Privacy Notice for the Postal Services of Hermes Germany GmbH
You can find the privacy policy for the postal services of Hermes Germany GmbH here .
Privacy Policy for myhermes.de
We, Hermes Germany GmbH (“Hermes”), take the protection of your privacy and your personal data very seriously. We therefore place great importance on ensuring that your data is secure and that data processing complies with applicable data protection regulations, in particular the EU General Data Protection Regulation (GDPR). Furthermore, we use technical and organizational measures to ensure that your data is optimally protected against unauthorized access by third parties.
This privacy policy applies to the online offering of Hermes myhermes.de and all subdomains (hereinafter “Hermes website”).
1 General Information
1.1 Data Controller
Hermes Germany GmbH
Essener Bogen 1
22419 Hamburg
Email:
zentrale@myhermes.de
For more information, please see our Legal Notice.
1.2 Contact Information for the Data Protection Officer
The Data Protection Officer
Hermes Germany GmbH
Essener Bogen 1
22419 Hamburg
Email:
Datenschutz@hermesworld.com
The following information applies to all procedures described. Any deviating provisions will be specified in the respective procedure description, if applicable.
1.3 Personal Data
Personal data—the law also refers to personal information and data that can be linked to an individual—is personal information that allows your identity to be determined. This includes, for example, information such as your name, address, phone number, or email address, as well as information about your browsing behavior, provided that this information can be directly or indirectly attributed to you.
1.4 Data Transfer to Third Parties, Subcontractors, and Third-Party Providers
Personal data is transferred to third parties only in accordance with legal requirements. We only disclose user data to third parties when necessary or for other purposes where the transfer is required to fulfill contractual obligations. Furthermore, it may be necessary to forward your data to authorities (e.g., tax offices or law enforcement agencies) in accordance with a legal obligation (Art. 6(1)(c) GDPR) in order to respond to their inquiries.
If we use subcontractors for our online services, we have taken appropriate contractual precautions as well as corresponding technical and organizational measures with regard to these companies.
If we use content or other resources from other companies (hereinafter collectively referred to as “third-party providers”) and their registered office is located in a third country, it can be assumed that a data transfer to the third-party providers’ countries of residence takes place. We transfer personal data to third countries only if an adequate level of data protection is ensured, the user has given consent, or there is another legal basis for such transfer.
1.5 Data Security
We have implemented appropriate technical and organizational measures to protect your data from loss, alteration, or unauthorized access. We continuously improve these security measures in line with technological advancements. Our website uses the industry-standard SSL (Secure Sockets Layer) for encryption. This ensures the confidentiality of your personal information over the internet.
All our employees receive regular training on data protection and are instructed on the secure and trustworthy handling of customer data. All our employees are bound by confidentiality and have signed a confidentiality and data protection agreement in their employment contracts.
1.6 Legal Basis
Hermes Germany GmbH operates as a postal service provider on behalf of commercial senders and private individuals, and in particular handles the pickup, transport, and delivery of shipments for them.
We collect and process your personal data based on the following legal grounds of the General Data Protection Regulation (GDPR), as well as the Postal Act (PostG) and the Telecommunications and Digital Services Data Protection Act (TDDDG):
Consent pursuant to Art. 6(1)(a) GDPR. Consent is any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Necessity for the performance of a contract or the implementation of pre-contractual measures pursuant to Art. 6(1)(b) GDPR. We require your data to prepare for the conclusion of a contract with you or to fulfill our contractual obligations toward you.
Processing to fulfill a legal obligation pursuant to Art. 6(1)(c) GDPR. The processing of your data is therefore required, for example, by law or other regulations.
Processing to safeguard legitimate interests pursuant to Art. 6(1)(f) GDPR. This means that processing is necessary to safeguard legitimate interests on our part or on the part of third parties, unless your interests or fundamental rights and freedoms, which require the protection of personal data, prevail.
Necessity for the performance of a task carried out in the public interest pursuant to Art. 6(1)(e) GDPR in conjunction with the provisions of Sections 67 et seq. of the Postal Act. The processing of recipient data and other data for the purpose of proper delivery is carried out to ensure a functioning postal service and is therefore in the public interest.
Pursuant to Section 25 of the TDDDG, the storage of and access to information on the end-user’s terminal equipment is permitted only with the end-user’s clear and comprehensive consent . However, consent is not required if this is necessary solely for the transmission of a message via a telecommunications network or for the provision of an expressly requested digital service
1.7 Your Data Protection Rights
Your rights
With regard to your personal data, in addition to the right to revoke the consents you have granted us, you generally have the following rights:
- Right of access
In accordance with legal requirements, as a data subject, you generally have the right to obtain information free of charge about the data we have stored about you (Art. 15 GDPR). In particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, and the origin of your data, if it was not collected directly from you. - Right to Rectification
If your personal data has been recorded incorrectly or incompletely, you can have it corrected at any time (Art. 16 GDPR). The quickest and easiest way to make the correction is directly in your myhermes.de account. - Right to erasure
You have the right to have your data stored by us erased (Art. 17 GDPR). If you wish to have your personal data erased, we may be required by law to retain this data for a certain period of time due to statutory retention obligations, such as for tax or accounting purposes. There may also be other legal obligations and rights that require us to continue storing the data. In such cases, we will delete the data immediately after the respective retention period expires. - Right to Restriction of Processing
You have the right to restrict the processing of your data (Art. 18 GDPR) if you contest the accuracy of the data, the processing is unlawful but you oppose its erasure; we no longer need the data, but you require it to assert, exercise, or defend legal claims; or you have objected to the processing pursuant to Art. 21 GDPR. - Right to data portability
You have the right to receive selected data we have stored about you in a commonly used, machine-readable format or to request that it be transmitted to another controller (Art. 20 GDPR). - Right to object
You have the right to object at any time to the processing of your data that is based on a balancing of interests or in the public interest, if there are grounds for this arising from your particular situation (Art. 21 GDPR). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
Regarding the processing of your personal data described in this Privacy Policy, you may exercise the above-mentioned rights by contacting us at the following address:
Hermes Germany GmbH
Essener Bogen 1
22419 Hamburg
Email: datenschutz@myhermes.de
Right to File a Complaint
You also have the right to file a complaint with a data protection supervisory authority regarding the processing of your personal data by Hermes. The supervisory authority responsible for Hermes Germany GmbH in connection with postal services is:
The Federal Commissioner for Data Protection and Freedom of Information
Graurheindorfer Straße 153, 53117 Bonn
https://www.bfdi.bund.de
For the processing of personal data not related to postal services, the competent supervisory authority for Hermes Germany GmbH is:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22, 20459 Hamburg
https://datenschutz-hamburg.de
Exercising Your Right to Access
Purposes of processing
The purpose of the processing is to provide data access in accordance with Art. 15 GDPR and to enable you to exercise your rights as a data subject.
Type of data
We process the data collected in connection with Hermes’ postal and other services. We also need your personal data to identify you.
Legal Basis
The legal basis for data processing is Article 6(1)(c) of the GDPR.
Retention period
If you request access to your data, we will store your request for 3 years. Earlier deletion is not possible here, based on statutory retention periods.
Obligation to provide your personal data
You are not obligated to disclose your personal data. Without your personal data, it is not possible to provide data access.
1.8 Duration of storage of personal data
We will delete your personal data as soon as the purpose for which it was stored no longer applies and there are no conflicting statutory or contractual retention periods (including those under the German Fiscal Code or the German Commercial Code).
1.9 Processing of your personal data in third countries
We have generally commissioned the processing of your personal data within the European Union. However, your personal data may be processed in the United States of America (USA). We have therefore ensured the level of data protection with appropriate safeguards in accordance with Chapter 5 of the GDPR, specifically Articles 45 and 46 of the GDPR.
1.10 Integration of Artificial Intelligence (AI)
At Hermes, we make targeted use of the potential of Artificial Intelligence (AI) to continuously improve our operational workflows and internal processes, thereby ensuring greater efficiency and reliability throughout our entire value chain.
The protection of your personal data is our top priority. All data processed within the scope of our AI applications undergoes comprehensive anonymization and pseudonymization procedures. This means that we transform your data so that it is either no longer traceable back to you personally (anonymization) or can only be reassigned to a specific person with additional information that is stored separately (pseudonymization). These measures ensure that your privacy is protected at all times and that your data is used exclusively to achieve the stated optimization and quality assurance goals, without any direct personal reference being established.
The sections on the individual applications provide more information on this topic, as well as details on the use of AI in the applications you use.
2. Processing in Connection with the Use of Website Features
2.1 Accessing the website
Processing purposes
The purpose of processing is to ensure the functionality of the website and the security of our IT systems.
Type of data
Each time the Hermes website is accessed, certain data from the accessing device is automatically collected by our web servers. The following data is collected:
- Technical device data (device type, operating system version, browser type, screen resolution, color depth, JavaScript on/off, etc.)
- The IP address of the accessing device
- Date and time of the visit (timestamp)
- User’s internet service provider
- Technical request
- Session ID
- The subpages of our website accessed by the user
- The website from which the respective user visits us (referrer URL)
- Web pages accessed by the user’s system via our website.
Legal basis
The legal basis in this context is Art. 6(1)(f) GDPR, § 25(2)(2) TDDDG. Our legitimate interest in processing the data lies in ensuring the functionality of the website and in securing our systems. Your interest in confidentiality takes a back seat in this regard. Without the processing of your personal data, the provision of the website as well as its operation and security are technically impossible. Securing our website also serves your interests.
Duration of storage
The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected, at the latest after 32 days.
Right to withdraw consent, object, and request deletion
The collection and processing of data for the purposes stated in this section is strictly necessary for the operation of the Hermes website. Consequently, there is no option to object.
Additonal information
The website is hosted by:
Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland
Processing of Your Personal Data in Third Countries
We have generally commissioned the processing of your personal data within the European Union. However, your personal data may be processed in the United States of America (USA). We have therefore ensured the level of data protection through appropriate safeguards in accordance with Chapter 5 of the GDPR, specifically Articles 45 and 46 of the GDPR.
