Who is the controller of your personal data?
The controller of your data is InPost UK Limited or the parent company of InPost UK Limited (InPost).
Where we use subcontractors in the performance of our services, the subcontractor may also be an independent data controller of your personal data or may only be a processor.
What personal data do we process?
As part of the services provided by InPost, we may process the following personal data:
- First Names, Last Names, Usernames and Titles
- Billing Address, Delivery Address, email address and telephone numbers
- Bank account and payment card details
- IP Address
- Login Data
- Marketing and Communication data
We collect and store this data in order to provide our services to you including sending messages by SMS and email in respect of parcel status updates and locations of Lockers where parcels have been delivered. We may also send payment, deposit and collection receipts to your email address.
We process the above data to the extent and scope necessary to perform the services provided by InPost and to comply with InPost’s legal obligations, including consideration of complaints submitted for these services.
In addition, as part of providing you with marketing messages or other requests, such as requests for proposals (with your prior consent), we may process your personal data that you provided to us when giving your consent.
Providing personal data by you is voluntary, but necessary for the provision of services provided by InPost or consideration and possible implementation of applications that you address to us. The requirement to provide this data is a contractual requirement, whereas in relation to data provided in the framework of complaints submitted to us due to non-performance or improper performance of postal and transport services, it is also a statutory requirement (specified in the Postal Services Act 2000).
In addition, because – for the purposes of security and protection of you and your shipments, in particular against theft and vandalism – we use monitoring of InPost parcel lockers, under which it is possible to record your image, and thus also process this personal data. Such processing of your data is therefore necessary not only for the protection of our legitimate interests, but also for the protection of your interests.
How do we receive your personal information?
We receive your personal data directly from you or from the sender of the parcel. Your personal data can therefore be obtained by InPost in the following circumstances:
- in the case in which you give us your Shipment to be delivered to a person indicated by you or to the indicated place;
- in the event that our customers (e.g. online stores) provide us with your data to deliver parcels to you;
- in the event that you submit a complaint to us for failure to perform or improper performance of the services we provide, or when your data is provided by a person authorised to make such a complaint, for example our customer who sent you a parcel and then submitted to InPost a complaint for non-performance or improper performance of the service on this shipment;
- where you submit to us an inquiry regarding the services or activities of InPost;
- if you provide InPost with your data to receive an InPost commercial offer;
- if you provide InPost with your data to create an account with InPost, which allows you to generate orders for the services we offer; and
- if you provide your data – only with your consent – to process it for the purposes of marketing InPost products and services and entities cooperating with InPost, which will be implemented by InPost or independently by these entities.
For what purpose do we process your personal data?
The purpose of processing your personal data is specified in particular in the relevant contract or InPost regulations, based on which we provide services to you or have access to your personal data, or directly when you consent to the processing of your personal data. Such reasons may include:
- providing postal or transport services to you, as well as services accompanying these services, including delivery of a parcel you have sent or delivery to you
- to send you messages by email or SMS in relation to the delivery of a parcel;
- to process payments and refunds
- the need to fulfil tax, legal and settlement obligations
- providing you with information and materials of a marketing nature or for the purpose of providing you with our offer (this is optional and requires your consent to receive this type of information)
- analysis, including personalisation, solely for the purposes of optimising processes in the provision of our services and improving their provision;
- To register you as a new customer
- Fraud prevention and detection.
How long do we store your personal data?
We store your personal data no longer than necessary. In particular, we store personal data for the time necessary for the proper performance of the services we provide, and after this period no longer than until the expiry of the limitation period for claims that may be raised in connection with the provision of these services. We store your personal data for the following periods:
- when you have an InPost account which enables you to order the services we provide, and commission these services as the sender (including the payer), as well as if you do not have such an account, but use our services as the sender (including the payer), we store your personal data for a maximum period of 6 years from the day you sent the parcel;
- when you are the recipient of a shipment, we store your personal data for no longer than the period of limitation of any claims for the provision of services by us, resulting from the Limitation Act 1980;
- when you file a complaint or complain about the services provided by InPost, we process your personal data contained in your complaint for the time necessary to consider your complaint. After this time we can store it for no longer than the period of limitation of any claims for a complaint arising from generally applicable law;
- when you submit another application or inquiry to us, we store your personal data for the period of service and eventual implementation of your application, and after that period we may store it for a period not exceeding the period of possible limitation of claims resulting from generally applicable law; and
- If the period of storage of your personal data results from mandatory provisions of law, we store your personal data for the period specified in these provisions.
Why do we store your data for such a period of time?
Because as InPost we have to comply with the obligations arising from the provisions of generally applicable law, in particular in the field of:
- implementation of postal law, transport law, tax and accounting regulations,
- to the extent that the processing of personal data is necessary for purposes arising from legitimate interests pursued by InPost, in the form of matters related to the pursuit of claims arising from the provision of services by InPost,
- continuous improvement of the level of security, in particular preventing fraud and fraud,
- other legally justified obligations imposed on InPost.
How do we process your personal data?
We process your personal data:
- in electronic form in our computer systems and by providing the same to our subcontractors, to the extent necessary for the proper performance of services provided by InPost;
- in physical form (e.g. in writing), to the extent necessary for the proper performance of the services provided by InPost, in particular as prints on transmission labels generated our computer systems, which are then attached to the parcel.
When processing your personal data, we use safeguards appropriate to the type, amount and scope of personal data being processed, and appropriate organisational and technical measures to best protect your personal data against unauthorised activities.
