of Austrian Post. In addition, under item 4 ("Information about possible data processing"), you will find the categories of recipients to whom data may be transmitted in the context of a specific processing. A list of possible recipients and categories of recipients of Austrian Post is available here: LIST

5.1. External service providers (processors)
We comply with statutory and contractual obligations. In a world of labour division, the required data processing work is oftentimes provided by specialised businesses, so-called service providers (processors). These businesses can provide such services at attractive rates while delivering high quality. Therefore, we transfer your personal data to such businesses in the scope necessary for them to provide the contractually agreed services.
These services may include data storage in secure computer centres, printing invoices and advertising material, postcards, photos and digitising contracts or invoices (creating a digital, non-editable image).
Our data processors include Post Partners, IT service providers, service providers for customer assistance activities, marketing businesses and advertising agencies.
We perform in-depth audits on all our processors on a regular basis.

5.2. Public bodies and institutions
Austrian Post must, in order to maintain its operations and fulfil all our legal obligations, transmit personal data to authorities (such as social security agencies, tax authorities or law enforcement agencies, supervisory authorities, customs authorities, health authorities) and other institutions (e.g., commissions) as well as courts to the extent required.

5.3. Other external recipients
As part of a contractual relationship and especially in relation with our performance duty or in the case of legal disputes, in specific cases, we may additionally share your personal data e.g., with other postal service providers (e.g., UPU, IPC), freight forwarding companies, physicians, hospitals, insurance companies and brokers, experts, attorneys, interest groups, address brokers and direct marketing companies, banks and capital investment firms, insurance companies, CPAs, consultants (especially tax experts), subsidy granting bodies, shareholders, investors, and external payment providers.
In addition, as part of our address broker activities, we may forward your data to advertising companies. These include companies that provide mail-order service or retail services, financial service providers and insurances, IT and telecommunication companies and utilities as well as associations such as charities and NGOs.

5.4. Data transmission within the Österreichische Post group
We may entrust specific data processing steps to specialised departments or companies within our group. We will do that, for instance, to better process your customer data for internal administration purposes. A list of our affiliated companies is available here: Holdings

5.5. Data transfer outside the EU or EEA
In individual cases, your data may be transferred to a country outside the EU or the EEA ("third country") if this third country has been confirmed by the European Commission to have an adequate level of data protection or if other suitable data protection safeguards are in place (e.g., binding internal company data protection regulations or EU standard data protection clauses only if they include a documented case-by-case review of the adequacy of the level of protection).
In the section "Information about possible data processing" (item 4), you will find information whether such transfer takes place outside the EU or the EEA in the context of a particular processing.

5.6 Data transfer in the context of cookies and similar technologies
In the cookie banners accessible on the page in question, we provide information about the recipients as well as the use, scope, and type of cookies and similar technologies used on our websites or other software solutions. In the respective banner, you can edit your cookie preferences and access information about the cookie providers/recipients and their privacy policies.

If only technically required cookies are used on the respective website or other software solution, we will inform you directly on the website or other software solution or in the privacy policy accessible there.

6. Automated decision-making and profiling

No automated decision-making or profiling pursuant to Art. 22 (1) and (4) of the GDPR is performed in the data processing by Austrian Post described on this page.

7. What rights do you have?

You have the right of access to your personal data that we process as a controller. For more information, please refer to Article 15 of the GDPR.

Under certain conditions, you may request the restriction of processing as well as the rectification and deletion of your personal data. For more information, please refer to Articles 16 to 19 of the GDPR.

In addition, under certain conditions, you also have the right to data portability, meaning that we would give you all personal data you have disclosed to us in a structured, standard, and machine processable format. For more information, please refer to Article 20 of the GDPR.

As a data subject, you have the right to object to the use of your data if the processing serves the purpose of direct marketing. In addition, you have the right to object at any time to the processing of your data carried out in the legitimate interests of Austrian Post or third parties if reasons arise from your specific circumstances. For more information, please refer to Article 21 of the GDPR. The processing of your personal data may be based on your consent pursuant to Art. 6 (1) (a) of the GDPR. You can revoke this consent at any time without giving reasons with future effect; until then, we will process your data lawfully.

