What are personal data?

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, your name, address, phone number or date of birth, and also data relating to your use of our online services.

For what purpose do we process your data?

DPD processes your data solely for the purpose of providing transport services on the instruction of consignors, for occasional promotional purposes and to provide and optimise our web service and delivery services. Lastly, your data is sometimes used for the billing of services provided by our cooperation partners or for the purpose of paying the salaries and social security contributions of our employees.

Further details of the exact purpose of processing are given below.

Where do we get your data from and what data is involved?

DPD receives data for processing from various sources and for various purposes.

We process personal data, which we collect through cookies referred to below or through explicit information that you have provided, for various purposes. In order to provide comprehensive information about the processing we undertake, we have stated the various applications of our website separately for you.

It is possible in the case of certain applications that you inform us of data yourself and give your consent to the intended data processing - however, reference is made to this separately. We use the personal data you provide solely to achieve the respective purpose for which these data are processed, for example to fulfil contractual obligations in the context of our transport services, to send out information and advertising material to both prospective and existing customers in due consideration of the German Telecommunications Act (TKG), and to handle service requests or provide other services on our website.

If you are a consignor, we receive your data when you contact us, visit one of our shipping websites or use us to send parcels. We store your billing address, details of pickup times, contacts or products selected/offered for this purpose. As a rule, we receive this data directly from you or in rare cases you are brought to our attention via the Internet or our sales partners.

If you are a consignee, we receive your data from the consignors. They provide us with your data as well as information about parcels or notification instructions mainly in electronic form using their own or our shipping systems. They normally do so because they have entered into a contractual relationship with you in accordance with Article 6 (1) b) GDPR, and we require this data to deliver goods or other products you have ordered from the consignor. Naturally, we also receive your data from other providers of postal services which act on our behalf in delivering parcels, for example if parcels come from abroad and if a different provider of postal services, which cooperates with us, has been entrusted there with the delivery.

DPD operates a logistics database to ensure provision of the services offered. Data relating to consignors and consignees that are relevant in terms of logistics are stored in this database. This database allows us to optimise the parcel delivery process so that parcels can reach the right consignee or an alternative delivery address that has been provided in as short a time as possible. This logistics database also allows us to track deliveries that have already been completed and parcels in order to respond to any queries relating to these, not only from consignors and consignees, but also from authorities in the course of administration of justice. We operate this database in our own legitimate interests in order to optimise our services and in the interests of consignors and consignees so as to enable delivery that is as prompt and smooth as possible.

If you are a system partner, parcel shop operator or delivery driver, we receive your data when you get in touch with us or with a system partner with the intention of working for us. Based on various statutory requirements and specific legitimate interests of ours and our customers, we are obliged to collect a certain amount of further information from you. This ranges from background checks to insurance cover, vehicles used and licences held.

If you are a visitor to our website, we receive your data via various website functions. We use cookies for this purpose or ask you for information directly. Our overriding aim is to optimise the presentation of our website and provide you with more information about various services. You have the option to limit or disable these services at any time by configuring your settings accordingly or clicking the relevant link (see 'Web analysis, cookies and third party services').

If you are an applicant for a job, we receive your data when you get in touch with us and send us your application. We use this data solely during the recruitment process.

We also collect personal data from prospective customers (for example, contacts, their contact details and information that is relevant to marketing) in the course of our canvassing and marketing activities. We are always on the look out for potential contract partners on the Internet, at trade fairs and at other events and keep a marketing database for this purpose in order to enable target-oriented advertising for our products and services. We take all these actions in our legitimate interest for marketing purposes pursuant to Art. 6 (1) 1 f) GDPR in conjunction with recital 47 for a period of three years from the end of a contractual relationship (customer and supplier) or first-time (unsuccessful) contact (prospective customers), unless explicit consent has been given by the data subject for a longer period.

Who might we share your information with?

DPD sends your information in order to fulfil legal or contractual obligations or based on a legitimate interest specified on a case-by-case basis. Insofar as such grounds do not exist, we will always obtain your consent to the transmission of data.

If you are a consignor, we send your information mainly to our depots, which are responsible for collecting your shipments, and from there to participating system partners and delivery drivers.

If you are a consignee, we send your data solely to the relevant consignors, system partners, parcel shops or delivery drivers (or to other providers of postal services which are needed for a delivery). If a parcel happens to be damaged, we also send your data to our insurers or to solicitors and courts in the event of a dispute.

Consignment data or details of the content of consignments will only be sent or made available to third parties under certain circumstances. Such third parties include, in particular, customs authorities, law enforcement agencies or insurance companies. You can obtain information about the status of consignments at any time using our app or the tracking functions on our website. This information is only available to authorised users and can only be obtained by entering the consignee's post code and the consignment number.

Job applications are received at our company only by the relevant department or by our system partners in the case of applications for delivery driver positions, and are subject to the relevant consent.

In some cases we also use service providers to carry out tasks and activities on our behalf. Unless they act on our behalf as part of the logistics chain, all service providers are under an obligation to comply with our instructions regarding the processing of data as specified in a data processing agreement.
DPD does not lease, lend or sell personal data to third parties.

