The data controller for the sender’s data is “Sociedad Estatal Correos y Telégrafos, S.A., S.M.E” (“Correos”), with Spanish Tax ID A-83052407 and registered address at Conde de Peñalver, nº 19, 28006 Madrid (Spain).
In terms of the recipient’s data, Correos will act:
To ensure the proper management of this data processing, Correos has appointed a Data Protection Officer (DPO or DPD) who can be contacted at the following email address regarding any matters related to this issue: dpdgrupocorreos@correos.com
Your data is processed for the following purposes:
A. Provision of the service requested
The sender’s data will be processed for providing the package delivery, postal delivery and email communication service requested, which, among other activities, implies the following: (i) Your registration as a customer; (ii) Delivery of the communication to the indicated address and, as appropriate, certification of the content and delivery status; (iii) Processing and responding to your queries, questions or claims and (iv) Philately services.
In turn, the recipient’s data will be processed for completing the delivery and, whenever required by the sender, accrediting reception by:
For management of the delivery process, and provided that the sender has provided a telephone number and/or email address for the recipient, Correos will make use thereof to contact the recipient and manage the delivery; for example, to inform them of the approximate day and time of delivery or to deal with delivery-related incidents (delays, inabilities to deliver, etc.). The sender expressly states and guarantees to Correos that these data have been provided by the recipient and that the sender has obtained unequivocal consent from the recipient to use said data for the aforementioned purposes.
Whenever the delivery is made to an office of Correos and the identity of the recipient does not match that of the person wishing to receive the delivery, Correos will ask the receiving party to accredit their power to represent the recipient and may keep a copy of any documents shown in this regard.
To provide PHILATELY SERVICES to subscribers NOT registered in the Correos Oficina Virtual, data will be processed to formalise philately product orders, whether a sporadic order or subscription to one of our collections.
B. Sending offers and promotions about Correos Oficina Virtual products and services
Correos may send you, by electronic means, commercial information on offers, promotions and discounts related to products and services marketed through the Correos Oficina Virtual.
However, you may object to receiving these types of commercial communications by any of the following means:
In relation to PHILATELY SERVICES, Correos understands that there is a legitimate interest in sending you commercial information (including the Philately Newsletter), by electronic or other means, provided that it includes products and services related to philately. This means you can start new collections, enjoy promotions to complete collections you've already started, or find out more about philately through our philately museum.
However, you may object to receiving these types of commercial communications by any of the following means:
C. Sending offers and promotions about other Correos products and services
If you give your consent, Correos may send you commercial information related to the provision, improvement and updating of our products and services, new rates, and discounts, through any electronic or non-electronic channel.
This commercial information may be generic or personalised. In the latter case it will imply the prior processing of your data in order to profile and characterise you and determine your tastes, preferences and needs, and, based on them, identify the offers that may be of most interest to you.
D. Sending of offers and promotions from Correos Group companies and third-party companies
If you give your consent, Correos may send you, through any electronic or non-electronic channel, offers and promotions from:
This commercial information may be generic or personalised. In the latter case it will imply the prior processing of your data in order to profile and characterise you and determine your tastes, preferences and needs, and, based on them, identify the offers that may be of most interest to you.
E. Sharing data with other Correos Group companies and third-party companies
If you give your consent, Correos may communicate your data to Correos Group companies and other companies whose sectors are detailed above so that these companies can send you offers and promotions related to their products and services directly without Correos intervening.
F. Enriching your information
If you give your consent, Correos may obtain more information about your characteristics, tastes and needs through the information provided by different external sources like public records, land registry, social networks, geomarketing tools, economic information databases like INFORMA, credit histories like ASNEF, BADEXCUG, etc. in order to make improvements to our products and services and/or adapt or choose the offers for these products and services that best fit your specific profile.
G. Compliance with legal obligations
Some of the various legal obligations assumed by Correos include those derived from applying the postal regulations (Law 43/2010 on the universal postal service, the rights of users and the postal market), the obligation of secrecy of communications (Article 18 of the Constitution), as well as tax law.
In compliance with these obligations, Correos may communicate your data to Public Administrations and courts whenever said information is required for established legal proceedings.
