Privacy Notice

The data are primarily processed for the purpose of handling the matter. They include name, address and additional contact details of the person submitting the application, name and address of a recipient (where applicable), subject matter of the issue (where applicable including information on consignments, etc.), bank details (where applicable). The legal basis for this is Art. 6 (1) lit. b) GDPR.

In addition, in accordance with Article 6 (1) lit. c) GDPR, the data are also processed in order to comply with legal requirements such as Section 99 of the Code of Criminal Procedure (StPO), Section 65 of the Postal Act (PostG), regulatory requirements, or tax provisions, etc.

If you are not a customer, we process necessary data within the framework of incident reports on the basis of your consent pursuant to Article 6 (1) lit. a) GDPR. This enables us to inform you of the incident status. You may withdraw this consent at any time with effect for the future. Withdrawing consent will not affect the lawfulness of any processing based on the consent before its withdrawal.

Finally, the data are also used to prepare statistics. In the opinion of Deutsche Post AG, there is no overriding interest worthy of protection, since the intervention intensity of the processing operations is kept as low as possible, e.g. through the use of anonymisation or aggregation. The legal basis for this is thus Art. 6 (1) lit. 1 f) GDPR.

In certain cases, DHL Express Germany GmbH will call you to clarify contractual matters, obtain your feedback, or for marketing purposes. The legal basis is either contract performance (Art. 6 para. 1 lit. b GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR), or consent (Art. 6 para. 1 lit. a GDPR).

If you call us or we call you, the call may be recorded for shipping-related matters, training, and quality assurance. The call will only be recorded after your consent. You can withdraw your consent at any time. From that moment, all communication will no longer be recorded. The storage duration is 9 months.

DHL Paket GmbH offers you a chat function to answer your questions about certain products and services quickly and in the best possible way. When you ask a question in the chat, an application (Customer service chatbot "Marie") tries to answer your questions in a partially automated manner. The system responds with keyword-based answers, gives a link recommendation for the relevant website, recommends a contact via a different channel or passes your request to a member of staff in a live chat. Should DHL Paket GmbH receive an enquiry from the area of responsibility of Deutsche Post AG, it will be forwarded to Deutsche Post for further processing as far as necessary.

Depending on your request the following categories of data can be processed within the chat functionality:

• Chat history as transcript
• Shipment number (including internal shipment data)
• Name
• Address
• E-mail address
• Phone number
• Usage data (e.g. chat start, chat end, chat duration, chat performance data)

Use of the chatbot is based on your consent pursuant to Article 6 (1) sentence 1 lit. a) GDPR. You can revoke your consent at any time:

• On the website www.dhl.de
  By deactivating performance technologies in Consent Management section. To do this, open the "Use of cookies" section on this page and select "Cookie settings".
• In the “Post and Parcel” app
  By selecting the menu items “More”, “Settings” and then “Data usage” you can deactivate the customer service chatbot there.

All questions that you enter into the chat are stored for a maximum of two years for the purpose of providing evidence of the service performed. The legal basis for such storage is our legitimate interest pursuant to Article 6 (1) lit. f) GDPR in order to prove the performance of the service.

User data is anonymised. The anonymised data are used to manage and improve the business processes and service processes. We look at data such as which products generally generate more requests and, where applicable, whether the general processing of requests takes too long. The legal basis for the anonymisation is the abovementioned legitimate interest in managing and improving the business processes and service processes pursuant to Article 6 (1) lit. f) GDPR.

The subsequent processing of your request in relation to a specific service or a specific shipment is carried out within the chat to enable the performance of a contract; the legal basis is Article 6 (1) lit. b) GDPR.

The "Marie" chatbot is operated by Salesforce (Salesforce.com, Inc. Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, United States) under a data processing contract.

Salesforce operates the systems on its own servers within the EU, as well as currently some system parts hosted by Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA ("AWS"), also within the EU.

When using the ChatBot "Marie" via WhatsApp, data is processed at WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For more information, see WhatsApp's privacy policy.

By installing and using WhatsApp on your mobile device, you agree to WhatsApp's terms and conditions, over which DHL Group has no control. These include, among other things, that you grant WhatsApp Inc. access to your phone number and the contacts stored on your mobile device. Likewise, data is stored on servers of WhatsApp Inc. that are not subject to European data protection law.

If you use the chat communication via WhatsApp, you consent to the data processing by WhatsApp (possibly also in third countries such as the USA). If you do not wish to do so, please use alternative contact channels, which you can find in the help and contact area on dhl.de (private customers: https://www.dhl.de/en/privatkunden/hilfe-kundenservice.html, business customers: https://www.dhl.de/en/geschaeftskunden/kontakt.html) in the corresponding topic area.

For more information please consult Salesforce's privacy policy and AWS' privacy policy.

When using the “Marie” chatbot via WhatsApp, data is also processed by LINK Mobility GmbH, Am Sandtorkai 73, 20457 Hamburg, Germany. Further information can be found in the LINK Mobility Privacy Policy.

LINK Mobility operates the systems on servers within the European Union.

This website contains contact forms for both DHL Paket GmbH and DHL Express Germany GmbH that can be used to contact the desired company electronically. If the user makes use of this option, the data entered in the input mask are transmitted to the relevant company and processed accordingly.

The personal data provided by you (e.g. first and last name, e-mail address, telephone number, address, comments, customer number, information on the weight and dimensions of a shipment, delivery documents, invoice-relevant information, information required for customs clearance) are processed exclusively for the technical administration of the web pages and to fulfil your wishes and requirements - i.e. primarily to process either contracts concluded with you or your enquiries. In addition, within the scope of processing a customer request, data processing may also be performed, for example, to create a customer account, accept and process a transport order, cooperation or registration of a service. The legal basis is performance of a contract pursuant to Article 6 (1) lit. b) GDPR.

Provided that no statutory or contractual retention periods must be complied with, your request will be stored for a maximum of two years by the respective controllers to prove that processing is being carried out properly, to ensure that processes run smoothly and to further optimise the services. The legal basis for this is the abovementioned legitimate interest pursuant to Article 6 (1) lit. f) GDPR.

As part of the contactless delivery of parcels and goods consignments requiring proof of delivery, it is possible for delivery agents themselves to confirm that delivery has taken place. This makes the delivery process more convenient and easier for recipients and at the same time increases efficiency of shipment deliveries.

DHL Paket GmbH uses various attributes to automatically assess whether the recipient's signature is not required for a specific shipment. These attributes include shipment-related attributes (e.g. weight, dimensions, date), sender-related attributes (e.g. total quantity being shipped, total liability amounts) and attributes linked to the address of the building where the shipment is to be delivered (e.g. total quantity being shipped, number of liability cases, number of residents). These attributes are linked to the shipment in a logical second and fed into an evaluation logic. Only the attributes themselves are used for the evaluation and not also the source to which the respective attribute was linked (e.g. address of the building). All attributes are also deleted after the automated evaluation has been carried out.

If, on the basis of the evaluation, no recipient signature needs to be obtained for the item in question, the delivery agent receives the information that the recipient's signature is not required in that specific case and they themselves acknowledge the successful delivery.

The data is processed once for the fulfilment of the contract with the sender in accordance with Art. 6 (1) lit. b) GDPR and also on the basis of Art. 6 (1) sentence 1 lit. e GDPR (guarantee of a functioning postal system) in conjunction with Section 68 (3) sentence 1 PostG for the provision of the postal service and for proof of proper service provision.

Account protection

The processing of personal data associated with registration and booking of DHL recipient services primarily serves to perform the contract in accordance with Art. 6(1)(b) GDPR. Furthermore, data processing is carried out in order to meet legal obligations in accordance with Art. 6(1)(c) GDPR in connection with contract performance.
Finally, the aforementioned data categories are processed in connection with our security concerns (e.g. to detect criminal offences and misuse) and to ensure the security of the DHL customer account (e.g. identification during customer service provision). DHL Paket GmbH has also undertaken the following measures to ensure the security of customer accounts:

• Prompt for a security question and answer as part of the registration process that allows customers to reset their password and identify themselves to customer service.
• Prompt for a change of password every three months and information on the possibility of 2-factor authentication. 2-factor authentication informs the customer by e-mail when their customer account is accessed from a new browser or device. Access must then be verified with a login code.

Changes to customer data and the use of the customer account are also logged for security reasons. Data processing is performed in accordance with Art. 6(1)(f) GDPR to ensure security and smooth contract processing.

