Privacy Notice

The controller for this website and other DHL Paket products and services is

DHL Paket GmbH
Strässchensweg 10
53113 Bonn

The controller for Deutsche Post products and services is

Deutsche Post AG
Charles-de-Gaulle-Strasse 20
53113 Bonn

The controller for DHL Express products and services is

DHL Express Germany GmbH
Heinrich-Brüning-Strasse 5
53113 Bonn

The controller for DHL 2-Mann-Handling GmbH products and services is

DHL 2-Mann-Handling GmbH
Charles-de-Gaulle-Strasse 20
53113 Bonn

The controller for DHL Hub Leipzig GmbH products and services is

DHL Hub Leipzig GmbH
Hermann-Köhl-Str. 1
04435 Schkeuditz

The data protection officer of the aforementioned controllers can be contacted as follows

Konzerndatenschutzbeauftragte Gabriela Krader, LL.M (CIPP/E)
Konzerndatenschutz
53250 Bonn
datenschutz[at]dpdhl.com

You enjoy the following data protection rights vis-à-vis the relevant controllers:

a) In accordance with Art. 15 GDPR, you can request information about your personal data processed by the particular controller.

b) You can request rectification in accordance with Art. 16 GDPR if your data are not (or are no longer) correct.

c) You can request the erasure of your personal data in accordance with Art. 17 GDPR.

d) In accordance with Art. 18 GDPR, you have the right to request a restriction on the processing of your personal data.

e) If the requirements of Art. 20(1) GDPR are met, you have the right to receive your data in a structured, commonly used and machine-readable format.

f) You have the right to object in accordance with Art. 21 GDPR if the processing of your data is based on a legitimate interest.

g) If you have given your consent to a certain type of processing, you can withdraw this consent at any time with effect for the future by informing the relevant contact addresses.

h) If you believe that the processing of your personal data violates data protection legislation, you have the right to lodge a complaint with the competent data protection supervisory authority in accordance with Art. 77(1) GDPR.

The competent supervisory authority for DHL Paket GmbH, Deutsche Post AG, DHL Express Germany GmbH, DHL Hub Leipzig GmbH and DHL 2-Mann-Handling GmbH with regard to postal and telecommunications services is:

The Federal Commissioner for Data Protection and Freedom of Information
Graurheindorfer Straße 153
53117 Bonn

The competent supervisory authority for other data processing by the named controllers is:

State Commissioner for Data Protection in North Rhine-Westphalia
Kavalleriestrasse 2-4
40213 Düsseldorf

and (concerning DHL HUB Leipzig GmbH)

State Commissioner for Data Protection in Saxony
Devrientstraße 5
01067 Dresden

Please contact the relevant company at the addresses below if you wish to assert your data subject rights:

• DHL Paket GmbH - please use the relevant contact form
  
• Deutsche Post AG - please use the relevant contact form
  
• DHL Express Germany GmbH - please send an e-mail to exp.de.privacy[at]dhl.com
• DHL 2-Mann-Handling GmbH - please send an e-mail to DHL-2MH-datenschutz[at]dhl.com
  
• DHL Hub Leipzig GmbH - please send an e-mail to lejhubdatenschutz[at]dhl.com

The aforementioned controllers do not sell, transfer or pass on your data to third parties in any other way and will not do so in the future unless this is required by law, necessary for the purposes of the contract or you have consented to such transfer. For example, when providing postal services, your address data and possibly your contact details may be disclosed to companies involved in the transport process (e.g. delivery partners abroad, courier service providers, customs service providers and - except for postal services - service provider for denied parties due to customs sanctions and controlled items services).

External service providers who process data on behalf of DHL Paket GmbH, Deutsche Post AG or DHL Express Germany GmbH or DHL Hub Leipzig GmbH or DHL 2-Mann-Handling GmbH (e.g. customer service activities, IT services) offer adequate guarantees that suitable technical and organisational measures have been implemented in such a way that processing is carried out in compliance with the requirements of the EU General Data Protection Regulation. They are contractually obliged to maintain strict secrecy in accordance with Art. 28 GDPR. In these cases, DHL Paket GmbH, Deutsche Post AG or DHL Express Germany GmbH or DHL Hub Leipzig GmbH or DHL 2-Mann-Handling GmbH continue to be responsible for the protection of your personal data. External service providers (e.g. PostIdent, Boku, TeleSign) only process personal data on documented instructions of the relevant controllers.

“Cookies” are small files that allow specific information relating to you to be stored on your device while you visit this website. Cookies help to determine the frequency of use and the number of users who visit this website and to make our services to you as convenient and efficient as possible.

When you access this website, you will be informed via a cookie banner that technically necessary cookies will be set. The processing of data by means of technically necessary cookies is based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR to ensure the technically flawless operation of the website. In addition, you will be informed that you can give your consent within the meaning of Art. 6 (1)(a) GDPR to the use of performance cookies and/or analysis cookies. Of course you have the possibility to revoke a given consent (see Handling cookies).

Duration of storage

These “Session cookies” are only stored for the duration of your visit to this website. They are automatically deleted when you close your browser.

Secondly, "persistent cookies" are used to record information about visitors who regularly access this website. No individual profiling is performed on the basis of usage behaviour. The contents of a persistent cookie are limited to an identification number. Your name, e-mail address, IP address etc. are not stored. The reason for using these cookies is to be able to offer you optimum user guidance as well as to "recognise" you and to be able to present you with as varied a website and new content as possible during recurrent use. The legal basis for this is the user’s consent in accordance with Art. 6 (1) (a) GDPR.

We also set the following cookies if you use DHL Shipment Tracking (DHL Sendungsverfolgung):

We also set the following cookies if you use DHL Online Franking (DHL Online Frankierung)*:

We also set the following cookies if you use DHL Finder (location search):

We also set the following cookies if you participate in the DHL Rewards Programme (Bonusprogramm)*:

Handling cookies

You can also use our products and services without cookies. In your browser, you can deactivate the saving of cookies, limit them to certain websites or set your browser so that you are notified as soon as a cookie is sent. You can also delete cookies from your PC at any time (file: "cookies"). However, please note that in this case you may expect limited page presentation and user guidance.

Most web browsers allow browser settings to manage most cookies to a certain extent.

Please visit the following page for detailed information about cookies, including about how to determine what cookies have been set and how to handle and delete them:
All about cookies

You can visit the following website for further EU-specific recommendations on cookies and the various opt-out choices:
Your online choices

Click on the following Adobe Analytics opt-out link if you wish to switch off general web tracking by Adobe Analytics:
Adobe Analytics Opt-Out

If you previously chose the opt-out and would like to undo this setting, click the Adobe Analytics opt-in link below:
Adobe Analytics Opt-In

You can also disable some or all of the advertising cookies set on your computer by visiting the Network Advertising Initiative (NAI) or the preferences manager.

Not all access to our website is via a web browser. Some users access DHL websites or applications with a mobile device. It may not be possible to disable cookies or change browser settings in this case.

The Trade Desk Cookie

We set cookies from The UK Trade Desk Ltd. 10th Floor, 1 Bartholomew Close London EC1A 7BL United Kingdom (for users from the European Economic Area and Switzerland) or from The UK Trade Desk Ltd, Global Privacy Office 2 Park Avenue, 5th Floor New York, NY 10016 (for other users). For more details, please see theTradeDesk privacy policy. The legal basis for this processing is your consent; Art. 6 para. 1 p. 1 lit. a) DSGVO.

DHL Paket GmbH offers you an improved user experience on this website by integrating Bing Maps as part of shipment tracking and location search.

• Shipment tracking: with the help of the tracking number you can track your packages and see the estimated time of delivery. If a DHL location is stored as delivery address, you can view it by using Bing Maps.
• Location search: you can use the Standortfinder on this website to search for our postal outlets, Packstations and parcel shops, which are displayed on a Bing Maps map.

