1. Data controller
The data controller is "Sociedad Estatal Correos y Telégrafos, S.A., S.M.E." (hereinafter “CORREOS”), with tax ID number A-83052407 and registered office at Conde de Peñalver, 19 – 28006 Madrid (Spain).
For the purpose of guaranteeing the proper management of said data processing activity, CORREOS has appointed a Data Protection Officer (DPO or DPD) who can be contacted at the following email address regarding any matters related to this issue: dpdgrupocorreos@correos.com
2. Purpose of the processing, legal basis and type of data processed
Your personal data will be processed by CORREOS, as the data controller, for the following purpose and based on the following legal basis:
Description of purpose: Your personal data will be processed to verify the authenticity of the email or text message you have received on behalf of CORREOS, so that you can identify any potential attempts at fraud or identity theft (phishing via email; smishing via text message) that use the name or image of CORREOS.
Data processed for this purpose: Email address or telephone number.
Basis of legitimacy: CORREOS’s legitimate interest in (i) combating fraud involving the use of the CORREOS brand and (ii) preventing data subjects from being harmed when they receive an email or text message sent in the name of CORREOS.
3. Sources from which the personal data originates
The data processed for this purpose is provided by you when you use the verifier.
4. Disclosure of data to third parties
In general, we do not intend to communicate your data to people outside CORREOS. Nonetheless, to comply with the law, we may be required to share your data with third parties such as public authorities (e.g. law enforcement) or courts.
Notwithstanding the above, your data may be shared with CORREOS’s service providers who require access to personal data; these providers will process the data as data processors, in accordance with CORREOS’s instructions and under its supervision.
5. International data transfers
No international transfers of interested parties' personal data are foreseen. However, in the event of any international transfer, it will be carried out in accordance with the criteria and requirements demanded by current legislation, by means of the adoption of appropriate legal guarantees, which may consist of the formalisation with the recipient of the data of (i) Standard Contractual Clauses approved by the European Commission to legitimise the international transfer of data to third countries or (ii) another valid legal instrument that guarantees an adequate level of protection equivalent to that of the European Economic Area.
6. Data storage time
Your personal data will be processed for checking that the email or SMS received by you in the name of CORREOS is genuine. Please be advised that the information used to carry out this check will not be stored on the systems.
7. Your rights
Users may exercise the following rights related to the processing of their data to the extent they are recognised in the data protection regulations applicable at any time:
You can exercise your rights through any of the following channels, indicating the right to be exercised:
1. Postal address: Conde de Peñalver, 19 28006 Madrid (Spain)
2. Email address: derechos.protecciondatos.correos@correos.com
You can find a set of forms that will help you exercise your rights on the website of the Spanish Data Protection Agency (AEPD). Moreover, we inform you that you have the right to file a claim with the control authority (in Spain, the AEPD) if you feel that your rights have been breached.
Correos will provide the requested information within one (1) month from receiving the request. Said period may be extended to two (2) months if necessary based on the complexity and number of requests.