Privacy Notice

Deutsche Post AG (hereinafter called 'DHL') is pleased that you have visited our social media presences and are interested in our company and our products and services. In the following, we would like to inform you about certain issues related to data protection that apply when you visit our social media presences.

• Our social media presences are made available by the respective operators of the social media platform pursuant to the applicable terms and conditions of use. The respective platform operator is solely responsible for the technical operation of this profile.
• DHL is solely responsible for the content that DHL posts on this page (such as information about our company, products, services, sweepstakes, campaigns) and for our interaction with visitors to our profile.
• The operators of the social media platform operate the entire IT infrastructure of the platforms. It makes its privacy policy available to users and has its own separate relationship with registered users of the platform. The operators of the social media platforms are solely responsible for all data protection topics involving your user profile, to which we have no access.
• We have no influence over the data processing by the operators of social media platforms who collect them. Furthermore, we have no information regarding the extent to which, the purposes for which or the length of time that the operators of the social media platforms store personal data and possibly analyze, link or transfer them to third parties.
• Please note that your personal data can, under certain circumstances, also be processed outside of the European Union/European Economic Area. This could result in data protection risks for users because an adequate level of data protection cannot be guaranteed in such cases and the ability to assert data subject rights is limited.
• Please see the respective privacy policies and cookie policies for the social media platforms to learn more about their data processing activities and how you can exercise your rights vis-á-vis the operators of the social media platforms.
  
  Facebook
  Instagram
  X
  LinkedIn
  YouTube
  TikTok
• If you would like to contact DHL directly – in other words, without the involvement of the social media platforms – please contact customer service

DHL is the data controller for the information it posts and also for the data processing that falls in its area of responsibility for the following social media presences:

• Facebook
• Instagram
• X
• LinkedIn
• YouTube
• TikTok

To the extent that it concerns the processing of personal data as part of page insights, the following platform operators are jointly responsible, along with us, for data processing. Joint data processing is based on an agreement between the joint controllers pursuant to Article 26 of the General Data Protection Regulation (GDPR).

• Facebook/Instagram: Facebook
• LinkedIn: LinkedIn Pages Joint Controller Addendum

3.1. Data processing in connection with our social media presences

We make use of our social media presences to inform you about, for example, our company, products, services, campaigns and sweepstakes and to interact with you regarding various topics and respond to your inquiries. The data processing performed in this connection is undertaken to safeguard our legitimate interests in accordance with Article 6(1)(f) of the GDPR. Our legitimate interest lies in public relations work and communication.

The social media platform operator publishes the information you provide on our profile, such as comments, likes, images and videos, and we process this information solely for the abovementioned purposes. We reserve only the right to erase illegal content should this be necessary. This applies, for example, to posts that constitute infringements of the law or are unlawful, hate comments, suggestive comments (explicitly sexual content) or attachments (such as images or videos), which under circumstances violate copyrights, privacy rights, criminal law or Deutsche Post AG’s ethics rules.

Data are also collected for the purpose of holding and processing sweepstakes. The details, such as which data are processed and the purpose of the processing, can be found in the privacy notices and terms and conditions of the respective contest.

If you would like to exchange personal data with us, we recommend that you contact our customer service. 

3.2. Data processing of page insights for statistical purposes

The social media platform operators from Facebook, Instagram and LinkedIn provide us with page insights, for which we are jointly responsible together with the platform operators. Page insights are anonymous statistics that are generated as a result of certain events and are tracked by social media platforms via cookies and similar technologies when a user such as you interacts with our social media profile. We can use the page insights, which contain no personal data, to see which content is particularly accessed by which group of individuals. This allows us to optimize our social media presence. This represents a legitimate interest on our part for the processing that takes place. The legal basis for data processing related to page insights is Article 6(1)(f) of the GDPR. We would like to point out that data processing can also take place independent of whether you are logged in or registered on the social media platform. We are unable to influence the use of cookies and similar technologies on the social media platform and, in this respect, refer you to your ability as a user to change your settings regarding the related data processing via the respective cookie banner on the social media platform (granting or not granting your consent). 

3.3. Social media monitoring

We use social media monitoring in order to obtain a picture of how our business, our products and our services are viewed and, based on this, identify potential for improvement. This entails analyzing posts on the social media platform based on the channel links used and relevant hashtag links. Only those posts to which you allow full public access will be used for this. The legal basis for processing personal data as part of social media monitoring is Article 6(1)(f) of the GDPR because we have a legitimate interest in identifying in freely accessible statements possible deficits in our products or services and responding appropriately. 

You may exercise your rights as set forth in this Privacy Notice by contacting data protection.

If you would like to exercise your rights as a data subject vis-à-vis the social media platform operators, please use the contact options provided by the platform operators on the social media platforms. Should we receive an inquiry that falls within the area of responsibility of the social media platforms, we will forward it to them for further processing.

