Information about data use pursuant to the General Data Protection Regulation (GDPR):

Mandatory information according to Art 13 and 14 GDPR of a purely informative nature.

Status: September 2023

1. What information is available on this page?

Österreichische Post AG (hereinafter referred to as "Austrian Post", "we", "us") processes your personal data in full compliance with the provisions of data protection law, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act and all other applicable laws. 

In this document, you will find information about data processing that takes place during the processing of parcels and certified letter mail items. This document includes the following sections:

  • To whom is this information addressed? (item 2)
  • Who is responsible for the processing of your data? (item 3)
  • Information about possible data processing (item 4)
  • With whom are we allowed to share your data? (item 5)
  • Automated decision-making and profiling (item 6)
  • What rights do you have? (item 7)
  • How can you get in touch us? (item 8)

Information about the use of cookies on our websites is available at Data protection.
If you are looking for information on specific postal products or services such as online services, advertising and marketing or business customer relations, you will find it in the selection field on the right-hand side. If you need printed copies of the information provided on this page or on additional pages, please contact the staff at our service locations.

2. To whom is this information addressed?

This privacy policy is addressed to all our customers who send or receive parcels or certified letters via our company.

3. Who is responsible for the processing of your data?

The responsible party for data processing described on this page is

Österreichische Post AG,
Rochusplatz 1,
1030 Vienna,
Austria

4. Information about possible data processing

4.1. Handling of parcels and certified letter mail items
Your data will be processed for the provision (handling and fulfilment) of postal services, in particular shipping and delivering parcels and certified letter mail.

Which of your data can we process for this purpose?
For this purpose, we process the following data:
address data, identification data, contact data, usage data, personal master data, payment data, image recordings of items, writing speed and writing pressure (signature)

What is the legal basis for this processing?
The legal basis for this processing is

  • the shipping contract (Art. 6 (1) (b) of the GDPR), 
  • our legal obligations (Art. 6 (1) (c) of the GDPR) in accordance with the Austrian Postal Market Act, the Austrian Delivery Act (esp. for official items), regulatory requirements, documentation obligations as well as requirements under company and capital market law, tax or corporate law and auditing and reporting obligations as well as Section 23 (2) of the Austrian Customs Law Enforcement Act and other customs regulations (execution of customs services);
  • the public interest in postal delivery (Art. 6 (1) (e) of the GDPR);
  • and our legitimate interest (Art. 6 (1) (f) in optimising the delivery as well as to handle item inquiries and claims.

How long can your data be stored?
Recipient data will be processed in the distribution centre for a maximum of 3 years from the time the item was recorded.

Accounting data and customs-related data are stored as part of item processing and delivery for a maximum of 7 years from the end of the calendar year in which the entry was last included in the balance sheet, depending on the data category.

Data on certified letter mail items can be processed for a maximum of 5 years from the start of storage.

With whom are we allowed to share your data?

Processors
Public authorities
International partners of Austrian Post

In the area of postal services, international item data may, given the contractual duty to deliver mail and the Treaty of Bern for international mail delivery signed by Austria, be processed in any third-country in the world, provided that this is necessary for the delivery of a specific item (Article 49 (1) (b), (c), (d) of the GDPR).

For delivery purposes, address data that cannot be read automatically at our distribution centres are coded remotely via video on our behalf. For this purpose, we use a contract processor in Vietnam.
In these cases, data transmission is based on EU standard data protection clauses and is performed along with a documented case-by-case check of the adequacy of the protection level (safeguard pursuant to Article 46 of the GDPR); these are available upon request on post.at/sonstigedatenschutzanliegen.

Other information about this processing:
If you do not provide the data necessary for the item, we will not be able to process the item.

4.2. Advance dispositions and redirection orders
Your data will be processed to carry out advance dispositions and redirection orders and thus for logistics purposes, because without this data it is not possible to carry out your orders. Even after the end of the agreement, the names and current address of all persons will continue to be processed in order for us to deliver items. If you have moved, we will make a note for the old address that the persons in question have moved.

Which of your data do we process for this purpose?
For this purpose, we process the following data:

Address data
Identification data
Contact information
Personal master data

What is the legal basis for this processing?
 The legal basis for this processing is

  • the contract for advance dispositions and redirection orders that we have concluded with you (Art. 6 (1) (b) of the GDPR); 
  • our legal obligation according to Section 18 of the Austrian Delivery Act, Section 32 (5) and Section 35 (2) of the Austrian Postal Market Act, which regulate redirections as well as the transfer to other postal service providers (Art. 6 (1) (c) of the GDPR) 
  • our legitimate interest (Art. 6 (1) (f) of the GDPR) in optimising the service;
  • data storage after the end of the contract is in the public interest in order to be able to deliver your items automatically and thus quickly and cost-effectively (Art. 6 (1) (e) of the GDPR).

How long can your data be stored?
To comply with the Austrian Federal Tax Code, we will process order data for up to seven years after the end of the calendar year when the order was performed. For logistics reasons, we will store your data as long as required for the delivery of items to your address, e.g., to plan the delivery process.  This also includes the general entry of information that you receive mail at a given address or that you have moved from an address.

With whom are we allowed to share your data?
For the purpose of fulfilling the contract as well as for legal obligations, your data may be transferred to the following recipients/categories of recipients:

Postal service providers
Processors
Public authorities

Other information about this processing:
You are under no contractual or legal obligation to provide your data for this service. If you do not provide the above information, advance dispositions and redirection orders cannot be set up.