We use Bing Maps from Microsoft Corporation (One Microsoft Way, Redmond, WA 98052-6399, USA) to display the map. The following data are transmitted to Microsoft for this purpose:

• Referrer (address of the page where Bing Maps is used)
• IP address of the user
• The browser used and browser preferences such as browser size and resolution, browser plugins, date, language setting
• User's location: only if the user explicitly confirms the browser prompt "Should www.dhl.de be allowed to access your location?"

Data processing is performed on the basis of Art. 6(1) (f) GDPR. DHL Paket GmbH has a legitimate interest in visualising DHL locations in the best possible way for customers, as one in ten website visitors makes a search query during their visit to the website. In the context of location search, the map also offers the customer the option of displaying the route from the customer's location to the postal outlet/Packstation. This service would not be possible without a map display.

Only the search address entered by the user is passed on during the location search. There is no link or storage between the search input and the user.

Processing of personal data due to the use of Bing Maps and information obtained through Bing Maps is subject to the Microsoft Bing Maps and MapPoint Web Service End User Terms of Use and Embedded Maps Service Terms of Use. In addition, the Microsoft Privacy Statement and Microsoft Service Agreement apply.

In the location search for postal retail outlets, DHL parcel shops, Packstations and additional automatic lockers, Deutsche Post helps customers navigate to a postal location by linking to the Google Maps website of Google Inc. (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). 

To ensure that you do not have to repeatedly enter into Google Maps the starting and destination addresses for your navigation, the following data are transmitted there when you click on "Mit Google Maps navigieren" ("Navigate with Google Maps"):

• Referrer (address of the location finder website)
• IP address of the user
• Browser; browser preferences, size and resolution; browser plugins; date; language setting
• User's location - only if the user explicitly confirms the browser prompt "www.deutschepost.de möchte deinen Standort abrufen" ("www.deutschepost.de would like to access your location"); otherwise, the location entered into the search input field (address, postal code or city/town) is used as the starting address for the navigation
• Destination address of the accessed postal location
• Selected travel mode (walking, car, public transportation)

Data are processed on the basis of Article 6(1)(a) of the General Data Protection Regulation (GDPR). By clicking on "Mit Google Maps navigieren" ("Navigate with Google Maps"), you authorize the transfer of data to Google Maps. In the context of a location search, the map shows customers the route to the retail outlet/Packstation. This service would not be possible without displaying a map.

We will not link the search to the user, nor will it be saved.

Data generated through the use of Google Maps and the information obtained through Google Maps are processed according to the terms and conditions of Google and the additional terms and conditions for Google Maps/Google Earth. The Google data privacy statement also applies.

The data are primarily processed for the purpose of handling the matter. They include name, address and additional contact details of the person submitting the application, name and address of a recipient (where applicable), subject matter of the issue (where applicable including information on consignments, etc.), bank details (where applicable). The legal basis for this is Art. 6 (1) lit. b) GDPR.

In addition, in accordance with Article 6 (1) lit. c) GDPR, the data are also processed in order to comply with legal requirements such as Section 99 of the Code of Criminal Procedure (StPO), Section 40 of the Postal Act (PostG), regulatory requirements, or tax provisions, etc.

If you are not a customer, we process necessary data within the framework of incident reports on the basis of your consent pursuant to Article 6 (1) lit. a) GDPR. This enables us to inform you of the incident status. You may withdraw this consent at any time with effect for the future. Withdrawing consent will not affect the lawfulness of any processing based on the consent before its withdrawal.

Finally, the data are also used to prepare statistics. In the opinion of Deutsche Post AG, there is no overriding interest worthy of protection, since the intervention intensity of the processing operations is kept as low as possible, e.g. through the use of anonymisation or aggregation. The legal basis for this is thus Art. 6 (1) lit. 1 f) GDPR.

DHL Paket GmbH offers you a chat function to answer your questions about certain products and services quickly and in the best possible way. When you ask a question in the chat, an application (Customer service chatbot "Marie") tries to answer your questions in a partially automated manner. The system responds with keyword-based answers, gives a link recommendation for the relevant website, recommends a contact via a different channel or passes your request to a member of staff in a live chat. Should DHL Paket GmbH receive an enquiry from the area of responsibility of Deutsche Post AG, it will be forwarded to Deutsche Post for further processing as far as necessary.

Depending on your request the following categories of data can be processed within the chat functionality:

• Chat history as transcript
  
• Shipment number (including internal shipment data)
• Name
• Address
  
• E-mail address
  
• Phone number
  
• Usage data (e.g. chat start, chat end, chat duration, chat performance data)

All the questions you ask in the chat will be stored for a maximum of 2 years in order to train the system and to be able to respond better to chat requests in the future. They will subsequently be irrevocably erased. Personal data are not stored and not analysed. Usage data such as chat duration, time stamp of messages and number of user dialogues are only stored for statistical purposes and a maximum of 2 years.

We process your data to address your request and to manage and improve our business and service processes. In the first case this is done on the basis of your consent (legal basis is Art. 6 para. 1 sentence 1 a GDPR), in the second case on the basis of our legitimate interest (legal basis is Art. 6 para. 1 sentence 1 f GDPR). You can revoke your consent at any time:

• On the website www.dhl.de
  By deactivating performance technologies in Consent Management section. To do this, open the "Use of cookies" section on this page and select "Cookie settings".
• In the “Post and Parcel” app
  By selecting the menu items “More”, “Settings” and then “Data usage” you can deactivate the customer service chatbot there.

The "Marie" chatbot is operated by Salesforce (Salesforce.com, Inc. Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, United States) under a data processing contract.

Salesforce runs the systems on its own servers in the European Union and currently some parts of the system with Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA ("AWS"), also in the European Union.

When using the ChatBot "Marie" via WhatsApp, data is processed at WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For more information, see WhatsApp's privacy policy.

By installing and using WhatsApp on your mobile device, you agree to WhatsApp's terms and conditions, over which Deutsche Post DHL has no control. These include, among other things, that you grant WhatsApp Inc. access to your phone number and the contacts stored on your mobile device. Likewise, data is stored on servers of WhatsApp Inc. that are not subject to European data protection law.

If you use the chat communication via WhatsApp, you consent to the data processing by WhatsApp (possibly also in third countries such as the USA). If you do not wish to do so, please use alternative contact channels, which you can find in the help and contact area on dhl.de (private customers: https://www.dhl.de/en/privatkunden/hilfe-kundenservice.html, business customers: https://www.dhl.de/en/geschaeftskunden/kontakt.html) in the corresponding topic area.

For more information please consult Salesforce's privacy policy and AWS' privacy policy.

When using the “Marie” chatbot via WhatsApp, data is also processed by LINK Mobility GmbH, Am Sandtorkai 73, 20457 Hamburg, Germany. Further information can be found in the LINK Mobility Privacy Policy.

LINK Mobility operates the systems on servers within the European Union.

As part of the contactless delivery of parcels and goods consignments requiring proof of delivery, it is possible for delivery agents themselves to confirm that delivery has taken place. This makes the delivery process more convenient and easier for recipients and at the same time increases efficiency of shipment deliveries.

DHL Paket GmbH uses various attributes to automatically assess whether the recipient's signature is not required for a specific shipment. These attributes include shipment-related attributes (e.g. weight, dimensions, date), sender-related attributes (e.g. total quantity being shipped, total liability amounts) and attributes linked to the address of the building where the shipment is to be delivered (e.g. total quantity being shipped, number of liability cases, number of residents). These attributes are linked to the shipment in a logical second and fed into an evaluation logic. Only the attributes themselves are used for the evaluation and not also the source to which the respective attribute was linked (e.g. address of the building). All attributes are also deleted after the automated evaluation has been carried out.

If, on the basis of the evaluation, no recipient signature needs to be obtained for the item in question, the delivery agent receives the information that the recipient's signature is not required in that specific case and they themselves acknowledge the successful delivery.