For information about the legal basis of our data processing, please see item 4 "Information about possible data processing").

Would you like to exercise your rights or do you have further questions, suggestions, or feedback? In this case, please go to item 8 ("How can you get in touch with us?") and contact the indicated person.

In addition, you have the option of filing a complaint with the Austrian Data Protection Authority:

Austrian Data Protection Authority,
Barichgasse 40-42,
1030 Vienna
Austria

Telephone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at

8. Contact us

To contact the data protection officer of Österreichische Post or to exercise your rights, please use one of the following options: 

• visit post.at/dataprotectioninquiry
• or write to
  Postkundenservice,
  To the attention of the Data Protection Officer
  Bahnsteggasse 17-23,
  1210 Vienna
  Austria
• or write to the e-mail-address team-datenschutz@post.at.

To ensure that your request to exercise your data protection rights is complete and can be assigned and processed properly in our databases, we require the following information in every case:

• Description of your request
• First name, last name
• Date of birth (especially to exclude similarities of names in connection with processing your request)
• Postal address
• YELLLOW telephone number (if you are a customer of YELLLOW, the provision of your telephone number is necessary for the proper processing of your request)
• E-mail address (in so far as you have provided an E-Mail adress to the Post in connection with a service or in order to contact the Post)
• Proof of identity – as proof of identity, either a digitally signed request or a (redacted) official ID or other (redacted) official documents such as registration forms, birth certificates can be submitted, provided that at least the name, date of birth, and issuing authority are visible.

No photo ID or digital signature is required when exercising the following rights: “Withdrawal of Consent/objection for advertising purposes" and "Erasure of data for third-party marketing purposes".

Should you request information according to Article 15 of the GDPR and there are doubts about your identity because you neither provide us with proof of identity nor are you otherwise considered to be clearly identified, we can, upon request, send you the information by post (registered and to be signed for) upon disclosure of your address and date of birth.

Your request will be processed based on the data you provide in the contact form. Please pay attention to the correctness of your data, especially to the usage of hyphens, commas, spaces etc. in your name and address.

9. Use of cookies

Several parts of our websites rely on cookies and similar technologies (hereinafter referred to as "cookies"). They make our offer more user-friendly and more efficient.

Cookies are small text files that are saved on your computer or smartphone and that your browser will store. They usually provide information about what pages/parts of our website were visited by users and can, among others, save user settings so that returning users will be recognised and do not have to log in again. Also, they allow for the targeted displaying of information to users as well as the analysis of website views.

Our business partners, so-called cookie providers, may also place cookies on our websites. These are used to improve our own products and services as if we had placed these cookies ourselves. For instance, to understand how our websites are used, we work with analysis partners including Google and Facebook (for additional information, please see item 9.4). However, cookie providers may also rely on cookies used on our websites for their own purposes, e.g., to place (their own or third-party) advertising on our websites and to measure their effectiveness. In such case, Austrian Post has no influence on the purpose and means of the cookie-based data processing while also not benefiting from this data processing. Cookies from such third-party providers may fall into the cookie categories listed under item 9.1.

9.1. Setting and managing cookies, legal basis
Apart from technically necessary cookies (strictly necessary cookies), which may be set on our websites without your consent in particular pursuant to Section 165 of the Austrian Telecommunications Act (TKG) and based on our legitimate interest (provision of a functioning online service) in accordance with Article 6(1)(f) GDPR, you may actively consent to or decline the use of performance cookies and marketing cookies before they are set. A cookie may be classified as “strictly necessary” if it is essential for the provision of the website. This means that the website would not function properly without the cookie (e.g., cookies required to provide a shopping basket or to store login status).

For this purpose, we have implemented a cookie consent management tool which, when you first access the respective website, provides detailed information about the cookies we use via a cookie banner (in particular name, purpose, duration and provider). Within this tool, you can either consent to the use of cookies before they are set or make a more detailed selection depending on the cookie category or even individually per cookie or cookie provider.

