Hermes Germany GmbH
Essener Str. 89
22419 Hamburg
Email: zentrale@hermesworld.com
The data protection officer
Hermes Germany GmbHEssener Str. 89
22419 Hamburg
Email:
Datenschutz@myhermes.de
The following information applies to all procedures described. Differing regulations will be specified in the respective procedural description if necessary.
“Personal data”—also called “personally identifiable information (PII)” in the legal statutes—means personal information that can be traced to your identity. They include information such as your name, address, telephone number, and email address, as well as information on your surfing behavior (if that information can be directly or indirectly allocated to you).
As a general principle, you can use the Hermes Website without disclosing personal data. If you create a parcel label, however, you will be asked to disclose information about the sender and receiver. You can also log in with your myhermes account if you wish to enjoy certain benefits when using the Hermes Website.
Personal data will not be transmitted to third parties except in accordance with statutory requirements. We pass users’ data on to third parties only if we must do so for billing purposes or for other purposes, if the transfer is necessary to fulfil contract obligations.
If we use a particular subcontractor for our online services, we have entered into suitable contracts with them and taken adequate technical and organizational measures.
Each time we use content or other resources from another company (that company, a “Third-Party Provider”) whose registered office is in a third country, data will assumably be transferred into that country. We transfer personal data into third countries only if their data protection level is adequate, we have the user’s consent, or we are otherwise legally permitted to do so.
We have taken suitable technical and organizational measures to protect your data from loss, modification, and unauthorized access. We continually improve those security measures in line with technological developments. Our website uses the industry standard SSL (Secure Sockets Layer) for encryption. This guarantees that your personal information will remain confidential on the internet.
All our employees are periodically trained in data protection and taught how to handle customer data safely and confidentially. All our employees are required to observe confidentiality and are obligated under their employment contracts to maintain confidentiality and comply with data protection requirements.
As a provider of postal services, Hermes Germany GmbH acts on behalf of commercial shippers and private individuals by picking up, conveying, and delivering shipments for them.
We collect and process your personal data on the following legal bases set forth in the General Data Protection Regulation (GDPR):
Consent pursuant to Art. 6(1)(a) GDPR. “Consent” means any voluntary declaration of intent that is unambiguously given for a certain case in the form of a declaration or other clear confirming action with which the data subject states that they agree to the processing of the personal data concerning them.
Pursuant to Art. 6(1)(b) GDPR (necessity in order to perform a contract or preparatory measures), we need your data to prepare to enter into the contract with you or meet our contract obligations toward you.
As well as on the basis of § 41(a)(3) of the German Postal Act (Postgesetz, PostG). Identification data are stored based on § 41(b)(2) PostG if there is a special interest in preserving evidence.
As a general principle, you have the following rights toward Hermes where your personal data are concerned:
If you have given us consent to use your personal data (for the electronic shipment notification, for example), you may withdraw that consent at any time without giving reasons. Such a withdrawal will apply to future use only, not to use that has already occurred.
You may also lodge a complaint with a data protection supervisory authority regarding the processing of your personal data by Hermes. The competent supervisory authority connected with postal services is:
Germany's Federal Commissioner for Data Protection and Freedom of Information
Graurheindorfer Str. 153, 53117 Bonn
https://www.bfdi.bund.de
The competent supervisory authority for Hamburg is:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str. 22, 20459 Hamburg
https://datenschutz-hamburg.de
The processing purposes are data disclosure pursuant to Art. 15 GDPR and the assertion of your rights as a data subject.
The data are processed that are processed in connection with Hermes’s postal services and other services.
The data processing is legally based on Art. 6(1)(c) GDPR.
If you ask us for information, we will store that request for three years. Statutory retention periods do not allow us to delete it earlier.
You are not required to disclose your personal data, but no data information can be provided unless you do.
We will erase the personal data as soon as the purpose for their storage no longer applies, unless a contract or the law (such as the German Tax Code or Commercial Code) requires us to continue storing them.
In general, we have arranged for your personal data to be processed within the European Union. That being said, your personal data might be processed in the United States of America (USA). We have therefore secured the level of data protection with suitable guarantees in accordance with Chapter 5 of the GDPR, in particular with Art. 45 or Art. 46 GDPR.
On www.myhermes.de, you can create a parcel label for shipping a parcel with Hermes. If the shipment size selected is insufficient or incorrect for your shipment, we will use your data to contact you so the shipment size can be adjusted and the differential amount subsequently paid (since another parcel class will be required).