The data is processed once for the purpose of fulfilling the contract with the sender in accordance with Art. 6 (1) lit. b) GDPR and also on the basis of Art. 6 (1) Sentence 1 lit. e GDPR (guaranteeing a functioning postal system) in conjunction with Section 41a (3) Sentence 1 of the Postal Services Act (PostG) for the provision of the postal service and for proof of the proper provision of the service.

DHL Paket GmbH offers its customers the opportunity to register for a DHL customer account on its website by entering personal data. The personal data are entered in an input mask, transmitted to DHL Paket GmbH and stored. Registration requires, in particular, e-mail address, password, security question and answer, first name and surname, address, telephone number and date of birth to be processed. The data are not disclosed to any other third party.

Registration for the DHL customer account is required firstly for the provision of certain content and services on this website (e.g. use of the Packstation) and secondly for the fulfilment of a contract, in particular the fulfilment of service bookings (e.g. sending the parcel announcement) as well as shipment-related and permanent DHL receipt preferences (e.g. delivery of parcels on a day selected by the customer).

When DHL recipient services are used, a DHL customer account contains information about the storage locations for parcels in the customer's absence (preferred location), desired delivery day (preferred day), desired delivery time window (preferred time), first name and surname, street and house number of another person who is to accept parcels in the customer's absence (preferred neighbour), postal outlets and parcel shops or Packstations to which a customer wishes to redirect their parcel (local rerouting, parcel rerouting).

According to Art. 6, 1. (a) GDPR the processing of neighbour data requires a consent which the customer has to obtain in advance. The personal data of the neighbour will be used exclusively to provide the "Delivery to Neighbour" service.

The data (e-mail or telephone number) provided to the deliverer in the context of an expression of interest regarding the preferred location service will be used exclusively for sending the notification concerning the preferred location initiation. The legal basis is Art. 6(1)(b) GDPR (implementation of pre-contractual measures). The data will be deleted immediately after sending the notification.

Customers who wish to use one of the following recipient services must verify their customer data once: Packstation, parcel rerouting, delivery notification. This is necessary so that we can guarantee the security of the services and delivery to the recipient indicated on the shipment. The legal basis is Art. 6,1. (b) GDPR. Customers can choose whether they would like to confirm their data by means of an addressTAN or by POSTIDENT. If POSTIDENT is selected, the customer data will be transmitted to the Deutsche Post AG for identity verification. Further information on the processing of data by POSTIDENT can be found here.

The use of shipment-related and permanent recipient services is regulated in our General Terms & Conditions, which the customer confirms when creating the customer account. A non-registered customer who uses the shipment-related recipient services must confirm the General Terms & Conditions each time.

The processing of personal data associated with registration and booking of DHL recipient services primarily serves to perform the contract in accordance with Art. 6(1)(b) GDPR. Furthermore, data processing is carried out in order to meet legal obligations in accordance with Art. 6(1)(c) GDPR in connection with contract performance.
Finally, the aforementioned data categories are processed in connection with our security concerns (e.g. to detect criminal offences and misuse) and to ensure the security of the DHL customer account (e.g. identification during customer service provision). DHL Paket GmbH has also undertaken the following measures to ensure the security of customer accounts:

• Prompt for a security question and answer as part of the registration process that allows customers to reset their password and identify themselves to customer service.
  
• Prompt for a change of password every three months and information on the possibility of 2-factor authentication. 2-factor authentication informs the customer by e-mail when their customer account is accessed from a new browser or device. Access must then be verified with a login code.
  

Changes to customer data and the use of the customer account are also logged for security reasons. Data processing is performed in accordance with Art. 6(1)(f) GDPR to ensure security and smooth contract processing.

When logging into the DHL customer account, user data and login attempts are analysed and processed by the Customer Identity & Access Management service (CIAM) of the service provider Akamai Technologies GmbH in order to maintain our IT security requirements. 

The service provider analyses the following data on the basis of a commissioned data processing contract exclusively on servers in the EU:

• Name
• Contact details
• Contract data
• Customer history
• Account credentials
• Metadata (e.g. IP address, browser data)

This reduces the risk of unauthorised third parties accessing customer data and using compromised accounts. Data processing is performed in accordance with Art. 6 (1)(f) GDPR to ensure security and smooth contract processing.

Users of a DHL customer account can also sign up to the DHL Paket GmbH rewards programme immediately on registration or subsequently under My Data and automatically collect reward points for selected services and products. We use the data collected under the DHL rewards programme (e.g. postal number, shipment number, services, e-mail address, voucher type) to credit reward points to your rewards account and for marketing purposes. As a participant in the DHL rewards programme, you may receive promotional information and interesting offers from us, including about our rewards. The data processing associated with this primarily serves to fulfil the contract in accordance with Art. 6(1)(b) GDPR and to safeguard legitimate interests in accordance with Art. 6(1)(f) GDPR. DHL Paket has a special legitimate interest in providing advertising information and attractive offers, including those relating to our rewards.

You can terminate your participation in the DHL Paket GmbH rewards programme at any time without having to observe a period of notice, thereby commissioning the erasure of your data. Notice of termination can be sent by e-mail to paket[at]dhl.de or by letter to DHL Paket GmbH, Kundenservice Paket, Postfach 148, 57549 Mudersbach.

If DHL Paket GmbH suspects that a customer's login data has been compromised, the customer's account will be closed to protect it against potential misuse. Proactive information is not sent to the customer as doing so might warn potential criminals. We therefore recommend logging in regularly in order to ensure before an order that the account has not been locked.

If you are already a customer of DHL Paket GmbH, Deutsche Post AG, DHL Express Germany GmbH or DHL Hub Leipzig GmbH, your address data (e.g. name, address) will be processed to inform you about offers, news, products and services of the particular company in question.

Alongside an existing consent, the relevant controller processes your e-mail address solely in order to provide you with information on their own and similar products where this is permitted by law. For example, DHL Paket GmbH or DHL Express Germany GmbH sends e-mails that you or others have requested, such as parcel notifications. Similarly, you may receive important usage instructions for product, service or system information as well as details of your particular customer account with DHL Paket GmbH or DHL Express Germany GmbH by e-mail. The legal basis for this processing is Art. 6(1)(f) GDPR. The processing of customer data for our own direct marketing purposes is carried out within the scope of the legitimate interest of the particular company in question. You have the right to object to such processing at any time. In order to exercise your right, simply contact the company in question using the contact details provided above.

Customers of DHL Paket can subscribe to free information by e-mail in the Customer account section of this website and DHL Express customers in the Info & know-how section. During registration, the e-mail address provided by the customer is transmitted to DHL Paket GmbH or DHL Express Germany GmbH. The user's e-mail address is collected for the purpose of delivering e-mails. If you register to receive information and news from DHL Paket GmbH or DHL Express Germany GmbH by e-mail (consent), the companies in question are each entitled to process your e-mail address for this purpose.

In addition, if you grant consent, e-mails (e.g. newsletters, delivery notifications) will be personalised in order to provide you with offers and services tailored to your interests and preferences as well as specific tips on the products and services of DHL Paket GmbH, Deutsche Post AG or DHL Express Germany GmbH. We also make contact for market research purposes - including a customer satisfaction survey on the aforementioned services and products. To this end, for example, controllers will process your master data (e.g. name, address) as well as information on the use of the particular services (e.g. total number of shipments, desired time and place of delivery time) together with, if applicable, your data from the DHL Paket GmbH rewards programme (e.g. award of reward points for goods and services used, discount amount, place and time of the transaction) and information on the use of subscribed e-mail communication (e.g. opening the newsletter, orders placed from the newsletter). The legal basis for this data processing is your consent in accordance with Art. 6(1)(a) GDPR. You may stop receiving information and news by e-mail at any time by clicking on the relevant link at the bottom of the e-mail. You can also withdraw consent at any time with effect for the future using the contact address of the particular companies provided above.