H. Statistical information and satisfaction surveys
Correos has a legitimate interest in knowing the opinion of its customers regarding its products and services, as well as their consumption habits (e.g. the frequency/recurrence of contracting different services), in order to be able to offer products and services that are better in line with their needs, and to improve its current products and services and contracting process.
To achieve the purpose detailed above, Correos may process your data and:
A personal data set is processed for the purposes explained in the sections above that can be divided into the following sources and categories:
A. Data provided by customers directly:
When registering and/or requesting service, through filling out the forms provided for such purpose.
The customer ensures that the data given to Correos for the provision of the requested services are accurate and shall communicate any change that may affect them. As a result, the customer is liable to Correos and third parties for any damage or harm caused as a result of not complying with the obligations assumed in this clause.
B. Data collected indirectly:
All data that, having received your consent, Correos collects from the external sources listed above in 2.G.
C. Data derived from service provision:
e.g.: List of products and services contracted in the past and their characteristics, claims or requests for information.
In general, we do not intend to communicate your data to people outside Correos. However, the following exceptions may occur:
Additionally, for international deliveries, and in order to comply with the request made by the sender, Correos must share the sender’s data, the recipient’s data and the description of the merchandise with the customs authorities and postal service operator in the destination country that will be responsible for making the delivery.
In this regard, the sender is informed that both the customs authorities and the postal service operator in the destination country may be located in a country where data protection regulations have not been declared adequate by the European Commission and/or do not provide appropriate safeguards for data processing. You may consult the List of Countries whose data protection regulations provide an adequate level of safety on the website of the Spanish Data Protection Agency and the website of the European Commission. Furthermore, we inform you that the legal grounds for said international data transfers lie in the need to do so for providing the service contracted by the sender, in accordance with Article 49.1.b) of the GDPR.
Similarly, whenever you contract provision of the Paq Premium Internacional service, Correos must share the personal data of the sender, the personal data of the recipient and the description of the merchandise with Cooperativa EMS for the purpose of drawing up statistical reports, improving the quality of this Paq Premium Internacional service and for auditing the provision thereof, in compliance with the regulatory framework of the Universal Postal Union (UPU) and the Internal Regulations of Cooperativa EMS, of which Correos is a member. We inform you that the legal grounds for said international data transfers lie in the need to do so for providing the service contracted by you, in accordance with Article 49.1.b) of the GDPR.
For a period of 6 months from the time the cancellation request is made, Correos will offer its users the possibility of recovering their former account. Once that period has expired, the data will be erased in accordance with data protection regulations, which involves blocking them; they will only be available at the request of judges and courts of law, the Public Prosecutor and competent Public Administrations during the limitation period for the actions that could arise. They will subsequently be eliminated. Limitation periods vary depending on the type of service; for example, in general the limitation period for most personal civil actions is 5 years.
Similarly, Correos will block customers who are inactive for a period of 5 years. Users who have registered for the Oficina Virtual service, but have not used it for more than 5 years, will be considered inactive customers.
Our data protection regulations provide you with a series of rights relating to the data processing involved in our services, and they can be summarised as follows:
You can exercise your rights through any of the following channels:
You can find a set of forms that will help you exercise your rights on the website of the Spanish Data Protection Agency (AEPD). Moreover, we inform you that you have the right to file a claim with the control authority (in Spain, the AEPD) if you feel that your rights have been breached.
Whenever Correos acts as the data processor, it will only process the recipient’s data for completing delivery of the communication or shipment and, where necessary, to accredit the delivery, either by collecting the details of the receiving party or completing additional verification actions when asked to do so by the sender.
Additionally, in order to better provide the service, the telephone number or email address may be used to inform the recipient of estimated delivery dates and handle any incident that may affect them. In this sense, the customer ensures the truthfulness and accuracy of the recipient’s information and, where applicable, confirms having complied with all data protection obligations that may be attributable to them, having obtained the recipient’s consent for Correos to carry out the processing described above, should said consent be necessary.
If the user is a company or professional who provides Correos access to personal data under their responsibility for the provision of any of our services, Correos commits to comply with all the obligations inherent to its position of data processor: