Privacy policy in-store products 

Information about the use of data pursuant to the General Data Protection Regulation (GDPR):

Mandatory information pursuant to Articles 13 and 14 of the GDPR, provided for informational purposes only
Updated: October 2026

1. What information is available on this page?

Österreichische Post AG ("Austrian Post", "we", "us") processes your personal data exclusively in accordance with the provisions of data protection law, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act, the Austrian Postal Market Act, and all other applicable laws.

On this page, you will find information about data processing for online products and services. This document includes the following sections: 

• To whom is this information addressed? (item 2)

• Who is responsible for processing your data? (item 3)

• Information about possible data processing (item 4), in particular

• Alternative delivery address such as PO box and vacation hold mail  (item 4.1)
• Customer management, inquiries and complaints from philately customer  (item 4.2)
• Advertising activities and sending newsletters to philately customers  (item 4.3)
• Post ENERGIE: arranging electricity or gas supply contracts (item 4.4)

• With whom may we share your data? (item 5)
• Automated decision-making and profiling (item 6)
• What rights do you have? (item 7)
• How can you get in touch with us? (item 8)

Information about the use of cookies on our websites is available at Data protection.

If you are looking for information on specific postal products or services such as mail and parcel delivery, advertising and marketing or business customer relations, you will find it in the selection field on the right-hand side. If you need printed copies of the information provided on this page or on additional pages, please contact the staff at our service locations.

2. To whom is this information addressed?

This data protection policy is addressed to all customers who purchase or use our in-store products.

3. Who is responsible for the processing of your data?

The responsible party for data processing described on this page is

Österreichische Post AG,
Rochusplatz 1,
1030 Vienna,
Austria

4. Information about possible data processing

4.1 Alternative delivery address such as PO box and vacation hold mail
We process your data as part of the PO box, PO box plus or vacation hold mail service in order to redirect letters and parcels addressed to you as requested.

Which of your data may we process for this purpose?
Personal master data, contact details, address data, identity document data, signatures and digital signatures, order and invoice data

What is the legal basis for this processing?
The legal basis for this processing is the contract for the PO box, PO box plus or vacation hold mail service (Art, 6 (1) (b) of the GDPR) that we have concluded with you.

How long will your data be stored?
For the purpose of redirecting your letters and parcels, your data will be stored for a maximum of 100 days from the date of processing of the physical contract or 31 days (metadata) from the date of transmission to the controller.

With whom are we allowed to share your data?
For contract archiving purposes, your data may be transmitted to the following categories of recipients:

Processors

Other information about this processing:
You are under no contractual or legal obligation to provide your data. The aforementioned data are required for the conclusion of a contract. If you do not provide the aforementioned data, we will not be able to provide the "PO box, PO box plus or vacation hold mail" service.

4.2 Customer management, inquiries and complaints from philately customers
We process your data as part of our customer management activities and the processing of inquiries and complaints from our philately customers.

Which of your data may we process for this purpose?
Personal master data, contact details, address data, payment data, contractual agreements, order and invoice data

What is the legal basis for this processing?
The legal basis for this processing is

• The contract we have entered into with you for our philatelic products and services (Article 6 (1) (b) GDPR);

•  Our legitimate interests (Article 6 (1) (f) GDPR) in ensuring that inquiries and complaints are handled properly and to our customers’ satisfaction.

How long can your data be stored?
For the purpose of customer management or for processing your inquiries and complaints, your data will be stored for a maximum of 3 years from the last contact we had with you or from receipt of the inquiry/complaint.

With whom are we allowed to share your data?
For the purpose of processing your inquiries or complaints, your data may be transmitted to the following categories of recipients:

        Processors

Other information about this processing:
You are under no contractual or legal obligation to provide your data. If you do not provide the aforementioned data, we will not be able to process your inquiries and complaints.

4.3 Advertising activities and sending newsletters to philately customers
We may process your data for advertising purposes and sending newsletters to philately customers in order to send you information about our philately products and services.

Which of your data may we process for this purpose?
Personal master data, contact data, address data

What is the legal basis for this processing?
The legal basis for this processing is

• Your consent (Art. 6 (1) (a) of the GDPR), which we obtain as necessary in accordance with the law. You can revoke this consent at any time without giving reasons with future effect
• as well as our legitimate interest for the purpose of direct marketing (Art. 6 (1) (f) of the GDPR) if the legal requirements are met.