Obligation to provide your personal data
You are not obligated to provide personal data. However, without the personal data mentioned above, you will not be able to access this website.
2.2 Your myhermes Account
You have the option to log in to myhermes.de using your myhermes.de account (“myhermes account”) or to register for one.
With the myhermes account, you can view an overview of the packages you have sent and received, track the shipment of these packages, and create shipping labels with minimal effort. You can also choose whether you would like to receive a package notification. You can also subscribe to our Hermes newsletter.
Processing purposes
We process the personal data collected through your myhermes account to provide you with the features described above. In addition, we use certain categories of data (package classes used, number of packages received, last login, user ID) to personalize the online experience (website and, if applicable, newsletter) to match your interests. If the shipment size you selected is insufficient or incorrect for your shipment, we will use your data to contact you. The purpose of this contact is to adjust the shipment size and to collect the difference in payment because a different package class is required.
Type of Data
For registration, we ask you to provide the following information:
- Name
- Address
- Email address
- Username
Optional information:
- Date of birth
- Phone number
- Mobile number
After successful registration, you will receive a unique Hermes customer number.
Legal basis
The legal basis for data processing in connection with the myhermes account is Article 6(1)(b) of the GDPR. The legal basis for contacting you regarding the adjustment of the package class is Article 6(1)(b) of the GDPR.
Right to rectification
You can correct your data yourself in your myhermes account.
Right to withdraw consent, object, and request deletion
If you do not wish to receive personalized communications, you may object at any time using the contact details provided below. You may specifically object to personalization via a user ID by clicking the opt-out link in the "Mapp Intelligence" section below. A tool will open where you can then uncheck the "Mapp Intelligence" box under "Statistics and Analysis."
If you wish to completely delete your myhermes account, you can easily do so in your myhermes account via the Hermes app or at www.myhermes.de by clicking the “Deactivate User” button.
Processing of Your Personal Data in Third Countries
We have generally commissioned the processing of your personal data within the European Union. However, your personal data may be processed in the United States of America (USA). We have therefore ensured the level of data protection with appropriate safeguards in accordance with Chapter 5 of the GDPR, specifically Articles 45 and 46 of the GDPR.
Obligation to provide your personal data
You are not obligated to provide personal data. However, if you wish to use the aforementioned features, opening a customer account is mandatory.
2.3 eBay Import Tool
Processing purposes
We have integrated the eBay Import Tool from the eBay Developer Program of eBay Inc. – hereinafter “eBay” – into our website. With the eBay Import Tool, you can import eBay shipping addresses into your myhermes account and thus ship eBay sales through us with just a few clicks. A myhermes account for the seller is required for this.
Type of Data
Only the recipient’s data required for shipping is imported, or, if provided by eBay:
- Title/Salutation
- Company name
- Last name
- First name
- Street/House number/Address details
- Zip code/City
- Country
- Phone number
- Status, order quantity, auction number/transaction number
Legal basis
Parcel distribution is carried out on the basis of Article 6(1)(b) of the GDPR.
Duration of storage
The status and order quantity are deleted immediately upon receipt and are not stored. The auction number/transaction number is stored in the myhermes account and is automatically deleted after 90 days. The recipient’s address is stored by us in accordance with the statutory retention periods.
Right to withdraw consent, object, and request deletion
The data import does not delete the above-mentioned data from eBay’s servers. If you wish to delete the data on eBay, please contact eBay directly at: https://www.ebay.de/help/home .
Obligation to provide your personal data
You are not obligated to provide personal data. Without this personal data, the import of eBay shipping addresses into your myhermes account cannot take place.
2.4 Hermes Newsletter for Private Customers
Processing purposes
Regular distribution of the Hermes Private Customer Newsletter via email for the purpose of providing information and news about new products and services.
Type of Data
To send our newsletter, we collect the following data:
- Title (optional)
- First name
- Last name
- Email address
We use your first name here to address you personally.
Legal basis
The legal basis for data processing is Art. 6(1)(a) GDPR or § 25(1) TDDDG.
Duration of storage
The data will be stored until you unsubscribe from the newsletter.
Right to withdraw consent, object, and request deletion
You can unsubscribe at any time, for example by clicking the link provided at the bottom of the newsletter, in the Hermes app, or on myhermes.de. After unsubscribing, your personal data transmitted in this context will be blocked immediately and deleted after the statutory retention periods have expired.
Further information
Our newsletter contains so-called tracking pixels, which enable us to analyse user reach. Tracking pixels are small graphics that are automatically loaded when a webpage or email is opened, allowing us to analyse user behaviour.
This analysis is automated and anonymized, so that no personal reference is established. If you have created a myhermes account, the newsletter may contain personalized content based on your myhermes account data (package classes used, number of packages received, last login). The legal basis for data processing is Art. 6(1)(a) GDPR, your consent to receive the newsletter.
Processing of your personal data in third countries
The Hermes newsletter is sent by:
Salesforce.com Inc.
Salesforce Tower
415 Mission Street, 3rd Floor
San Francisco, CA 94105
Salesforce processes your personal data in the United States. However, any transfer of personal data is carried out in compliance with the conditions set forth in Articles 44–50 of the GDPR and other provisions of the GDPR to ensure that the level of protection afforded to natural persons is maintained.
For more information, please visit:
https://www.salesforce.com/company/privacy/
Obligation to Provide Your Personal Data
You are not obligated to provide personal data. However, without your data, we cannot provide you with our newsletter.
2.5 Contests
Processing purposes
If you participate in a contest, we process your personal data for the purposes of participation, conducting, and concluding the contest on myhermes.de, in our newsletter, and on Instagram.
Type of data
In this context, we process the following data:
- First name, last name, Instagram username (for contests on Instagram)
- Email address
- Depending on the type of contest, additional personal data (e.g., mailing address)
- Contest data (e.g., answers to contest questions)
- Your consent to receive a newsletter (for contests via the newsletter)
- Date of birth
Legal basis
The legal basis for processing personal data to conduct and administer our contest is Article 6(1)(b) of the GDPR.
For some contests, we may process additional information in individual cases—such as age or Instagram username—for the purpose of verifying eligibility to participate in the contest. The legal basis for this is Article 6(1)(b) of the GDPR.
The legal basis for the purpose of advertising via our newsletter is your consent pursuant to Art. 6(1)(a) GDPR.
Right to Withdraw Consent, Object, and Request Deletion
The data will be deleted 4 weeks after the contest has been conducted or, if statutory retention periods prevent deletion, after such periods have expired.
You can unsubscribe from the newsletter at any time, for example by clicking the link provided at the bottom of the newsletter, in the Hermes app, or on myhermes.de. After unsubscribing, your personal data transmitted in this context will be blocked immediately and deleted after the statutory retention periods have expired.
Further Information
The Instagram prize will be shipped by the following service provider on behalf of Hermes:
Upljft GmbH
Vorsetzen 32
20459 Hamburg
Germany
Further information can be found at: https://www.upljft.com/de/datenschutz/
Obligation to Provide Your Personal Data
You are not obligated to provide personal data. However, without this personal data, you cannot participate in a contest.
2.6 Surveys
Processing purposes
To improve our services and troubleshoot issues, we occasionally conduct voluntary surveys/user surveys on myhermes.de. To do so, we ask website users to participate in a survey. The surveys are accessed via a link. Responses are entered via an online form and transmitted to Hermes. Hermes stores these responses and evaluates them. For this purpose, we use the external tool provided by the service provider SurveyMonkey.
Type of data
You can participate in the surveys anonymously. However, if we conduct surveys regarding shipment delivery, we may collect the shipment number in some cases. This is automatically transmitted to Hermes along with the responses when the survey is submitted. If we collect the shipment number, we will indicate this before the survey begins.
However, if you wish to participate in a contest in connection with the survey, we ask that you provide your email address.
Legal Basis
The legal basis for processing is Article 6(1)(a) of the GDPR, namely consent through participation in the survey.
Right to withdraw consent, object, and request deletion
If only anonymous data is collected in the survey, it will be deleted after evaluation. If personal data (e.g., the tracking number) is collected, this will be noted at the beginning of the survey. By participating in the survey, the participant consents to the processing. Collected personal data will be deleted after 30 days. Personal data entered by participants without being requested will not be included by Hermes for evaluation purposes. It will be deleted after 6 months at the latest. Participants are reminded before the surveys not to enter any personal data to protect their privacy.
Further Information
We use the services of the provider SurveyMonkey to conduct the surveys:
Momentive Europe UC
2nd Floor, 2 Shelbourne Buildings
Shelbourne Road, Dublin, Ireland
SurveyMonkey stores the IP addresses of respondents in backend logs. This processing is necessary to safeguard the legitimate interests of SurveyMonkey as a technical service provider for Hermes (Art. 6(1)(f) GDPR).
A personal connection can only be established indirectly if, for example, law enforcement authorities link the IP addresses to the survey responses and identify the owner of the internet connection associated with the IP address used for the survey.
For more information about the data we process, please visit:
https://de.surveymonkey.com/mp/legal/privacy-policy
Processing of Your Personal Data in Third Countries
We have generally commissioned the processing of your personal data within the European Union. However, your personal data may be processed in the United States of America (USA). We have therefore ensured an adequate level of data protection through appropriate safeguards in accordance with Chapter 5 of the GDPR, specifically Articles 45 and 46 of the GDPR.
Obligation to provide your personal data
You are not obligated to provide personal data. If you do not give your consent, you will not be able to participate in the survey.
2.7 Contact
Processing purposes
We use the collected data exclusively for the purpose of responding to your inquiry, as well as for other purposes specified at the time of data collection. If necessary to respond to your inquiry, we will transfer the data to the relevant Hermes company or to our agents. When you contact us via a contact form, by phone, via online chat, or by email, the personal data you provide will be collected and stored. If you contact us by phone, we may ask for your consent to record the conversation for training purposes and to improve service and process quality.
