Effective date: This Privacy Statement was updated on 1st July 2018 and is effective as of that date.
Introduction - What is the content of this document?
This privacy statement (“Privacy Statement”) applies to any collection and processing of personal data carried out by International Post Corporation SCRL, with registered office at avenue du Bourget 44, 1130 Haeren (Brussels), Belgium, VAT BE 0436.501.681 RPR/RPM Brussels ("IPC", "we", "us", or "our"), as data controller, in particular:
(i) when you interact with IPC (as representative, employee or agent of an IPC member) in relation to the management of its members by IPC;
(ii) when you interact with IPC as representative, employee or agent of an IPC contractor or supplier;
(iii) when you interact with IPC's website at https://www.ipc.be or an IPC website specific to a particular IPC service (the “Sites”) or when you otherwise communicate with IPC, whether online or offline, for information about IPC's activities;
(iv) when you use particular services provided by IPC to its members or non-members (it being noted that, in most cases, in relation to the services provided by IPC to its members/non-members, IPC merely acts as a processor on behalf and under the instructions of such members/non-members, except for certain reporting activities as further detailed below); or
(v) when, as part of the services provided by IPC to its members and non-members in relation to mail consignments, despatches, and items, IPC anonymizes personal data and generates reports and statistics based on anonymized information.
By using IPC's services, accessing this Site or otherwise providing us with your personal data, you confirm that you have read and that you understand the way we collect, process, use and disclose your personal data as described in this Privacy Statement.
For specific processing activities, we may need to obtain your consent to collect and process your personal data. When we need your consent, we will ask you, before you submit personal data or use the relevant sections of the Sites or our services, to confirm electronically that you consent to the related processing activity, as described in this Privacy Statement, by clicking on specific box(es). Your affirmative action in clicking that box signifies that you agree to the relevant processing activity as described in this Privacy Statement. Our records of your acceptance of this Privacy Statement, the date thereof, and of all future amendments to this Privacy Statement, shall be regarded as conclusive and written evidence of your consent.
We collect and process your personal data in accordance with all applicable data protection laws and regulations, in particular, the General Data Protection Regulation (EU) 2016/679 of 27 April 2016 ("GDPR") and applicable supplementing national provisions (the "Data Protection Laws").
This privacy statement explains what information relating to identified or identifiable individuals (personal data) we collect and how we use it, including for which purposes we use such personal data, with whom we may share it and the rights and choices available to you regarding our use of personal data about you. This Privacy Statement also describes how Personal Data about you are secured and how you can contact us about our privacy practices.
Personal Data We Collect
IPC collects the types of personal data described below, depending on your relationship and interaction with us.
If you are a representative, employee or agent of an IPC member or non-member:
- identification data (such as, for example, first name, last name, company, title, function)
- contact details (such as address, e-mail, phone number)
- relation to IPC and areas of interest in IPC
- user account information (login details, user name and password)
- information about use of IPC services (logs)
- enquiries and complaints submitted
If you are a representative, employee or agent of an IPC contractor or supplier:
- identification data (such as, for example, first name, last name, company, title, function)
- contact details (such as address, e-mail, phone number)
- relation to IPC and information about products and services sold to IPC
If you are a user of IPC's Sites including IPC’s public website:
(i) Information you provide us when subscribing to a service or opening an account on our Sites:
- identification data (such as, for example, first name, last name, company, title, function)
- contact details (such as address, e-mail, phone number)
- relation to IPC and areas of interest in IPC
- user account information (login details and user name)
- information about use of IPC services (logs)
- enquiries and complaints submitted
(ii) Information we automatically collect through your use of our Sites:
- Subject to your consent where required by law, we and our third-party service providers may use a variety of technologies that collect and provide information about how our Site is accessed and used. Such information may consist of your internet browser type, operating system, service provider, the webpages you viewed, the time you viewed them and for how long, demographic information about you (such as your age, gender, language, location and interest areas, where available) and what webpages you looked at before viewing the current page. We use this information to get a better idea of how our users interact with our Sites and then tailor and improve our Sites accordingly. Such information generally cannot be linked to you individually, but if we can link it to you then we treat it as Personal Data about you in accordance with this Privacy Policy.