However, data may be passed on to associated group companies and may be processed jointly in accordance with Article 26 GDPR. Based on logistics, tax law and administrative considerations, we have established various companies both in Germany and abroad which we use to process personal data in the context of customer support and marketing (as well as for other purposes) either jointly or as part of processor relationships. Together with these companies, which are each also controllers within the meaning of the GDPR, we provide the services commissioned from us, offer various services and operate a joint marketing database.

Insofar as we are expected to provide products and services offered by other companies associated with us in the context of an ongoing business relationship or following an explicit request by a prospective customer, we pass on the personal data of the prospective customer for the purposes indicated to the companies associated with us which offer the products and services that are of interest to the specific data subject.

Insofar as our contract partners or processors have their registered office in a third party country, i.e. a country outside the European Economic Area (EEA), we will inform you of the consequences of such circumstances in the service description.

How long do we keep hold of your data?

In the case of contract initiation or conclusion in our parcel shop, we process your personal data for the purpose of contract performance, and following full execution of a contract, until the end of the warranty, guarantee, limitation and statutory storage periods applicable to us, and beyond these until the settlement of any legal disputes for which data is required as evidence.

Data disclosed and stored in the course of other requests are processed by us until your request has been dealt with positively and are stored for as long as you could make legal claims against us or our authorised distributors based on your request.

DPD account details are deactivated according to data protection requirements following the termination of a contract and, insofar as this is financially and technically possible pursuant to Article 4 (2) GDPR, permanently deleted.

We process data, which we have collected from prospective customers for marketing and information purposes, in the event that they have given consent for this, until their consent is withdrawn, otherwise based on our legitimate interests, generally for a period of three years from the last business contact or contact initiated by the prospective customer.

However, if you so wish, we will delete your data that is processed for marketing purposes prior to the end of this period provided there is no legal obstacle to doing so.

If there is no consent for continued storage, job applications will be deleted according to data protection requirements no later than six months following notice of rejection.

Please see the table of cookies in Web analytics, cookies and third party services for details of the storage period of cookies.

DPD also has a presence in various social networks. These include Facebook, Twitter, Xing and YouTube. DPD operates its services on these platforms under the data privacy provisions of the respective platform operator and is not directly responsible for data processing by these operators.

Knowledge obtained from such data is used only for internal purposes and direct feedback. DPD points out that these platforms are intrinsically public and comments made there can generally be read by all users. DPD will not give out any consignment-related information or details of personal data in public forums via these platforms.

DPD offers the Predict service for consignors and consignees as part of its product portfolio.

Recipients of consignments from a consignor can use this service to receive advance information by e-mail or text regarding delivery of the parcels and the organisation of the delivery process. For this purpose, either the consignor (shipping customer) or the parcel customer itself sends relevant additional information to DPD, such as the consignee's e-mail address or mobile phone number.

Regardless of the fact that DPD only sends relevant messages to a parcel recipient on behalf of the consignor, it goes without saying that DPD is vigilant about legally compliant data processing. From a logistics provider's perspective, it is in a consignee's legitimate interests to be sent information promptly about an expected delivery by the consignor of a parcel and/or the logistics company transporting their delivery and/or to receive information about delivery problems quickly. This serves to prevent unnecessary waiting times and, if need be, to direct a person entitled to receive a parcel to the delivery address quickly.

Pursuant to a decision by the German Data Protection Conference on 23 March 2018, the legal basis for the forwarding of data by a consignor to a logistics company should be express consent from the customer. It stipulates that online traders can pass on delivery information or a consignment tracking link to their customers themselves.

Insofar as data is passed on from the consignor to provide the consignee with information quickly by DPD as the controller, processing is in the interest of the consignee especially if the consignor is not in a position to provide the relevant prompt information.

The shipping customer is, however, responsible for the accuracy of the e-mail addresses and phone numbers of its ordering customers (consignees) made available to DPD in terms of spelling, syntax and the assignment of a specific consignment as well as any specific consent from the end customer required for the forwarding to DPD.

If blocking requests have been made to DPD by a consignee with regard to the sending of information via e-mail or text, DPD is obliged to take account of such objection and suspend the service to the respective consignee. The shipping customer will not be informed of the blocking.
In the case of Predict information, this does not relate to advertising with the aim of promoting own or third party sales, but to the execution of the delivery process for goods that have already been ordered.

The consignor may also send information to its customers about itself in the form of customer banners as part of the Predict service. In addition to company name and address, customer banners may also include a company logo, website URL and a company-based slogan/strap line, however no advertising content over and above this in the form of text or visual representations. DPD does not intend to send its own advertising to customers.
We recommend that our shipping customers include the following information in their data privacy statements and obtain the relevant consent from end customers.

'In the context of dispatch handling, we would like to forward your data (name, address, e-mail address and/or mobile phone number where appropriate as well as other consignment-related data) to our shipping partner DPD Direct Parcel Distribution Austria GmbH to enable consignment tracking and use of the Predict service by DPD. Please tick to indicate your agreement'.

myDPD.at and dpd-business.at are platforms for private and commercial customers of DPD. These platforms make it easier for our customers to transfer data to DPD in the context of shipping orders and to manage the addresses needed for this. DPD uses this data for processing consignments as previously described.