The length of time during which your data are stored will depend on the particular context of the processing and will be based on the parameters imposed by data protection law. All public posts you make on our profiles will remain on our profiles for an unlimited time, unless we erase them on the basis of an update of the original post, a breach of law or an infringement of our guidelines. You may of course erase your posts, comments and the like at any time yourself or exercise your right to have us erase them.

In the case of the social media platform operators’ erasure of your data, we have no influence over this and therefore refer you to the privacy policy of the respective platform operator.

In order to get back to you via email or phone to make you an offer, you can use one of our Get a Quote services. Depending on the country you are residing and in order to get you to the right expert team or tool within DHL, we either ask whether you would like to ship parcels or documents, cargo / freight or international business mail and whether you are a business or private customer. 

Based on this information your request will be directed to our business units  [DHL Express, DHL Global Forwarding, DHL Freight, DHL eCommerce, DHL Paket] and you will immediately receive a product card with price and further details from the business unit(s) which offer best suits your request. It could also be that we ask you for the following details: country of origin and destination including city and postcode (we need an approximate origin and destination in order to give you a quote for your shipment as accurate as possible) and weight and dimension of the shipment. Depending on your request we might also ask the quantity, whether documents or dangerous goods are involved or whether it is palletized or stackable. This information is also forwarded to one of our business units  [DHL Express, DHL Global Forwarding, DHL Freight, DHL eCommerce, DHL Paket]  and you will immediately receive a product card shown with price and further details regarding your shipment and optional add-ons.

By clicking on the “continue to booking” button you will be forwarded to the respective business unit´s  booking tool system [MyDHL+, myDHLi, MyDHL Parcel]. Hence, on dhl.com we basically do not collect or otherwise process your personal data for our Get a Quote service. However, if data is nevertheless considered personal, such as the city and postcode, the legal basis for this is the contract in progress (Art. 6 (1) b) GDPR) and a legitimate interest in being able to submit our offer as accurately as possible (Art. 6 (1) f) GDPR).

Provided that no statutory or contractual retention periods needs to be observed, your request will be stored for a maximum of 30 days with the relevant business unit which finally made the quote as proof of proper processing and for the purpose of further optimizing services. On dhl.com the respective data is stored for a maximum of 30 days if you have used the safe shipment service and unless not earlier deletes by yourself.

If you are using or DHL for Business service we ask you for the shipping destination, the volume and the frequency of the shipment. Based on this information and your shipping needs, your request will be send to our business units [DHL Express, DHL Global Forwarding, DHL Freight, DHL eCommerce, DHL Paket]  and allocated to those which services best fit your requirements. In order to get in touch with you as soon as possible we also ask you for your company´s name, your name, business address, email address and phone number. This data will also be forwarded to the respective business units and is necessary to take steps at your request prior to entering into a contract and / or for the performance of a contract. The legal basis is therefore Art. 6 (1) b) GDPR.

Provided that no statutory or contractual retention periods need to be observed, your request will be stored for a maximum of 30 days with the relevant business unit which finally made the quote as proof of proper processing and for the purpose of further optimizing services.

You can use the Track and Trace service to track shipments addressed to you or sent by you, and also view the expected time of delivery. To this end the tracking information is sent to the respective business unit [DHL Express DHL Global Forwarding, DHL Freight, DHL eCommerce, DHL Supply Chain]to find the status of the shipment. You will also receive all important detailed information about your shipment from the respective business unit. In addition, the sender or recipient can also receive further information about the shipment in question by e-mail or SMS. For this purpose, the e-mail address or mobile phone number of the recipient of the notification can be stored and the notification activated. In this context, the person entering the data must ensure that the notification recipient agrees to the processing of e-mail address, mobile phone number and notification.

The following data are processed as part of shipment tracking: shipment number, name and address of the sender, name and address of the recipient, e-mail address of the sender/recipient if applicable, name and address of the alternative recipient if applicable, customer data of the sender, product or service name, shipment history, signature of the recipient, confirmation that a minimum age has been checked (over 16/over 18).

The data are processed for the purpose of fulfilling the contract on the basis of Art. 6(1) (b) GDPR.

To enhance user convenience, when using shipment tracking DHL automatically generates a list of the last shipment number searched for via the shipment search: This function saves you having to re-enter the shipment number when checking the shipping status of your shipment. In this context, you can name individual shipments according to your preference (“Shipment title"). For this purpose, the application saves a list of the last shipment searches in a cookie. 

Our Ship Now service leads you to our various customer portals of our business units [DHL Express, DHL Global Forwarding, DHL Freight, DHL eCommerce, DHL Paket] (e.g. MyDHL+, DHL eCommerce Web Portal, my DHLi or DHL Interactive). You can also continue as guest and you will be forwarded to our business unit which best meets you shipping needs. In any case we will not process your personal data at this stage. Same applies if you would like to schedule a redelivery. After a few questions about your shipment you will be directed to our various customer portals where you can arrange the redelivery in detail.