If you unsubscribe from e-mail communications or withdraw your consent, the corresponding data will be removed or blocked from the mailing list and will no longer be processed for these purposes. Your e-mail address is included in a blocking list at the particular company in question in order to protect the legitimate interests of the relevant controller in accordance with Art. 6(1)(f) GDPR. The legitimate interest lies in not sending you any information by e-mail in future.

The controller performs a measurement of success as part of the e-mail distribution process. For example, a record is made of whether an e-mail has been opened and if links in the e-mail have been clicked on. The analyses serve to identify the reading habits of users and to adapt content to them or to send different content according to users' interests. The legal basis for this data processing is Art. 6(1)(f) GDPR. This data processing for our own direct marketing purposes is carried out within the scope of the legitimate interest of the particular company in question.

DHL Paket GmbH, DHL Express Germany GmbH or Deutsche Post AG process the data collected in the course of implementing the contract for (data) security purposes (e.g. to detect criminal offences or misuse), to produce statistics and for quality assurance, process optimisation (e.g. improving registration and verification of DHL customer accounts) and planning reliability to the extent permitted by law. The controller has a legitimate interest for this processing in ensuring the smooth operation and continuous improvement of the particular products and services. In the opinion of the controllers, there is no overriding interest worthy of protection, since the intensity of the processing operations is extremely low, e.g. through the use pseudonyms. The legal basis for this data processing is Art. 6(1)(f) GDPR.

Your personal data provided on the order form will be forwarded to the participating retailers, who will subsequently process them to carry out the order. The data include your contact details and preferred location information. The legal basis for the processing is pursuant to Art. 6(1) sent. 1(b) GDPR (performance of a contract).

1. Introduction
Deutsche Post AG is pleased to welcome you to our Facebook fan page, thank you for your interest in our company, products and services. In the following document, we would like to inform you about certain issues related to data protection laws that apply when you visit our fan page.

• Our fan page was provided to us by Facebook in accordance with valid terms of use. Facebook is solely responsible for the technical operation of the fan page.
• We are solely responsible for the content that we post on the page.
• Your visit and your interaction on our fan page are tracked by Facebook. This information will be provided to us in anonymized form (as page insights). If you have a Facebook account, Facebook will process your data in accordance with Facebook’s own terms of use. If you are not a member of Facebook, your interactions on our fan page will be anonymously tracked and will also be provided to us in the form of statistical analysis (page insights). Both Facebook and we are jointly responsible for processing personal data in events related to page insights (insight data).
• Pursuant to the agreement between Facebook and us (a page insights addendum), every joint controller shall fulfill its information obligations on its own.
• You may exercise your rights as the data subject (see Item 4) by contacting the officer responsible for insights data. Should we receive an inquiry that falls into Facebook’s area of responsibility, we shall forward it to Facebook for further processing.
•  We have no say in Facebook’s processing of the data. Furthermore, we possess no information regarding the degree, purposes and length of time that Facebook will store the data and possibly evaluate, link and transmit the information to third parties. If you would like to contact us directly, i.e. without the participation of Facebook, please use the contact details on our website.
• You will find additional information regarding data processing for which Facebook is solely responsible in Facebook’s data policy and cookie policy.

2. Who is responsible for data processing?
Deutsche Post AG, Charles-de-Gaulle Str. 20, 53113 Bonn, Germany, is responsible for the information it posts and also for its processing.

You can reach our data protection officer(s) at

Deutsche Post AG
Corporate Data Protection
53250 Bonn, Germany
datenschutz[at]dpdhl.com

Facebook Ireland Ltd, 4 Grand Canal Harbour, Dublin 2, Ireland, and Deutsche Post AG are jointly responsible for processing the personal data in events for page insights (Insights data). Collective processing is based on an agreement between the joint controllers pursuant to Article 26 GDPR, which you can view at: Information on Page Insights

3. Which data do we process, and how and why do we process your data?

3.1 Data processing of page insights for statistical purposes
For our fan page, Facebook provides us with page insights. Page insights are anonymous statistics that are generated as a result of certain events and are tracked by Facebook when a fan page visitor such as you interacts on our fan page. We can use the page insights, which contain no personal data, to see which content is particularly accessed by which group of individuals. We can also use these data to optimize our fan page itself. This represents a legitimate interest for processing (processing of personal data in events for page insights). The legal basis for data processing related to page insight is Article 6 (1)(f) GDPR.

You can adjust your Facebook ad preference settings in your Facebook account.

3.2 Data processing resulting from contacting us and from other communications
We ourselves do not collect personal data when you get in touch with us by using a contact form or Messenger, among other options. This data is processed exclusively for the purpose of responding to the inquiry, for establishing contact, for the associated technical administration and, unless other statutory or contractual retention periods apply, will be used for a maximum of two years to prove correct and proper processing and for further optimization of services.

Our legitimate interest is to properly address your matter as quickly as possible. The legal basis for the processing is Article 6 (1)(f) GDPR. If the contact is initiated for contract inception or conclusion, Article 6 (1)(b) GDPR will serve as the legal basis.

If you provide us with personal data on our fan page (e.g., as part of comments), this process shall be conducted on the basis of your consent in accordance with Article 6 (1)(a) GDPR. You may revoke your consent at any time with effect for the future. If you would like to exchange personal data with us, we recommend that you contact our customer service.

Data is also collected for the purpose of holding and processing competitions. The respective details, such as which data is processed for which purpose, can be found in the data protection notices and terms and conditions of the respective competition.

3.3 Data processing for direct marketing purposes
We process personal data in order to inform you about our offers, innovations, products and services. Personal data are processed for direct marketing purposes within the context of our legitimate interests. The legal basis for this data processing is Article 6 (1)(f) GDPR. You have the right at all times to object to the processing for direct marketing purposes (see Item 4). Once your objection has been expressed, your personal data shall no longer be processed for these purposes.

3.4 Data processing for non-binding consultations
Secure the advantages of joint sales support from DHL Paket and Deutsche Post and thus the most efficient, comprehensive advice on all postal and parcel issues from a single source.

We hereby consent to the mutual exchange between DHL Paket GmbH, Deutsche Post AG and DHL Express Germany GmbH of data pertaining to their respective products, services and business relationships with us for sales purposes. This consent applies not only to data that are subject to postal secrecy protection (such as geographical volume data and dispatch data) but also to other personal data (e.g., contacts’ names and details). DHL Paket GmbH, Deutsche Post AG and DHL Express Germany GmbH aim to tailor their own and/or joint sales activities to the specific needs of their customers by means of the collective analysis and use of data. We also agree to receive cross-divisional advice for the entire portfolio by telephone and e-mail.

Details can be found in our supplementary privacy policy and if you no longer wish to be contacted, you can revoke the permission at any time with immediate effect at kundendaten[at]dhl.com. The legal basis for this processing is your consent according to Art. 6 (1)(a) GDPR.

4. What rights do users have?
Under the GDPR, data subjects shall have the following rights:

• Under Article 15 GDPR, they have the right to receive information regarding the personal data that are processed by the respective controller
• They may request a rectification under Article 16 GDPR, provided that their data are not or are no longer correct.
• Under Article 17 GDPR, the data subjects may demand that their personal data be erased.
• Under Article 18 GDPR, they have the right to demand a restriction on the processing of their personal data.
• If the conditions of Article 20 (1) GDPR have been met, the data subjects have the right to receive their data in a structured, commonly used and machine-readable format.
• Under Article 77 (1) GDPR, they have the right to lodge a complaint with the responsible data-protection authority.
• Under Article 21 (2) GDPR, you may at any time object to the processing of your personal data for direct marketing purposes.
• Under Article 21 GDPR, the data subjects have the right to object, provided that their data are processed on the basis of a legitimate interest in terms of Article 6 (1)(f) GDPR (see Items 3.1 and 3.2) and provided that they can cite grounds relating to their own particular situation. You can lodge an objection with our Facebook customer service by stating your contact details, the specific processing to which you are objecting, the grounds for objection arising from your particular situation and the name of the fan page.

or in the case of an objection to the processing of page insights for statistical purposes (see Item 3.1) with Facebook. Should we receive an inquiry that falls into Facebook’s area of responsibility, we shall forward it to Facebook for further processing.