Additional personal data such as name, address, phone number or e-mail address may be given on a voluntary basis, for example as part of a survey, a competition, product order, contact enquiry or request for information. Your data will always be processed in the context of the purposes described in the section entitled 'General information on data processing'.

We use cookies in several areas in the tools as on our website. They make our service more user-friendly, more effective and more secure. How we use cookies and how you can prevent them is described in Web analytics, cookies and services by third parties.

We offer Paypal as a possible payment option on our platforms in the context of payment processing. If you use this option, you will be redirected in the course of the payment process from our page to the relevant Paypal website where the payment transaction is actually processed. Regardless of this, personal data may be collected by Paypal upon activation of the relevant link.

Paypal is a service provided by Paypal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

As a European payment services provider, Paypal is also obliged to comply with data protection regulations (GDPR) and provides detailed information of the data collected and processed when using Paypal on its website at https://www.paypalobjects.com/webstatic/ua/pdf/EU/privacy.pdf. If you would like more information about Paypal, we recommend that you read its Data Privacy Policy.

A further option is to pay for our services using a credit card. We can offer this option using a further third party provider, Unzer Austria GmbH, Columbusplatz 7-8, 1100 Vienna, Austria. If you decide to use this payment option, you will likewise be redirected to this third party provider's website where the payment transaction will be completed.

Wirecard provides detailed information about data that is collected and processed during a payment transaction at https://www.unzer.com/de/datenschutz/.

Your concerns are important to us and for this reason we provide a customer service desk together with our associated companies. If you contact our customer service desk, a ticket will be generated internally via which your request or suggestion for improvement will be processed. We record data and the background to your request which you disclose in the course of your service request there.

To answer any questions you have asked, we also use the logistics database we operate which stores information about consignors, consignees and the progress of consignments.

If requests or suggestions for improvement made by you relate to experiences with freight companies acting on our behalf or other companies associated with us, we will forward the background to your request and data disclosed to the relevant party with your permission in order to respond to your request or in an attempt to implement your suggestion for improvement quickly.

Data disclosed and stored in this context are processed by us until your request has been dealt with and are stored as long as you could make legal claims against us or our authorised distributors based on your concerns. At the end of this period, the tickets in our system will only be kept for statistical purposes and any personal references will be deleted immediately in accordance with Article 4 (2) of the Austrian Data Protection Act.

In order to assess the credit status of (new) customers and suppliers, we use probability values based on automated statistical processes ('scoring').

Credit scores are calculated on our behalf by well-known credit agencies and commercial credit insurers. We pass data on to these service providers for this purpose on the basis of contractual agreements that have been verified for compliance with data protection regulations. DPD balances interests in order not to prejudice your interests disproportionately with a credit check on a case-by-case basis. If a credit check is negative, DPD reserves the right to reduce or change payment terms, or review the cooperation.

We use numerous technical and organisational security measures to protect your data against manipulation, loss, destruction and access by third parties. Our security measures are improved in line with technological developments in the Internet.

Pursuant to the General Data Protection Regulation and the Austrian Data Protection Act, as a data subject affected by our data processing, you are entitled to the following rights and remedies:

Right to information (Article 15 GDPR)

As a data subject you have the right to request information about whether and, if so, which personal data concerning you is processed. For your own protection (so that details of your data do not fall into the hands of a third party), it may be necessary for us to check your identity in an appropriate manner.

Right to rectification (Article 16) and erasure (Article 17 GDPR)

You have the right to request the rectification without undue delay of incorrect personal data concerning you or, taking account of the purposes of data processing, the right to have incomplete personal data completed as well as the erasure of your data provided the criteria in Article 17 GDPR have been met.

Right to restriction of processing (Article 18 GDPR)

You have the right in accordance with statutory requirements to the restriction of processing of all personal data that has been collected. Following a request for restriction, this data will be processed only with individual consent or to establish and implement legal claims.

Right to data portability (Article 20 GDPR)

You may request the unobstructed and unrestricted transfer of personal data to a third party.

Right to object (Article 21 GDPR)

On grounds relating to your particular situation, you may object at any time to the processing of personal data concerning you which is necessary for protecting our legitimate interests or those of a third party. Following an objection, your data will no longer be processed unless there are compelling legitimate grounds for processing, which override your interests, rights and freedoms or processing serves the establishment, exercise or defence of legal claims. You may object to data processing for direct advertising purposes at any time with future effect.

Withdrawal of consent

If you have given separate consent to the processing of your data, you may withdraw this at any time. Such withdrawal affects the permissibility of processing of your personal data once you have announced your withdrawal.

If you take steps to enforce your rights arising from the GDPR as indicated above, DPD must state their position on the requested measure or comply with the request without undue delay and no later than within one month of receiving your request.
We will respond to all reasonable requests within the legal framework free of charge and as promptly as possible.