Data protection information on the postal services of Hermes Germany GmbH

1 General information

1.1 Responsible body

Hermes Germany GmbH
Essener Bogen 1
22419 Hamburg

E-mail: zentrale@myhermes.de

You can find more information in our imprint.

zentrale@myhermes.de

1.2 Contact details of the data protection officer

The Data Protection Officer

Hermes Germany GmbH
Essener Bogen 1
22419 Hamburg

E-Mail: Datenschutz@myhermes.de

The following information applies to all procedures described. Any deviating regulations are stated in the respective procedure description.

1.3 Personal data

“Personal data” – also called “personally identifiable information” in the legal statutes – is personal information that allows conclusions to be drawn about your identity. This includes, for example, information such as your name, address, telephone number or email address, but also information about your surfing behaviour, provided that this information can be directly or indirectly attributed to you.

You can use the Hermes website without disclosing your personal data. However, when you create a parcel label, you will be asked to provide sender and consignee details. You can also log in with your myhermes-account if you want to enjoy certain benefits when using the Hermes website.

1.4 Data transfer to third parties, subcontractors and third-party providers

Personal data is only transferred to third parties within the framework of the legal requirements. We only pass on user data to third parties if this is necessary or for other purposes if the transfer is necessary to fulfil contractual obligations. Furthermore, it may be necessary to forward your data to authorities (e.g. tax offices or law enforcement authorities) in accordance with a legal obligation (Art. 6 (1) (c) GDPR) in order to answer their enquiries.

If we use subcontractors for our online offering, we have taken suitable contractual precautions and appropriate technical and organisational measures with these companies.

If we use content or other means from other companies (hereinafter jointly referred to as "third-party providers") and their registered office is located in a third country, it can be assumed that data will be transferred to the countries in which the third-party providers are based. We will only transfer personal data to third countries if there is an adequate level of data protection, user consent or other legal authorisations.

1.5 Data security

We have taken suitable technical and organisational measures to protect your data from loss, alteration or unauthorised access. We are constantly improving these security measures in line with technological developments. Our website uses the industry standard SSL (Secure Sockets Layer) for encryption. This guarantees the confidentiality of your personal data over the Internet.

All our employees receive regular training about data protection and are also instructed on how to handle customer data securely and confidentially. All our employees are obliged to maintain confidentiality and have signed an obligation to maintain confidentiality and comply with data protection in their employment contracts.

1.6 Legal basis

Hermes Germany GmbH acts as a postal service provider on behalf of commercial consignors and private individuals and in particular collects, transports and delivers shipments on their behalf.

We collect and process your personal data on the following legal bases of the General Data Protection Regulation (GDPR) and the German Postal Act (Postgesetz (PostG)).

Consent pursuant to Art. 6 (1) (a) GDPR. “Consent” is any freely given, specific and unambiguous indication of the data subject's wishes by which this person, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to this person.

Necessity for contract fulfilment or implementation of preparatory measures pursuant to Art. 6 (1) (b) GDPR. Your data is necessary for us to prepare the conclusion of the contract with you or to fulfil our contractual obligations towards you.

Processing to safeguard legitimate interests in accordance with Art. 6 (1) (f) GDPR. This means that processing is necessary to protect our legitimate interests or those of third parties, unless your interests or fundamental rights and freedoms, which require the protection of personal data, take precedence.

Necessity for the performance of a task carried out in the public interest pursuant to Art. 6 (1) (e) GDPR in conjunction with the provisions of § 67 et seq. German Postal Act (Postgesetz (PostG)). The processing of consignee data and other data for the purpose of proper delivery is carried out to ensure a functioning postal service and is therefore in the public interest.

1.7 Your data protection rights

Your rights

As a general principle, you have the following rights toward Hermes where your personal data are concerned:

