General Philately Privacy Policy

1. Data controller

The data controller for the sender’s data is “Sociedad Estatal Correos y Telégrafos, S.A., S.M.E” (“Correos”), with Spanish Tax ID A-83052407 and registered address at Vía Dublín no. 7 (Campo de las Naciones) 28070 Madrid (Spain). 

In terms of the recipient’s data, Correos will act: 

  1. As data processor when data have been provided by an individual or legal entity subject to data protection regulations; 
  2. As data controller when data have been provided by an entity not subject to data protection regulations. 

 To ensure the proper management of this data processing, Correos has appointed a Data Protection Officer (DPO or DPD) who can be contacted at the following email address regarding any matters related to this issue: dpdgrupocorreos@correos.com

2. Purpose and legitimacy of processing 

Your data is processed for the following purposes: 

A. Provision of the service requested 

The sender’s data will be processed for providing the package delivery, postal delivery and email communication service requested, which, among other activities, implies the following: (i) Your registration as a customer; (ii) Delivery of the communication to the indicated address and, as appropriate, certification of the content and delivery status; (iii) Processing and responding to your queries, questions or claims and (iv) Philately services. 

In turn, the recipient’s data will be processed for completing the delivery and, whenever required by the sender, accrediting reception by: 

  • Recording the name and surname of the receiving party and their ID number, together with a recording of their signature either on paper or using our PDAs. In any event, the receiving party may ask to sign on paper.
  • In addition, and besides the aforementioned procedures, certain senders ask Correos to verify the authenticity of the reliable ID document shown by the receiving party either for compliance with a regulation, for fraud prevention purposes or because, due to the assessment made solely and exclusively by the sender, such validation is proportional and necessary. When providing this service, Correos will restrict itself to following the instructions provided by the sender and will therefore obtain a copy of the reliable identification document and check for any signs of forgery using mechanical reading methods or other verification techniques. Correos will accept no liability for any failure to accredit the receiving party’s identity if the receiving party refuses to allow their identity details and, where applicable, their power to represent the recipient to be checked. The receiving party and/or recipient should contact the sender directly if they wish to lodge a complaint or make a claim in this regard.

For management of the delivery process, and provided that the sender has provided a telephone number and/or email address for the recipient, Correos will make use thereof to contact the recipient and manage the delivery; for example, to inform them of the approximate day and time of delivery or to deal with delivery-related incidents (delays, inabilities to deliver, etc.). The sender expressly states and guarantees to Correos that these data have been provided by the recipient and that the sender has obtained unequivocal consent from the recipient to use said data for the aforementioned purposes.

Whenever the delivery is made to an office of Correos and the identity of the recipient does not match that of the person wishing to receive the delivery, Correos will ask the receiving party to accredit their power to represent the recipient and may keep a copy of any documents shown in this regard.

To provide PHILATELY SERVICES to subscribers NOT registered in the Correos Oficina Virtual,  data will be processed to formalise philately product orders, whether a sporadic order or subscription to one of our collections.

B. Sending offers and promotions about Correos Oficina Virtual products and services

Correos may send you, by electronic means, commercial information on offers, promotions and discounts related to products and services marketed through the Correos Oficina Virtual. 

However, you may object to receiving these types of commercial communications by any of the following means:

  • By ticking the objection box provided when collecting personal data for registering as a user of the service.
  • By sending an email to bajas-comunicaciones@correos.com
  • Through the “Unsubscribe” or similar links that appear in all commercial communications.

In relation to PHILATELY SERVICES, Correos understands that there is a legitimate interest in sending you commercial information (including the Philately Newsletter), by electronic or other means, provided that it includes products and services related to philately. This means you can start new collections, enjoy promotions to complete collections you've already started, or find out more about philately through our philately museum.

However, you may object to receiving these types of commercial communications by any of the following means:

  • By ticking the objection box provided when collecting personal data for registering as a user of the service.
  • By sending an email to filatelia.crm.datos@correos.com
  • Through the “Unsubscribe” or similar links that appear in all commercial communications.

C. Sending offers and promotions about other Correos products and services

If you give your consent, Correos may send you commercial information related to the provision, improvement and updating of our products and services, new rates, and discounts, through any electronic or non-electronic channel.

This commercial information may be generic or personalised. In the latter case it will imply the prior processing of your data in order to profile and characterise you and determine your tastes, preferences and needs, and, based on them, identify the offers that may be of most interest to you.