To deliver the shipment with the parcel label, we need the following information:
For reasons of data privacy, no other personal data will be printed on the final parcel label. Optionally, the email addresses and telephone numbers of the sender and recipient can be disclosed when a parcel label is created for the purposes of receiving an order confirmation, making a shipment status report, and establishing contact if there are problems with delivery. The processing of this data is necessary for the performance of the contract. And parcel-related reference data (such as an eBay auction number) can be stated.
Some international parcel labels require data in addition to those mentioned (the email address for delivering the parcel, for example). The entry of those data is set up as a required field, and appropriate information, such as why we need those data for delivering the parcel, will be shown automatically when the parcel label is recorded.
Collecting and processing data to create the parcel label is legally based on Art. 6(1)(b) GDPR in conjunction with § 41(a)(3) PostG. We assume the recipient has granted their consent for the data to be forwarded to us, since we cannot deliver the package unless those data are disclosed.
Please be aware that entering personal data concerning a third party is always forbidden without that third party’s consent.
Collecting and processing data to create the parcel label is legally based on Art. 6(1)(b) GDPR in conjunction with § 41(a)(3) PostG. Processing data in connection with the payment procedure is legally based on Art. 6(1)(b) GDPR. If you disclose personal data concerning you or a third party and those data are not absolutely necessary for delivering the shipment (email addresses, for example), the data processing is legally based on consent pursuant to Art. 6(1)(a) GDPR. Our contacting you about adjusting the parcel class is legally based on Art. 6(1)(b) GDPR.
Whether or not you are logged into your myhermes account when you create a parcel label, we will store those data for 365 days, particularly to render customer support services or clear up delivery problems. Afterwards, the shipment data will be erased.
We will send our transport service provider any data that are needed to deliver the shipment.
You are not required to disclose personal data, but no parcel label can be created unless you disclose the aforementioned personal data needed for that purpose. Any disclosure of other information is voluntary.
We process your data so you can collect your shipment at your front door.
The following data of the shipment label will be collected:
Collecting and processing data in this context is legally based on § 41(a)(3) PostG in conjunction with Art. 6(1)(b) GDPR.
The data concerning your shipment will be erased when they are no longer needed to render the service in question and the statutory retention periods have expired.
The data will be disclosed to Hermes Germany GmbH, our service providers, and the recipient.
You are not required to provide your personal data, but you cannot use the aforementioned functions unless you do.
You collect the shipment at the front door. When you collect your shipment, you sign either directly on the scanner’s display or your parcel’s address label. The deliverer will photograph the signature on the shipment label.
When you collect the shipment, your signature will be recorded. For certain shipments, your ID number, date of birth, or a PIN will be recorded to clearly identify you.
Collecting and processing data in this context is legally based on § 41(a)(3) PostG in conjunction with Art. 6(1)(b) GDPR.
The data concerning your shipment will be erased when they are no longer needed to render the service in question and the statutory retention periods have expired.
The data will be disclosed to Hermes Germany GmbH, our service providers, and the commercial shipper.
You are not required to provide your personal data, but you cannot use the aforementioned functions unless you do.
A neighbor picks up your shipment for you. The purpose of processing the associated personal data is to document the deliverer to the substitute recipient who has received your mail item on your behalf and to provide proof to the sender and recipient that the mail items have been delivered correctly. In some cases, also as proof to the substitute recipient. We will also inform you as the addressee so that you know where to collect your mail item.
If a neighbor picks up your shipment, their signature, name, and possibly address will be recorded.
The legal basis is Art. 6 para. 1 lit. e GDPR in conjunction with §41a para. 3 Postal Act. The processing of personal data is carried out to ensure a functioning postal service and is therefore in the public interest. This also includes the authorisation to process the personal data of substitute recipients, insofar as this is necessary for the proper delivery of postal items.
The data concerning your shipment will be erased when they are no longer needed to render the service in question and the statutory retention periods have expired.
The data will be disclosed to Hermes Germany GmbH, our service providers, the sender and the recipient to the extent necessary.
The processing of personal data is mandatory for delivery to a substitute recipient.
The purpose of the processing is to create a return slip for your return to a commercial shipper. There are two different possibilities for the return slip. The first is for you to print out the return slip as a PDF document and attach it yourself. Then you can simply submit the parcel in a Hermes parcel shop. The second is for us to generate a QR code for you that you will simply show to the staff in a Hermes parcel shop. Then they will print out the return label and attach it to the parcel.