Type of Data
The following data may be collected. Whether this data is collected depends on your inquiry:
- First name
- Last name
- Address
- Shipment number
- Phone number
- Email address
- Bank account information
- Etc.
Legal basis
The legal basis for data processing is Article 6(1)(b) of the GDPR, based on your contract with Hermes. If we record your conversation with our customer service team with your consent for training purposes and to improve service and process quality, the legal basis is Article 6(1)(a) of the GDPR. If there is no contractual relationship between you and Hermes, the legal basis here is Article 6(1)(f) of the GDPR. In this case, Hermes’ legitimate interest outweighs your legitimate interest. The reason for this is that processing your inquiry is not possible without processing your personal data. Furthermore, the use of the contact form or contacting us is voluntary.
Duration of Storage
Calls recorded by customer service are stored for 28 days.
We delete data collected via the contact form, by email, or through our service bot once it is no longer necessary to retain it for the purpose of the contact or—if applicable—in accordance with statutory retention requirements.
Right to withdraw consent, object, and request deletion
If there is a legitimate interest, you may object to the processing at any time for the future via datenschutz@myhermes.de . In the case of an objection, correspondence cannot be continued. All personal data collected in this context will be deleted in the event of a valid objection.
Since telephone calls are recorded for the purposes mentioned above based on your prior consent, you may revoke this consent at any time, effective for the future, via datenschutz@myhermes.de .
Obligation to Provide Your Personal Data
You are not obligated to provide personal data. The fields marked in the input form are required fields; without your input, your request cannot be processed.
2.8 Chat Function
Processing purposes
The chat function is used to establish contact. You can use the chat like a contact form to chat with our service bot or our employees in near real time.
Type of data
When you start the chat, the following personal data is collected:
- Date and time of the request
- Browser type/version
- IP address
- Operating system used
- URL of the previously visited website
- Amount of data sent
- Content of the communication
- Transmission number
- Contact information (if provided, e.g., first name, last name, and email address)
Depending on the course of the conversation with our service bot or our staff, additional personal data may be collected in the chat that you enter yourself. The nature of this data depends heavily on your inquiry or the issue you describe to us. Please provide us only with the data necessary for your inquiry. The processing of all this data serves to provide you with a fast and efficient way to contact us and thereby improve our customer service.
Legal Basis
The processing of your data is based on the following legal grounds:
- Art. 6(1)(a) GDPR: Your consent is based on your use of the chat
- Art. 6(1)(b) GDPR: based on your contract with Hermes.
- Art. 6(1)(f) GDPR: Hermes’ legitimate interest outweighs your legitimate interest in this case. The reason for this is that processing your inquiry is not possible without processing your personal data.
We process your device information in accordance with Section 25(1) of the TDDDG.
Duration of storage
We store the conversation history in text form, the data, and the contact information you provided for a maximum period of 4 months. This serves the purpose of ongoing quality control of our service offerings.
Right to withdraw consent, object, and request deletion
If you do not wish for your data to be stored, please feel free to contact us at datenschutz@myhermes.de . We will then delete any stored conversations immediately.
When submitting your request, please ensure you provide us with your full contact details (first name, last name, and shipment number, if available); this is the only way we can clearly identify you and respond to your request.
Additional Information
When you visit our website, the chat widget is loaded as a JavaScript file from Amazon CloudFront. Technically, the chat widget represents the source code that runs on your computer and enables the chat.
We use the chat software provided by the company:
Userlike UG (limited liability)
Probsteigasse 44-46
50670 Cologne
For more information about the data processed, please visit: https://www.userlike.com/de/terms#privacy-policy
In addition, the technology for the automated processing of your inquiry and the associated data processing for responding to your inquiry and quality assurance is provided or carried out by the following company:
Otto GmbH & Co KG
Werner-Otto-Straße 1-7
22179 Hamburg
Processing of your personal data in third countries
We have generally commissioned the processing of your personal data within the European Union. However, your personal data may be processed in the United States of America (USA). We have therefore ensured the level of data protection with appropriate safeguards in accordance with Chapter 5 of the GDPR, specifically Articles 45 and 46 of the GDPR.
Obligation to provide your personal data
You are not obligated to provide personal data. If you do not give your consent, you will unfortunately not be able to use the chat function.
2.9 Voicebot
Processing purposes
You can use the voicebot to speak with our servicebot in near real-time; your speech is converted into text. This text is transmitted to our servicebot, where it is recognized and a response is generated in the form of text, which is then translated back into speech.
Type of Data
- Content of the communication
- Shipment number
- Contact information (if provided, e.g., first name, last name, and email address)
- Phone number
Depending on the course of the conversation with our service bot, additional personal data may be collected during the process, which you enter yourself. The type of this data depends heavily on your inquiry or the issue you describe to us. Please provide us only with the data necessary for your inquiry. The processing of all this data serves to provide you with a fast and efficient way to contact us and thus improve our customer service.
In addition, the storage of the transcribed data serves the purpose of ensuring the security of our information technology systems.
Legal Basis
The legal basis for data processing is Article 6(1)(b) of the GDPR, based on your contract with Hermes. If there is no contractual relationship between you and Hermes, the legal basis is Article 6(1)(f) of the GDPR. In this case, Hermes’ legitimate interest outweighs your legitimate interest. The reason for this is that processing your request is not possible without processing your personal data. Furthermore, the use of the voicebot is voluntary.
Duration of Storage
We store the transcript of the conversation, the data, and the contact information you provided for a maximum period of 4 months. This serves the purpose of ongoing quality control of our voice service.
Right to withdraw consent, object, and request deletion
If you do not wish for your data to be stored, please feel free to contact us at datenschutz@myhermes.de . We will then delete any stored conversations immediately.
When submitting your request, please ensure you provide us with your full contact details (first name, last name, and shipment number, if available); this is the only way we can clearly identify you and respond to your request.
Further Information
When you call, you will be connected directly to our service bot.
We use transcription software from the company:
VIER GmbH
Hamburger Allee 23
30161 Hanover
For more information about the data processed, please visit:
https://www.vier.ai/datenschutz/
In addition, the technology for the automated processing of your inquiry and the associated data processing for responding to your inquiry and quality assurance is provided or carried out by the following company:
Otto GmbH & Co KG
Werner-Otto-Straße 1-7
22179 Hamburg
Obligation to provide your personal data
You are not obligated to provide personal data. If you do not wish to provide your data, you will not be able to use the voicebot.
2.10 Market Research Surveys
Processing purposes
We use the collected data for market research purposes. The goal is to measure your willingness to recommend Hermes and your satisfaction with Hermes so that we can improve our services. If you are registered as a sender with your email address at myhermes.de and have created a shipping label, we will ask you about your willingness to recommend the Hermes brand through a market research institute we have commissioned.
Type of Data
The following data is processed from you for market research purposes:
- Last name, First name
- Email address
- Shipping number
- Zip code
Legal basis
The legal basis for the processing of your data is Article 6(1)(a) of the GDPR, your declaration of consent upon registration for the myhermes account.
Retention period
Your data will be stored by COGITARIS GmbH for 6 months and deleted after this period. The survey results are not stored by Hermes.
Right to withdraw consent, object, and request deletion
You can opt out of participating in market research at any time. To do so, please use the opt-out link provided in the survey. As soon as you select the option “I do not wish to receive any further emails regarding surveys,” we will automatically remove you from our market research survey. Please note that the opt-out process is not implemented immediately.
Further information
For our market research surveys, we use the market research institute Cogitaris GmbH
Cogitaris GmbH
Sömmeringstraße 14
55118 Mainz
Obligation to provide your personal data
You are not obligated to provide your personal data. If you do not wish to participate in the market research surveys, we ask that you unsubscribe from our newsletter.
2.11 Customer Satisfaction Survey
The customer satisfaction survey is conducted either electronically or verbally, depending on how you contact us.
After contacting us via the myhermes contact form and completing the process, you will receive the customer satisfaction survey via email, provided you have previously consented to the survey via a double opt-in. This also applies if you have already consented and contact Customer Service again.
When contacting Hermes Customer Service by phone, you will be transferred to the customer satisfaction survey after the call. Participation is optional; you may hang up at any time.
Processing purposes
We process the collected data for training purposes and for internal process optimization at Hermes.
Type of data
The following data is processed as part of the customer satisfaction survey:
For an electronic survey:
- IP address
- Last name, first name
- Email address
- Latitude and longitude of the location
- the results of the survey.
For a telephone survey
- Phone number
- the result of the survey.
Legal basis
The legal basis for data processing is Art. 6(1)(a) GDPR or § 25(1) TDDDG. If you participate in the customer satisfaction survey by phone, your consent is implied by starting the survey.
Duration of storage
The data will be stored until you withdraw your consent to the customer satisfaction survey.
Right to withdraw consent, object, and request deletion
If, after the satisfaction survey, you wish to object to data processing and/or withdraw your consent to future customer satisfaction surveys, you may do so by emailing info@myhermes.de .
The double opt-in data and/or the data from the customer satisfaction surveys will then be deleted immediately.
Further information
The customer satisfaction survey is conducted by:
Qualtrics Ireland Limited
Costello House, 1 Clarendon Row
Dublin 2, D0w TA43
(“Qualtrics”)
Obligation to provide your personal data
You are not required to provide personal data. However, without providing your data, you will not be able to participate in our customer satisfaction survey.
2.12 Reporting damage
Processing purposes
The purpose of processing is to record and, if necessary, settle claims, as well as to fully document your claim in order to arrange for payment if required.
Type of data
The following data is processed:
- Title
- Last name
- First name
- Email address
- Mobile number
- Address details
- Street
- House number
- City
- Zip code
- Country
- Bank details
- Photos (outer packaging, inner packaging, label, damaged contents)
- Proof of value (e.g., receipts, invoices, etc.)
All data, except for proof of value, is required.
