DPD (UK) - Shipping to the EU

Data Protection Principles

Article 5 of the UK GDPR sets out seven key principles which lie at the heart of the UK General Data Protection Regulation.

Lawfulness, fairness and transparency
An organisation has to advise Data Subjects what data processing will be done and what is processed must match up with how it has been described. There must be a lawful basis for all processing and that must be explained. The transparent way for an organisation to comply with this principle is by making a PRIVACY NOTICE available. Privacy Notices for staff are available on Dave - DPDgroup UK's staff intranet site and also the Information Security site.

Purpose limitations � specific, explicit and legitimate
Personal data can only be obtained for "specified, explicit and legitimate purposes" and personal data can only be used for a specific processing purpose that the Data Subject has been made aware of and no other, without further consent unless there is another legal basis to do so.

Data minimisation
Personal data collected about a Data Subject should be "adequate, relevant and limited to what is necessary"' in relation to the purposes for which they are processed. In other words, no more than the minimum amount of personal data should be processed or kept for specific processing.

Accurate and up to date
Personal data must be accurate and where necessary kept up to date. Every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the purposes for which they are processed, is erased or rectified without delay.

Not kept for longer than is necessary
Personal data must be kept in a form that permits identification of Data Subjects for no longer than necessary and data no longer required should be removed.

Security (organisational and technical)
The UK GDPR requires Data Controllers and Data Processors to handle personal data in a manner ensuring appropriate organisational and technical security of the personal data including protection against unlawful processing or accidental loss, destruction or damage.

Accountability
The UK GDPR requires Data Controllers and Data Processors to be responsible for, and be able to demonstrate compliance with its obligations under the provisions of the Data Protection Laws.

This website is not intended for children and we do not knowingly collect data relating to children.

At DPDgroup UK, we are 100% committed to protecting the privacy and security of the personal data we hold about our Customers, Consignees, and Employees.

Our appointed Data Protection Officer (DPO) is Donna McMullan, who is responsible for overseeing this Privacy Notice and responding to any Data Protection concerns you may have.

It is important that the personal data we hold about you is accurate. Please keep us updated if any of your personal data changes during your relationship with us.

GENERAL INFORMATION

The Data Protection Laws (Data Protection Act 2018, UK GDPR and the EU General Data Protection Regulation) protect the rights and freedoms of living, identifiable individuals known under the Data Protection Laws as Data Subjects.

This Privacy Notice relates to the personal information of the following individuals that is processed by DPDgroup UK:

A 'Customer' is a person or organisation who has a contract with DPDgroup UK to deliver parcels to or collect parcels from a Consignee.

A 'Consignee' is someone who is intended to have a collection or delivery from DPDgroup UK or one of our Customers.

Where DPDgroup UK processes your personal data in the circumstances set out in this Privacy Notice, DPDgroup UK acts as a Data Controller. If you are a Consignee, we recommend that you also refer to the Privacy Notice of our Customer (the company or individual you ordered the goods from) to find out details of how they process your personal data.

All processing activities are subject to the provisions of the Data Protection Laws.

DPDgroup UK must have a legal basis to process your personal information and this Privacy Notice explains what our lawful basis is in respect of each purpose for which we keep and use information about you.

Generally, we are allowed to process your personal information where:

you have provided consent for us to do so;
it is necessary in connection with a contract between us (such as a contract to supply our services to you as a Customer);
it is necessary in order for us to comply with our legal obligations, or
it is necessary for the purposes of a legitimate interest that we or a third party are pursuing, save where we determine that your rights override our interest.

Details of how to contact us if you have any further questions about Data Protection and how we process your personal information can be found in the Contact Us section, below.

CUSTOMER

What information do we collect from you?	How do we use this information?	What is our legal basis for processing your information?	How long do we store your information?
Individual and business contact name	To enter into a contract for delivery	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Billing address	To enter into a contract for delivery & Invoicing	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Business email address	To make contact	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Telephone number	To make contact	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Authorised signatory	To prevent fraud	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Your MyDPD login data	To assist with technical issues	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
MyDPD username and password	To assist with technical issues	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Name, Address (including country) Customer Ref number	Prevent the Export transit of parcels to and from individuals and businesses on international sanction and embargo lists	Legal Obligation	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule

CONSIGNEE

What information do we collect from you?	How do we use this information?	What is our legal basis for processing your information?	How long do we store your information?
Full name	To deliver a parcel to the named person	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Delivery address	To deliver to the address provided to us	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Telephone number	To contact in the event assistance is required to deliver the parcel & provide delivery notifications	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Email address	To provide delivery notifications and delivery experience surveys	Contract and Legitimate Interest	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Safe place (location)	To assist with parcel delivery	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
POD	To confirm delivery	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Name, Address (including country) parcel Number, Customer Ref number	Prevent the Export transit of parcels to and from individuals and businesses on international sanction and embargo lists	Legal Obligation	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
The telephone number used to call us	To record calls that have been made to DPD	Legitimate Interest	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
A recording of all inbound and outbound calls	For training & monitoring	Legitimate Interest	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
The email address used to contact us	To record emails that have been made to DPD	Legitimate Interest	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
A record of all emails you have sent to our Customer Services Team	To deal with any queries or complaints	Legitimate Interest	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule

CONSIGNEE - YOURDPD APP PROFILE

What information do we collect from you?	How do we use this information?	What is our legal basis for processing your information?	How long do we store your information?
Full name	To deliver a parcel to the named person	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Delivery address	To deliver to the address provided to us	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Telephone number	To contact in the event assistance is required to deliver the parcel & provide delivery notifications	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Email address	To provide delivery notifications and delivery experience surveys	Contract and Legitimate Interest	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Delivery preferences	To assist with parcel delivery	Contract	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Ideas submitted via MySpace	To enhance the services if idea is utilised	Consent	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule
Name, Address (including country) parcel Number, Customer Ref number	Prevent the Export transit of parcels to and from individuals and businesses on international sanction and embargo lists	Legal Obligation	For as long as is necessary in line with the Data Protection Laws and DPD UK's Retention Schedule

HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

DPDgroup UK is committed to protecting your personal information and ensuring that we have appropriate technical and organisational measures in place to do so.

As you will be aware, the transmission of information over the internet is inherently insecure, and we cannot guarantee the security of personal information sent over the internet. Once we have received your information, we will use strict procedures and security features to prevent unauthorised or unlawful processing and accidental loss, destruction, or damage of your personal data in line with our global industry-standard ISO 27001 & 27701 certification and accredited policies and procedures.

Where we have given you (or where you have chosen) a password that enables you to access certain parts of our service, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Overseas transfer of personal data

We may transfer your personal information outside the European Economic Area ("EEA") and will only do so if we are satisfied that an adequate level of protection is in place in compliance with the Data Protection Laws.

Third Party Links

You may find links to third-party websites on our websites. These 3rd party websites should have their own Privacy Notices and policies which you should check. We do not accept any responsibility or liability for any processing of your personal data or for their Privacy Notices and policies whatsoever as they are matters outside our control.

HOW YOU CAN HELP TO KEEP YOUR PERSONAL INFORMATION SECURE

We will take all appropriate and adequate measures to ensure that the personal information you provide through our websites and Apps is held and managed securely.

The system used by DPDgroup UK runs on a secure HTTPS platform, and incorporates sophisticated security devices to protect your personal information. However, you can help keep your personal information safe � not just on our website, but whenever you provide information online.

Here are some simple ways you can improve the security of your information:

Ensure that your devices always have the latest security updates;
Use strong passwords and do not reuse them across multiple websites;
Keep your passwords private;
Learn about how email scams operate and exercise caution when using email - learn more here

WHAT RIGHTS DO YOU HAVE IN RESPECT OF YOUR PERSONAL INFORMATION

The Data Protection Laws provide many provisions for you to exercise your Data Subject Rights when an organisation is processing your personal information.

For detailed information relating to your rights under the Data Protection Laws, click here.

Where the processing of your personal information is based on consent, you can withdraw or modify that consent at any time. To do so, please see the Contact Us section below.

Right to be informed

DPDgroup UK has a legal obligation to provide you with clear, informative, and easily accessible information about your personal information and our use of it. This is in the form of this Privacy Notice.

Right of access

You have the right to ask DPDgroup UK to confirm whether we hold any of your personal information. If we do (subject to any exemptions, restrictions, or the request being manifestly unfounded or excessive), you have the right to have a copy of your information and to be informed of the following:

Why we process your information;

The categories of information we process;

With whom we have shared the information;

How long we may hold your information;

Your rights in respect of our processing of your information, including your right to complain to a supervisory authority (which in the UK is the Information Commissioner's Office (ICO)

�

Right to rectification

If we hold information about you that you believe is incorrect or incomplete, you have the right to have inaccurate personal data rectified, or completed if it is incomplete, subject to your identity being verified by DPD.