Optionally, you can send the return slip (PDF and QR code) to the email address you specify.
The following data constitute mandatory information that we process when we create a return slip.
The following information is optional:
Collecting and processing data to create the return slip is legally based on Art. 6(1)(b) GDPR in conjunction with § 41(a)(3) PostG. Processing your mail address and customer reference is legally based on Art. 6(1)(a) GDPR. Your input of the data is deemed consent.
The data concerning your return and your customer reference will be erased after 365 days. We will erase the email address you specify after sending the email with the PDF document or the QR code.
You may object at any time to your email address and your customer reference being used in the future. Please send your objection to: datenschutz@myhermes.de
You are not required to disclose personal data, but no return slip can be created unless you disclose the aforementioned personal data needed for that purpose. Any disclosure of other information is voluntary.
You pick up your shipment at the parcel shop.
If you pick up your shipment, information about your ID document (number, type, and issuing country) will be collected.
For certain shipments, your date of birth, the completion of your ID number, or a PIN will be recorded to clearly identify you.
Processing and storing identification data when a shipment is picked up at the parcel shop is legally based on the German Postal Act (Postgesetz, PostG). Pursuant to § 41(b)(3), the identification data may be processed to prove that the postal service was rendered properly.
Identification data are stored based on § 41(b)(2) PostG if there is a special interest in preserving evidence.
We will erase the personal data as soon as the purpose for their storage no longer applies, but no later than 6 months after statutory or contractual limitation periods expire, § 41(b)(4) PostG.
Unfortunately, you cannot revoke your consent or have your data erased before 6 months expire.
The lawfulness of the storage of identification data by postal service providers is expressly confirmed by the Federal Commissioner for Data Protection:
https://www.bfdi.bund.de/DE/Buerger/Inhalte/Post/SpeicherungvonAusweisdaten.html
For what purpose was the ID number collected?
Hermes stores the ID number as evidence that the delivery was made correctly (§ 41(b)(2 and 3) PostG), since the shipment itself is addressed to the parcel shop. In the event of a complaint, the parcel shop address is insufficient.
To whom are the personal data transmitted?
The data collected in the parcel shop are stored in the systems of Hermes Germany GmbH. A proof of delivery is transmitted to the commercial shippers of the parcel. It includes the shipment number, the shipment status, and the time of the status.
You are required by law to disclose your personal data.
You use a one-time proxy for making a pickup at the parcel shop to give someone permission to pick up your shipment there.
If you arrange for an agent to pick up your shipment, information about the agent’s name and ID document (number, type, and issuing country) will be collected. The address data that you have entered on the proxy will be kept at the competent Hermes depot in paper form, in compliance with data protection laws.
Processing and storing identification data when a shipment is picked up at the parcel shop is legally based on the German Postal Act (Postgesetz, PostG). Pursuant to § 41(b)(3), the identification data may be processed to prove that the postal service was rendered properly.
Identification data are stored based on § 41(b)(2) PostG if there is a special interest in preserving evidence.
Hermes stores the ID number as evidence that the delivery to the agent was made correctly (§ 41(b)(2 and 3) PostG).
We will erase the personal data as soon as the purpose for their storage no longer applies, but no later than 6 months after statutory or contractual limitation periods expire, § 41(b)(4) PostG.
Unfortunately, you cannot revoke your consent or have your data erased before 6 months expire.
The lawfulness of the storage of identification data by postal service providers is expressly confirmed by the Federal Commissioner for Data Protection:
https://www.bfdi.bund.de/DE/Buerger/Inhalte/Post/SpeicherungvonAusweisdaten.html
The data collected in the parcel shop are stored in the systems of Hermes Germany GmbH. A proof of delivery is transmitted to the commercial shippers of the parcel. It includes the shipment number, the shipment status, and the time of the status.
You are required by law to disclose your personal data.
You hand in a shipment at the parcel shop that you would like to return to the commercial shipper.
All the data on the shipment label (original label or return label) will be processed. This particularly includes the end customer’s name and address, the commercial shipper’s name, and the shipment ID.
Collecting and processing data in this context is legally based on § 41(a)(3) PostG in conjunction with Art. 6(1)(b) GDPR.