To ensure the security of the DHL customer account login process, as well as to detect and prevent fraudulent or unauthorised access attempts, DHL uses a login and identity management solution provided by a specialised third-party service provider. In this context, user data and login attempts are processed and analysed to the extent necessary to protect the security and integrity of our systems.

The service provider analyses the following data on the basis of a commissioned data processing contract exclusively on servers in the EU:

• Name
• Contact details
• Contract data
• Customer history
• Account credentials
• Metadata (e.g. IP address, browser data)

This reduces the risk of unauthorised third parties accessing customer data and using compromised accounts. Data processing is performed in accordance with Art. 6 (1)(f) GDPR to ensure security and smooth contract processing.

If DHL Paket GmbH suspects that a customer's login data has been compromised, the customer account will be blocked as a precautionary measure to prevent possible misuse. The customer is not informed proactively so as not to warn potential criminals. It is therefore recommended that you log in regularly to ensure that your account is not blocked before placing an order.

Bonus programme

Users of a DHL customer account can also sign up to the DHL Paket GmbH rewards programme immediately on registration or subsequently under My Data and automatically collect reward points for selected services and products. We use the data collected under the DHL rewards programme (e.g. postal number, shipment number, services, e-mail address, voucher type) to credit reward points to your rewards account and for marketing purposes. As a participant in the DHL rewards programme, you may receive promotional information and interesting offers from us, including about our rewards. The data processing associated with this primarily serves to fulfil the contract in accordance with Art. 6(1)(b) GDPR and to safeguard legitimate interests in accordance with Art. 6(1)(f) GDPR. DHL Paket has a special legitimate interest in providing advertising information and attractive offers, including those relating to our rewards.

You can terminate your participation in the DHL Paket GmbH rewards programme at any time without having to observe a period of notice, thereby commissioning the erasure of your data. Notice of termination can be sent by e-mail to paket[at]dhl.de or by letter to DHL Paket GmbH, Kundenservice Paket, Postfach 148, 57549 Mudersbach.

Deletion of inactive customer accounts

With a DHL customer account, you have access to many DHL products and services - such as recipient services, DHL Packstations and much more. All you need is an e-mail/Post number and password.

An inactive DHL customer account has not been used for a period of two years. DHL reserves the right to delete an inactive customer account together with the associated activities and data if you have been inactive for at least two years.

This is how DHL defines activities:

A DHL customer account that is in use is considered active. Activities are, for example, the following actions that you can perform, when you log in to your customer account or are logged into it:

• Receive or send a parcel in conjunction with a recipient service

• Use Packstations for sending or receiving shipments

• Changes to the details and/or settings of the customer account

• Purchase of a shipping label/economy set in DHL online franking

• Collect or redeem DHL bonus points

Activities in a DHL customer account are independent of the device or interface on which they are carried out.

This happens when your DHL customer account is inactive: If you do not use your DHL customer account for two years, it will be considered inactive and DHL reserves the right to delete it. The legal basis for this is Art. 6 (1) (1) lit. b of the GDPR (Contract termination).

GoGreen and GoGreen Plus**

The sustainability overview in your DHL customer account shows you how many shipments you have received since the feature went live, or in the last 12 months. It also shows how many of the shipments were already sent sustainably by the sender using the GoGreen or GoGreen Plus** services, and the corresponding saving in greenhouse gas emissions (measured in kg CO₂). If you sign up to the GoGreen Plus** recipient service, a new reporting period starts and you can see how many shipments you have received since subscribing to the service, or in the last 12 months. Your DHL customer account also shows that you receive all shipments sustainably as a result of the sender signing up to GoGreen Plus** or through your subscription to the recipient service. Your data are also processed in this context for these statistical purposes. The General Terms and Conditions for Delivery and Shipment Options (GTC) apply. The legal basis for this processing is the performance of a contract pursuant to Article 6 (1) lit. b) GDPR.

DHL Express Germany GmbH and its sub-agents, DHL Hub Leipzig GmbH and DHL Airways GmbH, will declare luggage for customs clearance in your name and for your account either by individual customs declaration or by using the relevant customs authority forms (e.g. 0350, 0328) as returned goods, removal/relocation goods, student and pupil goods, refugee goods, inheritance or marriage goods. The data and documents requested from you in this context are a requirement of the customs authorities for placing these goods under the special end-use customs procedure. The legal basis for data processing by the customs authority arises in particular from Art. 3 et seq. Regulation (EC) No. 1186/2009 (Customs Exemption Regulation) in conjunction with REGULATION (EU) No. 952/2013 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 9 October 2013 and Section 21 (2) UStG as well as from Section 3 of the Federal Data Protection Act and the respective forms for customs declarations. The legal basis for data collection and further processing by DHL is Art. 6 (1) (b) GDPR (customs clearance order).

If the documents you send in contain information that is not required, you can black it out. This applies in particular to your copy of your ID card; all other information, except your first name, surname and address, can be blacked out.

You will receive an automated SMS or e-mail with a link to the "MyDHL - Perfect Your Shipment" portal, where you can upload your proofs securely and in compliance with data protection regulations. Your personal data will be stored for a period of 10 years due to legal obligations and then deleted.  The legal basis for the storage period results from Section 147 (3) (1) in conjunction with Art.  147 (1) (4a) of the German Fiscal Code (AO). If you are concerned about the electronic transmission of sensitive identity card or passport data, DHL can offer you "end-to-end" encryption. You can access DHL's own key server at keyserver.dhl.com and download a public encryption key. You can then use this key to encrypt your email containing the copy of your identity card/passport in compliance with data protection requirements.

The DHL Group Privacy Policy sets out the Group-wide standards for the processing of your data. In accordance with the provisions of the GDPR, all personal data will only be processed for a specific purpose by the DHL employees responsible for customs clearance and forwarded to the responsible customs office. Your data will only be transferred outside the European Economic Area (EEA) if this is permitted under applicable data protection law. In such cases, it is ensured that appropriate protective measures are taken for the transfer of your data (e.g. binding corporate rules (BCRs), EU standard contractual clauses).

If you are already a customer of DHL Paket GmbH, Deutsche Post AG, DHL Express Germany GmbH or DHL Hub Leipzig GmbH, your address data (e.g. name, address) will be processed to inform you about offers, news, products and services of the particular company in question.

Alongside an existing consent, the relevant controller processes your e-mail address solely in order to provide you with information on their own and similar products where this is permitted by law. For example, DHL Paket GmbH or DHL Express Germany GmbH sends e-mails that you or others have requested, such as parcel notifications. Similarly, you may receive important usage instructions for product, service or system information as well as details of your particular customer account with DHL Paket GmbH or DHL Express Germany GmbH by e-mail. The legal basis for this processing is Art. 6(1)(f) GDPR. The processing of customer data for our own direct marketing purposes is carried out within the scope of the legitimate interest of the particular company in question. You have the right to object to such processing at any time. In order to exercise your right, simply contact the company in question using the contact details provided above.

Customers of DHL Paket can subscribe to free information by e-mail in the Customer account section of this website and DHL Express customers in the Info & know-how section. During registration, the e-mail address provided by the customer is transmitted to DHL Paket GmbH or DHL Express Germany GmbH. The user's e-mail address is collected for the purpose of delivering e-mails. If you register to receive information and news from DHL Paket GmbH or DHL Express Germany GmbH by e-mail (consent), the companies in question are each entitled to process your e-mail address for this purpose.

In addition, if you grant consent, e-mails (e.g. newsletters, delivery notifications) will be personalised in order to provide you with offers and services tailored to your interests and preferences as well as specific tips on the products and services of DHL Paket GmbH, Deutsche Post AG or DHL Express Germany GmbH. We also make contact for market research purposes - including a customer satisfaction survey on the aforementioned services and products. To this end, for example, controllers will process your master data (e.g. name, address) as well as information on the use of the particular services (e.g. total number of shipments, desired time and place of delivery time) together with, if applicable, your data from the DHL Paket GmbH rewards programme (e.g. award of reward points for goods and services used, discount amount, place and time of the transaction) and information on the use of subscribed e-mail communication (e.g. opening the newsletter, orders placed from the newsletter). The legal basis for this data processing is your consent in accordance with Art. 6(1)(a) GDPR. You may stop receiving information and news by e-mail at any time by clicking on the relevant link at the bottom of the e-mail. You can also withdraw consent at any time with effect for the future using the contact address of the particular companies provided above.