How long can your data be stored?
Your data collected for the purpose of carrying out advertising activities and sending newsletters to philately customers will be deleted 3 days after the advertising activity has been carried our or the newsletter has been sent. 

Other information about this processing:
You are under no contractual or legal obligation to provide your data. If you do not provide us with the above data, we will be unable to provide you with information about our philately products and services.

4.4 Post ENERGIE: Arranging electricity and/or gas supply contracts
As part of Post ENERGIE, we process your data for the purpose of arranging electricity and/or gas supply contracts, including documenting our intermediary activities, and providing Post ENERGIE benefits, for example through bundled tariff offers from Österreichische Post AG and its affiliated companies.

Which of your data may we process for this purpose? 
Personal master data, address data, contact details, contractual agreements, and order and invoice data.

What is the legal basis for this processing?
The legal basis for this processing is  

• The contract we have entered into with you for arranging electricity and/or gas supply contracts (Article 6 (1) (b) GDPR);

• Compliance with legal obligations (Article 6 (1) (c) GDPR);
• Our legitimate interests in documenting activities, providing evidence and defending legal claims (Article 6 (1) (f) GDPR).

How long can your data be stored?

Your data will be retained for the purpose of arranging electricity and/or gas supply contracts, depending on the data category, until the contractual relationship ends.
Your tax-related data will be retained in accordance with the statutory retention requirements under Section 132 of the Austrian Federal Fiscal Code and Section 212 of the Austrian Commercial Code, or for longer where other legal grounds exist or related proceedings are pending.

With whom are we allowed to share your data?

Your data may be disclosed to the following recipients or categories of recipients for the purposes stated above:

Relevant cooperation partners in the energy supply sector;
Affiliated companies of Österreichische Post AG;
Processors;
Tax advisers;
Authorities;
Courts;
Other recipients, insofar as necessary for the performance of the contract or compliance with legal obligations.

Other information about this processing:

You are under no contractual or legal obligation to provide your data for processing. However, if you do not provide the data specified above, you will not be able to use our Post ENERGIE service (arranging electricity and/or gas supply contracts).

5. With whom are we allowed to share your data?

To learn with which recipient categories we are allowed to share your data, please see the section "Information about possible data processing". A detailed description of Austrian Post recipients and/or categories of recipients is available under item 5 in the document Data protection.

6. Automated decision-making and profiling

As a general rule, no automated decision-making or profiling pursuant to Article 22 (1) and (4) GDPR is carried out in data processing at Austrian Post.

7. What rights do you have?

You have the right of access to your personal data that we process as a controller. For more information, please refer to Article 15 of the GDPR.

Under certain conditions, you may request the restriction of processing as well as the rectification and deletion of your personal data.  For more information, please refer to Articles 16 to 19 of the GDPR.

In addition, under certain conditions, you also have the right to data portability, meaning that we would give you all personal data you have disclosed to us in a structured, standard, and machine processable format. For more information, please refer to Article 20 of the GDPR.

As a data subject, you have the right to object to the use of your data if the processing serves the purpose of direct marketing. In addition, you have the right to object at any time to the processing of your data carried out in the legitimate interests of Austrian Post or third parties if reasons arise from your specific circumstances. For more information, please refer to Article 21 of the GDPR. The processing of your personal data may be based on your consent pursuant to Art. 6 (1) (a) of the GDPR. You can revoke this consent at any time without the need to state reasons with future effect. Until then, we will lawfully process your data.

For information about the legal basis of our data processing, please see item 4 ("Information about possible data processing").

In addition, you have the option of filing a complaint with the Austrian Data Protection Authority:

Austrian Data Protection Authority,
Barichgasse 40-42,
1030 Vienna
Austria

Telephone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at

8. How can you get in touch with us?

Would you like to exercise your rights or do you have further questions, suggestions, or feedback?
To contact Austrian Post's data protection officer or to exercise your rights, please use one of the contact options listed under item 8 of our general data protection policy: post.at/Datenschutz.