We will erase the personal data as soon as the purpose for their storage no longer applies, but no later than 6 months after statutory or contractual limitation periods expire.
The data will be disclosed to Hermes Germany GmbH, our service providers, and the commercial shipper.
You are required by contractual regulations to disclose your personal data.
You hand in a shipment at the parcel shop that you would like to ship privately.
The address data that you have entered on the parcel label or manually will be processed.
Collecting and processing data in this context is legally based on § 41(a)(3) PostG in conjunction with Art. 6(1)(b) GDPR.
We will erase the personal data as soon as the purpose for their storage no longer applies, but no later than 6 months after statutory or contractual limitation periods expire.
The data will be disclosed to Hermes Germany GmbH, our service providers, and the recipient.
You are required by contractual regulations to disclose your personal data.
If you would like to track a shipment, you must enter a shipment number, order number, or receipt number for the shipment in question. If the number you enter is known in the Hermes system, you will receive information on the shipment progress, the estimated delivery time, and the delivery location.
To protect your privacy, no specific data concerning the recipient or private sender will be shown without additional identification.
The following data will be processed as part of shipment tracking:
Possible optional information depending on the type of delivery:
Collecting and processing data in this context is legally based on § 41(a)(3) PostG in conjunction with Art. 6(1)(b) GDPR.
The data concerning your shipment will be erased when they are no longer needed to render the service in question and the statutory retention periods have expired. The data concerning your shipment will be visible in the shipment tracking for an additional 90 days.
You are required by contractual regulations to disclose your personal data.
You can use the Hermes Preferred Delivery to book a onetime, shipment-related, alternative delivery location for your shipment (Preferred Drop-Off Location, Preferred Neighbor, or Preferred Parcel Shop), or to book an alternative delivery date.
Please note that you will always need to obtain the consent of the owner of that personal data before entering third party data.
The following data will be processed as part of the Hermes Preferred Delivery:
Possible optional information depending on your booking:
Collecting and processing data in this context is legally based on § 41(a)(3) PostG in conjunction with Art. 6(1)(b) GDPR.
We will use these data only to render the desired service for you and will erase them as soon as their storage is no longer necessary for rendering the service in question and the statutory retention periods have expired.
You are required by contractual regulations to disclose your personal data.
You can use the permanent Hermes Preferred Delivery to set up delivery to a storage location (permanent Preferred Storage Location) or arrange for them to be sent to a parcel shop (permanent Preferred Parcel Shop) on an ongoing basis.
The following data will be processed as part of the permanent digital Hermes Preferred Delivery:
The following data will be processed as part of the permanent analog Hermes Preferred Delivery:
Possible optional information depending on your booking:
Collecting and processing data in this context is legally based on § 41(a)(3) PostG in conjunction with Art. 6(1)(b) GDPR.
We will use these data only to render the desired service for you and will erase them as soon as their storage is no longer necessary for rendering the service in question and the statutory retention periods have expired.
You can end the future implementation of the permanent Hermes Preferred Delivery here .
You are not required to disclose personal data.
We will email you a parcel announcement and a digital notification card if the sender of the parcel sent us your email address for that purpose.
We need your email address to send you the digital notification card and the parcel announcement.
The processing of your personal data is legally based on your consent to the parcel announcement and the digital notification card pursuant to Art. 6(1)(a) GDPR.
The data will be erased automatically after 30 days.
If you wish to stop receiving both notifications from Hermes, you can unsubscribe directly under the link “Unsubscribe.” Alternatively, you can unsubscribe directly here . Please note that doing so will make us unable to inform you if we have dropped off a shipment with your neighbor, for example.
You are not required to disclose personal data, but you cannot receive a digital notification card unless you provide your consent.
You use the notification card either to grant Hermes a onetime or permanent drop-off permission for a shipment delivery or to commission a delivery to a Preferred Neighbor or Preferred Parcel Shop.
Please note that you will always need to obtain the consent of the owner of that personal data before entering third party data.
The address and contact data you have entered on the card will be processed.
The following data must be entered for the Preferred Drop-off Location:
If you desire a delivery to a Preferred Neighbor or Preferred Parcel Shop, the following data are relevant:
The telephone number or email address are optional.
The data processing is legally based on Art. 6(1)(b) GDPR.
The data concerning the proxy will be stored until the proxy (1) is revoked or (2) has not been used for 1075 days because Hermes Germany has not received a suitable delivery order.