If you unsubscribe from e-mail communications or withdraw your consent, the corresponding data will be removed or blocked from the mailing list and will no longer be processed for these purposes. Your e-mail address is included in a blocking list at the particular company in question in order to protect the legitimate interests of the relevant controller in accordance with Art. 6(1)(f) GDPR. The legitimate interest lies in not sending you any information by e-mail in future.

The controller performs a measurement of success as part of the e-mail distribution process. For example, a record is made of whether an e-mail has been opened and if links in the e-mail have been clicked on. The analyses serve to identify the reading habits of users and to adapt content to them or to send different content according to users' interests. The legal basis for this data processing is Art. 6(1)(f) GDPR. This data processing for our own direct marketing purposes is carried out within the scope of the legitimate interest of the particular company in question.

The sales departments of DHL Paket GmbH and DHL Express Germany GmbH process personal data in addition to business data in order to implement pre-contractual measures and for sales purposes. These data are contact details of the particular contact person of the interested party or customer (name, business e-mail address and telephone number) as well as information on the planned annual shipment volume and shipment structure. All other shipment and personal data stored as part of the business relationship (e.g. quotation calculation, contract processing, invoicing) are linked to the purpose of contract fulfilment. The legal basis for the abovementioned data processing is Article 6 (1) lit. b) GDPR. These data are also processed for the purpose of providing optimal and customised support (legitimate interest). The legal basis is Article 6 (1) lit. f) GDPR.

DHL Paket GmbH, DHL Express Germany GmbH or Deutsche Post AG process the data collected in the course of implementing the contract for (data) security purposes (e.g. to detect criminal offences or misuse), to produce statistics and for quality assurance, process optimisation (e.g. improving registration and verification of DHL customer accounts) and planning reliability to the extent permitted by law. The controller has a legitimate interest for this processing in ensuring the smooth operation and continuous improvement of the particular products and services. In the opinion of the controllers, there is no overriding interest worthy of protection, since the intensity of the processing operations is extremely low, e.g. through the use pseudonyms. The legal basis for this data processing is Art. 6(1)(f) GDPR.

Your personal data provided on the order form will be forwarded to the participating retailers, who will subsequently process them to carry out the order. The data include your contact details and preferred location information. The legal basis for the processing is pursuant to Art. 6(1) sent. 1(b) GDPR (performance of a contract).

When shipments (incl. returns) are handed in, a digital Drop-off receipt (proof of posting) is sent to the e-mail address that is provided to DHL Paket GmbH or DHL Express Germany GmbH with the contact details for the shipment. This posting receipt serves as proof of posting of the consignment and is part of the fulfilment of the contract. The legal basis for this is Art. 6 (1) (b) GDPR. For returns, DHL Paket GmbH or DHL Express Germany GmbH receives the contact details from the original sender of the shipment.

If you send shipments via a Packstation, it is also possible to receive a proof of posting for your shipment from DHL Paket GmbH via e-mail. The legal basis for data processing is Art. 6 (1) (b) GDPR, since the processing is necessary for the performance of the contract. Your e-mail address will not be disclosed to third parties and will be erased after 7 days. You can also receive a proof of posting without providing an e-mail address. To do this, however, you must post your shipments at a postal outlet or DHL parcel stores, where you will then receive a printed proof of posting.

Shipping confirmation is provided free of charge by DHL Paket GmbH to inform the sender or recipient that the shipping label for your shipment has been successfully generated and that your shipment has either already been passed on or will soon be passed on to DHL Paket GmbH. DHL Paket GmbH requires the e-mail address of the sender or the recipient in order to be able to notify you by e-mail of the shipping confirmation for your shipment. DHL will receive the particular e-mail address from the sender of the shipment if they wish to use DHL Paket GmbH's shipping confirmation service. DHL Paket GmbH subsequently processes the e-mail address for the sole purpose of sending the shipping confirmation. The legal basis for this is Art. 6 (1) (b) GDPR. The processing of the e-mail address for the purpose of shipment confirmation is part of the performance of the contract to inform you about the delivery of your shipment to DHL Paket GmbH that has taken place or will take place in the near future.

The delivery of letter and parcel shipments generally takes place at the delivery address specified on the shipment. To further support our delivery staff, information related to a delivery address is occasionally recorded and stored on a case-by-case basis. This can include, for example, a note on where mailboxes/bells can be found, warnings about hazards such as dogs or unsecured paths, or customer preferences for delivery, e.g., not to neighbours and no deposit in a Packstation. Such information is exclusively visible to our locally responsible delivery staff and is used solely for the purpose of proper and safe delivery. The stored data is not shared with third parties and is deleted once it is no longer needed. The legal basis is a legitimate interest according to Art. 6 (1) lit. f) GDPR to protect our delivery staff from dangers and ensure proper delivery.

1. Introduction

The DHL Group is delighted that you have decided to visit our Facebook fanpage and are interested in our company and our products and services. Please find below information on some aspects of data protection law in relation to your visit to our fanpage.

• Our fanpage has been made available to us by Facebook in accordance with the valid terms of use. Facebook has sole responsibility for technical operation of the fanpage.
• We have sole responsibility for the content provided by us on this page.
• Your visit to and your interaction on our fanpage are recorded by Facebook and made available to us in anonymised form (page insights). If you have a Facebook account, Facebook processes your data according to the Facebook terms of use. If you are not a member of Facebook, your interactions on our fanpage are recorded anonymously and also made available to us as statistical analysis (page insights). We and Facebook are joint controllers of the processing of personal data in events for page insights (insights data).
• According to the agreement that applies to us and Facebook (the Page Insights Controller Addendum), each of the joint controllers must fulfil its information obligations itself.
• To exercise your rights as a data subject (see No. 4), please contact one of the controllers of the insights data. If we receive a request which falls within the sphere of responsibility of Facebook, we will forward this on to Facebook for further processing.
• In addition, firstly we have no influence on data processing carried out by Facebook, and secondly we are unable to ascertain the extent to which, the purposes for which and the duration for which the data are stored by Facebook and, where applicable, are analysed, linked and forwarded to third parties. If you wish to contact us directly, i.e., without using Facebook, please use the contact details provided on our website.
• More detailed information on data processing for which Facebook has sole responsibility can be found in the Data Policy and Cookies Policy of Facebook.

2. Who is responsible for the data processing?

Deutsche Post AG, Charles-de-Gaulle Str. 20, 53113 Bonn, Germany is the controller of the information that it provides and of the processing operations for which it is responsible.

Our data protection officers can be contacted at:

Deutsche Post AG

Konzerndatenschutz

53250 Bonn

Germany

datenschutz[at]dpdhl.com

Insofar as it concerns the processing of personal data in events for page insights (insights data), Facebook Ireland Ltd, 4 Grand Canal Harbour, Dublin 2, Ireland is also the controller of the data processing in addition to us. Joint processing is carried out on the basis of an agreement between the joint controllers pursuant to Article 26 GDPR, which you can view here: Information about Page Insights

3. What data do we process and how and why do we process your data?

3.1 Data processing of page insights for statistical purposes

Facebook provides us with page insights for our fanpage. Page insights are anonymous statistics that are created based on specific events and are recorded by Facebook when fanpage visitors like you perform actions on our fanpage. We can use the page insights, which do not contain any personal data, to identify which types of content are requested particularly frequently by which group of persons. We can then optimise the presentation of our fanpage. This constitutes a legitimate interest in the processing that takes place (processing of personal data in events for page insights). The legal basis for data processing within the context of the page insights is Article 6 (1) lit. f) GDPR.

You can change the settings of your Facebook advertising preferences in your Facebook account.

3.2 Data processing in the event of contact and other communication

We process personal information if you make contact with us, e.g. via a contact form or Messenger. These data are used solely for the purpose of answering the matter in hand, for making contact and for the associated technical administration, and provided that no other statutory or contractual retention periods apply, are used for a maximum of two years in order to prove proper processing and the further optimisation of services.

Our legitimate interest lies in processing your request properly and as quickly as possible. The legal basis for such processing is Article 6 (1) lit. f) GDPR. If contact is made in order to initiate or conclude a contract, the applicable legal basis is Article 6 (1) lit. b) GDPR.

Where you provide personal data to us via our fanpage (e.g. in comments), this is done on the basis of your consent pursuant to Article 6 (1) lit. a) GDPR. You can revoke this consent at any time, with effect for the future. If you wish to replace existing personal data held by us, we recommend that you contact our Customer Service department.

Within the context of competitions, data are collected for the purpose of their implementation and management. The relevant details, for example on which data are processed for which purpose, can be found in the data protection information notices and terms of participation for the respective competition.