Legal basis
The legal basis for data processing is Article 6(1)(b) of the GDPR, based on your contract with Hermes. If there is no contractual relationship between you and Hermes, the legal basis is Article 6(1)(f) of the GDPR. In this case, Hermes’ legitimate interest outweighs your legitimate interest. The reason for this is that processing your request is not possible without processing your personal data.
Duration of Storage
Your data will be stored for 18 months, provided that no statutory retention period precludes its deletion.
Right to withdraw consent, object, and request deletion
In the event of a legitimate interest, you have the right to object to the processing at any time with effect for the future. Unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing is necessary for the establishment, exercise, or defence of legal claims.
Further Information
If clarification is needed regarding delivery, pickup, or in the event of a liability claim, we may pass your contact information on to our service partners.
Obligation to Provide Your Personal Data
You are required to provide your personal data. If you do not wish to provide this information, it will not be possible to process the claim.
2.14 PaketShop Finder
Processing purposes
We use HERE Maps to make it easier for you to find PaketShops near you and to view, for example, their opening hours and other PaketShop services. HERE Maps is a web service for displaying interactive maps to visually present geographic information.
You can search for PaketShops near your location only after explicitly consenting the browser or device prompt regarding location access.
Type of data
The following data is used to display the map and perform the location search:
- The entered ZIP code or address, to display the list of PaketShops
- Your location, only after you have explicitly consented to the browser’s location access request
The following data is stored to verify your consent for the map display and location search:
- IP address
- Metadata and display parameters (e.g., timestamps)
- Consent status (Yes/No)
- User ID
Legal basis
The legal basis for the processing of your personal data is Article 6(1)(a) of the GDPR. You have the option to decide whether you wish to provide your consent on a one-time or ongoing basis. If you choose to provide ongoing consent, we will no longer ask for your consent during any future visits to the location search for PaketShops.
Duration of storage
The location retrieval feature does not result in your location being stored by HERE.
Your data will be stored as proof of your consent until you revoke your consent. If statutory retention periods prevent deletion, your data will be retained until those periods expire.
Right to withdraw consent, object, and request Deletion
You can withdraw your consent to the location search at any time in the respective privacy settings of your browser or device, effective for the future.
Additional information
The map is provided by the following service provider:
HERE Global B.V. (parent company)
Kennedyplein 222-226
5611 ZT Eindhoven
Netherlands
Processing of your personal data in third countries
As a general rule, we have commissioned the processing of your personal data within the European Union. However, your personal data may be processed in a so-called third country. We have therefore ensured an adequate level of data protection through appropriate safeguards in accordance with Chapter 5 of the GDPR, specifically Articles 45 and 46 of the GDPR.
Obligation to provide your personal data
You are not obligated to provide your data. If you do not give your consent, we will not be able to use your location.
2.15 Route Navigation with Google Maps
Processing purposes
To use the route feature in our PaketShopFinder and to make it easier for you to find your preferred PaketShop, clicking the “Route” button will redirect you to Google Maps.
Type of data
To save you from having to re-enter the destination address into Google Maps, the following data is transmitted to Google Maps when you click “Route”:
- The address you entered or your location (if you have previously consented to location tracking)
- Destination address of the selected PaketShop
- IP address
- Referrer (address of the location finder website)
Legal basis
The legal basis for the processing of your personal data is Article 6(1)(a) of the GDPR, namely your consent given by clicking the “Route” button.
Duration of storage
We do not link or store the destination address with any other personal data about you.
The retention period depends on your settings in Google. For more information, see here:
https://support.google.com/maps/answer/6258979?hl=de&co=GENIE.Platform%3DDesktop
Right to withdraw consent, object, and request deletion
You can withdraw your consent to location tracking at any time in the respective privacy settings of your browser or device, effective for the future.
Additional information
The data is processed by the following company:
Google Ireland Limited
Gordon House
4 Barrow St, Dublin, D04 E5W5 Ireland
For more information about the data being processed, please visit:
https://policies.google.com/terms?hl=de&gl=de
https://www.google.com/intl/de_US/help/terms_maps/
Processing of your personal data in third countries
When using Google Maps, your personal data may be processed outside the European Union, specifically in the United States of America. Google Ireland Limited is solely responsible for this processing.
Obligation to provide your personal data
You are not required to provide your data. However, without your data, you will not be able to use the route navigation feature.
3. Contact via social media
Hermes Germany GmbH is active on various social networks. These include Instagram, YouTube, LinkedIn, and XING. We aim to engage in active communication with our prospective customers here and provide an opportunity to learn about our services and products. Additionally, we use these platforms to carry out marketing activities. Hermes operates its offerings on these platforms at in accordance with the privacy policies of the respective platform operators and bears no direct responsibility for their data processing. Insights derived from this data are used exclusively for internal purposes. Please note that these platforms are public by nature and that posts made there can generally be viewed by other/all users. Personal and shipment-related data should not be made public there.
3.1 Contacting Us via WhatsApp
Through our website, you have the option to contact us via WhatsApp. This is done by selecting the “Open WhatsApp” button. A window for WhatsApp Web will then open in your browser. WhatsApp is a messaging service provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
To enable you to contact us via WhatsApp, we use the Messenger Communication Platform provided by 360dialog GmbH, Torstraße 61, 10119 Berlin.
Processing purposes
If you contact us via WhatsApp, we or our WhatsApp service bot will use the platform to answer your questions in near real time.
Type of data
The following personal data is collected when the chat begins:
- Phone number
- Content of the communication
- Shipment number
- Contact information (if provided, e.g., first name, last name, and email address)
Depending on the course of the conversation with our service bot, additional personal data may be collected in the WhatsApp chat that you enter yourself. The nature of this data depends heavily on your inquiry or the issue you describe to us. We ask that you only provide us with the data that is strictly necessary to process your inquiry. The processing of all this data serves to provide you with a fast and efficient way to contact us and thus improve our customer service
Legal Basis
The processing of your data is based on the following legal grounds:
- Art. 6(1)(a) GDPR: Your consent is implied by your use of the chat when contacting us via WhatsApp
- Art. 6(1)(b) GDPR: based on your contract with Hermes.
- Art. 6(1)(f) GDPR: Hermes’ legitimate interest outweighs your legitimate interest in this case. The reason for this is that processing your request is not possible without processing your personal data.
Retention Period
Your chat data and your personal data will be stored by us for as long as necessary for the intended purpose. Deletion occurs as soon as the purpose of data collection no longer applies or your consent has been revoked. Stored chats are deleted by us after one month.
Right to withdraw consent, object, and request deletion
If you do not wish for your data to be stored, please feel free to contact us at datenschutz@myhermes.de . We will then delete stored conversations immediately.
When submitting your request, please be sure to provide us with your full contact information (first name, last name, and shipment number, if available); this is the only way we can clearly identify you and respond to your request.
Further information
Please note that when you use WhatsApp, the data you enter is stored by WhatsApp. Your data is stored and processed in accordance with WhatsApp’s standards. If you wish to exercise your data subject rights with WhatsApp, please contact WhatsApp directly.
WhatsApp Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2; Ireland
https://www.whatsapp.com/legal/privacy-policy-eea?eea=1%22
Processing of Your Personal Data in Third Countries
Please note that the use of WhatsApp cannot rule out the processing of personal data in countries outside the European Union and the European Economic Area, particularly in the United States. Under certain circumstances, this may be associated with the risk of more difficult legal enforcement, which poses a risk to the individual user.
Obligation to provide your personal data
You are not obligated to use WhatsApp to make contact or to provide personal data.
3.2 Instagram
We maintain a corporate presence (so-called fan pages) on the social media portal of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
To operate the company profile @hermes_germany on Instagram, Hermes Germany GmbH uses the technical platform and services of Instagram LLC, Menlo Park, CA 94025, USA (“Instagram”). The Instagram service is one of the products provided by Meta Platforms Ireland Limited.
Processing purposes
By presenting our company on Instagram, we aim to actively communicate with you and thus offer you the opportunity to learn about our services and products as well as our Hermes world. In addition, we use the platform to carry out marketing activities. To this end, we utilize the options provided by Instagram for target group-specific targeting and analysis of profile usage (“Insights”).
You also have the option to contact us via Instagram through one-on-one direct messages or publicly in the comments. If you use these contact options, we process the data and information you provide to address your request—the reason for your contact—and to answer your questions.
Information on joint controllership pursuant to Art. 26 GDPR
Meta Platforms Ireland Limited provides our company with statistical data, known as “Page Insights,” which give us insight into user activity on our business pages. The features of an Instagram- business page provided by Meta Platforms Ireland Limited for businesses are a product of Meta Platforms Ireland Limited, which is subject to the provisions of the Instagram Data Policy (see https://privacycenter.instagram.com/policy/), the information regarding Facebook Page Insights (see https://de-de.facebook.com/legal/terms/information_about_page_insights_data), as well as an agreement unilaterally provided by Facebook Ireland Limited within the meaning of Art. 26 GDPR (see https://www.facebook.com/legal/terms/page_controller_addendum).
Hermes Germany GmbH and Meta Platforms Ireland Limited have agreed in the aforementioned agreement that Meta Platforms Ireland Limited is responsible for providing you with information regarding the processing of Page Insights and for ensuring the exercise of your data subject rights (right to access, rectification, portability, and erasure of your data, as well as the right to object to and restrict the processing of your data) in accordance with the GDPR. In your Instagram settings, you can learn more about these rights and also have the option to contact the Data Protection Officer of Meta Platforms Ireland Limited.
Meta Platforms Ireland Limited and Hermes Germany GmbH have agreed that the Irish Data Protection Commission is the competent supervisory authority responsible for monitoring the processing of Page Insights. You have the right at any time to file a complaint with the Irish Data Protection Commission at www.dataprotection.ie or with another supervisory authority.
Type of Data
When you contact us via Instagram, the personal data you provide will be collected and stored depending on the intended purpose. We use the collected data exclusively for the purpose of responding to your inquiries and for other purposes specified at the time of data collection. If necessary to respond to your inquiry, we will also transfer the data to the relevant Hermes company.