If additional cookies or cookie providers are added after you have given your consent, a new cookie banner will be displayed, allowing you to make an active selection for these as well. Within the cookie consent management tool, each cookie provider is listed individually and their privacy policies/data protection notices are available. These provide further information, including how their cookies may be additionally disabled where applicable.

You may withdraw or amend any consent you have given and your cookie selections on post.at at any time via “Edit cookie settings” (available in the website footer) within the cookie management platform.

If you have activated an advertising blocker (so-called ad blocker) in your browser, this may also affect the behaviour of the cookie banner. The ad blocker may prevent the cookie banner from being displayed and therefore prevent you from configuring individual cookies via “Edit cookie settings”. If the ad blocker is activated, only strictly necessary cookies will be set, as these are required for the proper functioning of the website. To review details of the strictly necessary cookies, you would need to deactivate the ad blocker for this purpose.

In addition, you can also determine in your browser settings whether cookies may be set. Your device may also allow you to control cookies via its settings; please refer to your device manufacturer’s instructions for details on how this works.

If the storage of any consent-based cookies is rejected, this may result in functional limitations on the website(s).

9.2. Additional information about the advertising functions of Google Inc.
Once we have understood what is important to you and what you are interested in, we can show you relevant and helpful information. To place and manage our ads, we rely on Google Display & Video as well as Google Adwords (Google Ads).

We use the services of Google Ads to place advertising (so-called Google ads) on external websites and highlight our attractive offerings. By linking the data to the advertising campaign, we can determine how successful specific advertising efforts have been. In doing so, we strive to show you advertising that is relevant to you, to make our website more interesting for you and to reach a fair calculation of advertising costs.

These advertising materials are delivered by Google via so-called "Ad Servers". We use Ad Server cookies which measure certain success parameters, including how many times the ads were shown and how many clicks they obtained from users. Provided that you have accessed our website via a Google ad, Google Ads will place a cookie on your device. Such cookies are usually valid for 30 days only and are not used to identify you personally. However, specific users can be grouped via browser recognition.

If you have registered for one of the services provided by Google, Google can link your visit to your account. Even if you have not registered or logged on, the service provider might obtain information about our IP address and save it.

After you have given your consent and made your selection, you can revoke or change these "cookie settings" at any time by going to the cookie management platform.

9.3. Aditional information about Google Remarketing
In addition to Google Adwords, we use an application called Google Remarketing. This is a procedure that we use to target you once again. This application allows us to display our ads on your device after you have visited our website and continue using the Internet. This is done via cookies saved on your browser. These cookies allow Google to identify and analyse your user behaviour when you access different websites. This is how Google can determine that you have previously visited our website. According to information provided by Google, data collected as part of remarketing activities will not be associated with any of your personal data that Google may have saved. Google also highlights that it uses pseudo-anonymization for its marketing activities. For more information about Google's data protection policy, please visit https://www.google.com/intl/de/policies/privacy.

After you have given your consent and made your selection, you can revoke or change these "cookie settings" at any time by going to the cookie management platform.

9.4. Additional information about Facebook, Instagram, LinkedIn, TikTok, Reddit, Snapchat, Twitter, Pinterest & Microsoft
For the same purpose, i.e., displaying customised ads, Instagram Ads, Facebook Ads, LinkedIn Ads, TikTok Ads, Reddit Ads, Snapchat Ads, Twitter Ads, Pinterest Ads and Microsoft Ads may be activated provided that you give your consent. This is not personal information. Personal information will be saved on servers located both in the European Union (Ireland) and in third countries. The information will be stored for a period of 90 days.