3.3 Data processing for direct marketing purposes

We process personal data in order to inform you about our offers, innovations, products and services. Personal data are processed for direct marketing purposes on the basis of our legitimate interest. The legal basis for such data processing is Article 6 (1) lit. f) GDPR. You have the right to object to processing for direct marketing purposes at any time (see No. 4). Once we are in receipt of your objection, we will no longer process your personal data for these purposes.

3.4 Data processing for consultations without obligation

You agree that DHL Paket GmbH, Deutsche Post AG and DHL Express Germany GmbH may share data about their respective products, services and business relationships with each other and may organise their own and/or joint marketing measures in a customer-specific way based on the joint analysis and use of data. The consent applies both to data that are protected by postal secrecy (such as geographic volume data and shipment data) and also to other personal data (e.g. names and contact details of the contact persons). You also agree that all company units may reach out to you by telephone and email in relation to the entire portfolio. Details can be found in the supplementary data protection information and, if you re-consider matters at a later date, you can revoke your consent at any time with effect for the future by sending an email to kundendaten[at]dhl.com. The legal basis for such processing is your consent pursuant to Article 6 (1) lit. a) GDPR.

4. What rights do users have?

In accordance with the GDPR, data subjects have the following rights:

• Pursuant to Article 15 GDPR, you can obtain information about your personal data that is being processed by the respective controller.
• Pursuant to Article 16 GDPR, you can obtain rectification if your data are not or are no longer applicable.
• Pursuant to Article 17 GDPR, you can obtain the erasure of your personal data.
• Pursuant to Article 18 GDPR, you have the right to obtain restriction of processing of your personal data.
• If the prerequisites of Article 20 (1) GDPR apply, you have the right to receive your data in a structured, commonly used and machine-readable format.
• Pursuant to Article 77 (1) GDPR, you have the right to lodge a complaint with the competent data protection supervisory authority.
• Pursuant to Article 21 (2) GDPR, you can object to the processing of your personal data for direct marketing purposes at any time.
• Pursuant to Article 21 GDPR, you have a right to object where the processing of your data is based on a legitimate interest pursuant to Article 6 (1) lit. f) GDPR (see Nos. 3.1 and 3.2) and where you can demonstrate grounds for such objection which relate to your particular situation. You can submit your objection to our Facebook Customer Service team by providing your contact details, the specific processing operation to which you are objecting, the grounds for objection relating to your particular situation and the name of the fanpage.

or, in the case of an objection to the processing of page insights for statistical purposes (see No. 3.1), you can contact Facebook. If we receive a request which falls within the sphere of responsibility of Facebook, we will forward this on to Facebook for further processing.

If you wish to exercise your data subject rights vis-à-vis Facebook, please contact Facebook Ireland Ltd, 4 Grand Canal Harbour, Dublin 2, Ireland. You can do so online via the contact form provided on the Facebook website.

If you wish to exercise your data subject rights vis-à-vis us, please use the contact details provided under No. 2.

As users (e.g., if you don't have a smartphone or don't want to use the Post & DHL app), you generally have the option of arranging redelivery to your home address. A redelivery can be requested via this website. In this case, the shipment sent to the Packstation will be taken out of the Packstation and a second attempt to deliver to your home address will be made.

Alternatively, you can also completely exclude the notification or redirection of shipments to Packstations. Parcels will then only be dropped off with neighbours and/or in branch. You can do this via customer services or as a registered customer in your DHL customer account under "My data and services", and then "Delivery note" under parcel receipt. Clicking "No deliveries to Packstation" will show the relevant notification. Delivery agents will then receive this notification when making a delivery and will be required to deliver parcels to a different location.

DPAG, DHL Paket GmbH and DHL Express Germany GmbH process your identity document data in certain circumstances.

We may request that you prove your identity by submitting a valid identity card or passport or by submitting other official identity documents in order to ensure that the postal service is performed properly; see Section 69 of the Postal Act (PostG).

If there is a special interest in preserving evidence, we may collect and store the following data from the identity document pursuant to Section 69 (2) PostG in order to prove at a later date the proper performance of the postal service:

1. The type of identity document
2. The issuing authority
3. The identity document number
4. The date of issue

The identity document reader is used for this task. No other identity document data are stored by the identity document reader for this purpose.

We also process the following identity document data if the sender has booked the "Ident-Check" service. The following data are scanned, stored and checked:

1. First name and surname
2. Date of birth

In this case too, the processing is carried out for a specific purpose and is necessary in order to prove the proper handling and delivery of the shipment due to the greater interest in preserving evidence. The data collected in relation to the "Ident-Check" service is stored for the duration of 12 months on a solely shipment-related basis. The data is then archived and deleted after 3 years. We perform the service on behalf of the sender. The legal basis for the processing of your data as a recipient is Article 6 (1) lit. e) GDPR in conjunction with Section 68 PostG. The provisions of Section 68 PostG permit the processing of personal data in order to guarantee a functioning postal system and are thus in a special public interest pursuant to Article 6 (1) lit. e) GDPR. This also includes the authority pursuant to Section 68 (3) first sentence of PostG, which permits the processing of recipients' personal data where this is necessary for the proper delivery of postal items.

If your name changes, we need official proof of the name change (e.g. a scan of a notarised marriage certificate or your new ID) to update your data in the customer account. You can use the upload function provided for this purpose in our Contact form. This processing is carried out exclusively for the purpose of checking the name change and the subsequent name change in the customer account on the basis of the customer account contract concluded with you; the legal basis is Art. 6 (1) lit. b GDPR. The certificate is stored together with the request for up to 2 years and then automatically deleted.

1. Introduction

We are pleased that you are visiting our LinkedIn accounts/fan pages and are interested in our company, products, and services. We would like to inform you about some data protection aspects concerning your visit to our fan pages.

• Our fan pages have been provided to us by LinkedIn in accordance with the applicable terms of use. LinkedIn is solely responsible for the technical operation of the fan page.
• We are solely responsible for the content we post on this page.
• Your visit and interaction on our fan pages are recorded by LinkedIn and provided to us in anonymised form (Page Insights). If you have a LinkedIn account, LinkedIn processes your data according to LinkedIn's terms of use. If you are not a LinkedIn member, your interactions on our fan page are also recorded anonymously and provided to us as statistical evaluations (Page Insights). For the processing of personal data in events for Page Insights (Insights Data), we and LinkedIn Ireland are joint controllers.
• According to the agreement applicable to LinkedIn and us (so-called Page Insights Supplement), each joint controller must fulfil their information obligations independently.
• Please exercise your rights as a data subject (see section 4) with one of the controllers responsible for the Insights Data. If we receive a request that falls within LinkedIn's area of responsibility, we will forward it to LinkedIn for further processing.
• In addition, we have no influence on data processing by LinkedIn and cannot discern the extent, purposes, and duration for which LinkedIn stores, evaluates, links, and possibly transfers the data to third parties. If you wish to contact us directly, i.e., without LinkedIn's involvement, please use the contact options on our website.
• Further information on data processing solely by LinkedIn Ireland can be found in LinkedIn's privacy policy and cookie policy.

2. Who is responsible for data processing?

The DHL companies mentioned in the General section are responsible for the information we post and the processing we are responsible for.

Regarding the processing of personal data in events for Page Insights (Insights Data), in addition to us, LinkedIn Ireland Unlimited Company ("LinkedIn Ireland"), as the provider of LinkedIn in the countries of the European Union (EU) and the European Economic Area (EEA) as well as Switzerland, is responsible for data processing. The joint processing is carried out on the basis of an agreement between the joint controllers pursuant to Article 26 GDPR.

3. What data do we process and how and why do we process your data?

3.1 Data processing of page insights for statistical purposes

LinkedIn provides us with page insights for our fanpage. Page insights are anonymous statistics that are created based on specific events and are recorded by LinkedIn when fanpage visitors like you perform actions on our fanpage. We can use the page insights, which do not contain any personal data, to identify which types of content are requested particularly frequently by which group of persons. We can then optimise the presentation of our fanpage. This constitutes a legitimate interest in the processing that takes place (processing of personal data in events for page insights). The legal basis for data processing within the context of the page insights is Article 6 (1) lit. f) GDPR.

