PostNL Privacy Statement

PostNL Pakketten Belgium is the controller for all processing of personal data within the scope of this privacy statement.

In this privacy statement you will only find information about the processing of your personal data. If you have any questions or complaints about our services or products, please contact our customer service at customerservice@postnl.be.

Personal data is data that tells us something about you, or that we can associate with you. Obvious personal data include your name, address, e-mail address and telephone number. However, data that, in association with other data, says something about a natural person is also personal data. The protection of personal data applies only to the personal data of living natural persons. Data relating to a company is not personal data.

You share your personal data with us when you are a customer of our company, when you contact our offices, when you use one or more PostNL Pakketten services or when you visit our website or use our app. In other words, we collect and process personal data from anyone who has direct or indirect contact with our offices. PostNL Pakketten Belgium's services and products are not directed at minors. If you discover that we have inadvertently processed the personal data of minors, please notify us immediately via our customer service department so that we can immediately remove that personal data from our files and servers and make any other necessary corrections.

We process your personal data for specific purposes and always on a lawful base. This is described in more detail below. By processing, we mean everything we do with your personal data. For example, storage, consulting, analysing, altering, deleting, forwarding, etc.

Below, you can read about the lawful grounds on which and for what purposes PostNL Pakketten Belgium processes your personal data.

The contract you have concluded with PostNL Pakketten Belgium

You have signed an agreement with PostNL Pakketten Belgium for services we provide, such as delivering consumer goods to recipients. To execute this agreement, PostNL Pakketten Belgium may need to process certain personal data. This applies to the purposes and processing below.

To deliver parcels (including all inclusive services)

In order to provide and perform our services properly, we may process your personal data to send parcels and to inform you and the customer about the status of the delivery. We process personal data of both the sender of the parcel and its recipient. We do this according to the contract you enter into with us for sending parcels. We will process personal data such as:

• Name and address, company name, business address, correspondence address, name of contact person(s)
• E-mail addresses, fax number
• Telephone and/or mobile phone numbers
• VAT number, customer number
• Bank account number
• Track & Trace number
• Document number of the parcel
• Sometimes the document number of the ID document (= barcode and never National Register number)
• Signature

We do not store this personal data longer than necessary and for a maximum of one year after the service has been provided.

The legitimate interest of PostNL Pakketten Belgium

For some processing of personal data, PostNL Pakketten Belgium has what is known as a ‘legitimate interest’. PostNL Pakketten Belgium's interest in providing the logistics service is important in these cases. This legitimate interest can only be achieved if your personal data is processed. This applies to the following purposes and processing operations.

To improve and optimise our services

To improve our services and products, we may process your personal data. We do this by analysing and combining logistical data and other information. For analyses, we work as much as possible with anonymised data. We cannot link this data to individual data subjects. This allows us, for example, to improve the pages on our website, resolve complaints, create reports, improve our logistics processes and develop new products and services.

In addition, we may also contact you to ask your opinion about our services and products. This way, we can improve our services and products. We may approach you to take part in a customer satisfaction survey. We do this in various ways. For instance, we might sometimes send you an e-mail to ask how satisfied you are with our service. We may engage another party in this process.

To improve our services, we may process the following personal data:

• Name and address
• Shipment number
• E-mail address
• Telephone and/or mobile phone numbers

We do not store this personal data longer than necessary and for a maximum of one year after the service has been provided.

To keep in touch with you

To keep in touch with you, we will process your personal data. For example, when you contact us at customer service. We use this data to deal with your question or complaint so that we can help you faster. We will process personal data that you provide to us, such as:

• Name and address
• Your question or complaint
• Telephone and/or mobile phone numbers
• Tracking number of your question or complaint, as known by our customer service
• E-mail address
• Account name
• Messages and/or e-mails you have sent us

A telephone conversation with our customer service may be recorded for training and analysis purposes. We use this recording of the call to improve our customer service and services. You will be informed in advance when the phone call will be recorded. A recorded telephone conversation will be stored for a maximum of 60 days.

We do not store this personal data longer than necessary and for a maximum of one year after the service has been provided.

To enable us to provide you with the functionalities of our website and app

To offer you the functionalities of our website and the app, we will process your personal data. We do this to make the website and app work technically and to provide you with functionalities and improve them. To do this, we will process personal data such as:

• E-mail address
• Name and address
• IP address
• Data about your visit to a website or app (when/what you search/log)
• Your cookie settings
• Information we collect using cookies

We do not store this personal data longer than necessary and for a maximum of one year after the service has been provided.

To prevent abuse and fraud

We process your personal data to prevent and combat abuse and fraud in the (logistics) processes of PostNL Pakketten Belgium. We do this using your personal data that we already have. We analyse, investigate and take measures when necessary. In doing so, we process all personal data that may be necessary for this purpose.