Facebook Pixel, Instagram Pixel, LinkedIn Pixel, TikTok Pixel, Reddit Pixel, Snapchat Pixel, Twitter Pixel, Pinterest Pixel, Amazon Pixel as all as Microsoft Pixel allow us to check if users were redirected to our website after having clicked on an Instagram, Facebook, LinkedIn, TikTok, Reddit, Snapchat, Twitter, Pinterest, Amazon or Microsoft ad. Among other processes, Instagram Pixel, Facebook Pixel, LinkedIn Pixel, TikTok Pixel, Reddit Pixel, Snapchat Pixel, Twitter Pixel, Pinterest Pixel, Amazon Pixel and Microsoft Pixel use cookies, which are small text files that are stored locally in your web browser's cache memory on your device. If you have logged on to Instagram, Facebook, LinkedIn, Tik-Tok, Reddit, Snapchat, Twitter, Pinterest or Microsoft with your user account, your visit to our online offerings will be registered in your user account. All data collected about you is anonymous for us and therefore will not allow us to identify users. However, Instagram, Facebook, LinkedIn, TikTok, Reddit, Snapchat, Twitter, Pinterest and Microsoft can associate this data with your user account on these platforms.

Personal information may be saved on servers located both in the European Union (Ireland) and in third countries. These saved cookies can remain in place for up to 2 years.

We work with Microsoft Clarity and Microsoft Advertising. Using behavioural metrics, heatmaps and session recordings, we analyse how you use and interact with our website. This enables us to improve and market our products and services. Website usage data is collected using first-party and third-party cookies and other tracking technologies to determine the popularity of products and services and online activity. We also use this information to optimise the website, for fraud prevention and security purposes, and for advertising. For more information on how Microsoft collects and uses your data, please refer to the Microsoft Privacy Statement.

 

Information about Microsoft’s ad privacy policy is available here:
https://about.ads.microsoft.com/en-us/resources/policies/microsoft-advertising-privacy-policy

For additional information about Facebook's privacy policy, please visit:
https://www.facebook.com/privacy/explanation

Information about Instagram's privacy policy is available here:
https://www.facebook.com/help/instagram/155833707900388.

Information about LinkedIn's privacy policy is available here:
https://de.linkedin.com/legal/privacy-policy?

Information about TikTok’s privacy policy is available here:
https://support.tiktok.com/de/account-and-privacy

Information about Reddit’s privacy policy is available here:
https://www.reddit.com/policies/privacy-policy

Information about Snapchat’s privacy policy is available here:
https://snap.com/de-DE/privacy/privacy-policy/

Information about Twitter’s privacy policy is available here:
https://privacy.twitter.com/de

Information about Pinterest’s privacy policy is available here:
https://policy.pinterest.com/de/privacy-policy

Information about Amazon´s privacy policy is available here:
https://advertising.amazon.com/en-gb/resources/ad-policy/eu-data-protection-and-privacy?ref_=a20m_us_fnav_lngsw_en-gb

After you have given your consent and made your selection, you can revoke or change these "cookie settings" at any time by going to the cookie management platform.

10. Legal Information

10.1. Information on Websites of Österreichische Post
The information provided on the websites of Österreichische Post is for informational purposes only. We take great care to ensure that all information is correct and complete. However, we cannot exclude that unintentional or incidental mistakes will occur.

Österreichische Post accepts no liability or guarantee for the information provided on its websites. Above anything, Österreichische Post does not guarantee that all information can be displayed using any software or hardware configuration, that the information is up-to-date, secure and free from mistakes, that it meets your expectations and/or that it is permanently available. Also, Österreichische Post does not guarantee that its websites and auxiliary systems (e.g., servers) are free from viruses. In addition, Österreichische Post reserves the right to complement or change the information on its websites without prior notification.

Österreichische Post is not liable for inaccurate or missing information on its websites. This especially applies, without limitation, to (hyper)links and other content used on our websites directly or indirectly or that can be accessed from them. All decisions based on information provided by Österreichische Post on its websites are the sole and only responsibility of the user.

In addition, Österreichische Post accepts no liability for immediate/specific damage or consequential damage or other damage of any kind that may result in any way from the direct or indirect use of the information (including hyperlinks) provided on its websites.
All abovementioned provisions also apply to software that can directly or indirectly be accessed or used from the websites of Österreichische Post. If third-party software is accessed via (hyper)links, the rules of the provider in question shall apply.

10.2. Copyright
The design and content of these websites are subject to copyright. Any change or reproduction of images or text from these websites is subject to prior written consent by Österreichische Post. It is explicitly prohibited to use marks (e.g., trademarks, logos).