PRIVACY NOTICE

Courier Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.

We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Kazimierz Stefański, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address:
pl.dhlexp.iod@dhl.com or through application form available on the following website: www.dhl.com.pl

Processing Period

Your personal data will be stored for the period of cooperation with Service Partners and subsequently for the periods set out in law provisions including, among others: accountancy law, tax law, social insurance law.
When personal data are processed on the basis of Your consent, the Controller will store Your personal data until withdrawal of consent. The Company will stop to process personal data on the basis of its legitimate interests if You object to process data for those purposes.
In case of profiling we will use data for this purpose until You object to such processing.

• to conclude, perform and terminate cooperation agreements with service partners as well as to perform activities concerning obligations and liabilities of service partners and their personnel (including primarily curriers) (art. 6 (1) letter b) of the GDPR).
• for the purpose of publication of Your image for internal and external communication (for instance electronic mail, Intranet, company newspaper Express News and others) – on the basis of art. 6 (1) letter a) of the GDPR.
• law provision – with relation to obligations deriving from those provisions, including Civil Code, provisions on social insurance, health insurance, taxes, work accidents, company employee benefit fund, accounting, general defense obligation (art. 6 (1) letter c) of the GDPR).
• HR and development managing, which includes improvement of qualifications (also on the level of the Group, where the legitimate interests of the Controller is taking care of possible highest level of management and other employees (art. 6 (1) letter f) of the GDPR).
• development management, including profiling for statistics and business purposes – the legal basis for processing is legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), which is the optimal use of employees potential.
• organizing and co-financing of additional services for employees and their family members or partners (for instance group life insurance, health insurance, benefit system, etc.) – the legal basis for processing are legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), where the legitimate interests are to ensure best possible working conditions for employees.
• ensuring security in the premises belonging to the Company (including publication of image on ID cards and access cards) – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests are to ensure security in the Company premises (art. 6 (1) letter f) of the GDPR).
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay.

Provision of personal data is voluntary, and the failure of their provision will result in lack of possibility of cooperation with service partner/ its personnel (including couriers in the first place).

• entities from DHL group for internal administrative purposes
• third parties offering additional services to service partners/ its personnel (including couriers in the first place), such as group insurance, other benefits and entities participating in organization of business travel;
• third parties with relation to fulfillment of Your obligations, for instance common services for HR department, providing trainings and vocational trainings, recruitment and HR management, IT infrastructure support and maintenance, legal advisory, analysis of users behavior, order handling, compliance verification (audits), trainings and developments – whereas such entities process personal data as subcontractors, on the basis of agreement with DHL Express and exclusively on its instructions, i.e. for instance: independent external representatives, service providers, suppliers, partners, distributors, postal and operational services providers, providers of documentation management services;
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

Customer Representatives Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.

We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Kazimierz Stefański, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address: 
pl.dhlexp.iod@dhl.com or through application form available on the following website: www.dhl.com.pl

Processing Period

Personal data that You have provided will be stored for the period of provision of service to You by the Controller as well as for the period of handling potential compliant and until time of prescription of potential claims expires or an obligation to store data, according to law provisions expires, especially obligation to store accounting documents.

In case of profiling we will use data for this purpose until You object to such processing.