D. Sending of offers and promotions from Correos Group companies and third-party companies

If you give your consent, Correos may send you, through any electronic or non-electronic channel, offers and promotions from:

  • Other Correos Group companies that provide services related to the sectors of package delivery, added-value postal services, logistics, marketing and telecommunications.
  • Other companies with which Correos has entered into partnership agreements and that may belong to sectors such as telecommunications, finance, wholesale, healthcare or NGOs.

This commercial information may be generic or personalised. In the latter case it will imply the prior processing of your data in order to profile and characterise you and determine your tastes, preferences and needs, and, based on them, identify the offers that may be of most interest to you.

E. Sharing data with other Correos Group companies and third-party companies

If you give your consent, Correos may communicate your data to Correos Group companies and other companies whose sectors are detailed above so that these companies can send you offers and promotions related to their products and services directly without Correos intervening.

F. Enriching your information

If you give your consent, Correos may obtain more information about your characteristics, tastes and needs through the information provided by different external sources like public records, land registry, social networks, geomarketing tools, economic information databases like INFORMA, credit histories like ASNEF, BADEXCUG, etc. in order to make improvements to our products and services and/or adapt or choose the offers for these products and services that best fit your specific profile.

G. Compliance with legal obligations

Some of the various legal obligations assumed by Correos include those derived from applying the postal regulations (Law 43/2010 on the universal postal service, the rights of users and the postal market), the obligation of secrecy of communications (Article 18 of the Constitution), as well as tax law.

In compliance with these obligations, Correos may communicate your data to Public Administrations and courts whenever said information is required for established legal proceedings.

H. Statistical information and satisfaction surveys

Correos has a legitimate interest in knowing the opinion of its customers regarding its products and services, as well as their consumption habits (e.g. the frequency/recurrence of contracting different services), in order to be able to offer products and services that are better in line with their needs, and to improve its current products and services and contracting process.

To achieve the purpose detailed above, Correos may process your data and: 

  • Conduct satisfaction surveys, either by telephone or electronic means, even after you are no longer a customer, in the latter case to find out why you left. If, during the satisfaction survey, a customer states their opinion of the products and services of any of the Correos Group companies, the result of the survey and the identifying information of the participant may be communicated to the Correos Group company in question.
  • Anonymise it, so that the information concerning your consumer habits cannot subsequently be linked to your person, and then carry out statistical and econometric studies (e.g. to know the customer’s life cycle and/or identify models of propensity to abandonment).

3. Type of data processed

A personal data set is processed for the purposes explained in the sections above that can be divided into the following sources and categories:

A. Data provided by customers directly:

When registering and/or requesting service, through filling out the forms provided for such purpose.

The customer ensures that the data given to Correos for the provision of the requested services are accurate and shall communicate any change that may affect them. As a result, the customer is liable to Correos and third parties for any damage or harm caused as a result of not complying with the obligations assumed in this clause.

B. Data collected indirectly:

All data that, having received your consent, Correos collects from the external sources listed above in 2.G.

C. Data derived from service provision:

e.g.: List of products and services contracted in the past and their characteristics, claims or requests for information.

4. Data sharing and international transfers

In general, we do not intend to communicate your data to people outside Correos. However, the following exceptions may occur:

  • To comply with the law, we may be required to share your data with third parties such as public authorities (e.g. law enforcement) or courts.
  • To provide you with the best service for browsing our website and to process your request, we may be required to share your data with other companies in the Correos Group that are engaged in package delivery, added-value postal services, logistics, marketing and telecommunications. So, for example, if you request information about multi-channel direct marketing services, your data will be communicated to NEXEA Gestión Documental S.A., S.M.E to process the response.

Additionally, for international deliveries, and in order to comply with the request made by the sender, Correos must share the sender’s data, the recipient’s data and the description of the merchandise with the customs authorities and postal service operator in the destination country that will be responsible for making the delivery.

In this regard, the sender is informed that both the customs authorities and the postal service operator in the destination country may be located in a country where data protection regulations have not been declared adequate by the European Commission and/or do not provide appropriate safeguards for data processing. You may consult the List of Countries whose data protection regulations provide an adequate level of safety on the website of the Spanish Data Protection Agency and the website of the European Commission. Furthermore, we inform you that the legal grounds for said international data transfers lie in the need to do so for providing the service contracted by the sender, in accordance with Article 49.1.b) of the GDPR.