Right to be forgotten/erasure

We will process your information for the periods set out above. You may request that we erase your information and we will do so if one of the following applies:

The information is no longer needed for the original purpose for which we collected it;

You withdraw your consent for us to process the information (and we have no other legal ground to process it);

You object to us processing your information and we have no overriding reason to continue to do so;

We have processed your information unlawfully;

We are required by law to erase it

�

Right to portability

Also known as data portability, you have the right to obtain a copy of your personal information for your own purposes in certain circumstances (if the processing is based on consent or performance of a contract and the processing of it is carried out by automated means).

This right allows you to move, copy or transfer your personal information more easily from one data controller to another, in a safe and secure way without affecting its usability.

The right only applies to information you have provided to DPDgroup UK as the Data Controller.

Right to object

To direct marketing

You can tell us at any time that you would prefer that we do not use your information for direct marketing purposes. This is an absolute right.

To processing for our legitimate interests or those of a third party

Sometimes, we use your personal information to achieve goals that will help us as well as you. This includes:

When we tell you about products or services that are similar to ones that you have already bought;
When we use your information to help us make our business better;
When we contact you to interact, communicate or let you know about changes we are making

We aim to always ensure that your rights and information are properly protected.

You can tell us at any time that you would prefer that we do not process all or some of your information for our legitimate interests or those of a third party.

You must give specific reasons why you are objecting to the processing of your personal information data based upon your particular situation.

This is not an absolute right, and DPDgroup UK can refuse to comply if:

We can demonstrate compelling legitimate grounds for the processing, which override your interests, rights, and freedoms; or
The processing is for the establishment, exercise, or defence of legal claims;
If an exemption or restriction applies, or if the request is manifestly unfounded or excessive

Right to restrict processing

You have the right to ask us to stop processing your personal information in any way other than simply keeping a copy of it. This right is available where:

You have informed us that the information we hold about you is inaccurate, and we have not yet been able to verify this;
You have objected to us using your information for our legitimate interests and we are in the process of considering your objection;
We have used your information in an unlawful way, but you do not want us to delete your personal information;
We no longer need to use the information, but you need it in connection with a legal claim

Rights in relation to automated decision making including profiling

Any automated decision-making or profiling we undertake is solely for the purpose of tailoring the information which we provide to you.

We will not use automated decision-making or profiling to make any decisions that will have a legal effect upon you or otherwise significantly affect you, and you have the right not to be subject to such decisions.

HOW TO EXERCISE YOUR RIGHTS

You can make a data subject rights request verbally or in writing, including via social media;
To maintain the security of your information, for the right of access requests we will need to reasonably verify your identity before we provide you with a copy of any information we may hold;
We have one calendar month from the date of receipt of your request or receipt of the identification information requested in which to provide you with the information referred to above and copies of your information, which may be extended by an additional two months if the data request is complex or if you submit a number of requests;
We are obliged to inform you within the first month if we need to exercise our right to extend the disclosure period by up to an additional two months;
There is no charge or fee for the provision of this information in the first instance however, manifestly unfounded or excessive requests plus subsequent copies may attract a reasonable administration fee
DPDgroup UK can refuse to provide the information if an exemption or restriction applies, or if the request is manifestly unfounded or excessive

If you wish to exercise any of your data subject rights, please get in touch using the Contact Us section below.

CHANGES TO OUR PRIVACY NOTICE

This Privacy Notice will be reviewed every six months and may be updated from time to time.

Please check back frequently to see any updates or changes to our Privacy Notice.

This Privacy Notice was last updated on 22 December 2021

COMPLAINTS

If you wish to make a complaint about the collection or use of your personal information, please contact us in the first instance so that we may seek to resolve your complaint.

In the event that you are not satisfied with the processing of your personal information, you have the right to lodge a complaint with the relevant supervisory authority, which is the Information Commissioner's Office (ICO) in the UK, at any time.

The ICO's contact details are available here: https://ico.org.uk/concerns/ or write to them at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF.

CONTACT US

If you have any queries, complaints, or requests relating to any Data Protection matters, please contact our DPO at dpo@dpdgroup.co.uk.

You may also write to us at:
Data Protection Officer - DPDgroup UK Ltd, Broadwell Road, Oldbury, West Midlands, B69 4DA

DPD Local Privacy Notice

To direct marketing

To processing for our legitimate interests or those of a third party

Products & Services

About DPD Local

MyDPD Local

Service Updates