We do not store this personal data longer than necessary and for a maximum of one year after the service has been provided.

To carry out internal business processes

To carry out internal business processes, we also process your personal data. We process that data to ensure the successful functioning of our internal business operations. For example, billing, general management and asset management. We also process your personal data for finance and accounting, archiving and insurance, legal and business advice and dispute resolution. We will process personal data such as:

• Name and address
• E-mail address
• Telephone and/or mobile phone numbers
• Business/corporate information
• Other information that may be relevant in a legal dispute

We store this personal data no longer than strictly necessary and for a maximum of one year after the service has been provided, unless laws and regulations require us to comply with a longer retention period.

For customer relationship management and marketing

For relationship management and marketing purposes, we will process your personal data. We use data to send you suitable offers and newsletters if you are already a customer of PostNL Pakketten Belgium. We will also use your personal data to develop, carry out and analyse market research and marketing strategies. We will process personal data such as:

• Name and address
• Number of parcels shipped
• E-mail address
• Delivery preferences
• IP address

We do not store this personal data longer than necessary and for a maximum of one year after the service has been provided.

The statutory duty imposed on PostNL Parcels Belgium

Sometimes PostNL Pakketten Belgium has a legal obligation to comply with. To comply with this obligation, we have to process personal data. This is the case for the purposes and processing below.

To deliver parcels

To perform our services properly, we will process your personal data. To deliver parcels, we may be legally obliged to identify the recipient so that we can prove to the sender that the parcel was delivered to the correct customer and that the check has taken place. Depending on the service purchased by the sender and the situation, we will process the following personal data:

• Name and address
• Signature
• Photos of the delivery

We do not store this personal data longer than necessary and for a maximum of one year after the service has been provided.

To comply with the law

Sometimes we have to process personal data to comply with the law. For example, the customer records we need to keep or when tax-related or business-related obligations need to be fulfilled. To comply with relevant laws and regulations, we may have to disclose your personal data to government agencies or supervisory authorities. This may happen ad hoc. Before sharing this data, we check the authority of these authorities. We will process the following personal data:

• Name and address
• Shipment number

We do not store this personal data for longer than necessary and in accordance with the time limits imposed by law. If there no such provision in place, this period is a maximum of one year after the service has been provided.

We exchange data for internal business processes, to improve our services, carry out analyses and offer you all our services. The employees of PostNL Pakketten Belgium only have access to the personal data necessary for their tasks (Need-to-know principle).

Occasionally, it will be necessary to share your personal data with other parties. The main reasons are:

• It is required by law. For example, data from our financial (customer) records that we have to disclose to the tax authorities. Sometimes we are also obliged to disclose data to supervisory authorities, the police or other investigatory services. Before we do so, we always check whether they are authorised to ask for this information.
• Another company is more skilled at carrying out a task, for example when we ask a consultancy company to conduct a customer satisfaction survey. In that case, we always make arrangements in a processing agreement about how this business partner is required to handle your personal data.

PostNL Pakketten Belgium only shares your personal data with other partners if this is necessary for the purposes described above. We only share your personal data with partners that perform work on our instructions and on our behalf (called processors) and certain other stakeholders.

Processors

We contract other partners to perform certain services on our behalf. These third parties are called processors and they process personal data on our behalf according to the instructions we give them. The following partners are processors for PostNL Pakketten Belgium:

• IT service providers
• Research agencies
• Business partners in HR, legal and financial matters and GDPR
• Transport and logistics subcontractors

When these third parties are engaged by us, they work on our behalf, and they do not process your personal data for their own purposes. We make arrangements about this in processing agreements. In addition, we assess in advance whether these partners secure your personal data adequately and handle it with care.

Other stakeholders

In addition to processors, there are also parties with which we might share your personal data, but only when this is permitted or required by law. For example, your personal data may be provided to authorities, such as police, supervisors or (other) governmental agencies. We only do this when necessary to comply with a law. Your personal data may be shared with the following other stakeholders:

• Authorities and other government agencies to comply with a legal duty
• Insurance companies
• Attorneys (in the event of a legal dispute)

We store your personal data for the period we need to fulfil the purpose for which we collected it or in accordance with legally imposed retention periods. We have described this for each purpose above. The length of retention depends on a number of factors, such as:

• The purpose for which we use the data
• Any legal duty to store the data
• Striking a balance between your privacy interests and our legitimate business interests.

Personal data is deleted or anonymised when it is no longer needed for the purposes for which it is processed or when the legally imposed storage period has expired.