You can change the settings of your LinkedIn advertising preferences in your LinkedIn account at https://www.linkedin.com/campaignmanager/accounts/508274196/campaign-groups and at https://www.linkedin.com/campaignmanager/accounts/508015026/campaign-groups  

3.2 Data processing in the event of contact and other communication

We process personal information if you make contact with us, e.g. via a contact form or comment. These data are used solely for the purpose of answering the matter in hand, for making contact and for the associated technical administration, and provided that no other statutory or contractual retention periods apply, are used for a maximum of two years in order to prove proper processing and the further optimisation of services.

Our legitimate interest lies in processing your request properly and as quickly as possible. The legal basis for such processing is Article 6 (1) lit. f) GDPR. If contact is made in order to initiate or conclude a contract, the applicable legal basis is Article 6 (1) lit. b) GDPR. For some of this processing, we use external agencies that have their headquarters in Germany and generally process the name, address, contact details and email address on our behalf.

Where you provide personal data via our fanpage (e.g. in comments), this is done on the basis of your consent pursuant to Article 6 (1) lit. a) GDPR. You can revoke this consent at any time, with effect for the future. If you wish to replace existing personal data held by us, we recommend that you contact our Customer Service department.

Within the context of competitions, data are collected for the purpose of their implementation and management. The relevant details, for example on which data are processed for which purpose, can be found in the data protection information notices and terms of participation for the respective competition.

3.3 Data processing for direct marketing purposes

We process personal data in order to inform you about our offers, innovations, products and services. Personal data are processed for direct marketing purposes on the basis of our legitimate interest. The legal basis for such data processing is Article 6 (1) lit. f) GDPR. You have the right to object to processing for direct marketing purposes at any time (see No. 4). Once we are in receipt of your objection, we will no longer process your personal data for these purposes.

3.4 Data processing for consultations without obligation

You agree that DHL Paket GmbH, Deutsche Post AG and DHL Express Germany GmbH may share data about their respective products, services and business relationships with each other and may organise their own and/or joint marketing measures in a customer-specific way based on the joint analysis and use of data. The consent applies both to data that are protected by postal secrecy (such as geographic volume data and shipment data) and also to other personal data (e.g. names and contact details of the contact persons). You also agree that all company units may reach out to you by telephone and email in relation to the entire portfolio. Details can be found in the supplementary data protection information and, if you re-consider matters at a later date, you can revoke your consent at any time with effect for the future by sending an email to kundendaten[at]dhl.com. The legal basis for such processing is your consent pursuant to Article 6 (1) lit. a) GDPR.

4. What rights do users have?

In accordance with the GDPR, data subjects have the following rights:

• Pursuant to Article 15 GDPR, you can obtain information about your personal data that is being processed by the respective controller.
• Pursuant to Article 16 GDPR, you can obtain rectification if your data are not or are no longer applicable.
• Pursuant to Article 17 GDPR, you can obtain the erasure of your personal data.
• Pursuant to Article 18 GDPR, you have the right to obtain restriction of processing of your personal data.
• If the prerequisites of Article 20 (1) GDPR apply, you have the right to receive your data in a structured, commonly used and machine-readable format.
• Pursuant to Article 77 (1) GDPR, you have the right to lodge a complaint with the competent data protection supervisory authority.
• Pursuant to Article 21 (2) GDPR, you can object to the processing of your personal data for direct marketing purposes at any time.
• Pursuant to Article 21 GDPR, you have a right to object where the processing of your data is based on a legitimate interest pursuant to Article 6 (1) lit. f) GDPR (see Nos. 3.1 and 3.2) and where you can demonstrate grounds for such objection which relate to your particular situation. You can submit your objection to our Instagram Customer Service team by providing your contact details, the specific processing operation to which you are objecting, the grounds for objection relating to your particular situation and the name of the fanpage.

or, in the case of an objection to the processing of page insights for statistical purposes (see No. 3.1), you can contact LinkedIn. If we receive a request which falls within the sphere of responsibility of LinkedIn, we will forward this on to LinkedIn for further processing.

If you wish to exercise your data subject rights vis-à-vis LinkedIn, please contact:

LinkedIn Ireland Unlimited Company
Attn: Legal Dept. (Privacy Policy and User Agreement)
Wilton Plaza
Wilton Place, Dublin 2
Ireland

If you wish to exercise your data subject rights vis-à-vis us, please use the contact details provided under No. 2.

Contact forms for DHL Paket GmbH are available on this website and can be used to get in touch us. If the user chooses this option, the data entered in the input mask will be transmitted to DHL Paket GmbH, Deutsche Post Customer Service Center GmbH and, if consent has been given, to AZL GmbH and processed accordingly. The purpose of processing your data is to find suitable locations for setting up an automation solution. This includes the process from establishing contact to concluding the contract and setting up an automation solution.

The personal data provided by you (e.g. first and last name, e-mail address, telephone number, address, information about the location) will be processed to fulfil your wishes and requirements regarding a possible location of an automation solution - i.e. primarily to process your enquiries or contracts concluded with you. The legal basis is performance of a contract pursuant to Article 6 (1) lit. b) GDPR.

Provided that no statutory or contractual retention periods must be complied with, your request will be stored for a maximum of five years by the respective controllers to prove that processing is being carried out properly, to ensure that processes run smoothly, to reassess a potential site and to further optimise the services. The legal basis for this is the abovementioned legitimate interest pursuant to Article 6 (1) lit. f) GDPR.

On their websites (dhl.de/kundewerden and dhl.de/warenpost) Deutsche Post AG and DHL Paket GmbH offer business customers the option of concluding a DHL Paket business customer contract online or arranging a telephone appointment by entering personal data. The personal data are entered in an input mask on dhl.de and transmitted to Deutsche Post AG and DHL Paket GmbH in SSL-encrypted form on conclusion of the contract and stored.

The following data are processed when a contract is concluded or a telephone appointment is arranged (mandatory fields are marked with *):

• Company: Company name*, legal form*, street*, house number*, postcode*, town*, VAT ID, commercial register number, local court, webshop URL
• Owner/managing director: Form of address*, surname*, first name*, telephone*, e-mail*
• Shipments: Number of domestic parcels (per year)*, number of international parcels (per year)*, sustainable shipping with DHL GoGreen, interest in merchandise mail (Warenpost), information regarding the sender's property*
• Bank details: Account holder*, IBAN*, BIC*
• Contact person (* if selected): Form of address, surname, first name, telephone, e-mail
• Alternative collection address (* if selected): Company name, legal form, street, house number, postcode, town
• Alternative billing address (* if selected): Company name, legal form, street, house number, postcode, town.

Customer personal data are processed for the purpose of contract initiation, processing and fulfilment as well as for compliance with legal requirements (e.g. Section 257 of the Commercial Code (HGB), Section 147 of the Fiscal Code (AO)). The legal basis for the processing of personal data is Art. 6(1)(b) and (c) GDPR.

For process optimisations (e.g., to simplify registration and verification of the DHL business customer account), the responsible parties have a legitimate interest in processing personal customer data in relation to ensuring a smooth process and the continuous improvement of the respective products and services. The legal basis for this data processing is the legitimate interest described here Art. 6 (1) (f) GDPR.

No data is disclosed to third parties, except for real-time authentication of the bank account by means of the TÜV-certified immediate verification procedure from Sofort GmbH.  

Sofort GmbH will only use the data retrieved as part of the immediate verification procedure to determine the name stored for online banking or to compare the bank details for a real-time comparison with the account holder, IBAN and BIC details provided dhl.de. Sofort GmbH does not store any other personal data from online banking access, and in particular does not store account balances, turnover data, withdrawal limits, account lists or PINs.

For billing purposes vis-à-vis DHL Paket GmbH and to fulfil legal obligations of proof and retention, Sofort GmbH stores the account holder, the IBAN and the BIC, the date as well as the result of the verification, if applicable also the country, customer number, project number and transaction identifier (of the DHL customer) within the legal or contractual periods of retention. These periods of retention range from three to ten years.

Should the process of concluding the contract be interrupted, or the contract terminated due to a timeout, data entered on this page by the customer will be stored by Deutsche Post AG and DHL Paket GmbH for 30 days when the "Continue to your individual shipping costs" button at the bottom of the first page of the form is clicked on. These data are only stored for the purpose of assisting the customer and restoring the data already entered by the customer so that they can easily continue conclusion of the contract at a later date. To this end, the system will send them an e-mail 24 hours after the process of concluding the contract online was aborted containing a link that can be used to continue conclusion of the contract without data having to be re-entered. If the contract process is not completed within one week after the first e-mail has been sent, the customer will receive an additional reminder e-mail. This data processing is carried out in order to safeguard the aforementioned legitimate interests of DHL Paket GmbH and is based on Art. 6(1)(f) GDPR.