You can contact us at any time with questions via our Customer Service. Depending on the respective business unit, you will either be forwarded directly to the website of the respective business unit or we ask you to fill out a contact form beforehand, which requests the following data categories and then forwards them to the respective responsible business unit: your customer reference no., your name, the name of your company, postal address, email address and telephone no. country / region and the sector you are working for. The legal basis is Art. 6 (1) (b) GDPR, as this processing is carried out in order to prepare or to fulfil a contract. Furthermore, you provide the data voluntarily for the purpose of contacting us, so your consent is another legal basis, Art. 6 (1) (a) GDPR.

In addition you have the option to consent to promotional emails about our services. To this end we also forward your contact data to our business units [DHL Express, DHL Global Forwarding, DHL Freight, DHL eCommerce, DHL Paket] . The legal basis for this is your consent according to Art. 6 (1) (a) GDPR.

If you would like to participate in one of our Events and/or Webinars, you will be redirected to the appropriate registration page. There we basically collect the following personal data: your name, your email address and who is your main contact at DHL. Depending on the respective sector we may also ask for your company name, your seniority and whether you have previously done business with DHL. The legal basis is Art. 6 (1) (b) GDPR, as this processing is carried out in order to fulfil the contract (attending the event).

If you subscribe to Delivered to know first about new articles we only collect your email address and it is not used for any other purpose. The legal basis for this is your consent according to Art. 6 (1) (a) GDPR. You may unsubscribe at any time by clicking the relevant link at the bottom of the Delivered mail. You can also revoke the consent at any time with effect for the future using the contact address provided. If you unsubscribe from Delivered or revoke your consent, the corresponding data will be removed or blocked from the mailing list and will no longer be processed for these purposes.

Notwithstanding the foregoing, if you are an existing DHL customer, your postal data (e.g. name, address) will be processed to contact you in order to provide you with the latest information about our offers, news, products and services. Apart from an existing consent, which is based on Art. 6 (1) a) GDPR, we will process your e-mail address exclusively in order to provide you with information regarding DHL own and similar products. Legal basis for the aforementioned processing to keep you updated regarding our own and similar products is Art. 6 (1) f) GDPR. The processing of customer data for own direct marketing purposes is regarded as carried out for a legitimate interest. You have the right to object at any time to the said processing. To exercise your right, simply get in touch with us by using the contact details mentioned under "Who is Responsible".

You have the option there to consent to promotional emails about our services. To this end we also forward your contact data to our business units [DHL Express, DHL Global Forwarding, DHL Freight, DHL eCommerce, DHL Supply Chain]. The legal basis for this is your consent according to Art. 6 (1) (a) GDPR. You may unsubscribe at any time by clicking the relevant link at the bottom of the Delivered mail. You can also revoke the consent at any time with effect for the future using the contact address provided.

If you register for one of our newsletters, we are entitled to use your e-mail address for this purpose. The legal basis for this data processing is your consent pursuant to Art. 6 (1) (a) GDPR. You may unsubscribe from the newsletter at any time by clicking the relevant link at the bottom of the newsletter. You can also revoke the consent at any time with effect for the future using the contact address provided. If you unsubscribe from our e-mail communications or revoke your consent, the corresponding data will be removed or blocked from the mailing list and will no longer be processed for these purposes.
Including your e-mail address in a blocking list is effected in order to safeguard our legitimate interests pursuant to Art. 6 (1) (f) GDPR. Our legitimate interest lies in not sending you any information by e-mail in the future.

Processing of personal data of business customers

DHL Express takes the protection of personal data processed in our systems and processes seriously. We ensure a high standard of data security.

In accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC – hereinafter referred to as GDPR – you will soon learn how DHL Express processes your personal data.

We inform you that the controller of your personal data is DHL Express Polska sp. z o.o. with its registered office at ul. Wirażowa 37, Warsaw.

The Controller has appointed a Data Protection Officer, who can be contacted in all matters regarding the processing of personal data and the exercise of rights related to the processing of personal data at the mailing address of the Controller's registered office, electronically at the email address: pl.dhlexp.iod@dhl.com, or via the contact form available on the website here.

Retention period

The personal data you provide will be stored for the period during which the Controller provides services to you, as well as for the period of consideration of any complaints and until the expiration of any claims or the obligation to store data resulting from legal regulations, in particular the obligation to store accounting documents.