• to conclude and perform contract on package delivery including additional services and managing Your packages – the legal basis of processing is necessity of data processing in order to enter into and perform the contract, according to art. 6 (1) letter b) of the GDPR.
• to handle lodged compliant – legal basis for processing is necessity of data processing for the performance of the contract, according to art. 6 (1) letter b) of the GDPR.
• control over export and import of strategic goods – legal basis for data processing is necessity to fulfill legal obligation imposed on the Controller, according to art. 6 (1) letter c) of the GDPR, and specifically the Act of 9th November 2000 on foreign trade in goods, technologies and services of strategic importance to state security and to preserve international peace and security.
• fulfillment of obligations deriving from law provisions by the Controller – specifically the Act of 29th September 1994 on accounting – the legal basis for data processing is necessary to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR.
• counteracting money laundering and terrorism financing – the legal basis is necessity to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR, specifically the Act of 1st March 2018 on money laundering and counteracting terrorism.
• pursuing claims concerning the agreement entered into – the legal basis for processing is necessity of processing in order to fulfill legitimate interests of the Controller, where these legitimate interests are the possibility to pursue claims according to civil law and before amicable courts, contained in art. 6 (1) letter f) of the GDPR.
• direct marketing of Controller own products and services, including for statistics purpose and for the purpose of profiling. The legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are direct marketing of the Controller own products and services, according to art. 6 (1) letter f) of the GDPR.
• profiling in order to identify the preferences or needs with relation to products and services and presenting adequate offer –the legal basis for processing is legitimate interests of the Controller, where these interests are direct marketing of own products and services, according to art. 6 (1) letter f) of the GDPR.
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay. Provision of personal data is voluntary, but necessary in order to conclude and perform the contract between You and DHL Express concerning package delivery as well as services and additional products.

Data provided by You will be disclosed to:

• partners cooperating with DHL Express with regard to package delivery, including couriers and other carriers, as well as partner customer services as well as entities maintaining drop-off and parcel-pick machines.
• entities from DHL group, that provide various services to DHL Express, such as accounting, debt collection or IT services and support the process of packages delivery, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• in case where package insurance has been purchased, Your personal data will be disclosed to insurance company cooperating with DHL.
• DHL Express partners supporting marketing processes, including marketing agencies, hosting service provider, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

You have:

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

Electronic Shipping Solution User Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.
We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. zo .o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Kazimierz Stefański, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address: 
pl.dhlexp.iod@dhl.com or through application form available on the following website: www.dhl.com.pl

Processing Period

Personal data that You have provided will be stored for the period of provision of service to You by the Controller as well as for the period of handling potential compliant and until time of prescription of potential claims expires or an obligation to store data, according to law provisions expires, especially obligation to store accounting documents.

Data provided by You can be processed for the following purpose:

• to conclude and perform contract on package delivery including additional services and managing Your packages – the legal basis of processing is necessity of data processing in order to enter into and perform the contract, according to art. 6 (1) letter b) of the GDPR.
• fulfillment of obligations deriving from law provisions by the Controller – specifically the Act of 29th September 1994 on accounting – the legal basis for data processing is necessary to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR.
• counteracting money laundering and terrorism financing – the legal basis is necessity to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR, specifically the Act of 1st March 2018 on money laundering and counteracting terrorism.
• Direct marketing of Controller own products and services, including for statistics purpose and for the purpose of profiling. The legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are direct marketing of the Controller own products and services, according to art. 6 (1) letter f) of the GDPR.
• profiling in order to identify the preferences or needs with relation to products and services and presenting adequate offer –the legal basis for processing is legitimate interests of the Controller, where these interests are direct marketing of own products and services, according to art. 6 (1) letter f) of the GDPR.
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay.

Provision of personal data is voluntary, but necessary in order to conclude and perform the contract between You and DHL Express concerning package delivery as well as services and additional products.

• partners cooperating with DHL Express with regard to package delivery, including couriers and other carriers, as well as partner customer services as well as entities maintaining drop-off and parcel-pick machines.
• entities from DHL group, that provide various services to DHL Express, such as accounting, debt collection or IT services and support the process of packages delivery, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• In case where package insurance has been purchased, Your personal data will be disclosed to insurance company cooperating with DHL.
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

You have:

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

Employees Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.

We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Kazimierz Stefański, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address: 
pl.dhlexp.iod@dhl.com or through application form available on the following website: www.dhl.com.pl

Processing Period

Your personal data will be stored for the period of Your employment and subsequently for the period set out by the labour law provisions and other sector-specific laws, i.e. accounting law, tax law, social insurance law.

When personal data are processed on the basis of Your consent, the Controller will store Your personal data until withdrawal of consent. The Company will stop to process personal data on the basis of its legitimate interests if You object to process data for those purposes.
In case of profiling we will use data for this purpose until You object to such processing.