If a business customer contract is concluded with DHL, personal data collected via the online customer acquisition process on dhl.de will be archived for a further 10 years after termination of the business relationship in accordance with legal requirements.

If no business customer contract is concluded with DHL despite registration, personal data collected via the online customer acquisition process on dhl.de will be erased after 60 days. If you wish to exercise your right of objection - in particular to the use of your data for advertising purposes - please send an e-mail with the following subject line "Request for erasure from mailing list", stating your company name, to the following address: geschaeftskunde[at]dhl.de.

Payment methods

DHL online franking offered by Deutsche Post AG enables you to buy your own DHL shipping labels for national and international shipping of your Päckchen and Paket items. Personal data of the purchaser of the DHL shipping label and of the sender and recipient of the shipment (e.g. shipping method, type of product, additional services, pick-up address, name and address of the sender and recipient, PostNumber of the sender/recipient, telephone number of the recipient (where applicable), information on the customs declaration (where applicable), email address of the sender and (where applicable) of the recipient, payment method) are processed for the purpose of contract handling and fulfilment as well as compliance with legal requirements (e.g. Section § 99 of the German Code of Criminal Procedure (StPO), Section 65 of the German Postal Act (PostG) Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code(AO)). Depending on which product or service you have booked, the shipment data are forwarded to the companies involved in providing postal services (in this case: DHL Paket GmbH, DHL Express Germany GmbH), in order to be able to ensure the proper delivery of the shipment. The legal basis for the processing of the personal data is Article 6 (1) lit. b) and lit. c) GDPR.

With the exception of the name of the payment services provider used and anonymised IDs which are required to process recall or cancellation requests, Deutsche Post AG does not store any details relating to payment. The legal basis for this is Article 6 (1) lit. b) GDPR, as the processing of the data is required for returning the payment and thus for execution of the contract. The payment services provider alone carries out the entire payment processing operation and it alone utilises the payment data required for this. Various payment methods are offered when a DHL shipping label is purchased.

Credit card

To process payment by credit card, Deutsche Post AG uses the Braintree service of the payment services provider PayPal (Europe) S.á r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. If you pay by credit card, the data required for processing the payment (credit card number, expiry date and verification number) are collected and processed by the payment services provider. The legal basis for the data processing is Article 6 (1) lit. b) GDPR, as the processing of the data is required for the payment and thus for execution of the contract. PayPal's applicable data protection provisions can be viewed in the PayPal data protection information notice.

Giropay

Where the payment method is Giropay, EVO Payments International GmbH, Elsa-Brändström-Straße 10-12, 50668 Cologne, Germany (EVO) is commissioned to process the payment. The data required to process the payment are collected and processed by the payment services provider. The legal basis for the data processing is Article 6 (1) lit. b) GDPR, as the processing of the data is required for the payment and thus for execution of the contract. The applicable data protection provisions for payment via Giropay can be viewed in the data protection information notices of EVO Payments International GmbH.

PayPal

It is also possible to process the payment transaction using the PayPal online payment service. PayPal's European operating company is PayPal (Europe) S.á.r.l. & Cie. S.C.A. 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg. If you select PayPal as the payment method, your data which are required for the payment process will be transmitted to PayPal. By selecting this payment option you consent to the transmission of your personal information as required for payment processing. Generally, the following data are transmitted to PayPal: name, address, company name, email address, telephone number and mobile number, IP address. Those personal data relating to the respective shipping order are also required in order to process the contract. The legal basis for the data processing is Article 6 (1) lit. b) GDPR, as the processing of the data is required for the payment via PayPal and thus for execution of the contract.

The payment process also offers the opportunity for the customer to conclude a billing agreement with PayPal. No personal data are exchanged with Deutsche Post AG in this connection. In certain circumstances, the data transmitted to PayPal are transmitted to credit reference agencies by PayPal. This transmission is for the purpose of checking identity and credit worthiness. PayPal's applicable data protection provisions can be viewed in the PayPal data protection information notice. Deutsche Post AG does not use any payment services provider where the payment method is direct debit. Only the data required to process the payment transaction are processed. The legal basis is Article 6 (1) lit. b) GDPR; contract fulfilment.

Google Pay and Apple Pay

We also offer payment handling via Google or Apple Pay. The data required to process the payment is collected and processed by the payment services provider. Personal data such as name, address, company, e-mail address, telephone and mobile number, IP address is transmitted to Google or Apple Pay as standard in order to carry out the payment process. The data protection provisions of the respective payment provider apply. The data protection provisions of Google Pay can be viewed at: Google Pay Data Protection Provisions, while the applicable regulations for Apple Pay can be found at: Apple Pay Data Protection Provisions.

Pay by Bank

We also offer payment processing by bank transfer through Brite AB, Linnégatan 5, 114 47 Stockholm, Sweden. The data required for payment processing is collected and processed by the payment service provider Brite. For the purpose of processing the payment transaction, personal data such as [name, address, company name, email address] is regularly transmitted to Brite. The legal basis for this data processing is Article 6(1)(b) GDPR, as the processing of the data is necessary for payment processing, account verification and thus for the performance of the contract. The applicable privacy provisions of Brite can be found in Brite’s Privacy Notice.

Processing on the basis of a legitimate interest of Deutsche Post AG

Where applicable, in order to safeguard the legitimate interests of Deutsche Post AG, your data are transmitted to a credit reference agency to carry out an identity and credit worthiness check. This applies in particular if Deutsche Post AG provides a service in advance and bears the economic risk (e.g. in the case of payment by direct debit). The legal basis for data processing within the context of a credit worthiness check by a credit reference agency is Article 6 (1) lit. f) GDPR.

Finally, data are also processed for the additional purposes as listed below:

• within the scope of our security concerns (e.g. to detect criminal offences),
• for the purpose of preparing statistics,
• for purposes of quality assurance, process optimisation and
• planning security

In such cases, Deutsche Post AG has a legitimate interest in order to guarantee a smooth process and to continuously improve its products and services. Deutsche Post AG does not consider that an overriding interest requiring protection exists as the processing operations are carried out with as little interference as possible (e.g. using pseudonyms). The legal basis for this is Article 6 (1) lit. f) GDPR.

DHL Paket GmbH offers the DHL Retoure Selbstzahler service, which the retailer/sender can use to make the process easier for customers/recipients wishing to return an item. DHL Paket GmbH will send an e-mail to the recipient on the sender's behalf, containing a link to a shipping label with the relevant data already entered. The sender guarantees that it is entitled on a legal basis (e.g., by consent) to provide DHL Paket GmbH with the e-mail address and any other contact data for this purpose. In addition, the sender will be informed that the recipient has purchased the shipping label for return shipping. DHL Paket GmbH processes this data on the grounds of its legitimate interests in the performance of the contract concluded with the sender; Article 6 (1) (f) GDPR. The recipient can object to such processing by applying to the sender.

Packstation expert panel supplementary data protection notice

With this data protection notice, we want to inform you about data processing in connection with participation in the user panel for private customers of Deutsche Post and DHL. For general information about the processing of personal data, responsible parties, contacts, and especially exercising your rights as a data subject, go to www.deutschepost.de/datenschutz and www.dhl.de/en/dataprotection. 

Purpose of data processing

As part of the Packstation expert panel's activities, we will occasionally invite you to participate in studies and surveys relating to the DHL Packstation and its functionality and interfaces, and to DHL Group portals and websites for private customers. The data we collect is used to obtain a better impression of you and your needs and to make relevant improvements. 

Among other things, we process your data to:

• Make the operation of DHL Packstations as pleasant as possible
• Develop new functionality oriented to user needs
• Compile statistics
• Provide you (if permitted) with customized ads inviting your participation in studies and surveys
• Perform quality assurance, process optimization and planning certainty measures

We will store your contact information until further notice. We will store data from studies and surveys for no more than 2 years.

Legal basis

The legal basis for this processing of your data is your consent within the meaning of Article 6 (1) (f) of the General Data Protection Regulation (GDPR). You can withdraw this consent here at any time without giving reasons. 

Cookies set when surveys.dpdhl.com is accessed

Transfer of your data

Your data will not be transferred, nor will it be passed on to an EU third country.

