The protection of your personal data is very important for us. Providing postal services, we are obliged to keep postal secret, which includes, among others, information provided in postal consignments, data concerning entities using postal services and data related to the fact and the circumstances of rendering postal services  or using these services. In addition, information or data covered by postal secret can be collected, recorded, stored, developed, altered, removed or made available only when these activities are concerned with the postal service being provided or are necessary to perform it or if separate regulations state otherwise. 

In many cases postal secret also covers your personal data as defined by the commonly binding legal regulations. This document is to reasonably provide you necessary information concerning how we process your personal data and what are your rights in connection with our processing of your personal data. 

Who is the controller of your personal data? 

The Controller of your data is, depending on the type of the service performed, the respective company having capital links with Integer.pl S.A. (the list of these entities is available at the address: https://integer. pl/grupa-kapitalowa - hereinafter these entities will be collectively referred to as "InPost") or the external entity which has provided data to InPost for the purpose and in the scope of performance of the service and in particular: 

• If you are a natural person sending your package as part of the postal or transit services provided through InPost pack machines (Paczkomaty) - the controller of your data is InPost Paczkomaty sp. z o.o, based at ul. Wielicka 28, 30-552 Kraków. 
• If you are a natural person sending your package as part of the courier services provided by InPost - the controller of your data is InPost Ekspress sp. z o.o, based at ul. Wielicka 28, 30-552 Kraków.
• When you order an external entity to perform a service on a shipment which should be sent through InPost Express Sp. z o.o. courier network or pack machines network of InPost Paczkomaty sp. z o.o.(e.g. if you order goods in an online store, indicating your personal details for delivery) - the controller of your personal data is this external entity (e.g. online store) which has ordered InPost to perform the service on such shipment as the sender. 

Always when you express your consent to processing your personal data, you will be informed before expressing this consents which company from among InPost companies is the controller of your personal data. 

Which personal data do we process? 

Under the services provided by InPost, we process the following personal data: 

• first and last name of the sender (including the payer) and the recipient (addressee) of the shipment, 
• address of the shipment sender (street, house number, apartment no., postal code, place), 
• address of the shipment recipient (street, house number, apartment no., postal code, place),
• new address for shipment delivery, if, after sending the shipment, the sender reports a request to InPost to deliver it to a new address, or InPost determines a different delivery address with the shipment recipient before shipment delivery (the new address contains the data as the street, house number, apartment number, postal code  and town/city), 
• shipment sender's and recipient's e-mail address, which is processed for the purpose of sending the information regarding service delivery, in particular the information about the current shipment delivery status, or information allowing receipt of the shipment from a Paczkomat machine, 
• sender's and recipient's telephone number for the purpose of direct contact or sending information regarding service delivery, in particular contact in order to determine a different place for shipment delivery, or information allowing receipt of the shipment from a Paczkomat machine, 
• depending on the chosen service delivery path, we can also process the bank account number as necessary to transfer the collected cash (as part of the collection service, the so-called cash on delivery) to a third person indicated by the sender and any information making it possible to identify the circumstances of making payment of collected monies or account top-ups under prepaid payment for our services, 
• IP address of the persons who use our systems for ordering the services that we provide.

We process the above data for the purpose and to the extent necessary to perform the services rendered by InPost and to discharge InPost's legal obligations, including examination of any submitted complaints for these services. 

In addition, as part of transferring any marketing information to you or processing your other requests, e.g. requests for quotation (with your prior consent), we can process your personal data you have given us when expressing the above consent. 

Your provision of personal data is voluntary, but necessary to perform InPost's services or examine and possibly process any requests you're forwarding to us. The requirement to provide these data is a contractual requirement, while for the data provided as part of the complaints submitted to us for non-performance or improper performance of postal and carriage services, it is also a statutory requirement (specified in the executive provisions to the act  Postal Law and Carriage Law). 