Data provided by You can be processed for the following purpose:

• to conclude, perform and terminate employment contract - the legal basis of processing is necessity of data processing in order to enter into and perform the contract, according to art. 6 (1) letter b) of the GDPR.
• performing activities related to possible disciplinary liability of the employees, liability of the employee for damage against the employer, liability of the employee for employer assets, including establishing and pursuing possible claims – legal basis for processing is art. 6 (1) letter b) of the GDPR.
• where consent has been given, for the purpose of publication of Your image for internal and external communication (for instance electronic mail, Intranet, company newspaper Express News and others) – on the basis of art. 6 (1) letter a) of the GDPR.
• fulfilling obligations deriving from the Act of 26th June 1974 Labour Coder and its implementing acts, which include keeping archive of personal files – the legal basis for data processing is law provision and legal obligation imposed on the controller contained in art. 6 (1) letter c) of the GDPR.
• fulfilling obligations deriving from provisions on: social insurance, health insurance, work accidents, company employee benefit fund, accounting, general defense obligation and from other obligations, due to the law provisions – the legal basis for processing is legal obligation imposed on the Controller – art. 6 (1) letter c) of the GDPR.
• disclosure of personal data to entities authorized on the basis of law, as well as to the entities, that data have to be disclosed to, in order to use special rights provided for in the labour law by the employees - the legal basis for processing is legal obligation imposed on the Controller – art. 6 (1) letter c) of the GDPR.
• work results management, including profiling for statistics and development purposes – the legal basis for processing is legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), where the legitimate interests are optimal use of employees potential.
• taking actions concerning obligations and responsibility of the employee, non-competition clause, employee professional qualifications, including trainings – the legal basis for processing is necessity of processing for the purpose of entering into and performance of the contract, according to art. 6 (1) letter b) of the GDPR as well as necessity for the legitimate interests of the Controller, where these legitimate interests of the Controller are taking care of the highest possible level of its personnel.
• personnel management, planning and analysis of the employment, managing assets given to the employee, organizing and financing of business travels and business credit cards, payment and management of remuneration, tasks assignment, employee assessment – the legal basis for processing is necessity of data processing for the purpose of legitimate interests of the Controller, where the legitimate interests of the Controller is taking care of possible highest level of management and other employees (art. 6 (1) letter f) of the GDPR).
• development management, including profiling for statistics and business purposes – the legal basis for processing is legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), which are the optimal use of employees potential.
• organizing and co-financing of additional services for employees and their family members or partners (for instance group life insurance, health insurance, benefit system, etc.) – the legal basis for processing are legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), where the legitimate interests are to ensure best possible working conditions for employees.
• ensuring security in the premises belonging to the Company (including publication of image on ID cards and access cards) – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where this legitimate interests are to ensure security in the Company premises (art. 6 (1) letter f) of the GDPR).
• ensuring security of information and obeying professional secrecy – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where this legitimate interests are to ensure proper protection of information and professional secrecy.
• financial, administrative and IT service, including creating and maintaining accounts in IT systems and enabling tele-work – the legal basis for processing is necessity to pursue legitimate interests of the Controller, where this legitimate interests of the Controller are enabling functioning of the Company, coordination of their actions and internal administrative purposes (art. 6 (1) letter f) of the GDPR).
• ensuring cooperation and communication on the capital group level and with the external entities that provide services to the Company, including global scale cooperation (for instance corporate books, planning and analysis of the employment) - the legal basis for processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are enabling global scale cooperation and fulfillment of internal purposes.
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay.

Provision of personal data is mandatory, where it derives from law provisions, and failure of their provision will result in lack of possibility of entering into employment contract. Provision of other personal data is voluntary, and failure of their provision will result in lack of possibility of fulfillment of particular purposes indicated above.