The data you provide may be processed for the purpose of:

1. maintaining a contact base, also for the purpose of establishing potential business relations, which constitutes a legitimate interest of the controller (Article 6(1)(f) GDPR) and may lead to cooperation (Article 6(1)(b) GDPR),
2. conducting direct marketing of DHL services and third parties (including through the preparation of a dedicated offer, created on the basis of estimated quantities of shipments), responding to interventions, complaints, complaints or changes of disposition, preparing a response or dealing with a matter that has been reported in your message, in case of a request to cease contact - designation as an entity that does not wish to do so - which constitutes a legitimate interest of the data controller (Article 6(1)(f) GDPR),
3. presentation of the offer of our services - after obtaining permission to contact a given communication channel. The basis is the consent given (Article 6(1)(a) of the GDPR),
4. conducting a Research Relationship Survey (pursuant to Article 6(1) of the GDPR),
5. archiving of any telephone calls to resolve the matter you report and to evaluate the conduct of our consultant, which is a legitimate interest in DHL (pursuant to Article 6(1) of the GDPR),
6. review of the parties hereto (including prior to execution) - the U.S. sanctions list, EU, local (the basis for processing for the purposes of the legitimate interests of DHL (pursuant to Article 6(f) of the GDPR). We will collect information about whether the page is listed. In case of doubt, we will ask for additional information.

The recipients of your personal data may be entities supporting DHL in the implementation of its processes (other entities of the DHL Group, IT entities, legal advice, entities storing and destroying documents).

Retention period of your personal data: the data will be processed accordingly: until you withdraw your consent, object, or verify the database (e.g. cessation of your activity).

You have the right to:

1. withdrawal of consent at any time, which does not affect the lawfulness of processing carried out before its withdrawal,
2. request access to and rectification of personal data concerning you if they are incorrect,
3. in cases provided for by law, request the deletion of personal data concerning you,
4. in cases provided for by law, request to restrict the processing of your personal data,
5. in cases provided for by law, transfer of data to another controller.

You also have the right to object to the processing for reasons related to your particular situation.

In order to exercise the rights indicated above, please contact the Data Protection Officer, who is available at: pl.dhlexp.iod@dhl.com or the DHL mailing address.

Your personal data is not subject to automated decision-making, including profiling. This means that we do not make decisions based solely on automated processing of data that could significantly affect you.

The controller of your personal data does not intend to transfer your personal data to a third country or international organization.

You have the right to lodge a complaint with the supervisory authority - the President of the Office for Personal Data Protection.

Your data was obtained from information provided during existing contacts, as well as from public sources (CEIDG, KRS, private websites, social media, others: e.g. beneficiaries of EU funds).

Providing additional personal data is voluntary, but may be necessary to establish and implement cooperation.

Courier Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.

We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Aleksandrę Piórkowską, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address:
pl.dhlexp.iod@dhl.com or through application form available here.

Processing Period

Your personal data will be stored for the period of cooperation with Service Partners and subsequently for the periods set out in law provisions including, among others: accountancy law, tax law, social insurance law. 
When personal data are processed on the basis of Your consent, the Controller will store Your personal data until withdrawal of consent. The Company will stop to process personal data on the basis of its legitimate interests if you object to process data for those purposes. In case of profiling we will use data for this purpose until you object to such processing.

Data provided by You can be processed for the following purpose:

• to conclude, perform and terminate cooperation agreements with service partners as well as to perform activities concerning obligations and liabilities of service partners and their personnel (including primarily curriers) (art. 6 (1) letter b) of the GDPR).
• for the purpose of publication of Your image for internal and external communication (for instance electronic mail, Intranet, company newspaper Express News and others) – on the basis of art. 6 (1) letter a) of the GDPR.
• law provision – with relation to obligations deriving from those provisions, including Civil Code, provisions on social insurance, health insurance, taxes, work accidents, company employee benefit fund, accounting, general defense obligation (art. 6 (1) letter c) of the GDPR).
• HR and development managing, which includes improvement of qualifications (also on the level of the Group, where the legitimate interests of the Controller is taking care of possible highest level of management and other employees (art. 6 (1) letter f) of the GDPR).
• development management, including profiling for statistics and business purposes – the legal basis for processing is legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), which is the optimal use of employees potential.
• organizing and co-financing of additional services for employees and their family members or partners (for instance group life insurance, health insurance, benefit system, etc.) – the legal basis for processing are legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), where the legitimate interests are to ensure best possible working conditions for employees.
• ensuring security in the premises belonging to the Company (including publication of image on ID cards and access cards) – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests are to ensure security in the Company premises (art. 6 (1) letter f) of the GDPR).
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay.

Provision of personal data is voluntary, and the failure of their provision will result in lack of possibility of cooperation with service partner/ its personnel (including couriers in the first place).

Data provided by You will be disclosed to:

• entities from DHL group for internal administrative purposes
  
• third parties offering additional services to service partners/ its personnel (including couriers in the first place), such as group insurance, other benefits and entities participating in organization of business travel;
• third parties with relation to fulfillment of Your obligations, for instance common services for HR department, providing trainings and vocational trainings, recruitment and HR management, IT infrastructure support and maintenance, legal advisory, analysis of users behavior, order handling, compliance verification (audits), trainings and developments – whereas such entities process personal data as subcontractors, on the basis of agreement with DHL Express and exclusively on its instructions, i.e. for instance: independent external representatives, service providers, suppliers, partners, distributors, postal and operational services providers, providers of documentation management services;
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

You have:

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

Customer Representatives Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.