Right to information
In accordance with the legal requirements, you as the data subject have the right to receive information about your data stored by us free of charge (Art. 15 GDPR). In particular, you can request information about the processing purposes, the category of personal data, the categories of recipient to whom your data has been or will be disclosed, the planned storage period and the origin of your data if it was not collected directly from you.
Right to rectification
If your personal data has been recorded incorrectly or incompletely, you can have this corrected at any time (Art. 16 GDPR). The quickest and easiest way to make the correction is directly in your myhermes.de account.
Right to erasure
You have the right to erasure of your data stored by us (Art. 17 GDPR). If you wish to have your personal data deleted, we may be required to store this data for a certain period due to statutory retention obligations, for example for tax or accounting purposes. There may also be other legal obligations and rights that may also require us to continue storing data. In these cases, we will delete the data immediately after the respective storage period has expired.
Right to restriction of processing
You have the right to restrict the processing of your data (Art. 18 GDPR) if the accuracy of the data is disputed by you, the processing is unlawful but you refuse to delete it; we no longer need the data, but you need it for the assertion, exercise or defence of legal claims or you have lodged an objection to the processing in accordance with Art. 21 GDPR.
Right to data portability
You have the right to receive selected data stored by us about you in a commonly used, machine-readable format or to request that it be transferred to another controller (Art. 20 GDPR).
Right to object to processing
You have the right to object at any time to the processing of your data, which is carried out based on a balance of interests or in the public interest, if there are reasons for this arising from your particular situation (Art. 21 GDPR). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right of appeal

You also have the right to complain to a data protection supervisory authority about the processing of your personal data by Hermes. The supervisory authority responsible for Hermes Germany GmbH in connection with postal services is

The Federal Commissioner for Data Protection and Freedom of Information
Graurheindorfer Straße 153, 53117 Bonn, Germany
https://www.bfdi.bund.de

For all other processing of personal data not related to postal services, the responsible supervisory authority for Hermes Germany GmbH is:

The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany
https://datenschutz-hamburg.de

Exercising your right to information

Processing purposes

The purpose of the processing is to provide data information in accordance with Art. 15 GDPR and to exercise your rights as a data subject

Type of data

The data that is processed in connection with the postal services and services provided by Hermes is processed. We also need your personal information to identify you.

Legal basis

The legal basis for data processing is Art. 6 (1)(c) GDPR.

Duration of storage

If you ask us for information, we will store your request for 3 years. Earlier deletion is not possible due to statutory retention periods.

Obligation to provide your personal data

You are not required to disclose your personal data, but no data information can be provided unless you do.

1.8 Duration of storage of personal data

The personal data will be deleted by us as soon as the purpose of storage no longer applies and there are no deviating legal or contractual retention periods (e.g. according to the German Tax Code or the German Commercial Code).

1.9 Processing of your personal data in third countries

We have generally commissioned the processing of your personal data in the European Union. Nevertheless, your personal data may be processed in the United States of America (USA). We have therefore secured the level of data protection with suitable guarantees in accordance with Chapter 5 of the GDPR, in particular Art. 45 and Art. 46 GDPR.

2 Processing in the context of package distribution

2.1. National parcel label

Processing purposes

You can create a parcel label online at www.myhermes.de or in one of our ParcelShops to send a parcel nationally with Hermes. The personal data is processed for the purpose of executing and fulfilling the contract and to comply with legal requirements.

Type of data

To create your online parcel label and so that we can deliver the shipment with the parcel label, we need the following information:

Name of the sender
Address of the sender
Sender's e-mail address (for an order confirmation if the parcel label is not paid in cash when the parcel is handed over to Hermes).
Name of the consignee
Address of the consignee
E-mail address of the consignee (optional)

If you send your parcel to a ParcelShop or the HermesBox, the consignee 's email address is mandatory so that we can inform the consignee that their parcel has arrived.

To create a handwritten parcel label in one of our ParcelShops and so that we can deliver the shipment with the parcel label, we need the following information:

Name of the sender
Address of the sender
Name of the consignee
Address of the consignee

Optionally, the sender's e-mail address and telephone number can be entered when creating the parcel label to receive an order confirmation, a shipment status report and to contact the sender in the event of delivery problems. Furthermore, parcel-related reference data (e.g. eBay auction number) can be specified. The consignee's e-mail address is optional for parcel notifications.

Legal basis

Please note when entering third-party data, you always must obtain prior permission from the owner of this personal data.

The legal basis for data collection and processing in connection with the creation of parcel labels is Art. 6 (1) (b) GDPR. As far as the consignee's data is concerned, the provisions of § 68 PostG authorise the processing of personal data to ensure the functioning of the postal system and are therefore in the public interest in accordance with Art. 6 (1)(e) GDPR. The authorisation pursuant to § 68 (3) s.1 PostG also includes the processing of personal data of consignees, insofar as this is necessary for the proper delivery of postal items. The legal basis for data processing in connection with the payment process is Art. 6 (1) (b) GDPR. The legal basis in relation to customs clearance is Art. 6 (1) (c) GDPR.