Data provided by You will be disclosed to:

• Entities from DHL group for internal administrative purposes
• Entities from DHL group, that provide various services to DHL Express, such as accounting, debt collection or IT services, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• third parties offering additional services to employees such as group insurance, other benefits and entities participating in organization of business travel;
• third parties with relation to fulfillment of Your obligations concerning employment, for instance common services for HR department, providing trainings and vocational trainings, recruitment and HR management, IT infrastructure support and maintenance, legal advisory, analysis of users behavior, order handling, compliance verification (audits), trainings and developments – whereas such entities process personal data as subcontractors, on the basis of agreement with employer and exclusively on its instructions, i.e. for instance: independent external representatives, service providers, suppliers, partners, distributors, postal and operational services providers, providers of documentation management services;
• Company clients and contractors with relation to fulfillment of work
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

Expressing consent is voluntary, therefore You can withdraw it at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

User - Compliant Application Form Concerning VAT Invoice and Duplicates Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.
We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Kazimierz Stefański, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address: 
pl.dhlexp.iod@dhl.com or through application form available on the following website:
 www.dhl.com.pl

Processing Period

Personal data provided by You will be stored for the time necessary to handle Your question concerning compliant and issuing invoice duplicate, as well as for the period of handling potential compliant and until time of prescription of potential claims expires or an obligation to store data, according to law provisions expires, especially obligation to store accounting documents.

Data provided by You can be processed for the following purpose:

• to handle lodged compliant – legal basis for processing is necessity of data processing for the performance of the contract, according to art. 6 (1) letter b) of the GDPR.
• fulfillment of obligations deriving from law provisions by the Controller – specifically the Act of 29th September 1994 on accounting – the legal basis for data processing is necessary to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR.
• counteracting money laundering and terrorism financing – the legal basis is necessity to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR, specifically the Act of 1st March 2018 on money laundering and counteracting terrorism.
• pursuing claims concerning the agreement entered into – the legal basis for processing is necessity of processing in order to fulfill legitimate interests of the Controller, where these legitimate interests are the possibility to pursue claims according to civil law and before amicable courts, contained in art. 6 (1) letter f) of the GDPR.
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay.
Provision of data is voluntary, but necessary in order to handle Your inquiry.

• entities from DHL group, that provide various services to DHL Express, such as accounting, debt collection or IT services, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

Couriers Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.

We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Kazimierz Stefański, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address: 
pl.dhlexp.iod@dhl.com or through application form available on the following website: www.dhl.com.pl

Processing Period

Your personal data will be stored for the period of cooperation with Service Partners and subsequently for the periods set out in law provisions including, among others: accountancy law, tax law, social insurance law.

When personal data are processed on the basis of Your consent, the Controller will store Your personal data until withdrawal of consent. The Company will stop to process personal data on the basis of its legitimate interests if You object to process data for those purposes.

In case of profiling we will use data for this purpose until You object to such processing.

Data provided by You can be processed for the following purpose:

• to conclude, perform and terminate cooperation agreements with service partners as well as to perform activities concerning obligations and liabilities of service partners and their personnel (including primarily curriers) (art. 6 (1) letter b) of the GDPR).
• for the purpose of publication of Your image for internal and external communication (for instance electronic mail, Intranet, company newspaper Express News and others) – on the basis of art. 6 (1) letter a) of the GDPR.
• law provision – with relation to obligations deriving from those provisions, including Civil Code, provisions on social insurance, health insurance, taxes, work accidents, company employee benefit fund, accounting, general defense obligation (art. 6 (1) letter c) of the GDPR).
• HR and development managing, which includes improvement of qualifications (also on the level of the Group, where the legitimate interests of the Controller is taking care of possible highest level of management and other employees (art. 6 (1) letter f) of the GDPR).
• development management, including profiling for statistics and business purposes – the legal basis for processing is legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), which is the optimal use of employees potential.
• organizing and co-financing of additional services for employees and their family members or partners (for instance group life insurance, health insurance, benefit system, etc.) – the legal basis for processing are legitimate interests of the Controller (art. 6 (1) letter f) of the GDPR), where the legitimate interests are to ensure best possible working conditions for employees.
• ensuring security in the premises belonging to the Company (including publication of image on ID cards and access cards) – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests are to ensure security in the Company premises (art. 6 (1) letter f) of the GDPR).
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay.

Provision of personal data is voluntary, and the failure of their provision will result in lack of possibility of cooperation with service partner/ its personnel (including couriers in the first place).