We make every effort to secure your personal data to the best of our ability. For instance, we spend a lot of time and money on securing our internal systems processing personal data. We also have our security checked regularly by external experts and have our own (cyber) security department that monitors the digital security of our data.

Furthermore, only those employees who need your personal data to perform their tasks are allowed to see your personal data (Need-to-know principle).

We also require our suppliers and processors to handle your personal data as carefully and securely as we do, and they need to have necessary security certificates.

In addition, both our own external Data Protection Officer (DPO) and the Belgian regulator, the Data Protection Authority (GBA), monitor how we process your personal data and whether we comply with the current privacy legislation (GDPR).

PostNL Pakketten Belgium processes your personal data only within the European Economic Area (EEA). If on an exceptional basis we process your personal data outside the EEA, we ensure that it is as well protected as within the EEA. We do this by:

• The standard data protection clauses adopted by the EU Commission, or
• By transferring personal data only to organisations in countries that the European Commission has indicated as having adequate personal data protection.

If on an exceptional basis personal data is transferred to a company in a country outside the EEA, we will take measures to ensure that personal data is adequately protected.

You have the right to know what personal data we collect, store and process about you. Below we explain your privacy rights, whether there are exceptions to these rights and how you can exercise them. We will always provide you with an answer within the legal deadlines.

Right of access

You have the right to access your personal data we process. This means that you can request information concerning the personal data we process about you. The purpose of this right is to give you the opportunity to check whether your personal data is correct and complete. If necessary, you can modify this personal data (or have it corrected). We provide you with this personal data if there is no legal exemption.

You can submit a request like this:

• Do you have a PostNL account? Then you may already access some of your personal data. You can modify much of that data in your PostNL account.
• You can't or don't want to manage it on your PostNL account? Submit your request to the Privacy Office of PostNL Pakketten Belgium at privacy.be@postnl.be.
• You prefer to do it by post? Then send your request to: PostNL Pakketten Belgium Privacy Office - DPO Bremheidelaan 10 2300 Turnhout

Please note that if you request access to your personal data (or you wish to exercise any other right), we are obliged to check your identity in order to ensure that we are providing the personal data to the right data subject. We therefore ask you to provide our Privacy Office a front/back copy of your identity card. This copy will be destroyed immediately after verification.

Right to rectification

You have the right to rectify your personal data we process if it is incorrect or incomplete. You can do this in the same way and under the same conditions (checking your identity) as described above.

Right to erasure (right to be forgotten)

You have the right to have your personal data erased. Please note that PostNL Pakketten Belgium will not always be able to comply with this request, for example if there is a legal obligation to store the data for a certain period of time or if it is still needed to fulfil the purpose. For example, for delivering a parcel. If you submit a request within this delivery period, it is clear that we cannot delete your personal data yet. The right to have your personal data erased applies if:

• We no longer need it for the initial purpose;
• You revoke your consent to its processing;
• You object to our use of your personal data for our own legitimate interests;
• We process your personal data illegitimately;
• Applicable laws or regulations require us to delete your personal data.

You can do this in the same way and under the same conditions (checking your identity) as described above.

Right to restriction of processing

You have the right to restrict the processing of your personal data in the cases below:

• You believe your personal data is incorrect;
• We process your personal data illegitimately;
• You would like us to store your data in order to use it in legal proceedings;
• You have objected to our use of your personal data for our own legitimate interests.

You can do this in the same way and under the same conditions (checking your identity) as described above.

Right to object

You have the right to object to the processing of your personal data by PostNL Pakketten Belgium. This is only possible under certain private circumstances. You can do this in the same way and under the same conditions (verification of your identity) as described above.

Right to data portability

You have the right to receive your personal data processed by us in a way that enables you to easily give it to another party. This is only possible when you have provided us the personal data yourself, and when we process it automatically on the basis of the agreement you have entered into with us.

You can do this in the same way and under the same conditions (verification of your identity) as described above.

This privacy statement is subject to change at any time. The most recent update is dated on 24 July 2024.

The Data Protection Authority (GBA) supervises how we process your personal data and how we respect the applicable privacy legislation (GDPR). In addition, our own Data Protection Officer (DPO) checks if we handle your personal data properly and if we respect all the principles of the GDPR.

If after reading this privacy statement you still have questions about the way we process your personal data, please feel free to contact our Privacy Office - DPO in writing at privacy.be@postnl.be.

If you have any questions or complaints about our services or products or shipments, please contact our Customer Service at klantenservice@postnl.be.

If you are not satisfied with our answers to your privacy questions or if you believe that your privacy rights have been breached, you may address a complaint to the Data Protection Authority, Drukpersstraat 35, 1000 Brussels, +32 (0)2 274 48 00, contact@apd-gba.be.