In addition, in connection with the fact that – for safety and protection of you and your shipments, in particular against theft and any acts of vandalism – we apply CCTV video surveillance for InPost pack machines (Paczkomaty), under which it is possible that your image can be recorded, and thus we also process  these personal data. Such processing of your data is therefore necessary not only to protect our legally justified interests, but also to protect your interests and, when such footage records a crime being committed, this processing is also necessary to fulfill the obligation  binding upon us, resulting in particular from Article 81 of the act Postal Law (Journal of Laws 2017.1481 as amended) and Article 304 of the Code of Criminal Procedure (Journal of Laws 2017.1481 as amended). We store the records in a manner ensuring their safe processing (we are writing how we protect your personal data below in chapter "How do we process your personal data?") and for the period of up to one month from the day of recording. 

How do we receive your personal data? 

We receive your personal data directly from you, or from the sender (including the payer) of the shipment which they have sent by ordering InPost to perform the service on such shipment. These data can therefore be received by InPost in the following circumstances: 

• when you have given us your package for us to deliver it to the person you indicate or to the indicated place, 
• when our customers (e.g. online stores) have given us your data in order to deliver shipments to you, 
• when you report a complaint to us or a complaint for non-performance or improper performance of the services that we provide, or when your data are provided by a person authorized to submit such complaint, for example our customer who have sent a shipment to you,  and then submitted a complaint to InPost for non-performance or improper performance of the service concerning this shipment, 
• when you are making another inquiry to us concerning the services provided by InPost or InPost's operations, 
• if you give your data to InPost in order to receive InPost's commercial offer, 
• if you give your data to InPost in order to create an account in InPost's IT system, allowing generation of orders for services that we offer, 
• if you give your data – only with your consent – to process them for the needs of marketing products and services of InPost and the entities cooperating with InPost that will be realized by InPost or independently by these entities.

For what purpose do we process your personal data?

The purpose of processing your personal data is specified in particular in the respective InPost agreement or Terms and Conditions on the basis of which we provide the services to you or have access to your personal data, or directly when you express your consent to processing your personal data. Such purpose can be: 

• performance of postal services or carriage services for you as well as any accompanying services, including delivery of the shipment which you have sent, or delivery of a shipment to you, 
• our need to discharge tax, legal and settlement obligations,
• transferring you marketing information and materials or for transferring our offer to you (it is optional and requires your consent to receiving such type of information).
• analysis, including customization, only for the needs of optimization of the processes at our provision of the services and improvement of our services.

How long do we store your personal data?

We store your personal data no longer than necessary. In particular, we store these data for the time necessary to correctly perform the services that we provide and, after this period, no longer than until the end of the limitation period of the claims what can be raised in connection with these services. The term of storage of the personal data is specified in our services' terms and conditions, agreements of entrusting data processing (then this time shall be binding upon the Parties of these agreements), the content of your expressed consents to processing your personal data, and if it is not specified in these  terms and conditions or agreements, we store your personal data for the following periods: 

• when you have the account in our systems for ordering the services that we provide and you order these services as the sender (including the payer), and if you do not have such account, but you are using our services as the sender (including the payer), we store your personal data for  the period of no more than 6 years, starting from the date you send the given shipment, 
• when you are the recipient of the shipment, we store your personal data for the period of no more than 18 months, from the date of sending the shipment and, after this time, we can keep these data for the period not longer than the limitation period of possible claims for our provision  of the services as resulting from the commonly binding legal regulations, 
• when you are making a complaint or a complaint for the services provided by InPost, we process your personal data included in this complaint or motion for the time necessary to examine this complaint and motion, and, after this time, we can keep them for the period not longer than the limitation period of  possible claims under the submitted complaint or motion, as resulting from the commonly binding legal regulations,
• when you are making another report or inquiry to us, we store your personal data for the period of service and possible processing of your report, and, after this period, we can keep them for the period not longer than the period of possible limitation period of the claims as resulting from the commonly binding  legal regulations,
• if the storage time of your personal data results from the absolutely binding legal regulations, we store your personal data for the period specified in these regulations. 