The following data is processed when you contact us:
- Master data (e.g., name, address)
- Contact details (e.g., email, phone number)
Meta Platforms Ireland Limited, in turn, processes data points related to your visit to our Facebook company page, which you can read about here at Facebook Ireland Limited https://de-de.facebook.com/legal/terms/information_about_page_insights_data .
Legal basis
The legal basis for data processing is Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. If processing is necessary for the performance of a contract with you or for the implementation of pre-contractual measures, we process your personal data on this basis in response to your inquiry. We process your personal data based on our legitimate interest in communicating with you and responding to your contact request, in continuously optimizing our corporate presence, as well as our legitimate interest in carrying out efficient advertising measures. Our legitimate interest outweighs your interests in this case, as improving our communication channels makes it significantly easier for you to contact us.
Duration of Storage
We delete the data collected in this context as soon as storage is no longer necessary for the purpose of contact (after a maximum of one year), or—in the case of legal retention obligations—restrict processing.
Please note that the data you submit to Instagram is stored on Instagram’s servers. You are responsible for deleting your data there yourself. Changing or deleting data on Instagram does not trigger a corresponding change or deletion on our end.
Right to Withdraw Consent, Object, and Request Deletion
If the processing of your personal data in connection with your contact request was based on our legitimate interest, you have the right to object to the processing of your personal data at any time. In the event of an objection, correspondence cannot be continued. All personal data collected in this context will be deleted in the event of a valid objection.
Further Information
The social media platform Instagram is not operated by us, but by the respective service providers under their own responsibility. Due to the nature of the platform, product ownership and design of Instagram lie with the platform operator Meta Platforms Inc. We have no influence over the data collected by Instagram or its data processing procedures, nor are we aware of the full scope of data collection, the purposes of processing, or the retention periods.
Please note that the processing of personal data in countries outside the European Union and the European Economic Area, particularly in the United States, cannot be ruled out. Under certain circumstances, this may be associated with the risk of more difficult legal enforcement, which poses a risk to individual users.
For more information about the data processed, please visit:
Meta Platforms Ireland Limited
Dublin Ballsbridge Campus
Dublin 4
Ireland
https://de-de.facebook.com/help/instagram/519522125107875
https://privacycenter.instagram.com/policy
Processing of Your Personal Data in Third Countries
We have generally commissioned the processing of your personal data within the European Union. However, your personal data may be processed in the United States of America (USA). We have therefore ensured an adequate level of data protection through appropriate safeguards in accordance with Chapter 5 of the GDPR, specifically Articles 45 and 46 of the GDPR.
3.3 YouTube
By presenting our company on YouTube, we aim to provide you with the opportunity to learn about our company’s products and services through this channel. Additionally, we use YouTube to carry out marketing activities.
The YouTube video platform is not operated by us, but by the respective service providers under their own responsibility. Due to the nature of the platform, product ownership and design of YouTube lie with Google LLC. We have no influence over the data collected by YouTube or its data processing procedures, nor are we aware of the full scope of data collection, the purposes of processing, or the retention periods.
The data is processed by the following company:
Google Ireland Limited
Google Building Gordon House
4 Barrow St, Dublin, D04 E5W5, Ireland
For more information, please visit:
https://policies.google.com/privacy?hl=de&gl=de#infocollect
Please note that the processing of personal data in countries outside the European Union and the European Economic Area, particularly in the United States, cannot be ruled out. Under certain circumstances, this may be associated with the risk of more difficult legal enforcement, which poses a risk to individual users.
4. Use of Cookies and Similar Technologies
The Hermes website uses cookies. By clicking the “Accept” button on the cookie banner or by selecting your individual settings, you consent to Hermes storing cookies and tracking mechanisms on your device or retrieving these cookies and tracking mechanisms from your device. Cookies are small text files that can be stored in the web browser or by the web browser on the user’s device. Cookies typically contain a unique string of characters that enables the browser or device to be uniquely identified when the website is visited again.
- This website uses various types of cookies. These can be divided into:
- Temporary session cookies, which are typically deleted when you close your web browser;
- Persistent cookies, which are stored on your device for a longer period and contain certain settings, such as the language selected for using the Hermes website;
- First-party cookies, which are stored on your device by the Hermes website;
- Cookies from other internet services authorized and used on this Hermes website (so-called third-party cookies), which are stored on your device by those services
The first-party cookies used by this Hermes website include temporary session cookies and permanent cookies. The website stores information in the permanent cookies to save any personal user settings and improve the user experience on the next visit (e.g., the selected language settings). The website stores technical information in the temporary session cookies that is necessary for the website to function. The storage period for these cookies is determined by the timeframes specified in this section.
This website also uses services provided by third parties to analyze user behavior or to provide internet services. The service providers may use cookies (third-party cookies), web beacons, or similar analytics technologies. You can find more detailed information about the internet and analytics technologies used here in the following sections.
In general, the web browser on your device can be configured to prevent the storage of cookies or the use of analytics technologies. However, some features of this website may then no longer be available. Alternatively, the browser can be set to notify you as soon as a cookie or similar analytics technology is used. In addition, all cookies can be manually deleted at any time.
Withdrawal of All Consents
You can fully revoke the consents you have given for the data processing described below via the following tool . This will stop the analytics service from running and will also store an opt-out cookie in the web browser of the device you are using, instructing that no further data from this device should be processed for the aforementioned purposes.
4.1 Usercentrics
Usercentrics is a consent management platform that uses technically necessary cookies. This is done via an entry in the LocalStorage of your respective browser.
Processing purposes
This is a consent management service. The storage of consents serves to comply with legal obligations.
Type of data
This list contains the following (personal) data collected by or through the use of this service:
- Opt-in and opt-out data
- Referrer URL
- User Agent
- User settings
- Consent ID
- Time of consent
- Consent type
- Template version
- Banner language
Legal basis
The legal basis for the processing of the data is Article 6(1)(c) of the GDPR in conjunction with Article 7(1) of the GDPR.
Retention period
Consent data (consent and withdrawal of consent) is stored for three years. Upon expiration of the retention period, the collected data is deleted immediately. This data can be deleted by the user at any time via their browser settings.
Right to withdraw consent, object, and request deletion
Due to the legal obligation to collect the data, an objection is not possible.
Further information
The data controller is:
Usercentrics GmbH
Sendlinger Str. 7
80331 Munich
Germany
For more information about the data processed, please visit:
https://usercentrics.com/de/datenschutzerklaerung/
Processing of Your Personal Data in Third Countries
We have generally commissioned the processing of your personal data within the European Union. However, your personal data may be processed in the United States of America (USA). We have therefore ensured the level of data protection with appropriate safeguards in accordance with Chapter 5 of the GDPR, specifically Articles 45 and 46 of the GDPR.
Obligation to provide your personal data
The provision of your personal data is necessary to fulfill a legal obligation.
4.2 Mapp Intelligence Tag Manager
The Mapp Intelligence Tag Manager is a technically necessary tool for efficiently integrating plugins into the website. These plugins enable the integration of services such as online chat or statistics tools on the website and the setup of the consent service for data-processing applications such as the PaketShopFinder.
Processing purposes
The Mapp Intelligence Tag Manager forms the technically necessary interface to Usercentrics. It is used to control or block tracking scripts, cookies, and tracking mechanisms based on rules. The processing of data serves to comply with legal obligations by storing consents.
Type of data
For technical reasons, IP addresses are generally processed by web servers located in Germany but are not stored. No other data is processed by the Mapp Intelligence Tag Manager, nor can such data be analysed.
The following data is collected when the website is opened:
- Consent Status (true/false)
The following data is processed but not stored.
- IP addresses
Legal basis
The legal bases for the processing of the data are Art. 6(1)(c) GDPR and § 25(2)(2) TDDDG.
Duration of storage
No data is stored.
Right to object and right to erasure
Due to the legal obligation to collect the data, an objection is not possible.
Further information
The data controller is:
Mapp Digital
c/o Webtrekk GmbH
Robert-Koch-Platz 4
10115 Berlin
Germany
For more information about the data processed, please visit:
https://www.webtrekk.com/privacy-notice.htm
Obligation to Provide Your Personal Data
The provision of your personal data is necessary to fulfill a legal obligation.
4.3 AB Tasty
Processing purposes
An A/B test is a testing method used to evaluate two variants of a system, in which the original version is tested against a slightly modified version. A multivariate test is an A/B test with multiple variables.
The purpose of processing is to continuously improve the online offering.
Type of data
When using the Hermes website, AB Tasty collects the following statistical information:
- Pseudonymized usage data (browser used, number of pages viewed, number of visits, order of visits, duration of visits, record of usage of individual web pages)
- IP address for geolocation purposes (regional details of the location). After geolocation, which takes place immediately upon visiting the page, the IP address is deleted immediately.
Legal basis
The legal basis for data processing in this context is Art. 6(1)(a) GDPR or § 25(1) TDDDG, provided that you have consented to the use of cookies on the Hermes website.
Duration of Storage
The cookies set by AB Tasty have a maximum duration of 13 months and are then automatically deleted from the device used. Deleting the cookies anonymizes the collected analytics data, as it can no longer be linked to a cookie ID.
Right to withdraw consent, object, and request deletion
Consent to usage analysis via the AB Tasty web analytics service can be revoked at any time with future effect by unchecking the “AB Tasty” box under the “Statistics and Analysis” category and then saving via the following tool .
As a result, the analytics service will no longer be used, and a cookie named “AB Tasty Opt-out” from the domain myhermes.de will be stored on your device. The AB Tasty analytics service will no longer collect or process any data from your device. This revocation remains in effect until the “AB Tasty” checkbox mentioned above is reactivated.
Further Information
Data is collected via a tracking pixel embedded on the Hermes website (and its subpages) as well as through cookies set by AB Tasty. The data collected enables the analytics service to analyse our visitors’ browsing behaviour and to design the Hermes website in a more customer-oriented manner. The usage analysis is conducted in such a way that neither we nor the analytics service can identify individual users.