The DHL Paketkasten, placed directly in front of your door, means you can receive parcels at home at any time. To ensure convenient and secure receipt, the DHL delivery agent then places your shipments in the parcel box or collects returns and pre-franked parcels. When purchasing and using the parcel box, your personal data (e.g. first and last name, contact data, contract information, billing information, postal number, DHL Paketkasten ID) are processed for the purpose of fulfilling the contract on the basis of Art. 6(1)(b) GDPR. Furthermore, data processing is carried out in order to meet legal obligations in accordance with Art. 6(1)(c) GDPR in connection with contract performance.

A DHL Paket GmbH parcel notification informs you free of charge about the expected delivery date of the parcels you have ordered to your home address. Furthermore we inform you in case of a delay in delivery or if we did not meet you upon the delivery.

DHL Paket GmbH requires your e-mail address in order to be able to notify you by e-mail.

Parcel notification is a part of DHL Paket services that are activated as an integral element of the contract when you register with DHL Paket. The processing of the e-mail address for the purpose of parcel notification is carried out for the performance of a contract on the basis of Art. 6(1)(b) GDPR.

If you are not a registered DHL customer, DHL Paket GmbH will receive your e-mail address from the sender of the shipment if they wish to use DHL Paket GmbH's parcel notification service. The legal basis for the sender to pass on the e-mail address to DHL Paket GmbH is usually your consent to the sender in accordance with Article 6 (1) (a) GDPR. DHL Paket GmbH subsequently processes the e-mail address for the sole purpose of sending you the parcel notification. The legal basis for this is Art. 6(1)(b) GDPR.

Every parcel notification includes an opt-out for future parcel notifications.

DHL Paket GmbH uses tracking software that can analyse the opening rate of and clicks on e-mails.  The data generated upon delivery and retrieval of e-mails is used exclusively in an anonymised and condensed form for statistical purposes and for the further development of the website on the basis of Article 6 (1) lit. f) GDPR (legitimate interest).

Loading Technical Content in Emails

To ensure proper display and functionality of parcel notification emails, certain technical elements (e.g., images, animations, formatting files, or fonts) are automatically loaded when the email is opened. For this purpose, DHL Paket GmbH uses a Content Delivery Network (CDN) provided by a technical service partner.

When these elements are retrieved, it is technically necessary for the IP address of your device to be transmitted to the CDN service in order to deliver the content securely and reliably. The IP address is processed solely for this technical operation and is not stored or used for any other purpose. Processing takes place only transiently within the CDN system components (e.g., for routing network traffic).

To maintain stable system operations, the service provider generates technical log files. No IP addresses are stored; instead, they are fully anonymized by inserting a placeholder in the log files. It is not possible to reconstruct the original IP address. No further analysis or profiling is carried out.

Processing is based on Art. 6(1)(f) GDPR to ensure the secure, efficient, and reliable delivery of email content.

Satisfaction surveys

DHL Paket GmbH, DHL Hub Leipzig GmbH and Deutsche Post AG regularly conduct satisfaction surveys for various areas and use this customer feedback as a basis to continuously improve their products and services. They welcome your participation, which allows you to inform them what they are already doing well and where you would like to see improvements. Your participation in a satisfaction survey is voluntary and is based on your consent; the legal basis is Article 6 (1), first sentence, lit. a) GDPR.

You can ascertain whether or not a satisfaction survey is anonymous either from the e-mail invitation or from information provided in the questionnaire itself. If a satisfaction survey is not anonymous, your responses can be linked to your contact data. We can thus react directly to your responses and contact you if necessary. In such cases, your personal data is used only in order to communicate with you and is handled in compliance with data protection requirements. If surveys are anonymous, your responses are not linked to your contact data. This means we cannot react to your responses or contact you.

Your consent to participation in the satisfaction survey also includes us being allowed to use your responses for advertising purposes. However, unless separately agreed, the use of your responses for advertising purposes is always on an anonymised basis, i.e., without any reference to you as a natural or legal person, or to your company if you are a business customer of ours.

DHL Paket GmbH or DHL Express Germany GmbH will inform you of the expected collection time window when you receive the collection notification.

An e-mail address or telephone number is required to send you the collection notification. If you use an e-mail address or telephone number of a third party for the collection notification to whom the consignment collection is to be announced, please ensure that this person agrees to the disclosure.

The processing of the e-mail address or telephone number for the purpose of collection notification takes place exclusively for the purpose of being able to deliver the collection notification. The legal basis for this is Article 6 (1) lit. b GDPR.

The provisions of Section 68 of the Postal Act (PostG) permit the processing of personal data in order to guarantee a functioning postal system and are thus in a special public interest pursuant to Article 6 (1) lit. e) GDPR. This also includes the authority pursuant to Section 68 (3) first sentence of the Postal Act (PostG) which permits the processing of personal data of alternate recipients (neighbours or other third parties) where this is necessary for the proper delivery of postal items. This includes, for example, name, address, capacity as neighbour or other third party.

Processing primarily serves the following purposes: documenting delivery, (potentially) providing evidence vis-à-vis the parties involved (sender, recipient, alternate recipient), and informing the actual recipient that his shipment has been delivered, so that he knows from whom he can collect his parcel.

The period for which data are stored is based on the time limits for exclusion of liability and on the statutory retention periods pursuant to Section 439 (1) of the German Commercial Code (HGB) and pursuant to Section 257 (1) Nos. 1 and 4 of the German Commercial Code (HGB). Data retention period: 

• Parcels: 3 years
• Letters and parcels with payment transactions: 10 years

The storage of personal data in connection with the provision of postal services is necessary for the provision of the service and is also permitted pursuant to the Postal Act (PostG) and in particular Section 68 et seqq. of the Postal Act (PostG). The data are stored solely in order to prove proper handover and can only be called up via the individual shipment number, the "Identcode", and only in connection with a specific shipment.

If the recipient specifies you as alternate recipient, the recipient must obtain your consent for this pursuant to Article 6 (1) lit. a) GDPR. Your personal data will then be used solely in order to provide the service "delivery to neighbour".

In principle, the legal basis for the processing of recipient data is Article 6 (1) lit. e) GDPR. The provisions of Section 68 PostG permit the processing of personal data in order to guarantee a functioning postal system and are thus in a special public interest pursuant to Article 6 (1) lit. e) GDPR. This also includes the authority pursuant to Section 68 (3) first sentence of PostG, which permits the processing of recipients’ personal data where this is necessary for the proper delivery of postal items. This includes, for example, the name, address, shipment data, whether the recipient was available to accept the delivery or if the shipment was delivered to an alternate recipient, a picture of the shipment at the drop-off location, plus the GPS coordinates at the time of delivery. In this context, the processing of the personal data primarily serves two purposes: documenting delivery and (potentially) providing evidence of proper delivery vis-à-vis the parties involved (sender, recipient).

Depending on the relevant legal regulations, the recipient's name and address are in some instances transferred to the authorities of the country of transit or destination for the purposes of customs clearance and payment of taxes, or for security screening.

For shipments with the delivery variant "closest droppoint" (e.g. delivery to a parcel shop in the country of destination), the legal basis is Article 6 (1) lit. e) GDPR in conjunction with Section 68 (3) first sentence of the Postal Act (PostG) as informing the recipient of the fact that a shipment can be collected and from where it can be collected is necessary for the proper delivery of postal items and thus in order to guarantee a functioning postal system.

The period for which data are stored is based on the time limits for exclusion of liability and on the statutory retention periods pursuant to Section 439 (1) of the German Commercial Code (HGB) and pursuant to Section 257 (1) Nos. 1 and 4 of the German Commercial Code (HGB). Data retention period:

• Parcels: 3 years
• Customs documents: 6 years
• Parcels with payment transactions: 10 years

The storage of personal data in connection with the provision of postal services is necessary for the provision of the service and is also permitted pursuant to the Postal Act (PostG) and in particular Section 41 et seqq. of the Postal Act (PostG). The handover data are stored solely in order to prove proper handover to Deutsche Post AG.

For information on the processing of your recipient data as registered recipient, please refer to Customer Account and Recipient Services.

Within the context of the respective services - especially transport and logistics services - provided by DHL Paket GmbH, Deutsche Post AG or DHL Express Germany GmbH, personal data are processed on the basis of contracts concluded with the senders. These data include, for example, name, address, email address, telephone number, shipment information, bank data. These data are, for example, used to execute a (transport) contract, to administer customer data, to process payments and, where applicable, to carry out credit checks. Depending on the relevant legal regulations, certain sender data are transferred to the authorities of the country of transit or destination for the purposes of customs clearance and payment of taxes, or for security screening. Such data generally include the sender's name and address, a description of the goods, the number of items, weight and value of the shipment. In the course of delivery the sender data will additionally be disclosed to the recipient and/or where applicable also to the alternate recipient.

In principle, the legal basis for the processing of sender data is Article 6 (1) lit. b) GDPR as the data are processed for the performance of the contract and to provide evidence of correct provision of the service.

The period for which data are stored is based on the time limits for exclusion of liability and on the statutory retention periods pursuant to Section 439 (1) of the German Commercial Code (HGB) and pursuant to Section 257 (1) Nos. 1 and 4 of the German Commercial Code (HGB). Data retention period: 

• Parcels: 3 years
• Customs documents: 6 years
• Letters and parcels with payment transactions: 10 years

The storage of personal data in connection with the provision of postal services is necessary for the provision of the service and is also permitted pursuant to the Postal Act (PostG) and in particular Section 67 et seqq. of the Postal Act (PostG). The handover data are stored solely in order to prove proper handover to Deutsche Post AG and can only be called up via the individual shipment number, the "Identcode", and only in connection with a specific shipment. 

DHL Express Germany GmbH processes your email and/or telephone number situationally for communication via email, SMS, or WhatsApp regarding the delivery of your express shipments (e.g., shipment status, delivery time, delivery delay, unclear address data). We receive your contact details from the sender. If it is a Packstation delivery and you are a registered Packstation customer, we receive the data from DHL Paket GmbH. The legal basis for the transfer and communication with you is the legitimate interest (Art. 6 para. 1 lit. f GDPR) to deliver the express shipment at the first delivery attempt as efficiently as possible. You can object to the contact entirely or regarding a specific channel at any time. For example, the messages will include an option to object, or you can express your objection during the phone call or inform DHL's data protection team. The contact options can be found above. If you are a registered DHL Express customer, you can also select your contact preferences (email, SMS, WhatsApp) in your customer account.

A sanctions list check involves the screening of persons with whom it is illegal to do business ("Denied Parties"). Such Denied Parties are natural or legal persons who have been listed by regulatory authorities as being blocked from import or export transactions. Shipments to or from such persons can be held back for further scrutiny by DHL HUB Leipzig GmbH on behalf of DHL Express Germany GmbH until it has been verified that onward transport of the shipment is not prohibited. To facilitate the quick release of the shipment, you will usually be requested to submit a copy of your identity card (or alternatively your residence permit) or passport. The following data categories are required: type of document, document number, full first name, any name affixes, full surname, date of birth, place of birth. You can make any other data illegible.

The legal basis for processing is the fulfillment of a legal obligation in accordance with Art. 6 para. 1 lit. c GDPR in conjunction with the EU regulations (EC) No. 2580/2001, (EC) No. 881/2002, and (EU) No. 753/2011, as well as additional lists such as those from the UN and the US OFAC. Depending on the circumstances, local, country-specific lists may also be added. Furthermore, DHL must ensure compliance with all applicable laws and regulations along its entire service and shipping chain within its international and highly dynamic network.

Generally, customers receive an automated text message or email containing a link that takes them to the "MyDHL - Perfect Your Shipment" portal, where they can upload their documents securely and in compliance with data protection requirements. The document data collected will be deleted after a maximum of 5 days. If you are concerned about the electronic transmission of sensitive identity-card or passport data, DHL can offer you "end-to-end" encryption. You can access DHL's own key server at keyserver.dhl.com and download a public encryption key. You can then use this key to encrypt your email containing the copy of your identity card/passport in compliance with data protection requirements.

Some information is required to process your request (e.g. shipment number or drop-off date). Processing of these data is necessary and is carried out to enable the performance of a contract pursuant to Art. 6 (1) sentence 1 lit. b) GDPR. We also ask you to provide other pertinent data on a voluntary basis, as these may facilitate faster processing (e.g. IBAN or email address). The legal basis for processing such data is your consent pursuant to Article 6 (1) sentence 1 lit. a) GDPR. The mandatory fields for required information are indicated accordingly [*mandatory field].

You can use shipment tracking service to track shipments addressed to you or sent by you, and also view the expected time of delivery. For tracking, simply enter your shipment number and the current status of your shipment will be displayed. You will also receive all important detailed information about your shipment. In addition, the sender or recipient can also receive further information about the shipment in question by e-mail or SMS. For this purpose, the e-mail address or mobile phone number of the recipient of the notification can be stored and the notification activated. In this context, the person entering the data must ensure that the notification recipient agrees to the processing of e-mail address, mobile phone number and notification.

The following data are processed as part of shipment tracking: shipment number, name and address of the sender, name and address of the recipient, e-mail address of the sender/recipient if applicable, name and address of the alternative recipient if applicable, customer data of the sender, product or service name, shipment history, signature of the recipient, confirmation that a minimum age has been checked (over 16/over 18).

The data are processed for the purpose of fulfilling the contract on the basis of Art. 6(1)(b) GDPR.

In selected cases, you will be offered live tracking for your parcel in DHL shipment tracking. As part of live tracking, you can follow the route of your parcel live on a map on the day of delivery. The legal basis is Article 6 (1) lit. b) GDPR because such processing is carried out to enable the performance of a contract.

It is also possible to track national express shipments from DHL Express Germany GmbH via the shipment tracking function on this page. The legal basis is Art. 6 (1)(b) GDPR, as this processing is carried out in order to fulfil the contract.

Video surveillance at DHL Express Germany GmbH locations is carried out to exercise domestic rights and to prevent vandalism and theft. It is also used to protect employees, the property of DHL Express Germany GmbH, its customers, suppliers and service partners, and to protect postal confidentiality. The legal basis for this is the legitimate interest pursuant to Article 6 (1) lit. f GDPR. At airports, video surveillance is also carried out to satisfy legal requirements set out in aviation safety regulations; the legal basis for this is Art. 6 (1) lit. c GDPR. The image data may be passed on to investigating authorities. Data is not processed in a third country, i.e. outside the European Economic Area (EEA). The storage period is 30 days in accordance with the requirements of the Transported Asset Protection Association (TAPA).

A web session is comparable to a face-to-face seminar but takes place via the Internet and is computer/software-based. Our format is aimed at (potential) business customers and deals with letter and/or parcel shipments or related topics. The web sessions primarily serve to present services or products from Deutsche Post and DHL or to provide support for their use.

To enable smooth participation in the format, contact may be made, both before and after the session, with the email used for the registration process (e.g. in the form of a registration confirmation, the sending of an access link or the provision of the presentation shared during the web session).

You can participate in a web session if you have registered for it in advance. The following data is requested for this: first name, surname, email address.

Processing of this data is necessary to enable you to use the web session and is based on your login (consent pursuant to Article 6 (1) (1) lit. a GDPR). You can revoke your consent at any time, with effect for the future. This will not affect the lawfulness of the processing up to this point in time. You can send the revocation informally by post to: Deutsche Post AG, Attn.: Dept. 123F, Sträßchensweg 10, 53113 Bonn.

In order to be able to conduct web sessions via the Internet we use the software solution from WebinarGeek B.V. WebinarGeek's data protection policy can be found here. For the order-related execution of the web session, we transmit your registration and/or customer data to WebinarGeek B.V.

Statistical data is transmitted to Deutsche Post AG during and after the web session. If you participate in a web session, ask or answer a question during a web session, we receive the following in addition to your registration data: information on (the duration of) participation, the question asked and/or answer given, for the purpose of further customer support or enhancement of the user experience. Users who express a wish to receive personal advice during or after a web session will additionally be contacted by their sales contact person. The following data is requested in advance for this: company name, customer number (optional), street, building number, postcode, city and telephone number.

An encrypted connection is established between you and the web-session organiser. No image of or sound from you will be transmitted or recorded during the web session. By clicking "Join", you confirm that you will also not make any recording or capture any screenshots of this session.

You can end the session at any time by simply closing the browser window or exiting the program or app. If your contact person ends the session, your participation in the session will also end automatically. The web session provider (WebinarGeek B.V.) and Deutsche Post AG will store your registration data (first name, surname, email address) and information on your usage behaviour during the web session (e.g.: duration of participation, answers to brief surveys). The data will be anonymised after one year at the latest, so that identification is no longer possible.

The web session provider (WebinarGeek B.V.) and Deutsche Post AG will store your registration data (first name, surname, email address) and information on your usage behaviour during the web session (e.g.: duration of participation, answers to brief surveys). The data will be anonymised after one year at the latest, so that identification is no longer possible.