We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Aleksandrę Piórkowską, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address: 
pl.dhlexp.iod@dhl.com or through application form available here.

Processing Period

Personal data that You have provided will be stored for the period of provision of service to You by the Controller as well as for the period of handling potential compliant and until time of prescription of potential claims expires or an obligation to store data, according to law provisions expires, especially obligation to store accounting documents.

In case of profiling we will use data for this purpose until You object to such processing.

Data provided by You can be processed for the following purpose:

• to conclude and perform contract on package delivery including additional services and managing Your packages – the legal basis of processing is necessity of data processing in order to enter into and perform the contract, according to art. 6 (1) letter b) of the GDPR.
• to handle lodged compliant – legal basis for processing is necessity of data processing for the performance of the contract, according to art. 6 (1) letter b) of the GDPR.
• control over export and import of strategic goods – legal basis for data processing is necessity to fulfill legal obligation imposed on the Controller, according to art. 6 (1) letter c) of the GDPR, and specifically the Act of 9th November 2000 on foreign trade in goods, technologies and services of strategic importance to state security and to preserve international peace and security.
• fulfillment of obligations deriving from law provisions by the Controller – specifically the Act of 29th September 1994 on accounting – the legal basis for data processing is necessary to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR.
• counteracting money laundering and terrorism financing – the legal basis is necessity to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR, specifically the Act of 1st March 2018 on money laundering and counteracting terrorism.
• pursuing claims concerning the agreement entered into – the legal basis for processing is necessity of processing in order to fulfill legitimate interests of the Controller, where these legitimate interests are the possibility to pursue claims according to civil law and before amicable courts, contained in art. 6 (1) letter f) of the GDPR.
• direct marketing of Controller own products and services, including for statistics purpose and for the purpose of profiling. The legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are direct marketing of the Controller own products and services, according to art. 6 (1) letter f) of the GDPR.
• profiling in order to identify the preferences or needs with relation to products and services and presenting adequate offer –the legal basis for processing is legitimate interests of the Controller, where these interests are direct marketing of own products and services, according to art. 6 (1) letter f) of the GDPR.
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay. Provision of personal data is voluntary, but necessary in order to conclude and perform the contract between You and DHL Express concerning package delivery as well as services and additional products.

Data provided by You will be disclosed to:

• partners cooperating with DHL Express with regard to package delivery, including couriers and other carriers, as well as partner customer services as well as entities maintaining drop-off and parcel-pick machines.
• entities from DHL group, that provide various services to DHL Express, such as accounting, debt collection or IT services and support the process of packages delivery, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• in case where package insurance has been purchased, Your personal data will be disclosed to insurance company cooperating with DHL.
• DHL Express partners supporting marketing processes, including marketing agencies, hosting service provider, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

You have:

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

Electronic Shipping Solution User Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.
We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. zo .o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Aleksandrę Piórkowską, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address: 
pl.dhlexp.iod@dhl.com or through application form available here.

Processing Period

Personal data that You have provided will be stored for the period of provision of service to You by the Controller as well as for the period of handling potential compliant and until time of prescription of potential claims expires or an obligation to store data, according to law provisions expires, especially obligation to store accounting documents.

Data provided by You can be processed for the following purpose:

• to conclude and perform contract on package delivery including additional services and managing Your packages – the legal basis of processing is necessity of data processing in order to enter into and perform the contract, according to art. 6 (1) letter b) of the GDPR.
• fulfillment of obligations deriving from law provisions by the Controller – specifically the Act of 29th September 1994 on accounting – the legal basis for data processing is necessary to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR.
• counteracting money laundering and terrorism financing – the legal basis is necessity to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR, specifically the Act of 1st March 2018 on money laundering and counteracting terrorism.
• Direct marketing of Controller own products and services, including for statistics purpose and for the purpose of profiling. The legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are direct marketing of the Controller own products and services, according to art. 6 (1) letter f) of the GDPR.
• profiling in order to identify the preferences or needs with relation to products and services and presenting adequate offer –the legal basis for processing is legitimate interests of the Controller, where these interests are direct marketing of own products and services, according to art. 6 (1) letter f) of the GDPR.
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay.

Provision of personal data is voluntary, but necessary in order to conclude and perform the contract between You and DHL Express concerning package delivery as well as services and additional products.

Data provided by You will be disclosed to:

• partners cooperating with DHL Express with regard to package delivery, including couriers and other carriers, as well as partner customer services as well as entities maintaining drop-off and parcel-pick machines.
• entities from DHL group, that provide various services to DHL Express, such as accounting, debt collection or IT services and support the process of packages delivery, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• In case where package insurance has been purchased, Your personal data will be disclosed to insurance company cooperating with DHL.
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

You have:

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

Employees Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.