If you wish to exercise data subject rights against Facebook, please contact Facebook Ireland Ltd., 4 Grand Canal Harbour, Dublin 2, Ireland. You may exercise these rights online by using the contact form provided on the Facebook site.

If you would like to exercise your rights as a data subject in dealings with us, please use the contact data included in Item 2.

When shipments (incl. returns) are handed in, a digital Drop-off receipt (proof of posting) is sent to the e-mail address that is provided to DHL Paket GmbH or DHL Express Germany GmbH with the contact details for the shipment. This posting receipt serves as proof of posting of the consignment and is part of the fulfilment of the contract. The legal basis for this is Art. 6 (1) (b) GDPR. For returns, DHL Paket GmbH or DHL Express Germany GmbH receives the contact details from the original sender of the shipment.

If you send shipments via a Packstation, it is also possible to receive a proof of posting for your shipment from DHL Paket GmbH via e-mail. The legal basis for data processing is Art. 6 (1) (b) GDPR, since the processing is necessary for the performance of the contract. Your e-mail address will not be disclosed to third parties and will be erased after 7 days. You can also receive a proof of posting without providing an e-mail address. To do this, however, you must post your shipments at a postal outlet or DHL parcel stores, where you will then receive a printed proof of posting.

Shipping confirmation is provided free of charge by DHL Paket GmbH to inform the sender or recipient that the shipping label for your shipment has been successfully generated and that your shipment has either already been passed on or will soon be passed on to DHL Paket GmbH. DHL Paket GmbH requires the e-mail address of the sender or the recipient in order to be able to notify you by e-mail of the shipping confirmation for your shipment. DHL will receive the particular e-mail address from the sender of the shipment if they wish to use DHL Paket GmbH's shipping confirmation service. DHL Paket GmbH subsequently processes the e-mail address for the sole purpose of sending the shipping confirmation. The legal basis for this is Art. 6 (1) (b) GDPR. The processing of the e-mail address for the purpose of shipment confirmation is part of the performance of the contract to inform you about the delivery of your shipment to DHL Paket GmbH that has taken place or will take place in the near future.

As users (e.g., if you don't have a smartphone or don't want to use the Post & DHL app), you generally have the option of arranging redelivery to your home address. A redelivery can be requested via this website. In this case, the shipment sent to the Packstation will be taken out of the Packstation and a second attempt to deliver to your home address will be made.

Alternatively, you can also completely exclude the notification or redirection of shipments to Packstations. Parcels will then only be dropped off with neighbours and/or in branch. You can do this via customer services or as a registered customer in your DHL customer account under "My data and services", and then "Delivery note" under parcel receipt. Clicking "No deliveries to Packstation" will show the relevant notification. Delivery agents will then receive this notification when making a delivery and will be required to deliver parcels to a different location.

With regard to the data of the neighbour or other third party, we are also entitled, pursuant to Section 41b (2) PostG, to collect and store certain identification data:

1. Type of identification
2. Issuing authority
3. Number of the identification
4. Date of issue.

Other identification data is not stored by the identification reader devices. The data processing within the scope of the "Ident-Check" service is for a special purpose and necessary to prove the proper handling and delivery of the item due to the increased need to preserve evidence; see also Section 41a (3) PostG. The data collected in connection with the "Ident-Check" service is stored solely in relation to the individual consignment and for the duration of the statutory and contractual retention periods.

1. Introduction
We are pleased that you are visiting our LinkedIn account / fan page and are interested in our company, products and services. Below, we would like to inform you about some data protection aspects in the context of your visit to our fan page. 

• Our fan page was made available to us by LinkedIn in accordance with the applicable terms of use. LinkedIn is solely responsible for the technical operation of the fan page.
• We bear sole responsibility for the content we post on this site.
• Your visit and interaction on our fan page are recorded by LinkedIn and made available to us in anonymised form (page insights). If you have a LinkedIn account, LinkedIn processes your data in accordance with the LinkedIn terms of use. If you are not a LinkedIn member, your interactions on our fan page are recorded anonymously and also made available to us as a statistical evaluation (page insights). We and LinkedIn Ireland are jointly responsible for the processing of personal data in events for page insights (insights data).
• In accordance with the agreement applicable to LinkedIn and us (known as the page insights supplement), each joint controller is responsible for fulfilling its own information obligations.
• Please exercise your rights as a data subject (see section 4) against one of the Insights data controllers. If we receive a request that falls within LinkedIn's area of responsibility, we pass it on to LinkedIn for further processing.
• In addition, on the one hand, we have no influence on the data processing by LinkedIn and, on the other hand, it is not apparent to us to what extent, for what purposes and for how long the data is stored by LinkedIn and, if applicable, evaluated, linked and passed on to third parties. If you wish to contact us directly, i.e. without the involvement of LinkedIn, please use the contact options on our website.
• For more information on the data processing for which LinkedIn Ireland is solely responsible, please see LinkedIn's Privacy Policy and Cookie Policy.

2. Who is responsible for data processing?
Deutsche Post AG, Charles-de-Gaulle Str. 20, 53113 Bonn, Germany, is the responsible party for the information it posts and the processing for which it is responsible.

You can reach our data protection officer at

Deutsche Post AG
Konzerndatenschutz
53250 Bonn
datenschutz[at]dpdhl.com 

As far as the processing of personal data in Events for Page Insights (Insights Data) is concerned, LinkedIn Ireland Unlimited Company ("LinkedIn Ireland"), as the provider of LinkedIn in the countries of the European Union (EU) and the European Economic Area (EEA) as well as Switzerland, is the data controller in addition to us. Joint processing is carried out on the basis of an agreement between the joint controllers in accordance with Article 26 of the GDPR.

3. What data do we process and how and why do we process your data?

3.1 Data processing of page insights for statistical purposes 
LinkedIn provides us with so-called page insights for our fan page. Page insights are anonymous statistics created based on certain events and collected by LinkedIn when fan page visitors like you take action on our fan page. Based on the page insights, which do not contain any personal data, we are able to identify which content is most frequently requested by which group of people. Based on this, we can optimise our fan page appearance. This constitutes a legitimate interest for the processing taking place (processing of personal data in events for site insights). The legal basis for data processing as part of the page insights is Art. 6(1)(f) GDPR.

You can change your LinkedIn advertising preferences settings in your LinkedIn account at https://www.linkedin.com/campaignmanager/accounts/508274196/campaign-groups and
at https://www.linkedin.com/campaignmanager/accounts/508015026/campaign-groups  

3.2 Data processing when contacting us and further communication 
We process personal data when you contact us, e.g. via contact form or by comment. This data is processed exclusively for the purpose of responding to the request, for contacting you and for the associated technical administration and, provided that no other legal or contractual retention periods apply, is used for a maximum of two years to provide evidence of proper processing and further optimisation of services.

Our legitimate interest is to process your request properly and as quickly as possible. The legal basis for this processing is Art. 6(1)(f) GDPR. If the contact is made for the purpose of initiating or concluding a contract, Art. 6 (1)(b) GDPR is used as the legal basis. For this purpose we partly call upon German-based third-party agencies to process certain data on our behalf, as a general rule the name, address, contact details and e-mail address.

If you provide us with personal data via our fan page (e.g. in comments), this is done on the basis of your consent pursuant to Art. 6 (1)(a) GDPR. You can revoke this consent at any time with effect for the future. If you wish to exchange personal data with us, we recommend that you contact our customer service. 

In the context of competitions, data is collected for their implementation and processing. The details of this, such as which data is processed for which purpose, can be found in the data protection information and conditions of participation of the respective competition.