Why do we store your data for such period? 

Because, as InPost, we have to discharge the obligations resulting from the requirements of the commonly binding laws, including in particular with regard to:

• postal law, carriage law, tax and accounting regulations, 
• to the extent the processing of the personal data is necessary for the purposes resulting from legally justified interests pursued by InPost, as matters related to investigation of any claims resulting from services provided by InPost,
• permanent improvement in the safety level, in particular preventing abuse and fraud,
• other legally justified obligations imposed on InPost.

How do we process your personal data?

To the extent of postal and carriage services provided by InPost, we process your personal data:

• in the electronic form in InPost's and InPost subcontractors' IT systems, to the extent necessary to correctly perform the services provided by InPost, also in an automated way, 
• in the physical form (e.g. in writing), to the extent necessary to correctly perform the services provided by InPost, in particular as printouts on sending labels generated through InPost's IT systems which are stuck on the shipment. 

In the course of processing your personal data, we apply securities adequate to the kind, amount and scope of the processed personal data as well as appropriate organizational and technical measures so as to secure your personal data as well as possible against unauthorized actions. 

Being aware how important is the protection of your personal data, we use among others:

• encryption of your data using SSL layer (Secure Sockets Layer) while they are being sent, 
• in specified cases of anonymization, pseudonymization and encryption processes for your personal data
• other hardware, network as well as system securities, such as: firewalls, licensed hardware and network antivirus software, access control through a protected VPN network and many other IT safety solutions,
• electronic as well as physical access control mechanisms for persons to the buildings and rooms where your personal data are processed (among others magnetic and electronic keys, safety locks, CCTV monitoring),
• other securities that are intended to protect your personal data.

What are the contact details of the personal data Controller's and the Controller's person responsible for protection of the personal data? 

InPost contact details: ul. Wielicka 28, 30-552 Kraków. Contact with the person responsible for personal data protection in InPost is possible at the email address: dane_osobowe@grupainteger.pl, or by traditional correspondence to the above stated address. 

In the event of any questions or doubts concerning protection of your personal data, you can contact us through the e-mail address: dane_osobowe@grupainteger.pl. 

What is the legal basis for InPost's processing of your personal data?

InPost processes your personal data in particular in order to perform postal and carriage services that it offers. These services are performed under agreements, including agreements concluded with shipment senders. Without processing these personal data, we are not able to perform these services (e.g. not knowing the address for shipment delivery and its addressee, we are not able to deliver such shipment), or other services which we have undertaken to provide. The processing of your personal data is also necessary to meet the legal obligations imposed on us. One of such obligations is that specified in Article 81 of the act Postal Law (Journal of Laws 2017.1481 as amended) – according to this provision, InPost, acting as the postal operator, is obliged to perform tasks and obligations for defense, safety of the state as well as safety and public order in the scope and on the terms specified in the act Postal Law as well as in separate provisions. 

We also process your personal data for the purposes resulting from our legally justified interests – we deem "legally justified interest" to be compliant with the commonly binding law as well as reasonable purpose of processing the data (e.g. direct marketing of our products or services, or our pursuing of any claims under the conducted business operations). Each time when we want to process your personal data based on the legally justified interest, we check and assess whether such processing of the personal data will affect you and your rights. We will not process your personal data based on our "legally justified interest", if your interest or your rights and freedoms are superior to it. 

In the event of other purposes of processing your personal data, you can at any time withdraw your consent to processing your personal data for these purposes without effect on the validity of processing the personal data before withdrawal of the consent. We obtain your consent specifically for using your personal data for marketing purposes. 

Who is the recipient of your personal data? 