We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Aleksandrę Piórkowską, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address: 
pl.dhlexp.iod@dhl.com or through application form available here.

Processing Period

Your personal data will be stored for the period of Your employment and subsequently for the period set out by the labour law provisions and other sector-specific laws, i.e. accounting law, tax law, social insurance law.

When personal data are processed on the basis of Your consent, the Controller will store Your personal data until withdrawal of consent. The Company will stop to process personal data on the basis of its legitimate interests if You object to process data for those purposes.
In case of profiling we will use data for this purpose until You object to such processing.

Data provided by You can be processed for the following purpose:

• to conclude, perform and terminate employment contract - the legal basis of processing is necessity of data processing in order to enter into and perform the contract, according to art. 6 (1) letter b) of the GDPR.
• performing activities related to possible disciplinary liability of the employees, liability of the employee for damage against the employer, liability of the employee for employer assets, including establishing and pursuing possible claims – legal basis for processing is art. 6 (1) letter b) of the GDPR.
• where consent has been given, for the purpose of publication of Your image for internal and external communication (for instance electronic mail, Intranet, company newspaper Express News and others) – on the basis of art. 6 (1) letter a) of the GDPR.
• fulfilling obligations deriving from the Act of 26th June 1974 Labour Coder and its implementing acts, which include keeping archive of personal files – the legal basis for data processing is law provision and legal obligation imposed on the controller contained in art. 6 (1) letter c) of the GDPR.
• fulfilling obligations deriving from provisions on: social insurance, health insurance, work accidents, company employee benefit fund, accounting, general defense obligation and from other obligations, due to the law provisions – the legal basis for processing is legal obligation imposed on the Controller – art. 6 (1) letter c) of the GDPR.
• disclosure of personal data to entities authorized on the basis of law, as well as to the entities, that data have to be disclosed to, in order to use special rights provided for in the labour law by the employees - the legal basis for processing is legal obligation imposed on the Controller – art. 6 (1) letter c) of the GDPR.
• work results management, including profiling for statistics and development purposes – the legal basis for processing is legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), where the legitimate interests are optimal use of employees potential.
• taking actions concerning obligations and responsibility of the employee, non-competition clause, employee professional qualifications, including trainings – the legal basis for processing is necessity of processing for the purpose of entering into and performance of the contract, according to art. 6 (1) letter b) of the GDPR as well as necessity for the legitimate interests of the Controller, where these legitimate interests of the Controller are taking care of the highest possible level of its personnel.
• personnel management, planning and analysis of the employment, managing assets given to the employee, organizing and financing of business travels and business credit cards, payment and management of remuneration, tasks assignment, employee assessment – the legal basis for processing is necessity of data processing for the purpose of legitimate interests of the Controller, where the legitimate interests of the Controller is taking care of possible highest level of management and other employees (art. 6 (1) letter f) of the GDPR).
• development management, including profiling for statistics and business purposes – the legal basis for processing is legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), which are the optimal use of employees potential.
• organizing and co-financing of additional services for employees and their family members or partners (for instance group life insurance, health insurance, benefit system, etc.) – the legal basis for processing are legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), where the legitimate interests are to ensure best possible working conditions for employees.
• ensuring security in the premises belonging to the Company (including publication of image on ID cards and access cards) – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where this legitimate interests are to ensure security in the Company premises (art. 6 (1) letter f) of the GDPR).
• ensuring security of information and obeying professional secrecy – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where this legitimate interests are to ensure proper protection of information and professional secrecy.
• financial, administrative and IT service, including creating and maintaining accounts in IT systems and enabling tele-work – the legal basis for processing is necessity to pursue legitimate interests of the Controller, where this legitimate interests of the Controller are enabling functioning of the Company, coordination of their actions and internal administrative purposes (art. 6 (1) letter f) of the GDPR).
• ensuring cooperation and communication on the capital group level and with the external entities that provide services to the Company, including global scale cooperation (for instance corporate books, planning and analysis of the employment) - the legal basis for processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are enabling global scale cooperation and fulfillment of internal purposes.
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay.

Provision of personal data is mandatory, where it derives from law provisions, and failure of their provision will result in lack of possibility of entering into employment contract. Provision of other personal data is voluntary, and failure of their provision will result in lack of possibility of fulfillment of particular purposes indicated above.

Data provided by You will be disclosed to:

• Entities from DHL group for internal administrative purposes
• Entities from DHL group, that provide various services to DHL Express, such as accounting, debt collection or IT services, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• third parties offering additional services to employees such as group insurance, other benefits and entities participating in organization of business travel;
• third parties with relation to fulfillment of Your obligations concerning employment, for instance common services for HR department, providing trainings and vocational trainings, recruitment and HR management, IT infrastructure support and maintenance, legal advisory, analysis of users behavior, order handling, compliance verification (audits), trainings and developments – whereas such entities process personal data as subcontractors, on the basis of agreement with employer and exclusively on its instructions, i.e. for instance: independent external representatives, service providers, suppliers, partners, distributors, postal and operational services providers, providers of documentation management services;
• Company clients and contractors with relation to fulfillment of work
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

You have:

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

Expressing consent is voluntary, therefore You can withdraw it at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

User - Compliant Application Form Concerning VAT Invoice and Duplicates Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.
We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Aleksandrę Piórkowską, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address: 
pl.dhlexp.iod@dhl.com or through application form available here.