3.3 Data processing for direct marketing purposes
We process personal data to inform you about our offers, news, products and services. Personal data is processed for our own direct marketing purposes within the scope of our legitimate interest. The legal basis for this data processing is Art. 6(1)(f) GDPR. You have the right to object to processing for direct marketing purposes at any time (see Point 4). If you object, your personal data will no longer be processed for these purposes.

3.4 Data processing for non-binding consultations
Secure the advantages of joint sales support from DHL Paket and Deutsche Post and thus the most efficient, comprehensive advice on all postal and parcel issues from a single source.

We hereby consent to the mutual exchange between DHL Paket GmbH, Deutsche Post AG and DHL Express Germany GmbH of data pertaining to their respective products, services and business relationships with us for sales purposes. This consent applies not only to data that are subject to postal secrecy protection (such as geographical volume data and dispatch data) but also to other personal data (e.g., contacts’ names and details). DHL Paket GmbH, Deutsche Post AG and DHL Express Germany GmbH aim to tailor their own and/or joint sales activities to the specific needs of their customers by means of the collective analysis and use of data. We also agree to receive cross-divisional advice for the entire portfolio by telephone and e-mail.

Details can be found in our supplementary privacy policy and if you no longer wish to be contacted, you can revoke the permission at any time with immediate effect at kundendaten[at]dhl.com. The legal basis for this processing is your consent according to Art. 6 (1)(a) GDPR.

4. What rights do users have?
Under the GDPR, data subjects are entitled to the following rights: 

• In accordance with Art. 15 GDPR, you can request information about your personal data processed by the particular controller.
• You can request rectification in accordance with Art. 16 GDPR if your data is not (or is no longer) correct.
• You can request the deletion of your personal data in accordance with Art. 17 GDPR.
• In accordance with Art. 18 GDPR, you have the right to request a restriction on the processing of your personal data.
• If the requirements of Art. 20 (1) GDPR are met, you have the right to receive your data in a structured, commonly used and machine-readable format.
• In accordance with Art. 77 (1) GDPR, you have the right to complain to the competent data protection supervisory authority.
• In accordance with Art. 21 (2) GDPR, you may object to the processing of personal data relating to you for direct marketing purposes at any time.
• You have the right to object in accordance with Art. 21 GDPR if the processing of your data is based on a legitimate interest within the meaning of Art. 6(1)(f) GDPR (see Sections 3.1 and 3.2) and if you can provide reasons for this arising from your particular situation. You can submit the objection to our Instagram customer service, stating your contact details, the specific processing you are objecting to, the reasons for objection resulting from your particular situation and the name of the fan page.

or in the case of an objection to the processing of page insights for statistical purposes (see Point 3.1) to LinkedIn. If we receive a request that falls within LinkedIn’s area of responsibility, we pass it on to LinkedIn for further processing.

If you wish to exercise data subject rights against LinkedIn, please contact:

LinkedIn Ireland Unlimited Company
Attn: Legal Dept (Privacy Policy and User Agreement)
Wilton Plaza
Wilton Place,
Dublin 2
Ireland

If you would like to exercise your data subject rights against us, please contact us using the contact details provided under Point 2.

On their websites (dhl.de/kundewerden and dhl.de/warenpost) Deutsche Post AG and DHL Paket GmbH offer business customers the option of concluding a DHL Paket business customer contract online or arranging a telephone appointment by entering personal data. The personal data are entered in an input mask on dhl.de and transmitted to Deutsche Post AG and DHL Paket GmbH in SSL-encrypted form on conclusion of the contract and stored.

The following data are processed when a contract is concluded or a telephone appointment is arranged (mandatory fields are marked with *):

• Company: Company name*, legal form*, street*, house number*, postcode*, town*, VAT ID, commercial register number, local court, webshop URL
  
• Owner/managing director: Form of address*, surname*, first name*, telephone*, e-mail*
  
• Shipments: Number of domestic parcels (per year)*, number of international parcels (per year)*, climate friendly shipping with DHL GoGreen, interest in merchandise mail (Warenpost), information regarding the sender's property*
  
• Bank details: Account holder*, IBAN*, BIC*
  
• Contact person (* if selected): Form of address, surname, first name, telephone, e-mail
  
• Alternative collection address (* if selected): Company name, legal form, street, house number, postcode, town
  
• Alternative billing address (* if selected): Company name, legal form, street, house number, postcode, town.
  

Customer personal data are processed for the purpose of contract initiation, processing and fulfilment as well as for compliance with legal requirements (e.g. Section 257 of the Commercial Code (HGB), Section 147 of the Fiscal Code (AO)). The legal basis for the processing of personal data is Art. 6(1)(b) and (c) GDPR.

For process optimisations (e.g., to simplify registration and verification of the DHL business customer account), the responsible parties have a legitimate interest in processing personal customer data in relation to ensuring a smooth process and the continuous improvement of the respective products and services. The legal basis for this data processing is the legitimate interest described here Art. 6 (1) (f) GDPR.

No data is disclosed to third parties, except for real-time authentication of the bank account by means of the TÜV-certified immediate verification procedure from Sofort GmbH.  

Sofort GmbH will only use the data retrieved as part of the immediate verification procedure to determine the name stored for online banking or to compare the bank details for a real-time comparison with the account holder, IBAN and BIC details provided dhl.de. Sofort GmbH does not store any other personal data from online banking access, and in particular does not store account balances, turnover data, withdrawal limits, account lists or PINs.

For billing purposes vis-à-vis DHL Paket GmbH and to fulfil legal obligations of proof and retention, Sofort GmbH stores the account holder, the IBAN and the BIC, the date as well as the result of the verification, if applicable also the country, customer number, project number and transaction identifier (of the DHL customer) within the legal or contractual periods of retention. These periods of retention range from three to ten years.

Should the process of concluding the contract be interrupted, or the contract terminated due to a timeout, data entered on this page by the customer will be stored by Deutsche Post AG and DHL Paket GmbH for 30 days when the "Continue to your individual shipping costs" button at the bottom of the first page of the form is clicked on. These data are only stored for the purpose of assisting the customer and restoring the data already entered by the customer so that they can easily continue conclusion of the contract at a later date. To this end, the system will send them an e-mail 24 hours after the process of concluding the contract online was aborted containing a link that can be used to continue conclusion of the contract without data having to be re-entered. If the contract process is not completed within one week after the first e-mail has been sent, the customer will receive an additional reminder e-mail. This data processing is carried out in order to safeguard the aforementioned legitimate interests of DHL Paket GmbH and is based on Art. 6(1)(f) GDPR.

If a business customer contract is concluded with DHL, personal data collected via the online customer acquisition process on dhl.de will be archived for a further 10 years after termination of the business relationship in accordance with legal requirements.

If no business customer contract is concluded with DHL despite registration, personal data collected via the online customer acquisition process on dhl.de will be erased after 60 days. If you wish to exercise your right of objection - in particular to the use of your data for advertising purposes - please send an e-mail with the following subject line "Request for erasure from mailing list", stating your company name, to the following address: geschaeftskunde[at]dhl.de.

Payment types

With DHL online franking, Deutsche Post AG enables you to purchase DHL shipping stamps for the national and international shipment of your parcels and packages yourself. Personal data of the person buying the DHL shipping stamp as well as of the sender and recipient of the shipment are processed (e.g. type of shipment, type of product, additional services, collection address, name and address of the sender and recipient, postal number of the sender/recipient, telephone number of the recipient if applicable, details of the customs declaration if applicable, e-mail address of the sender and, if applicable, of the recipient, method of payment) for the purpose of contract processing and fulfilment as well as compliance with legal requirements (e.g. Section 99 of the Code of Criminal Procedure (StPO), Section 40 of the Postal Act (PostG), Section 257 of the Commercial Code (HGB), Section 147 of the Fiscal Code (AO)). Depending on which product or service you have ordered, the shipment data is sent to the companies involved in the provision of postal services (here: DHL Paket GmbH, DHL Express Germany GmbH) in order to ensure the proper delivery of the shipment. The legal basis for the processing of personal data is Art. 6(1)(b) and (c) GDPR.