The myhermes website uses the service provided by AB Tasty:
AB TASTY SAS (“AB Tasty”)
3 impasse de la Planchette
F-75003 Paris
For more information about the data we process, please visit:
https://www.abtasty.com/de/nutzungsbedingungen/
Processing of Your Personal Data in Third Countries
We have generally commissioned the processing of your personal data within the European Union. However, your personal data may be processed in the United States of America (USA). We have therefore ensured an adequate level of data protection through appropriate safeguards in accordance with Chapter 5 of the GDPR, specifically Articles 45 and 46 of the GDPR. The processing of your personal data may also take place in the United Kingdom. An adequacy decision has been issued by the European Commission for the United Kingdom.
Obligation to provide your personal data
You are not obligated to provide your personal data. Unless you use the above-mentioned function to disable tracking by AB Tasty, your personal data will be processed when you access this website
4.4 Mapp Intelligence
Processing purposes
The analytics service enables us to analyse our users’ browsing behaviour using the collected data. By evaluating the data obtained, we are able to compile information about the use of the individual components of our website. This helps us ensure the integrity of our website and continuously improve its usability and user-friendliness. The usage analysis is conducted in such a way that neither we nor the analytics service can identify individual users.
Type of Data
The following data is processed:
- Technical device data (device type, operating system version, browser type, screen resolution, color depth, JavaScript on/off, etc.)
- Anonymized IP address
- The website from which the respective user visits us (referrer URL)
- Subpages visited on the Hermes website (clicks made by the user)
- Randomly generated session ID by setting a session cookie
- Randomly generated long-term ID by setting a persistent cookie
- Date, time, and duration of the visit
- Geolocation (country, region, city)
- User ID, to which the information stored in the cookies is assigned in a pseudonymized manner, provided that a user has a customer account and is logged in to it.
Legal basis
The legal basis for data processing in this context is Art. 6(1)(a) GDPR or § 25(1) TDDDG, provided that consent has been given for the use of cookies on the Hermes website.
Duration of storage
The data is deleted as soon as it is no longer needed for our analysis purposes. The session cookie with the session ID becomes invalid and is deleted at the end of the website visit. The persistent cookie with the long-term ID becomes invalid and is deleted after 6 months. All data collected by the analytics service is anonymized after 14 months at the latest.
Right to withdraw consent, object, and request deletion
You may object to cookie-based data collection and processing at any time with future effect by unchecking the "Mapp Intelligence" box and then saving your settings via the following tool . The Mapp Intelligence analytics service will no longer collect or process any data from this device using cookies. This objection remains in effect as long as the "Mapp Intelligence" checkbox is not reactivated.
Further Information
Data is collected via a tracking pixel embedded on the Hermes website (and its subpages), as well as through cookies set by Mapp Intelligence.
The data is processed by the following company:
Webtrekk GmbH
Robert-Koch-Platz 4
10115 Berlin
For more information about the data processed, please visit:
https://mapp.com/privacy/
Processing of Your Personal Data in Third Countries
We have generally commissioned the processing of your personal data within the European Union. However, your personal data may be processed in the United States of America (USA). We have therefore ensured an adequate level of data protection through appropriate safeguards in accordance with Chapter 5 of the GDPR, specifically Articles 45 and 46 of the GDPR.
Obligation to provide your personal data
You are not obligated to provide your personal data. If tracking by Webtrekk is enabled via the aforementioned function, your personal data will be processed when you access this website.
4.5 Mapp Marketing Automation
Processing purposes
Using the data collected as described below, the analytics and targeting service "Mapp Marketing Automation" enables us to display personalized content to our users on the Hermes website based on user segments.
Type of data
When using the Hermes website, the following data is processed by our analytics service:
- Technical device data (device type, operating system version, browser type, screen resolution, color depth, JavaScript on/off, etc.);
- Anonymized IP address;
- the website from which the respective user visits us (referrer URL);
- Subpages visited on the Hermes website (clicks made by the user);
- Randomly generated session ID by setting a session cookie;
- Randomly generated long-term ID by setting a persistent cookie;
- Date, time, and duration of the visit.
- Geolocation (country, region, city)
- User ID, to which the information stored in the cookies is assigned in a pseudonymized manner, provided that a user has a customer account and is logged in to it.
Legal basis
The legal basis for data processing in this context is Article 6(1)(a) of the GDPR or Section 25(1) of the TDDDG, provided that consent has been given for the use of cookies on the Hermes website.
Duration of Storage
The data will be deleted as soon as it is no longer needed for our analysis purposes. The session cookie with the session ID is deleted at the end of the website visit. The persistent cookie with the long-term ID expires and is deleted after 6 months. All data collected by the analytics service is anonymized after 14 months at the latest.
Right to withdraw consent, object, and request deletion
Consent to usage analysis and the collection of personalized information on the Hermes website by Mapp Marketing Automation can be revoked at any time with future effect by unchecking the "Mapp Marketing Automation" box in the following tool and then saving the settings.
Further Information
Data is collected via a tracking pixel embedded on the Hermes website (and its subpages) as well as through cookies set by Mapp Intelligence.
The data is processed by the following company:
Mapp Digital Germany GmbH
Dachauer Str. 63, 80335 Munich
For more information about the data processed, please visit:
https://mapp.com/privacy/
Processing of Your Personal Data in Third Countries
We have generally commissioned the processing of your personal data within the European Union. However, your personal data may be processed in the United States of America (USA). We have therefore ensured an adequate level of data protection through appropriate safeguards in accordance with Chapter 5 of the GDPR, specifically Articles 45 and 46 of the GDPR.
Obligation to provide your personal data
You are not obligated to provide your personal data. If tracking by Mapp Marketing Automation is enabled via the aforementioned feature, your personal data will be processed when you access this website.
4.6 Google Ads Conversion
Processing purposes
This Hermes website uses conversion tracking provided by Google Inc. to measure the effectiveness of online advertising. Under the Digital Market Act, platform operators such as Google are required to obtain or have obtained user consent. Google is informed of the consent status of the respective user via an interface.
Type of Data
If a user clicks on a Hermes advertisement placed via Google Ads and this advertisement leads to this Hermes website, a cookie is set on the user’s device.
This cookie allows Google to recognize, on the one hand, that this website user clicked on the ad and was redirected to our website, and, on the other hand, whether this user performed certain actions on our website.
Google uses this information to provide us with anonymized usage statistics about our website. We cannot associate this information with specific users. No personal information regarding the identity of users is transmitted to us.
Once you have given your consent, the following information is transmitted to Google based on Google Consent Mode:
- Timestamp
- Referrer
- User agent and signals regarding ad-click information in the URL (e.g., GCLID)
- Information about the consent status
- Information about the CMP and
- Random numbers generated when the page was loaded.
Legal basis
The legal basis for data processing in this context is Art. 6(1)(a) GDPR or § 25(1) TDDDG, provided that consent has been given for the use of cookies on the Hermes website.
Duration of storage
The cookie set for conversion tracking purposes expires after 30 days and is deleted from the respective device. Within the tool itself, the data is stored for 9–18 months ( https://policies.google.com/technologies/ads ).
Right to withdraw consent, object, and request deletion
Your consent to the analysis of personalized information on the Hermes website by Google can be revoked at any time with future effect by unchecking the "Google Ads Conversion" box in the following tool . You may also object to the collection of your data at any time.
Further Information
The data is processed by the following company:
Google Ireland Limited
Google Building Gordon House
4 Barrow St, Dublin, D04 E5W5, Ireland
For more information about the data processed, please visit:
https://policies.google.com/privacy?hl=de
https://policies.google.com/technologies/ads
Processing of Your Personal Data in Third Countries
We have generally commissioned the processing of your personal data within the European Union. However, your personal data may be processed in the United States of America (USA). We have therefore ensured the level of data protection with appropriate safeguards in accordance with Chapter 5 of the GDPR, specifically Articles 45 and 46 of the GDPR.
Obligation to provide your personal data
You are not obligated to provide your personal data. If tracking via Google Ads Conversion is enabled through the aforementioned feature, your personal data will be processed when you visit this website.
4.7 Bing Ads Conversion
Processing purposes
This Hermes website uses conversion tracking provided by Microsoft Corporation to measure the effectiveness of online advertising. Under the Digital Markets Act, platform operators such as Microsoft are required to obtain users’ consent or ensure that consent is obtained. Microsoft is informed of each user’s consent status via an interface.
Type of Data
If a user clicks on a Hermes advertisement placed via Microsoft Advertising and this advertisement leads to this Hermes website, a cookie is set on the user’s device.
This cookie allows Microsoft to recognize, on the one hand, that this website user clicked on the ad and was redirected to our website, and, on the other hand, whether this user performed certain actions on our website.
Microsoft uses this information to provide us with anonymized usage statistics about our website. We cannot link this information to specific users. No personal information regarding the identity of users is transmitted to us.
Once you have given your consent, the following information is transmitted to Microsoft based on the UET Consent Mode:
- Timestamp
- Referrer
- User agent and signals regarding ad-click information in the URL
- Information about the consent status
- Information about the CMP
- Random numbers generated when the page was loaded.
Legal basis
The legal basis for data processing in this context is Art. 6(1)(a) GDPR or § 25(1) TDDDG, provided that consent has been given for the use of cookies on the Hermes website.
Storage period
The cookie set for conversion tracking purposes expires after 30 days and is deleted from the respective device. Within the tool itself, the data is stored for 6–18 months ( https://privacy.microsoft.com/de-de/privacystatement ).
Right to withdraw consent, object, and request deletion
Your consent to the analysis of personalized information on the Hermes website by Microsoft can be revoked at any time by unchecking the "Bing Conversion" box in the following tool , effective for the future. You may also object to the collection of your data at any time.