In accordance with the regulations of GDPR, "the recipient" of your personal data is a natural or legal person, public authority, company or another entity to whom the personal data are disclosed, regardless of whether they are a third party or not. Your personal data are not processed only by InPost and their personnel. We provide our services through many subcontractors, starting from transport enterprises, to entities that run postal sites for us and release shipments to you in them. Therefore, your data are processed by such categories of recipients as:

• InPost employees and co-workers,
• InPost subcontractors, providing services, on our behalf, of shipment moving, sorting and delivery, 
• insurer processing damages in shipment, 
• subcontractors operating our IT networks and databases as well as creating IT solutions for us and providing marketing services for us, 
• subcontractors operating the helpline for InPost and the customer service department, 
• company having capital links with Integer.pl S.A. (the list of these entities is available at the address: https://integer.pl/pl/grupa-kapitalowa-integer-pl/profil-dzialalnosci), 
• professional entities providing tax, legal, audit and clearing consultancy for InPost. 

We enter with the entities processing your personal data into non-disclosure agreements and agreements on personal data processing in a manner which is consistent with the commonly binding laws in personal data protection and on the terms to ensure safe processing of your  personal data as well as we give them respective powers of attorney. 

In addition, under the obligation specified in Article 81 of the act Postal Law (Journal of Laws 2017.1481 as amended), in the situations specified in this provision the recipient of your personal data can be public authorities and state services, e.g. President of the Office of Electronic Communication who controls postal operations. 

Are your personal data transferred to third states, namely states which are not members of the European Economic Area? 

Your personal data are transferred to third states when the services provided by InPost are to be performed also within the territory of the third state. Such a situation is e.g. when you send a shipment through InPost to such country. Your personal data can also be provided to our subcontractors (e.g. entities that deliver your shipment within the territory of the third state) and entities providing tax, legal, audit and clearing consultancy for InPost, if they run their operations within the territory of the third state. In each of the above cases we protect the processing of your personal data, in particular by entering into non-disclosure agreements and agreements on personal data processing in a manner which is consistent with the commonly binding laws in the European Union and in Poland related to protection of  personal data and on the terms to ensure safe processing of your personal data. We do not transfer your personal data to international organizations. We do not transfer your personal data to third states, if such transfer impossible or is excluded by virtue of commonly binding legal regulations.

Cookies files 

If you are using our websites and systems available through those sites (in particular those that enable generation of purchase orders as well as other activities related to ordering postal and carriage services), when browsing these pages the so-called  "cookies" files (cookies) are created. These are small text files which are stored on your device through which you are viewing the websites. They are commonly used in order to ensure the operation of websites and other services provided over the Internet and to improve and develop those sites, on the basis of reading the content of these files. 

InPost collects the information included in "cookies", such as website connection data or IP address of the device which the site is connected from – these are data showing the way you use our websites. Such information is used for administrative and statistical purposes and to improve those sites and improve your comfort of using them. In addition these data, processed automatically, can be used for analysis of content recipients' behaviors on these sites (e.g. time of visiting the website) or for customization of website content, in particular by delivering online advertisements. 

You do not have to accept cookies files (you can accept them both by clicking the respective button on our website and through the respective settings in your web browser), but this may make the site not  operate fully it should.  

What are your rights concerning access to your personal data? 

You have the right to request from InPost, as the data controller, access to your personal data, correct, remove them or restrict their processing as well as the right to submit an objection against processing them and the right to transfer these data and receive their copies. 

If you have given consent to processing your data by InPost, you have the right to withdraw the consent at any time, without effect on compliance with law of any processing which has been completed under the consent prior to the withdrawal. 

You can exercise the above rights by submitting the respective statement to InPost, in particular through the e-mail address: dane_osobowe@grupainteger.pl. 

You also have the right to submit a complaint to the supervisory body (President of the Office of Personal Data or a different state authority obliged under legal regulations to supervise the principles of personal data processing), if you think that we have not properly discharged our obligations. 

The present policy may change, in particular if necessary due to any change in the commonly binding legal regulations or change in the range of the services offered by InPost. The current version of the policy is available at: https://inpost.pl/ochrona-danych-osobowych.