Data provided by You will be disclosed to:

• entities from DHL group for internal administrative purposes
  
• third parties offering additional services to service partners/ its personnel (including couriers in the first place), such as group insurance, other benefits and entities participating in organization of business travel;
• third parties with relation to fulfillment of Your obligations, for instance common services for HR department, providing trainings and vocational trainings, recruitment and HR management, IT infrastructure support and maintenance, legal advisory, analysis of users behavior, order handling, compliance verification (audits), trainings and developments – whereas such entities process personal data as subcontractors, on the basis of agreement with DHL Express and exclusively on its instructions, i.e. for instance: independent external representatives, service providers, suppliers, partners, distributors, postal and operational services providers, providers of documentation management services;
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

Shipper and Receiver Data Processing

DHL treats personal data processed within its systems and in the framework of its procedures very seriously. We ensure high standard of data security.

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – hereinafter referred to as the GDPR – You will find out how DHL Express process Your personal data below.
We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Kazimierz Stefański, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address:
pl.dhlexp.iod@dhl.com or through application form available on the following website: www.dhl.com.pl
Additional information for the package address:

Data contained in Bill of Lading (data category) have been provided by the sender (shipper).

Processing Period

Personal data that You have provided will be stored for the period of provision of service to You by the Controller as well as for the period of handling potential compliant and until time of prescription of potential claims expires or an obligation to store data, according to law provisions expires, especially obligation to store bill of ladings or accounting documents.

In case of profiling we will use data for this purpose until You object to such processing.

Data provided by You can be processed for the following purpose:

• to conclude and perform contract on package delivery and to handle additional services according to sender or receiver instruction – the legal basis of processing is necessity of data processing in order to enter into and perform the contract, according to art. 6 (1) letter b) of the GDPR.
• ensuring security of persons and assets in the transport – the legal basis for data processing is necessity to fulfill legal obligations imposed on the Controller, according to art. 6 (1) letter c) of the GDPR and specifically:
• in case of road transport of dangerous materials (the Act of 19th August 2011 on the transport of dangerous goods, Journal of Laws of 2011 item 1367).
• in case of air freight of dangerous materials (proclamation of 5th June 2015 of the President of Civil Aviation Authority, Journal of Laws of 2015 item 30)
• Custom declarations according to good intended use – the legal basis for data processing is necessity to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR, and specifically in 1) Regulation of the European Parliament and the Council 952/2013/EC of 9th October 2013 laying down the Union Customs Code 2) Commission Delegated Regulation (EU) 2015/2446 of 28 July 2015 supplementing Regulation (EU) No 952/2013 of the European Parliament and of the Council as regards detailed rules concerning certain provisions of the Union Customs Code; 3) Council Regulation (EC) No 1186/2009 of 16 November 2009 setting up a Community system of reliefs from customs duty; 4) Instruction on completion of custom declaration drafted on the basis of aforementioned provisions published by the National Treasury Administration on the Ministry of Finance website: https://www.finanse.mf.gov.pl/clo/zgloszenia-celne-i-intrastat/zgloszenia-celne/instrukcje; 5) The Regulation of Minister of Finance of 8th September 2016 on custom declarations; 6) The Act of 29th August 1997 Tax law 7) the Act of 11th March 2004 on goods and services tax.
• Fulfillment of obligations deriving from law provisions by the Controller – specifically the Act of 29th September 1994 on accounting – the legal basis for data processing is necessary to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR.
• counteracting money laundering and terrorism financing – the legal basis is necessity to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR, specifically the Act of 1st March 2018 on money laundering and counteracting terrorism.
• pursuing claims concerning the agreement entered into – the legal basis for processing is necessity of processing in order to fulfill legitimate interests of the Controller, where these legitimate interests are the possibility to pursue claims according to civil law and before amicable courts, contained in art. 6 (1) letter f) of the GDPR.
• analytical and statistical – the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR

When we add new purposes of the processing, you will be informed thereof without delay.

Provision of personal data is voluntary, but necessary in order to conclude and perform the contract between You and DHL Express concerning package delivery as well as services and additional products.