Various payment methods are offered when purchasing the DHL shipping label.

For payment processing via credit card, Deutsche Post AG use the Braintree service from payment services provider PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. If you pay by credit card, the data required for payment processing (credit card number, expiry date and verification number) will be collected and processed by the payment service provider. The legal basis for data processing is Art. 6(1) (b) GDPR, as the processing of the data is necessary for payment and thus for the performance of the contract. The applicable data protection policy of PayPal can be viewed in the Paypal privacy policy.

EVO Payments International GmbH, Elsa-Brändström-Strasse 10-12, 50668 Cologne, Germany (EVO), is commissioned with handling Giropay payments. The data required for payment processing will be collected and processed by the payment services provider. The legal basis for data processing is Art. 6(1) (b) GDPR, as the processing of the data is necessary for payment and thus for the performance of the contract. The applicable data protection policy for payments via Giropay can be viewed in the EVO Payments International GmbH privacy policy.

In addition, there is the option of processing the payment transaction using the online payment service PayPal. The European operating company of PayPal is PayPal (Europe) S.à.r.l. & Cie. S.C.A. 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg. If you choose PayPal as the payment method, your data required for the payment process will be transmitted to PayPal. By selecting this payment option, you consent to the transfer of personal data required for payment processing. The following data is routinely transmitted to PayPal: name, address, company, e-mail address, telephone and mobile number, IP address. In order to process the contract, such personal data are also required that are related to the particular shipping order. The legal basis for data processing is Art. 6(1)(b) GDPR, as the processing of the data is necessary for payment by PayPal and thus for the performance of the contract.

Furthermore, the customer has the option to conclude a billing agreement with PayPal during the payment process. In this context, no personal data are exchanged with Deutsche Post AG. The data transmitted to PayPal may be transmitted by PayPal to credit agencies. The purpose of this transfer is to check identity and creditworthiness. The applicable data protection policy of PayPal can be viewed in the Paypal privacy policy. For direct debit payments, Deutsche Post AG does not use the services of a payment services provider. Only the data required for processing the payment transaction is processed. The legal basis for this is Art. 6 (1) (b) GDPR; contract fulfilment.

Deutsche Post AG does not store any payment details besides the name of the payment service provider used and anonymous IDs required for the processing of revocation or cancellation requests. The legal basis for data processing is Art. 6 (1) (b) GDPR, as the processing of the data is necessary for the return of payment and thus for the performance of the contract. The entire handling of payments and the use of the payment data required for this purpose are performed exclusively by the payment service provider.

Processing on the basis of legitimate interest of Deutsche Post AG

If necessary, your data will be transmitted to a credit agency to protect the legitimate interests of Deutsche Post AG in order to carry out an identity and credit check. This is particularly the case if Deutsche Post AG makes advance payment and bears the economic risk (e.g., in the case of payment by direct debit). The legal basis for data processing as part of a credit check by a credit agency is Art. 6(1)(f) GDPR.

Finally, processing is also carried out for the purposes listed below:

• In connection with security concerns (e.g., for the purpose of detecting criminal offences),
• For the purpose of preparing statistics,
• For the purposes of quality assurance and process optimisation, and
• Planning certainty

Deutsche Post AG has a legitimate interest in this in order to ensure smooth processing and to constantly improve its products and services. In the opinion of Deutsche Post AG, there is no overriding interest worthy of protection, since the intensity of the processing operations is extremely low, e.g., through the use of pseudonyms. The legal basis for this is Art. 6(1)(f) GDPR.

DHL Paket GmbH offers the DHL Retoure Selbstzahler service, which the retailer/sender can use to make the process easier for customers/recipients wishing to return an item. DHL Paket GmbH will send an e-mail to the recipient on the sender's behalf, containing a link to a shipping label with the relevant data already entered. The sender guarantees that it is entitled on a legal basis (e.g., by consent) to provide DHL Paket GmbH with the e-mail address and any other contact data for this purpose. In addition, the sender will be informed that the recipient has purchased the shipping label for return shipping. DHL Paket GmbH processes this data on the grounds of its legitimate interests in the performance of the contract concluded with the sender; Article 6 (1) (f) GDPR. The recipient can object to such processing by applying to the sender.

Packstation expert panel supplementary data protection notice

With this data protection notice, we want to inform you about data processing in connection with participation in the user panel for private customers of Deutsche Post and DHL. For general information about the processing of personal data, responsible parties, contacts, and especially exercising your rights as a data subject, go to www.deutschepost.de/datenschutz and www.dhl.de/en/dataprotection. 

Purpose of data processing

As part of the Packstation expert panel's activities, we will occasionally invite you to participate in studies and surveys relating to the DHL Packstation and its functionality and interfaces, and to Deutsche Post DHL portals and websites for private customers. The data we collect is used to obtain a better impression of you and your needs and to make relevant improvements. 

Among other things, we process your data to:

• Make the operation of DHL Packstations as pleasant as possible
• Develop new functionality oriented to user needs
• Compile statistics
• Provide you (if permitted) with customized ads inviting your participation in studies and surveys
• Perform quality assurance, process optimization and planning certainty measures

We will store your contact information until further notice. We will store data from studies and surveys for no more than 2 years.

Legal basis

The legal basis for this processing of your data is your consent within the meaning of Article 6 (1) (f) of the General Data Protection Regulation (GDPR). You can withdraw this consent here at any time without giving reasons. 

Cookies set when surveys.dpdhl.com is accessed

In your browser, you can deactivate the saving of cookies, limit them to certain websites or have a message sent to you as soon as a cookie is sent. You can also delete cookies from your computer's hard drive at any time ("cookies" folder). In this case, you will have to re-enter data if there is an interruption. Most browsers have settings that allow a certain degree of control over the vast majority of cookies. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit http://www.allaboutcookies.org/. For further EU-specific information on cookies and the various opt-out options available, you can also visit http://www.youronlinechoices.eu/.

Not everyone who visits our site will do so using a web browser. Some users will access DHL websites or associated applications using a mobile device. If so, it may not be possible to disable cookies or adjust web browser settings.

Transfer of your data

Your data will not be transferred, nor will it be passed on to an EU third country.

A DHL Paket GmbH parcel notification informs you free of charge about the expected delivery date of the parcels you have ordered to your home address. Furthermore we inform you in case of a delay in delivery or if we did not meet you upon the delivery.

DHL Paket GmbH requires your e-mail address in order to be able to notify you by e-mail.

Parcel notification is a part of DHL Paket services that are activated as an integral element of the contract when you register with DHL Paket. The processing of the e-mail address for the purpose of parcel notification is carried out for the performance of a contract on the basis of Art. 6(1)(b) GDPR.

If you are not a registered DHL customer, DHL Paket GmbH will receive your e-mail address from the sender of the shipment if they wish to use DHL Paket GmbH's parcel notification service. The legal basis for the sender to pass on the e-mail address to DHL Paket GmbH is usually your consent to the sender in accordance with Article 6 (1) (a) GDPR. DHL Paket GmbH subsequently processes the e-mail address for the sole purpose of sending you the parcel notification. The legal basis for this is Art. 6(1)(b) GDPR.

Every parcel notification includes an opt-out for future parcel notifications.

A DHL Paket GmbH pick-up notification informs you about the expected pick-up time frame.

DHL Paket GmbH requires your e-mail address in order to be able to notify you by e-mail about the pick-up time frame.

If you use an e-mail address of a third person for the pickup notification, to whom the pick-up should be announced by e-mail, you have to make sure that this person has consented to the use.

DHL Paket GmbH subsequently processes the e-mail address for the sole purpose of sending you the parcel notification. The legal basis for this is Art. 6(1)(b) GDPR.