Processing Period

Personal data provided by You will be stored for the time necessary to handle Your question concerning compliant and issuing invoice duplicate, as well as for the period of handling potential compliant and until time of prescription of potential claims expires or an obligation to store data, according to law provisions expires, especially obligation to store accounting documents.

Data provided by You can be processed for the following purpose:

• to handle lodged compliant – legal basis for processing is necessity of data processing for the performance of the contract, according to art. 6 (1) letter b) of the GDPR.
• fulfillment of obligations deriving from law provisions by the Controller – specifically the Act of 29th September 1994 on accounting – the legal basis for data processing is necessary to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR.
• counteracting money laundering and terrorism financing – the legal basis is necessity to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR, specifically the Act of 1st March 2018 on money laundering and counteracting terrorism.
• pursuing claims concerning the agreement entered into – the legal basis for processing is necessity of processing in order to fulfill legitimate interests of the Controller, where these legitimate interests are the possibility to pursue claims according to civil law and before amicable courts, contained in art. 6 (1) letter f) of the GDPR.
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay.
Provision of data is voluntary, but necessary in order to handle Your inquiry.

Data provided by You will be disclosed to:

• entities from DHL group, that provide various services to DHL Express, such as accounting, debt collection or IT services, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

You have:

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

Couriers Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.

We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Aleksandrę Piórkowską, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address: 
pl.dhlexp.iod@dhl.com or through application form available here.

Processing Period

Your personal data will be stored for the period of cooperation with Service Partners and subsequently for the periods set out in law provisions including, among others: accountancy law, tax law, social insurance law.

When personal data are processed on the basis of Your consent, the Controller will store Your personal data until withdrawal of consent. The Company will stop to process personal data on the basis of its legitimate interests if You object to process data for those purposes.

In case of profiling we will use data for this purpose until You object to such processing.

Data provided by You can be processed for the following purpose:

• to conclude, perform and terminate cooperation agreements with service partners as well as to perform activities concerning obligations and liabilities of service partners and their personnel (including primarily curriers) (art. 6 (1) letter b) of the GDPR).
• for the purpose of publication of Your image for internal and external communication (for instance electronic mail, Intranet, company newspaper Express News and others) – on the basis of art. 6 (1) letter a) of the GDPR.
• law provision – with relation to obligations deriving from those provisions, including Civil Code, provisions on social insurance, health insurance, taxes, work accidents, company employee benefit fund, accounting, general defense obligation (art. 6 (1) letter c) of the GDPR).
• HR and development managing, which includes improvement of qualifications (also on the level of the Group, where the legitimate interests of the Controller is taking care of possible highest level of management and other employees (art. 6 (1) letter f) of the GDPR).
• development management, including profiling for statistics and business purposes – the legal basis for processing is legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), which is the optimal use of employees potential.
• organizing and co-financing of additional services for employees and their family members or partners (for instance group life insurance, health insurance, benefit system, etc.) – the legal basis for processing are legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), where the legitimate interests are to ensure best possible working conditions for employees.
• ensuring security in the premises belonging to the Company (including publication of image on ID cards and access cards) – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests are to ensure security in the Company premises (art. 6 (1) letter f) of the GDPR).
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay.

Provision of personal data is voluntary, and the failure of their provision will result in lack of possibility of cooperation with service partner/ its personnel (including couriers in the first place).

Data provided by You will be disclosed to:

• entities from DHL group for internal administrative purposes
  
• third parties offering additional services to service partners/ its personnel (including couriers in the first place), such as group insurance, other benefits and entities participating in organization of business travel;
• third parties with relation to fulfillment of Your obligations, for instance common services for HR department, providing trainings and vocational trainings, recruitment and HR management, IT infrastructure support and maintenance, legal advisory, analysis of users behavior, order handling, compliance verification (audits), trainings and developments – whereas such entities process personal data as subcontractors, on the basis of agreement with DHL Express and exclusively on its instructions, i.e. for instance: independent external representatives, service providers, suppliers, partners, distributors, postal and operational services providers, providers of documentation management services;
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

You have:

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

Shipper and Receiver Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.
We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Aleksandrę Piórkowską, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address:
pl.dhlexp.iod@dhl.com or through application form available here.
Additional information for the package address:

Data contained in Bill of Lading (data category) have been provided by the sender (shipper).