The revocation of the proxy must be mailed or emailed to Hermes Germany’s customer service department.
Email: info-paket@hermesworld.com
Postal address:
Hermes Germany GmbH
Essener Str. 4
22419 Hamburg
The data will be promptly blocked after the revocation is received. After the proxy is blocked, any further shipment delivery will be made to the postal address transmitted by the sender.
The data will be permanently erased 365 days after they are blocked.
The data will be disclosed to Hermes Germany GmbH, our service providers, and clients.
You are required by contractual regulations to disclose your personal data.
If you have subscribed to permanent notifications on our website, you will receive a notification for each parcel sent with Hermes. We will send that notification to the email address you specified. You will then receive information such as announcements, updates (early or delayed delivery), and delivery notifications.
You must enter the following data when subscribing to the permanent notification function:
Processing your personal data is legally based on your consent to permanent notifications by confirming your mail address pursuant to Art. 6(1)(a) GDPR.
The data are stored until the consent to permanent notifications is revoked.
You can unsubscribe at any time: by selecting the following link provided in the notification, for example, or at myhermes.de .
After you have confirmed the email to unsubscribe, we will not send you any more notifications about future shipments. Shipments that are awaiting delivery when you unsubscribe will still be announced.
You are not required to disclose personal data, but we cannot provide you with our parcel notifications unless you do.
We process your data based on your request for delivery to a Hermes Box. We process your email address to send you a PIN. We need your shipment number to deliver your parcel and for clear identification.
The following data will be processed:
The processing of your personal data is legally based on your contract with us for parcel receipt to a Hermes Box pursuant to Art. 6(1)(b) GDPR.
Your data will be erased when they are no longer needed to render the service in question and the statutory retention periods have expired.
We also use the following service providers:
Sistemas Kern S.A.U.
Calle Neptuno, 20
28229 Villanueva del Pardillo
Madrid
Spain
In general, we have arranged for your personal data to be processed within the European Union. That being said, your personal data might be processed in the United States of America (USA). We have therefore secured the level of data protection with suitable guarantees in accordance with Chapter 5 of the GDPR, in particular with Art. 45 or Art. 46 GDPR.
You are not required to provide your personal data, but you cannot use the Hermes Box service unless you do.
We process your data based on the use of a Hermes Box to return your parcel. Your email address will be used to send you a receipt. We need your shipment number to return your parcel and for clear identification.
The following data will be processed:
The processing of your personal data is legally based on your contract with us for using a Hermes Box to return your parcel pursuant to Art. 6(1)(b) GDPR.
Your data will be erased when they are no longer needed to render the service in question and the statutory retention periods have expired.
We also use the following service providers:
Sistemas Kern S.A.U.
Calle Neptuno, 20
28229 Villanueva del Pardillo
Madrid
Spain
In general, we have arranged for your personal data to be processed within the European Union. That being said, your personal data might be processed in the United States of America (USA). We have therefore secured the level of data protection with suitable guarantees in accordance with Chapter 5 of the GDPR, in particular with Art. 45 or Art. 46 GDPR.
You are not required to provide your personal data, but you cannot use the Hermes Box service unless you do.
The declaration is used to document and prove that you, as the intended recipient of a shipment, have not received it.
The following data will be processed as part of the confirmation:
Depending on the type of form (paper or digital):
The legal basis for the processing of your personal data is Art. 6 par. 1 lit. f GDPR. We have a legitimate interest in following up on reported parcel losses. In individual cases, we may share this confirmation with our service providers. The legal basis for this transfer is Art. 6 para. 1 lit. b GDPR and serves the fulfilment of the contract with the respective service provider.
The data is deleted when it is no longer required and the legal retention periods have expired.
Data processing is carried out by Hermes Germany GmbH. In individual cases, data may be processed by our service providers.
Our website and our privacy policy might contain links to external websites of third parties whose content we cannot influence. Therefore, we are not liable for that third-party content.
The respective provider or operator of a linked website is always responsible for its content. The linked pages were checked for possible legal infringements when they were linked. No unlawful content could be identified at that time. Without specific indications of a legal infringement, permanent monitoring of the linked pages is not possible or feasible. If we learn of a legal infringement, we will remove such links without undue delay.
We may modify or update parts of the privacy policy without notifying you in advance. Please review the privacy policy before you use our services to remain informed of any modifications or updates.
Current status of the privacy policy: March 2024