- Certain information is gathered by means of cookies. IPC uses cookies and similar technologies on its Sites as described in our Cookies Policy available at www.ipc.be/about-ipc/privacystatement/cookies. By clicking the "Accept Cookies" button on IPC Cookie Banner, you are agreeing to our use of cookies and similar technologies in line with your current cookie setting and in accordance with our Cookie Policy. If you do not agree to our use of cookies in this way, you should set your browser settings accordingly. You will always be able to withdraw your consent and change your choice by amending your browser settings in the future. If you disable cookies that we use, this may impact your user experience while on this Site.
If you are the sender or recipient of mail consignments, despatches, and items.
(i) IPC may process personal data related to the movement of letters and goods across borders – usually in the postal system, as provided by, and transmitted to, the members and non-members of IPC. In principle, IPC only processes such personal data (such as your identification details, contact details, enquiries, signature, nature and physical description and barcode of postal items, customs data, BIC and IBAN, as well as data relating to the delivery process) on behalf, and under the instructions of, postal operators using IPC' services, as data processor.
(ii) IPC may, however, as data controller, in connection with those services, extract and process certain information relating to mail consignments provided by its members and non-members and processed through IPC's services for statistics, analytics and reporting purposes as defined by IPC. For such purposes, IPC only extracts and further processes non-personally identifiable information, i.e. only information relating to mail consignments not including the sender or recipient's identification details.
Purposes for which We Process Personal Data
IPC processes the personal data detailed above for the following purposes:
(i) Support of IPC members: such as the eligibility, admission and ongoing management of members of IPC, the decision-making process within IPC, invoicing of members, dispute management and compliance with legal obligations;
(ii) Management of IPC's contractors: including the management of the contract with contractors, suppliers or vendors, invoicing, dispute management and compliance with legal obligations;
(iii) Management of users of IPC's Sites and services: including the creation and management of users' online accounts on IPC's Sites and/or services; the improvement of IPC's Sites and/or services; the provision of IPC's newsletter and other information (if requested by a user);
(iv) Reporting and analytics relating to postal services and consignments [and other services]: the production and analysis of performance reports – in which personal data are aggregated and anonymised – for the use of members and non-members, and the provision of features associated with the movement of goods across borders, such as the despatch of a pre-paid return item.
Legal bases of the Processing
The processing activities performed by IPC as described above are justified on the ground of the following legal bases:
(i) the processing is necessary for the performance of a contract between IPC and you or for the performance of a service requested by you, for example, when you register on IPC' s Sites for our services or to receive our newsletter (Article 6, 1, (b) of the GDPR);
(ii) the processing is necessary for the purposes of the legitimate interests pursued by IPC (or third parties to whom personal data may be disclosed) without being overridden by your own interests and fundamental rights and freedoms (Article 6, 1, (f) of the GDPR); such legitimate interests may notably encompass processing your personal data to respond to a query or request for information from you, e.g. to process your requests for information and/or comments on our services, for asking your feedback about your experience of our services, and, to the extent that you allow it, to inform you about services in which you are likely to be interested (e.g. to receive news updates from us); to support our members and non-members; to generate, extract, anonymize and process non-personally identifiable information to provide reporting and statistics on mail services;
(iii) the processing is necessary for compliance with a legal obligation to which IPC is subject (Article 6, 1, (c) of the GDPR) ; or
(iv) we have obtained your prior consent to the processing where such consent is required by law, such as to send you promotional communications about IPC.
If you do not provide the above mentioned personal data, we may not be able to provide you with the services you request from us.
Sharing of Personal Data
Personal data related to the movement of letters and goods across borders is originated by a particular member/non-member and is destined to a particular member/non-member. IPC stores and processes this data and may appoint, after security vetting and signature of a contract with the necessary Data Protection safeguards, suppliers to process the data on its behalf.
When required to achieve the above purposes and grounded on the legal bases described above, IPC may share Personal Data with:
(i) third party services providers acting on our behalf and under our instructions, that provide services to us, in particular web-related services providers and other IT services providers [located in the European Economic Area];
(ii) IPC members and non-member postal operators that have a legitimate interest to receive such information (in particular, reports and analytics) in relation to the performance of postal services;
Except as expressly set forth herein, IPC shall not provide Personal Data about you to other third parties without obtaining your prior permission, unless it is required to do so under a statutory provision or court order. In particular, IPC may disclose Personal Data about you in the following circumstances:
(i) to respond to authorized information requests from law enforcement authorities or the judiciary or when otherwise required or permitted by law;
(ii) to respond to an emergency; or
(iii) otherwise to protect the rights, property, safety, or security of third parties, visitors to the Sites or the public.