Processing Period

Personal data that You have provided will be stored for the period of provision of service to You by the Controller as well as for the period of handling potential compliant and until time of prescription of potential claims expires or an obligation to store data, according to law provisions expires, especially obligation to store bill of ladings or accounting documents.

In case of profiling we will use data for this purpose until You object to such processing.

Data provided by You can be processed for the following purpose:

• to conclude and perform contract on package delivery and to handle additional services according to sender or receiver instruction – the legal basis of processing is necessity of data processing in order to enter into and perform the contract, according to art. 6 (1) letter b) of the GDPR.
• ensuring security of persons and assets in the transport – the legal basis for data processing is necessity to fulfill legal obligations imposed on the Controller, according to art. 6 (1) letter c) of the GDPR and specifically:
• in case of road transport of dangerous materials (the Act of 19th August 2011 on the transport of dangerous goods, Journal of Laws of 2011 item 1367).
• in case of air freight of dangerous materials (proclamation of 5th June 2015 of the President of Civil Aviation Authority, Journal of Laws of 2015 item 30)
• Custom declarations according to good intended use – the legal basis for data processing is necessity to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR, and specifically in 1) Regulation of the European Parliament and the Council 952/2013/EC of 9th October 2013 laying down the Union Customs Code 2) Commission Delegated Regulation (EU) 2015/2446 of 28 July 2015 supplementing Regulation (EU) No 952/2013 of the European Parliament and of the Council as regards detailed rules concerning certain provisions of the Union Customs Code; 3) Council Regulation (EC) No 1186/2009 of 16 November 2009 setting up a Community system of reliefs from customs duty; 4) Instruction on completion of custom declaration drafted on the basis of aforementioned provisions published by the National Treasury Administration on the Ministry of Finance website: https://www.finanse.mf.gov.pl/clo/zgloszenia-celne-i-intrastat/zgloszenia-celne/instrukcje; 5) The Regulation of Minister of Finance of 8th September 2016 on custom declarations; 6) The Act of 29th August 1997 Tax law 7) the Act of 11th March 2004 on goods and services tax.
• Fulfillment of obligations deriving from law provisions by the Controller – specifically the Act of 29th September 1994 on accounting – the legal basis for data processing is necessary to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR.
• counteracting money laundering and terrorism financing – the legal basis is necessity to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR, specifically the Act of 1st March 2018 on money laundering and counteracting terrorism.
• pursuing claims concerning the agreement entered into – the legal basis for processing is necessity of processing in order to fulfill legitimate interests of the Controller, where these legitimate interests are the possibility to pursue claims according to civil law and before amicable courts, contained in art. 6 (1) letter f) of the GDPR.
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR

When we add new purposes of the processing, you will be informed thereof without delay.

Provision of personal data is voluntary, but necessary in order to conclude and perform the contract between You and DHL Express concerning package delivery as well as services and additional products.

Data provided by You will be disclosed to:

• partners cooperating with DHL Express with regard to package delivery, including couriers and other carriers, as well as partner customer services as well as entities maintaining drop-off and parcel-pick machines.
• Entities from DHL group, that provide various services to DHL Express, such as accounting, debt collection or IT services and support the process of packages delivery, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• In case where package insurance has been purchased, Your personal data will be disclosed to insurance company cooperating with DHL.
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

You have:

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

User – My Bill App

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC - hereinafter referred to as the GDPR - You will find out how DHL Express process Your personal data below.

We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. Z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Aleksandrę Piórkowską, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address:
pl.dhlexp.iod@dhl.com or through application form available here.

Personal data that You have provided will be stored for the period of provision of service to You by the Controller as well as for the period of handling potential compliant and until time of prescription of potential claims expires or an obligation to store data, according to law provisions expires, especially obligation to store accounting documents. Data provided by You can be processed for the following purpose:

• to conclude and perform contract on package delivery including additional services and managing Your packages - the legal basis of processing is necessity of data processing in order to enter into and perform the contract, according to art. 6 (1) letter b) of the GDPR.
• fulfillment of obligations deriving from law provisions by the Controller - specifically the Act of 29th September 1994 on accounting - the legal basis for data processing is necessary to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR.
• to handle lodged compliant - legal basis for processing is necessity of data processing for the performance of the contract, according to art. 6 (1) letter b) of the GDPR.
• counteracting money laundering and terrorism financing - the legal basis is necessity to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR, specifically the Act of 1st March 2018 on money laundering and counteracting terrorism.
• pursuing claims concerning the agreement entered into - the legal basis for processing is necessity of processing in order to fulfill legitimate interests of the Controller, where these legitimate interests are the possibility to pursue claims according to civil law and before amicable courts, contained in art. 6 (1) letter f) of the GDPR.
• analytical and statistical - the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay.
Provision of data is voluntary, but necessary in order to service provision.

Data provided by You will be disclosed to:

• Entities from DHL group, that provide various services to DHL Express, such as accounting, debt collection or IT services, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

You have:

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the  contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.