Similarly, whenever you contract provision of the Paq Premium Internacional service, Correos must share the personal data of the sender, the personal data of the recipient and the description of the merchandise with Cooperativa EMS for the purpose of drawing up statistical reports, improving the quality of this Paq Premium Internacional service and for auditing the provision thereof, in compliance with the regulatory framework of the Universal Postal Union (UPU) and the Internal Regulations of Cooperativa EMS, of which Correos is a member. We inform you that the legal grounds for said international data transfers lie in the need to do so for providing the service contracted by you, in accordance with Article 49.1.b) of the GDPR.

5. Data storage time

For a period of 6 months from the time the cancellation request is made, Correos will offer its users the possibility of recovering their former account. Once that period has expired, the data will be erased in accordance with data protection regulations, which involves blocking them; they will only be available at the request of judges and courts of law, the Public Prosecutor and competent Public Administrations during the limitation period for the actions that could arise. They will subsequently be eliminated. Limitation periods vary depending on the type of service; for example, in general the limitation period for most personal civil actions is 5 years.

Similarly, Correos will block customers who are inactive for a period of 5 years. Users who have registered for the Oficina Virtual service, but have not used it for more than 5 years, will be considered inactive customers.

6. Your rights

Our data protection regulations provide you with a series of rights relating to the data processing involved in our services, and they can be summarised as follows:

  • Right to access: Knowing what type of data we are processing and the type of processing we are carrying out.
  • Right to rectification: Being able to request the modification of your data if they are inaccurate or false.
  • Right to data portability: Being able to obtain a copy of the data being processed in an interoperable format.
  • Right to restrict processing, in those cases provided for by law.
  • Right to erasure: Requesting the deletion of your data when the processing is no longer necessary.
  • Right to oppose: This right allows you, for example, to request for us to stop sending you commercial communications.
  • Right to withdraw the consent given.

You can exercise your rights through any of the following channels:

  1. Postal address: Vía Dublín no. 7 (Campo de las Naciones) 28070 Madrid (Spain)
  2. Email address: derechos.protecciondatos.correos@correos.com

You can find a set of forms that will help you exercise your rights on the website of the Spanish Data Protection Agency (AEPD). Moreover, we inform you that you have the right to file a claim with the control authority (in Spain, the AEPD) if you feel that your rights have been breached.

7. Access to third-party data

Whenever Correos acts as the data processor, it will only process the recipient’s data for completing delivery of the communication or shipment and, where necessary, to accredit the delivery, either by collecting the details of the receiving party or completing additional verification actions when asked to do so by the sender.

Additionally, in order to better provide the service, the telephone number or email address may be used to inform the recipient of estimated delivery dates and handle any incident that may affect them. In this sense, the customer ensures the truthfulness and accuracy of the recipient’s information and, where applicable, confirms having complied with all data protection obligations that may be attributable to them, having obtained the recipient’s consent for Correos to carry out the processing described above, should said consent be necessary.

If the user is a company or professional who provides Correos access to personal data under their responsibility for the provision of any of our services, Correos commits to comply with all the obligations inherent to its position of data processor:

  • It will access and process the data to which it has access subject to the instructions thereof, not using said data for purposes other than service provision. To do so, it may use the services of other third parties (sub-processors), if it becomes necessary for the service provision and contracting operations and/or storage, provided that (i) the new processor is subject to the same terms and conditions (instructions, obligations, safety measures, etc.) and the same formal requirements in terms of the correct processing of personal data and guaranteeing the rights of the individuals involved; (ii) Correos, upon explicit request, makes available a list identifying the sub-processed services and the identity of the sub-processors; and (iii) If the sub-processor is not compliant, Correos will continue to be fully liable.
  • It will implement the proper legal, technical and organisational measures to guarantee a level of security that is proportionate to the risk, in accordance with the provisions of Article 32 of the GDPR and, upon your request, will inform you of the risk assessment methodology used.
  • When the provision of service subject to the contract comes to an end, it will destroy or return the processed data as well as any media or documents containing the data that have been processed, without prejudice to the option to store these data, under due protection, pursuant to the terms of our data protection regulations.
  • It will ensure compliance with all other obligations contained in the data protection regulations.