The above recipients shall be located within the European Economic Area or another country that is covered by an adequacy decision of the European Commission.
Only a limited number of individuals within IPC (e.g., IPC’s Security Officer, Director Technology, Head of Technology Operations) will be granted access to personal data about you on a need to know basis.
How we protect Personal Data
IPC takes – and requires that any third party services providers and/or processor processing personal data on behalf and under the instructions of IPC takes – appropriate technical and organizational measures to protect personal data about you against accidental or unlawful destruction or accidental loss, misuse, unauthorized access, disclosure, alteration or destruction, and against any other unlawful form of processing of information as defined by applicable Data Protection Laws.
However, please note that no electronic transmission or storage of information is 100% secure. Therefore, despite the security measures that we have put in place to protect personal data about you, we cannot guarantee that loss, misuse, or alteration of data will never occur.
Links to other websites
Our Sites may provide links to other websites for your convenience and information. These websites operate independently from us. We are not responsible for any use of these websites nor for any data processing and privacy practices associated with such websites. We invite you to review these websites' privacy notices if you visit them or provide any personal data to them.
How we may update this Privacy Policy
Except to the extent limited by applicable law, IPC reserves the right, in its sole discretion, to change, modify, and/or add to all or parts of this Privacy Statement, at any time. Any change to this Privacy Statement will be posted on this page and notified to you by e-mail (where appropriate or required by law and to the extent that we have your e-mail address). We shall indicate at the top of the Privacy Statement the date when it was most recently updated.
How long we may keep Personal Data
Personal data about you will not be kept for longer than necessary for the purposes identified herein, generally for up to 10 years after the end of the contractual relationship with you (if any), unless shorter or longer retention periods apply as per applicable statutory obligations.
What are your rights
You, as an individual whose personal data is processed as described in this Privacy Statement, have a number of rights which are summarized in broad terms as laid down in the following list. Please note that exercising these rights is subject to certain requirements and conditions as set forth in applicable law. If you wish to access personal data about you or exercise any of the rights listed below, you should apply in writing to the contact person identified in the Contact section below.
Right of access
You have the right to obtain confirmation from us as to whether or not your personal data is processed, and, where that is the case, to request access to that personal data including, without limitation, the categories of personal data concerned, the purposes of the processing and the recipients or categories of recipients. We do have to take into account the rights and freedoms of others, so this is not an absolute right. If you want to request more than one copy of the personal data, we may charge a reasonable fee based on administrative costs.
Right to rectification
You have the right to obtain from us the rectification or completion of inaccurate or incomplete personal data concerning you.
Right to erasure ('right to be forgotten')
You have the right to obtain from us the erasure of personal data concerning you in certain circumstances as defined under applicable law.
Right to restriction of processing
In certain circumstances as defined under applicable law, you have the right to request that we restrict processing of personal data about you.
Right to data portability
In certain circumstances as defined under applicable law, you have the right to receive personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit that personal data to another controller.
Right to object
In certain circumstances as defined under applicable law, you have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data about you by us and we can be required to no longer process personal data about you unless we demonstrate compelling legitimate grounds for the processing or for the establishment, exercise or defence of legal claims. You also have the right to object at any time to processing of personal data concerning you for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing.
Right to withdraw consent
If you have declared your consent for any personal data processing activities as described in this Privacy Statement, you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to withdrawal of the consent.
How to contact us
If you have any questions or concerns about this Privacy Statement, or if you wish to access personal data about you or exercise any of the rights listed in the "What are your rights" Section above, please send a written request to our address above or, by phone to + 32 11 24 86 37 or by e-mail to [email protected].
You must provide evidence of your identity in order to exercise any of the rights listed in the "What are your rights" Section above.
Any communication from us in relation to your rights as detailed above will be provided free of charge. However, in case of requests that are manifestly unfounded or excessive, in particular because of their repetitive character, IPC may charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or refuse to act on the request.
You also have the right to lodge a complaint with the competent authority, in particular in the Member State of your habitual residence or place of work, of an alleged infringement of the GDPR.