Realising the importance of protecting your personal data, we have implemented the following measures:
- encrypt your data using the SSL (Secure Sockets Layer) layer during transmission;
- in certain cases, anonymisation, pseudonymisation and encryption of your personal data;
- other hardware, network and system security, such as: firewalls, licensed hardware and network antivirus software, controlled access through a secured VPN and many other IT security solutions;
- electronic and physical mechanisms for controlling access of people to buildings and rooms in which your personal data is processed (e.g. magnetic and electronic keys, security locks, monitoring); and
- other safeguards that are designed to protect your personal data.
What are the contact details of the Personal Data Administrator and the person responsible at the Administrator for the protection of personal data?
InPost contact details: Contact with the person responsible for the protection of personal data in InPost is possible at the following e-mail address: firstname.lastname@example.org.
What are the legal grounds for processing your personal data by InPost?
InPost processes your personal data in order to perform the postal and transport services it offers. These services are performed on the basis of contracts, including contracts concluded with shippers. Without processing this personal data, we are not able to perform these services (e.g. without knowing the address for delivery of the package and its addressee, we are not able to deliver such a package), or other services we have committed to. The processing of your personal data is also necessary to fulfil our legal obligations.
We also process your personal data for purposes arising from our legitimate interests – by “legitimate interest” we mean compatible with the generally applicable law and the rational purpose of data processing (e.g. direct marketing of our products or services or pursuing claims by us for our business activities). Whenever we want to process your personal data on the basis of a legitimate interest, we examine and assess whether such processing of personal data will affect you and your rights. We will not process your personal data on the basis of our “legitimate interest” if your interest or your rights and freedoms override it.
For other purposes of processing your personal data, you may withdraw your consent to the processing of your personal data for these purposes without affecting the validity of the processing of personal data before the consent is withdrawn. We obtain your consent in particular for the use of your personal data for marketing purposes.
Who are the recipients of your personal data?
Pursuant to the provisions of the GDPR, the “recipient” of personal data is a natural or legal person, public authority, entity or other entity to whom personal data is disclosed, regardless of whether it is a third party. Your personal data is not processed exclusively by InPost and its staff. We provide our services with the help of many subcontractors, including transport companies and couriers. Your data is therefore processed by such categories of recipients as:
- InPost employees and associates;
- InPost subcontractors, providing services on our behalf for receiving, moving, sorting and delivery of shipments;
- InPost subcontractors responsible for payments and refunds;
- insurers responsible for covering potential damage to shipments;
- subcontractors operating our IT networks and databases and creating IT solutions for us and providing marketing services to us;
- subcontractors servicing the InPost helpline and customer service department,; Her Majesty’s Revenue & Customs, regulators and other authorities based in the United Kingdom who may require us to report processing activities;
- companies affiliated by capital with Integer.pl SA (a list of these entities is available at: https://integer.pl/pl/grupa-kapitalowaniinteger-pl/profil-dzialalnosci); and
- professional entities providing InPost tax, legal, auditing, digital marketing, website hosting and settlement consultancy.
Is your personal data transferred to third countries, i.e. countries that do not belong to the European Economic Area?
Your personal data is transferred to third countries in the event that the services provided by InPost are to be performed also in the territory of a third country. This is the case, for example, when you send a parcel via InPost to such a country. Your personal data may also be transferred to our subcontractors (e.g. entities that deliver your parcel in a third country) and entities providing InPost with tax, legal, audit and billing advice if they operate in a third country. With each of the above cases, we secure the processing of your personal data, in particular by entering into confidentiality agreements and the processing of personal data in a manner which is in line with the provisions of the law generally applicable in the European Union and the United Kingdom in the field of personal data protection and on conditions to ensure the security of processing your personal data. We do not transfer your personal data to international organisations. We do not transfer your personal data to third countries if such transfer is not possible or is excluded by generally applicable law.
Cookies and IP Addresses
If you use our website and systems available through our website (in particular enabling the generation of orders and other activities related to the ordering of postal and transport services), when browsing these pages, so-called “cookies” are created. These are small text files that are stored on your device through which you browse websites. They are commonly used to ensure the functioning of websites and other services provided via the Internet, and to improve and develop these pages, which is based on reading the content of these files.
InPost collects information contained in “cookies”, such as the date of connection to the website or the IP address of the device from which the connection to the website takes place – this are data showing how you use our websites. This information is used for administrative and statistical purposes and to improve our website and improve your user experience. In addition, this data, processed automatically, can be used to analyse the behaviour of content recipients on our website (e.g. time spent on the website) or to personalise the content of website, in particular by providing online advertisements.
You do not have to accept cookies (you can accept their use by selecting the appropriate button on our website, as well as by choosing the appropriate settings in your web browser), but this may lead the website not to work properly.
An IP address is a label which is used to identify one or more devices on a computer network, such as the internet. It is comparable to a postal address. We record the IP address of visitors to our website along with details of the pages they have viewed and the services they have purchased from our website.
What are your rights regarding access to your personal data?
You have the right to request from InPost, as the administrator of personal data, access to your personal data, rectification, deletion or limitation of processing, as well as the right to object to their processing, and the right to transfer this data and receive a copy thereof.
If you have consented to the processing of your data by InPost, you have the right to withdraw consent at any time, without affecting the lawfulness of the processing that was carried out on the basis of consent before its withdrawal.
You can exercise the above rights by submitting the appropriate InPost statement, in particular via the email address: email@example.com.
You also have the right to lodge a complaint with the supervisory body (the Information Commissioners Office) if you feel that we have not properly addressed our obligations.
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
This policy may change, in particular if it is necessary due to a change in generally applicable law or a change in the scope of services offered by InPost. The current version of the policy is available at: https://www.inpost.co.uk/privacy-policy/