Further information
The data is processed by the following company:
Microsoft Ireland Operations Limited
One Microsoft Place, South County Business Park
Leopardstown, Dublin, Ireland 18, D18 P521
For more information about the data processed, please visit:
https://privacy.microsoft.com/de-de/privacystatement
Processing of Your Personal Data in Third Countries
We have generally commissioned the processing of your personal data within the European Union. However, your personal data may be processed in the United States of America (USA). We have therefore ensured the level of data protection with appropriate safeguards in accordance with Chapter 5 of the GDPR, specifically Articles 45 and 46 of the GDPR.
Obligation to provide your personal data
You are not obligated to provide your personal data. However, unless you use the above-mentioned function to disable tracking by Bing Ads Conversion, accessing this website is not possible without the processing of your personal data.
4.8 Adform
Processing purposes
These technologies enable us to measure the success of online advertising and to target Internet users on other websites with advertisements who have already visited this Hermes website, who have already seen our advertising banners on other websites, or who, based on statistical criteria, might be interested in our services.
Type of data
The following data is collected anonymously via a cookie ID, which does not allow any conclusions to be drawn about the respective user or the specific device used:
- Technical device data (device type, operating system version, browser type and version, screen resolution, color depth, JavaScript on/off, etc.)
- Anonymized IP address
- The website from which the respective user visits us (referrer URL)
- Subpages visited on the Hermes website (clicks made by the user)
- Date and time of access
- Advertising ID (association with specific advertising measures and campaigns)
- Geolocation (city, region, country).
Data that could identify the device (e.g., MAC address, IMEI number, etc.) is not collected.
Legal basis
The legal basis for data processing in this context is Art. 6(1)(a) GDPR or § 25(1) TDDDG, provided that consent has been given for the use of cookies on the Hermes website.
Duration of Storage
The cookies or other identifiers (MAID) set in this context expire after 180 days and are deleted from the device.
Right to withdraw consent, object, and request deletion
Consent to usage analysis and the collection of personalized information on the Hermes website may be revoked at any time with future effect by unchecking the "Adform" box in the following tool and then saving the settings.
Further information
The data is processed by the following company:
Adform A/S Denmark
Rosenborggade 15, 2nd floor
1130 Copenhagen K, Denmark
For more information about the data processed, please visit:
https://site.adform.com/privacy-center/overview
Obligation to provide your personal data
You are not obligated to provide your personal data. However, unless you use the above-mentioned function to disable tracking by Adform, accessing this website is not possible without the processing of your personal data.
4.9 Google Maps
Processing purposes
We use Google Maps to help you find package shops near you and to view, for example, their opening hours and other package shop services. Google Maps is a web service for displaying interactive maps to visually represent geographic information.
The interactive map from Google Maps can only be used after you explicitly confirm by clicking the “Activate Map” button. Additionally, when you select the “Route” icon, you will be redirected directly to Google Maps so that you can view your route to the Parcel Shop.
Type of Data
For map display and location search, we transmit the following data to Google:
- The entered ZIP code or address to display the list of PaketShops
- Your location, only after you explicitly confirm the browser prompt for location access
- IP address
Legal basis
Data processing is based on your consent (Art. 6(1)(a) GDPR or § 25(1) TDDDG), which is given by explicitly confirming the “Activate Map” button or by selecting the “Route” icon.
Duration of storage
When you perform a location search, only the search address you entered is transmitted. We do not link or store the search input with any other personal data you provide.
The duration of storage depends on your settings in Google. You can find more information here:
https://support.google.com/maps/answer/6258979?hl=de&co=GENIE.Platform%3DDesktop
Right to withdraw consent, object, and request deletion
Consent can be revoked at any time via the tool under the “Cookies” tab in the footer.
Further Information
The data is processed by the following company:
Google Ireland Limited
Gordon House
4 Barrow St, Dublin, D04 E5W5 Ireland
For more information about the data processed, please visit:
https://policies.google.com/terms?hl=de&gl=de
https://www.google.com/intl/de_US/help/terms_maps/
Processing of Your Personal Data in Third Countries
When using Google Maps, your personal data may be processed outside the European Union, specifically in the United States of America. Google Ireland Limited is solely responsible for this processing.
Obligation to provide your personal data
You are not obligated to provide your personal data. However, if you use the above-mentioned function to disable tracking by Google Maps, accessing this website will not be possible without the processing of your personal data.
4.10 YouTube Remarketing
Processing purposes
We display advertisements based on user behaviour and interest in Hermes YouTube advertisements and the Hermes YouTube channel.
Type of data
Users who have performed one or more of the following actions on YouTube
- watched a video from a channel
- watched specific videos
- watched a video from a channel as an ad
- watched specific videos as ads
- subscribed to a channel
- visited a channel's homepage
- liked a video from a channel
- added a video from a channel to a playlist
- shared a video from a channel.
are tracked on your device using a cookie and/or other identifiers (MAID). This cookie and/or other identifiers (MAID) indicate whether a user has previously interacted with a Hermes ad or the YouTube channel.
Google uses this information to display ads based on user behavior.
Legal basis
The legal basis for the processing of your data is Article 6(1)(a) of the GDPR or Section 25(1) of the TDDDG, as well as your consent to the use of cookies on the YouTube website.
Duration of Storage
The cookie set for remarketing purposes expires after 30 days and is deleted from the respective device. The data is stored in the tool itself for 9–18 months (https://policies.google.com/technologies/ads)
Right to withdraw consent, object, and request deletion
To withdraw your consent, please contact
Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, or visit the following website:
https://myaccount.google.com/intro/privacycheckup
Further information
Your data is processed by the following company:
Google Ireland Limited
Google Building Gordon House
4 Barrow St, Dublin, D04 E5W5, Ireland
For more information, visit:
https://policies.google.com/privacy?hl=de&gl=de#infocollect
Processing of Your Personal Data in Third Countries
Please note that the processing of personal data in countries outside the European Union and the European Economic Area, particularly in the United States, cannot be ruled out. Under certain circumstances, this may be associated with the risk of more difficult legal enforcement, which poses a risk to the individual user.
Obligation to provide your personal data
You are not obligated to provide your personal data.
4.11 Chat Function
The chat function with our customer service is available to you on our contact page, within the FAQ, and in the shipment tracking section after entering the shipment number.
Processing purposes
This cookie is a technically necessary tool that ensures the chat widget functions properly. To this end, a cookie is stored in your browser that only processes your data when you are actively using the chat. Additionally, it allows you to continue a chat that has already begun, even if you have left the page in the meantime.
Type of data
In addition to technical details regarding the messenger status, the cookie contains IDs for existing contacts so that they can be recognized.
- User ID of the contact
- Number of page views and visits
- Timestamp of the last interaction and the last page view
- Last recoverable status of the chat window
- Flag indicating when the user closes the chat window.
Legal basis
The legal basis in this context is Art. 6(1)(f) GDPR, § 25(2)(1) TDDDG. Our legitimate interest in processing this data is to ensure that our customers can contact us quickly and efficiently via our contact pages. Your interest in confidentiality takes a back seat in this context. Without the processing of your personal data, it is not possible to provide the chat service. Quick accessibility also serves your interests.
Duration of storage
The cookie is stored for 24 hours.
Right to withdraw consent, object, and request deletion
The collection and processing of data for the purposes stated in this section is strictly necessary for the operation of the chat function. Consequently, there is no option to object.
Further information
The data is processed by the following company:
Userlike UG (limited liability)
Probsteigasse 44-46
50670 Cologne
For more information about the processed data, please visit:
https://www.userlike.com/de/terms#privacy-policy
Obligation to provide your personal data
You are not obligated to provide personal data. However, without the personal data listed above, you will not be able to access the pages mentioned above.
5. Collaboration with Advertising Partners / Third-Party Cookies (IAB TCF Partners)
Hermes collaborates with service providers that enable Hermes to deliver personalized advertising (e.g., retargeting) on advertising spaces.
These service providers may—once consent has been given—place cookies in your browser, for example, which enable your browser to be recognized.
When advertising is displayed on myHermes.de, the service providers listed below are also used—after you have given your consent—to analyse the effectiveness of the displayed advertising, verify the agreed-upon method of delivery, and provide the advertising materials.
In the context described above, Hermes collaborates with Otto (GmbH & Co KG), Virtual Minds GmbH (Adition and Active Agent), RevJet Corporation, and Flashtalking. These service providers are commissioned directly by the advertiser; after data collection and transmission, these service providers are then independently responsible.
5.1 Adition
On this website, data is collected and stored for marketing and optimization purposes using the Adition ad serving platform provided by Virtual Minds GmbH, Ellen-Gottlieb-Straße 16, 79106, Freiburg im Breisgau (www.adition.com/). Among other things, pseudonymized user profiles may be created from this data. Cookies may be used for this purpose. The data collected using Adition’s ad serving technology is not used by Adition to personally identify visitors to this website.
The following data is processed in this context:
- IP addresses
- Data provided by the user
- Device characteristics
- Approximate location data
- Device ID
- Precise location data
- Probabilistic identifiers
- User profiles
- Browsing and interaction data
- Privacy settings.
More information about the provider’s privacy policy can be found here .
5.2 Virtual Minds
On this website, data is collected and stored for marketing and optimization purposes using Active Agent from Virtual Minds GmbH, Ellen-Gottlieb-Straße 16, 79106, Freiburg im Breisgau (www.adition.com). Among other things, pseudonymized user profiles can be created from this data. Cookies may be used for this purpose. The data collected via Active Agent is not used by Virtual Minds GmbH to personally identify visitors to this website.
The following data is processed in this context:
- IP addresses
- Data provided by the user
- Device characteristics
- Approximate location data
- Device ID
- Precise location data
- Probabilistic identifiers
- User profiles
- Browsing and interaction data
- Privacy settings.
More information about the provider’s privacy policy can be found here .
5.3 Flashtalking
On this website, data is collected and stored using Flashtalking, Schanzenstraße 35, 51063 Cologne (www.flashtalking.com) for marketing and optimization purposes . Among other things, pseudonymized user profiles can be created from this data. Cookies may be used for this purpose. The data collected via Flashtalking is not used by Flashtalking to personally identify visitors to this website.