4.3 Handling of AllesPost customer data at Post Customer Service (PKS)
If you are a customer of the AllesPost (AP) product, your data may be used by the Post Customer Service (PKS) to contact you in two cases:

  • If an AP customer reports to PKS that he/she is missing an item and it turns out that the item was mistakenly delivered to you as an AP customer. You will be contacted by PKS to arrange a pickup of the shipment. 
  • If an AP customer reports to the PKS that he/she has received a shipment that belongs to you as an AP customer. The PKS will contact you to arrange for redelivery to you. 

PKS may contact you in writing or by telephone. To do so, we will use the e-mail address or telephone number you have stored in your AllesPost account or in your Post account, respectively.

Which of your data can we process for this purpose?
Address data, contact information

What is the legal basis for this processing?
The legal basis is the contract for the product AllesPost which we have concluded with you (Article 6 (1) (b) of the GDPR); our legitimate interest in ensuring that AllesPost items are properly delivered and that losses/misdeliveries are avoided for the benefit of our customers.

4.4. Sending item-related status information
We process your data for delivering item-related status information. In doing so, you will be informed about the status of the item on behalf of the sender. This information can be provided either via text message or e-mail. If an item can be matched to a user registered with Austrian Post, the recipient will be informed about the item assigned to them via the Austrian Post app.

Which of your data do we process for this purpose?
For this purpose, we process the following data:
personal master data, usage data, identification data, contact data.

What is the legal basis for this processing?
The legal bases for this processing are

  • the fulfilment of the contract with the sender (Art. 6 /1/ (b) GDPR)
  • the protection of our legitimate interests according to Art. 6 /1/ (f) GDPR in informing our customers about incoming items.

How long will your data be stored?
 Your data collected for the purpose of sending status information on items will be deleted immediately after the item was delivered.

With whom are we allowed to share your data?
 For the purpose of sending item-related status information, your data may be transferred to the following categories of recipients:

Processors

We work with a processor in Turkey to host a text message platform.
In these cases, the transfer of data is based on EU standard data protection clauses (safeguard pursuant to Art. 46 of the GDPR) including a documented case-by-case assessment of the adequacy of the level of protection; these are available upon request at post.at/sonstigedatenschutzanliegen

4.4. Quality management
We process your data as part of our quality assurance process for items to determine measures to improve quality and reduce potential losses along the process chains. This also includes documentation of security incidents.

Which of your data can we process for this purpose?
For this purpose, we process the following data:
address data, personal master data, identification data, contact data.

What is the legal basis for this processing?
The legal basis for this processing is

  • the shipping contract (Art. 6 (1) (b) of the GDPR);
  • our legal obligations (Art. 6 (1) lit c of the GDPR) as defined in the Austrian Postal Market Act;
  • and our legitimate interest (Art. 6 (1) (f) in ensuring the quality of our delivery processes.

How long will your data be stored?
Your data will be stored as part of our item quality assurance processes for no more than 2 years from the end of the calendar year in which the storage was made, depending on the data category. 

With whom are we allowed to share your data?
 Your data will be transferred to the following recipients as part of our item quality assurance process: 

Processors
Postal service providers

5. With whom are we allowed to share your data?

To learn with which recipient categories we are allowed to share your data, please see the section "Information about possible data processing". A detailed description of Austrian Post recipients and/or categories of recipients is available under item 5  in the document Data protection.

6. Automated decision-making and profiling

As a general rule, no automated decision-making or profiling pursuant to Article 22 (1) and (4) GDPR is carried out in data processing at Austrian Post.

7. What rights do you have?

You have the right of access to your personal data that we process as a controller. For more information, please refer to Article 15 of the GDPR.

Under certain conditions, you may request the restriction of processing as well as the rectification and deletion of your personal data. For more information, please refer to Articles 16 to 19 of the GDPR.

In addition, under certain conditions, you also have the right to data portability, meaning that we would give you all personal data you have disclosed to us in a structured, standard, and machine processable format. For more information, please refer to Article 20 of the GDPR.

As a data subject, you have the right to object to the use of your data if the processing serves the purpose of direct marketing. In addition, you have the right to object at any time to the processing of your data carried out in the legitimate interests of Austrian Post or third parties if reasons arise from your specific circumstances. For more information, please refer to Article 21 of the GDPR. The processing of your personal data may be based on your consent pursuant to Art. 6 (1) (a) of the GDPR. You can revoke this consent at any time without giving reasons with future effect; until then, we will process your data lawfully.

For information about the legal basis of our data processing, please see item 4 "Information about possible data processing").

Would you like to exercise your rights or do you have further questions, suggestions, or feedback? In this case, please go to item 8 ("How can you get in touch with us?") and contact the indicated person.

In addition, you have the option of filing a complaint with the Austrian Data Protection Authority:

Austrian Data Protection Authority, 
Barichgasse 40-42, 
1030 Vienna
Austria

Telephone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at

8. How can you get in touch with us?

Would you like to exercise your rights or do you have further questions, suggestions, or feedback?
To contact Austrian Post's data protection officer or to exercise your rights, please use one of the contact options listed under item 8 of our general data protection policy: post.at/Datenschutz.