• partners cooperating with DHL Express with regard to package delivery, including couriers and other carriers, as well as partner customer services as well as entities maintaining drop-off and parcel-pick machines.
• Entities from DHL group, that provide various services to DHL Express, such as accounting, debt collection or IT services and support the process of packages delivery, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• In case where package insurance has been purchased, Your personal data will be disclosed to insurance company cooperating with DHL.
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

You have:

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.

User – My Bill App

According to requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC - hereinafter referred to as the GDPR - You will find out how DHL Express process Your personal data below.

We would like to inform You that the controller of Your personal data is DHL Express (Poland) Sp. Z o.o., with its registered seat in Warsaw, Wirażowa 37.

The Controller has designated Data Protection Officer - Kazimierz Stefański, that can be contacted in all matters concerning personal data processing and exercising rights related to personal data processing to the postal address of the Controller establishment, electronically to the following e-mail address:
pl.dhlexp.iod@dhl.com or through application form available on the following website: www.dhl.com.pl

Personal data that You have provided will be stored for the period of provision of service to You by the Controller as well as for the period of handling potential compliant and until time of prescription of potential claims expires or an obligation to store data, according to law provisions expires, especially obligation to store accounting documents. Data provided by You can be processed for the following purpose:

• to conclude and perform contract on package delivery including additional services and managing Your packages - the legal basis of processing is necessity of data processing in order to enter into and perform the contract, according to art. 6 (1) letter b) of the GDPR.
• fulfillment of obligations deriving from law provisions by the Controller - specifically the Act of 29th September 1994 on accounting - the legal basis for data processing is necessary to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR.
• to handle lodged compliant - legal basis for processing is necessity of data processing for the performance of the contract, according to art. 6 (1) letter b) of the GDPR.
• counteracting money laundering and terrorism financing - the legal basis is necessity to fulfill legal obligation imposed on the Controller contained in art. 6 (1) letter c) of the GDPR, specifically the Act of 1st March 2018 on money laundering and counteracting terrorism.
• pursuing claims concerning the agreement entered into - the legal basis for processing is necessity of processing in order to fulfill legitimate interests of the Controller, where these legitimate interests are the possibility to pursue claims according to civil law and before amicable courts, contained in art. 6 (1) letter f) of the GDPR.
• analytical and statistical - the legal basis for data processing is necessity to pursue legitimate interests of the Controller, where these legitimate interests of the Controller are analysis and statistics of its actions, according to art. 6 (1) letter f) of the GDPR.

When we add new purposes of the processing, you will be informed thereof without delay.
Provision of data is voluntary, but necessary in order to service provision.

Data provided by You will be disclosed to:

• Entities from DHL group, that provide various services to DHL Express, such as accounting, debt collection or IT services, where such entities process personal data on the basis of agreements entered into with the Controller and exclusively according to its instructions.
• apart from aforementioned entities Your personal data can disclosed exclusively to entities entitled to process Your data on the basis of law provisions.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), i.e. in third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of standard contractual clauses adopted by the European Commission, thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these clauses can be obtained from the controller.

Personal data that You have provided will be disclosed to entities established outside European Economic Area (EEA), it. In third countries. The European Commissions has not adopted adequacy decision, with relation to these countries. Personal data will be transferred to aforementioned entities on the basis of binding corporate rules (BCR), thus ensuring adequate safeguards as regards the protection of privacy and rights and freedoms of the data subject. The copy of these BCR can be obtained from the controller.

• right of access to Your personal data, their rectification, erasure or limiting their processing;
• right to object to process Your personal data, where the legal basis of processing are the legitimate interests of the Controller. In particular You have right to object to processing for the purpose marketing and profiling;
• right to data portability, i.e. to receive from the Controller Your personal data, in a structured, commonly used and machine-readable format where Your personal data are processed for the purpose of concluding and performing the  contract. You can transmit received personal data to another controller.
• right to lodge in a compliant with supervisory authority dealing with personal data protection, which in Poland is the President of Personal Data Protection Office.

In order to exercise aforementioned rights, please contact the Controller or data protection officer of DHL Express, which contact details have been indicated above.