The following data is processed in this context:
- IP addresses
- Device characteristics
- Device identifiers
- Probabilistic identifiers
- Identifiers derived from authentication
- Browsing and interaction data
- Approximate location data
- User profiles
- Privacy settings.
More information about the provider’s privacy policy can be found here .
5.4 RevJet
This website uses technologies from RevJet Corporation, 981 Industrial Road Suite F, San Carlos, CA 94070, (www.revjet.com) to collect and store data for marketing and optimization purposes. Among other things, pseudonymized user profiles may be created from this data. Cookies and other technologies may be used for this purpose. The data collected by RevJet Corporation is not used to personally identify visitors to this website.
The following data is processed in the course of this:
- IP addresses
- Device ID
- Approximate location data
- User profiles
- Privacy settings.
More information about the provider’s privacy policy can be found here .
5.5 Otto (GmbH & Co KG)
On this website, data is collected and stored using technologies from Otto (GmbH & Co KG), Werner-Otto-Straße 1-7, 22179 Hamburg (www.otto.de) for marketing and optimization purposes. Among other things, pseudonymized user profiles may be created from this data. Cookies and other technologies may be used for this purpose. The data collected by Otto (GmbH & Co KG) is not used to personally identify visitors to this website.
The following data is processed in this context:
- IP addresses
- Device identifiers
- Browsing and interaction data
- Data provided by the user
- User profiles
- Privacy settings
More information about the provider’s privacy policy can be found here .
Further information
The legal basis for data processing in this context is Art. 6(1)(a) GDPR or § 25(1) TDDDG.
The cookies set in this context expire and are deleted from the device after 12 or 24 months at the latest.
Consent to usage analysis and the collection of personalized information on the Hermes website can be revoked at any time with future effect by unchecking the respective partner’s box in the following tool and then saving the settings.
6. Privacy Policy for LinkedIn Message Ad + Lead Ad and Xing Lead Ad
By presenting our company on social media platforms, we aim to actively engage with you and offer you the opportunity to learn about our company’s products and services through these channels. Additionally, we use social media platforms to carry out marketing activities.
You have the option to submit your data to Hermes via LinkedIn and/or Xing so that Hermes can contact you to initiate a customer relationship.
Processing purposes
The purpose of processing is for Hermes to contact you as a preliminary step toward establishing a business relationship. Use for advertising purposes—in particular, contacting you by phone and sending the Hermes newsletter—will only occur if you have expressly consented to this.
In addition, as part of our marketing activities, we use the targeting options provided by social media platforms to address specific target groups.
Type of data
By submitting the embedded form, the following data is transmitted to us: title, first name, last name, company name, email address, and/or phone number.
Data transmission does not result in the deletion of data from the LinkedIn and/or Xing servers. Furthermore, any modification or deletion of data on LinkedIn and/or Xing does not trigger a corresponding modification or deletion on our end.
Legal basis
The legal basis for data processing in connection with LinkedIn Message Ad + Lead Ad and Xing Lead Ad is Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. We process your personal data based on our legitimate interest in communicating with you, in continuously optimizing our corporate presence, and in carrying out efficient advertising measures. If the processing is necessary for the performance of a contract with you or for the implementation of pre-contractual measures, we process your personal data on this basis.
Duration of Storage
If no business relationship is established after initial contact, the data will be deleted by Hermes Germany GmbH within 30 days of the first contact. In the case of a business relationship, the terms and conditions agreed upon at that time apply.
Right to erasure and rectification
You may request access to, modify, or have your data deleted at any time, e.g., by contacting us directly ( myhermes-business@hermesworld.com ).
Further Information
Social media platforms are not operated by us, but by the respective service providers under their own responsibility. Due to the nature of the platform, product control and design of the social media platform lie with the respective social media platform operator. We have no influence over the data collected by the service provider or the data processing procedures, nor are we aware of the full scope of data collection, the purposes of processing, or the retention periods.
For more information about the data processed, please visit:
LinkedIn Ireland Unlimited Company
Wilton Place,
Dublin 2, Ireland
https://www.linkedin.com/legal/privacy-policy
New Work SE (XING)
Am Strandkai 1
20457 Hamburg
https://privacy.xing.com/de/datenschutzerklaerung
Processing of Your Personal Data in Third Countries
Please note that the processing of personal data in countries outside the European Union and the European Economic Area, particularly in the United States, cannot be ruled out. Under certain circumstances, this may be associated with the risk of more difficult legal enforcement, which poses a risk to the individual user.
Obligation to provide your personal data
You are not obligated to provide your personal data via LinkedIn and XING. If you do not wish to provide us with personal data via LinkedIn and XING, communication via LinkedIn and XING as a contact channel is not possible.
7. Social Media Monitoring
To monitor public conversations about Hermes Germany GmbH on the German-language web and to be able to respond to them if necessary, we use the services of Talkwalker by Hootsuite.
Processing purposes
We are constantly working to further improve our services and products. Monitoring and analyzing the opinions users publicly express about our company and individual services and products helps us do this.
Type of Data
If you post about Hermes on social media, for example via your public profile on Twitter/X, we can view that tweet as well as your publicly available profile information (such as username, handle, bio, profile picture, number of followers).
Legal basis
The legal basis for data processing is Article 6(1)(f) of the GDPR if your real name is used on social media. Our legitimate interest in improving our services and products outweighs your legitimate interest, as your information is publicly available.
Duration of storage
The data collected in this context will be available in Talkwalker for a period of two years. Please note that the data you submit on social media is stored on the servers of the respective provider (Facebook, Instagram, forums, comment sections on online media, etc.). You are responsible for deleting your data from those platforms yourself.
Right to Withdraw Consent, Object, and Request Deletion
If the processing of your personal data in connection with your contact request was based on our legitimate interest, you have the right to object to the processing of your personal data at any time. In the event of an objection, correspondence cannot be continued. All personal data collected in this context will be deleted in the event of a valid objection.
Further Information
We use the services of:
TALKWALKER
Sàrl 33 Avenue John F Kennedy
L-1855 Kirchberg – Luxembourg
(German office: Talkwalker GmbH c/o mainfort, Schillerstraße 42-44 Frankfurt am Main, 60313 Germany).
Please note that users utilize the features offered by social media at their own risk. The terms of use of the respective provider apply. This provider collects access data. The social media platforms are not operated by us, but by the respective service providers under their own responsibility. Due to the nature of the platforms, product control and design of the social media portals lie with the respective social media portal operator. We have no influence over the data collected by the service provider or the data processing operations, nor are we aware of the full scope of data collection, the purposes of processing, or the retention periods.
We would like to point out that the processing of personal data in countries outside the European Union and the European Economic Area, particularly in the United States, cannot be ruled out. Under certain circumstances, this may be associated with the risk of more difficult legal enforcement, which poses a risk to the individual user.
8. Sanctions List Screening
Sanctions lists are directories of individuals, companies, organizations, or institutions subject to economic and legal restrictions imposed by governments or authorities. Pursuant to the so-called prohibition on making available, these individuals, companies, groups, or organizations may not be provided with any direct or indirect financial assets or economic resources.
Hermes maintains international trade relations and offers its services worldwide. As a result, Hermes is subject to various national and international sanctions regimes. These sanctions regimes give rise to a variety of obligations, such as refraining from maintaining business relationships with certain countries or individuals. To comply with these obligations, Hermes conducts checks against sanctions lists maintained and published by entities such as the UN, the EU, or individual states to ensure that no funds or other economic resources are made available for terrorist purposes.
Processing purposes
The purpose of processing is to comply with the aforementioned obligations, as well as to identify individuals named on sanctions lists in order to make a decision regarding the establishment and, if applicable, continuation of business relationships.
Type of data
We use the following data during the sanctions list check:
- Shipment ID (shipment number)
- First and last name
- Street & house number
- Zip code
- City
- Country
Legal basis
In the event of a comparison with sanctions lists, the legal basis is derived from Article 6(1)(f) of the GDPR, our legitimate interest in conducting the verification. Our legitimate interests lie in the necessity of the obligation to identify persons named on sanctions lists, to refrain from maintaining business relationships with these persons, to comply with the applicable sanctions regimes, and to avoid sanctions against Hermes for violations of sanctions regimes. Additionally, our interest lies in avoiding significant legal and financial consequences for Hermes. Your confidentiality interests take a back seat in this context, especially since the verification is conducted solely on a random basis.
Duration of Storage
Your personal data will be deleted as soon as it is no longer needed for the purpose of processing and provided that no statutory retention periods preclude this. We delete any positive matches from a sanctions list check 10 years after the sanctions list check is performed. The data records used to perform the sanctions list check are stored and deleted after 10 years.
Right to object
The general right to object applies to all processing purposes described in this Privacy Policy that are based on Article 6(1)(f) of the GDPR. Unlike the specific right to object to data processing for marketing purposes, under the GDPR we are only obligated to honor such a general objection if you provide us with compelling reasons (e.g., a potential threat to your life or health).
Further Information
We use the following provider to check and compare sanctions lists:
AEB SE
Sigmaringer Straße 109
70567 Stuttgart
Obligation to provide your personal data
You are not obligated to provide your personal data. Processing is based on legitimate interest.
9. Liability and Up-to-Date Information
9.1 Liability for Links
Our website and our privacy policy may contain links to external third-party websites over whose content we have no control. Therefore, we cannot assume any liability for this third-party content.
The respective provider or operator of the linked website is always responsible for its content. The linked website was checked for potential legal violations at the time the link was created. No illegal content was identifiable at the time the link was created. Permanent monitoring of the content of the linked site is neither possible nor reasonable without concrete evidence of a legal violation. If we become aware of a legal violation, we will remove such links immediately.
9.2 Updates and Changes
We may change or update parts of the privacy policy without notifying you in advance. Please review the privacy policy before using our services to ensure you are up to date on any changes or updates.
Current version of the Privacy Policy: June 2026