In principle, the legal basis for the processing of recipient data is Article 6 (1) lit. e) GDPR. The provisions of Section 41a of the Postal Act (PostG) permit the processing of personal data in order to guarantee a functioning postal system and are thus in a special public interest pursuant to Article 6 (1) lit. e) GDPR. This also includes the authority pursuant to Section 41a (3) first sentence of the Postal Act (PostG) which permits the processing of recipients' personal data where this is necessary for the proper delivery of postal items. This includes, for example, name, address, shipment data, whether the recipient was available to accept the delivery or if the shipment was delivered to an alternate recipient. In this context, the processing of the personal data primarily serves two purposes: documenting delivery and (potentially) providing evidence vis-à-vis the parties involved (sender, recipient).

Depending on the relevant legal regulations, the recipient's name and address are in some instances transferred to the authorities of the country of transit or destination for the purposes of customs clearance and payment of taxes, or for security screening.

For shipments with the delivery variant "closest droppoint" (e.g. delivery to a parcel shop in the country of destination), the legal basis is Article 6 (1) lit. e) GDPR in conjunction with Section 41a (3) first sentence of the Postal Act (PostG) as informing the recipient of the fact that a shipment can be collected and from where it can be collected is necessary for the proper delivery of postal items and thus in order to guarantee a functioning postal system.

The period for which data are stored is based on the time limits for exclusion of liability and on the statutory retention periods pursuant to Section 439 (1) of the German Commercial Code (HGB) and pursuant to Section 257 (1) Nos. 1 and 4 of the German Commercial Code (HGB). Data retention period:

• Parcels: 3 years
• Customs documents: 6 years
• Parcels with payment transactions: 10 years

The storage of personal data in connection with the provision of postal services is necessary for the provision of the service and is also permitted pursuant to the Postal Act (PostG) and in particular Section 41 et seqq. of the Postal Act (PostG). The handover data are stored solely in order to prove proper handover to Deutsche Post AG and can only be called up via the individual shipment number, the "Identcode", and only in connection with a specific shipment.

For information on the processing of your recipient data as registered recipient, please refer to Customer Account and Recipient Services.

Within the context of the respective services - especially transport and logistics services - provided by DHL Paket GmbH, Deutsche Post AG or DHL Express Germany GmbH, personal data are processed on the basis of contracts concluded with the senders. These data include, for example, name, address, email address, telephone number, shipment information, bank data. These data are, for example, used to execute a (transport) contract, to administer customer data, to process payments and, where applicable, to carry out credit checks. Depending on the relevant legal regulations, certain sender data are transferred to the authorities of the country of transit or destination for the purposes of customs clearance and payment of taxes, or for security screening. Such data generally include the sender's name and address, a description of the goods, the number of items, weight and value of the shipment. In the course of delivery the sender data will additionally be disclosed to the recipient and/or where applicable also to the alternate recipient.

In principle, the legal basis for the processing of sender data is Article 6 (1) lit. b) GDPR as the data are processed for the performance of the contract and to provide evidence of correct provision of the service.

The period for which data are stored is based on the time limits for exclusion of liability and on the statutory retention periods pursuant to Section 439 (1) of the German Commercial Code (HGB) and pursuant to Section 257 (1) Nos. 1 and 4 of the German Commercial Code (HGB). Data retention period: 

• Parcels: 3 years
• Customs documents: 6 years
• Letters and parcels with payment transactions: 10 years

The storage of personal data in connection with the provision of postal services is necessary for the provision of the service and is also permitted pursuant to the Postal Act (PostG) and in particular Section 41 et seqq. of the Postal Act (PostG). The handover data are stored solely in order to prove proper handover to Deutsche Post AG and can only be called up via the individual shipment number, the "Identcode", and only in connection with a specific shipment. 

The provisions of Section 41a of the Postal Act (PostG) permit the processing of personal data in order to guarantee a functioning postal system and are thus in a special public interest pursuant to Article 6 (1) lit. e) GDPR. This also includes the authority pursuant to Section 41a (3) first sentence of the Postal Act (PostG) which permits the processing of personal data of alternate recipients (neighbours or other third parties) where this is necessary for the proper delivery of postal items. This includes, for example, name, address, capacity as neighbour or other third party.

Processing primarily serves the following purposes: documenting delivery, (potentially) providing evidence vis-à-vis the parties involved (sender, recipient, alternate recipient), and informing the actual recipient that his shipment has been delivered, so that he knows from whom he can collect his parcel.

The period for which data are stored is based on the time limits for exclusion of liability and on the statutory retention periods pursuant to Section 439 (1) of the German Commercial Code (HGB) and pursuant to Section 257 (1) Nos. 1 and 4 of the German Commercial Code (HGB). Data retention period: 

• Parcels: 3 years
• Letters and parcels with payment transactions: 10 years

The storage of personal data in connection with the provision of postal services is necessary for the provision of the service and is also permitted pursuant to the Postal Act (PostG) and in particular Section 41 et seqq. of the Postal Act (PostG). The data are stored solely in order to prove proper handover and can only be called up via the individual shipment number, the "Identcode", and only in connection with a specific shipment.

If the recipient specifies you as alternate recipient, the recipient must obtain your consent for this pursuant to Article 6 (1) lit. a) GDPR. Your personal data will then be used solely in order to provide the service "delivery to neighbour".

You can use shipment tracking service to track shipments addressed to you or sent by you, and also view the expected time of delivery. For tracking, simply enter your shipment number and the current status of your shipment will be displayed. You will also receive all important detailed information about your shipment. In addition, the sender or recipient can also receive further information about the shipment in question by e-mail or SMS. For this purpose, the e-mail address or mobile phone number of the recipient of the notification can be stored and the notification activated. In this context, the person entering the data must ensure that the notification recipient agrees to the processing of e-mail address, mobile phone number and notification.

The following data are processed as part of shipment tracking: shipment number, name and address of the sender, name and address of the recipient, e-mail address of the sender/recipient if applicable, name and address of the alternative recipient if applicable, customer data of the sender, product or service name, shipment history, signature of the recipient, confirmation that a minimum age has been checked (over 16/over 18).

The data are processed for the purpose of fulfilling the contract on the basis of Art. 6(1)(b) GDPR.

In selected cases, you will be offered live tracking for your parcel in DHL shipment tracking. As part of live tracking, you can follow the route of your parcel live on a map on the day of delivery. The legal basis is Art. 6 (1)(b) GDPR, as this processing is carried out in order to fulfil the contract.

It is also possible to track national express shipments from DHL Express Germany GmbH via the shipment tracking function on this page. The legal basis is Art. 6 (1)(b) GDPR, as this processing is carried out in order to fulfil the contract.

DHL Paket GmbH offers you an improved user experience on this website by integrating Google Maps as delivery to Packstation/postal outlet.

• Shipment tracking: for some shipments we offer a live tracking function that allows you to follow the path of your shipment live on a Google Maps map.
• Delivery to Packstation/postal outlet: within tracking, you will see an option to redirect your shipment to a Packstation or postal outlet if you are not going to be at home at the time of delivery. You can select the appropriate Packstation/postal outlet on a map from Google Maps.

We use Google Maps from Google Inc. (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to display the map. The following data are transmitted to Google for this purpose:

• Referrer (address of the page where Google Maps is used)
• IP address of the user
• Google account (if the user is logged into Google, this will be recognised and assigned)
• The browser used and browser preferences such as browser size and resolution, browser plugins, date, language setting
• User's location: only if the user explicitly confirms the browser prompt "Should www.dhl.de be allowed to access your location?"

Data processing is performed on the basis of Art. 6(1) (f) GDPR. DHL Paket GmbH has a legitimate interest in visualising DHL locations in the best possible way for customers, as one in ten website visitors makes a search query during their visit to the website. In the context of location search, the map also offers the customer the option of displaying the route from the customer's location to the postal outlet/Packstation. This service would not be possible without a map display.

Only the search address entered by the user is passed on during the location search. There is no link or storage between the search input and the user.

To Google's privacy policy