If you provide your own or third-party personal data that is not necessary for the delivery of the shipment (not a mandatory field), Art. 6 (1) (a) GDPR is the legal basis for consent. We also assume that the consignee has consented to the transfer of the data to us.

Duration of storage

Regardless of whether you are logged in with your myhermes account when creating a parcel label or not, we store this data for a period of one year, in particular for the purpose of providing customer support services or clarifying delivery problems. The shipment data will then be deleted.

Further information

The data will be disclosed to Hermes Germany GmbH, our service providers, the sender and the consignee to the extent necessary.

Obligation to provide your personal data

You are not required to disclose your personal data. However, no parcel label can be created without the required personal data mentioned above. The remaining information, which is not a mandatory field, is voluntary.

2.2 International parcel label

Processing purposes

You can create a parcel label online at www.myhermes.de or in one of our ParcelShops to send a parcel internationally with Hermes. The personal data is processed for the purpose of executing and fulfilling the contract and to comply with legal requirements.

Type of data

To create your online parcel label and so that we can deliver the shipment with the parcel label, we first need the following information:

Name of the sender
Address of the sender
Sender's e-mail address (for an order confirmation if the parcel label is not paid in cash when the parcel is handed over to Hermes).
Name of the consignee
Address of the consignee

To create a handwritten parcel label in one of our ParcelShops and so that we can deliver the shipment with the parcel label, we need the following information:

Name of the sender
Address of the sender
Name of the consignee
Address of the consignee

To be able to deliver your parcel in the individual countries, it may be necessary to collect further data than the above, such as the e-mail address or telephone number for parcel delivery. Reasons for this may be, for example, that a return shipment can be averted by consulting with the consignee in the event of an unclear delivery situation, to inform the consignee that the shipment has been deposited for them at a partner branch or local parcel station and to transmit the pick-up PIN for ParcelShops and Parcelstations in individual countries. The entry of this data is stored as a mandatory field and corresponding information, e.g. why we need this data for parcel delivery, is displayed when the parcel label is entered. A customs declaration must be submitted for shipments sent by private individuals outside the European Union. To ensure proper customs clearance, it may be necessary to process the e-mail address and telephone number for this purpose.

Legal basis

Please note when entering third-party data, you always must obtain prior permission from the owner of this personal data.

The legal basis for data collection and processing in connection with the creation of parcel labels is Art. 6 (1) (b) GDPR. As far as the consignee's data is concerned, the provisions of § 68 PostG authorise the processing of personal data to ensure the functioning of the postal system and are therefore in the public interest in accordance with Art. 6 (1) (e) GDPR. The authorisation pursuant to § 68 (3) s. 11 PostG also includes the processing of personal data of consignees, insofar as this is necessary for the proper delivery of postal items. The legal basis for data processing in connection with the payment process is Art. 6 (1) (b) GDPR. The legal basis in relation to customs clearance is Art. 6 (1) (c) GDPR.

Duration of storage

Further information

The data will be disclosed to Hermes Germany GmbH, our service providers, transport service providers, the sender and the consignee to the extent necessary.

Obligation to provide your personal data

2.3 Payments

2.3.1 Payment via PayPal

Processing purpose

If you have selected the payment method "PayPal" when creating a parcel label, your data required for the payment process will be transmitted to PayPal.

Type of data

The following data is regularly transmitted to PayPal:

Product
Price
Logistics service
Order number
PayPal Transaction ID
IP address
Duration of storage

Please refer to the PayPal privacy policy at: https://www.paypal.com/myaccount/privacy/privacyhub

Possibility of erasure/objection and deletion

Please contact PayPal for this. You can find further information at:

https://www.paypal.com/myaccount/privacy/privacyhub

Further information

The European operating company of PayPal is:

PayPal (Europe) S.á.r.l. & Cie. S.C.A.

22-24 Boulevard Royal,

2449 Luxembourg, Luxembourg

PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" via PayPal. PayPal uses the result of the credit check with regard to the statistical probability of non-payment for the purpose of deciding on the provision of the respective payment method. The credit report may contain probability values (so-called score values). If score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Among other things, address data is included in the calculation of the score values.

The applicable data protection provisions of PayPal may be retrieved under

https://www.paypal.com/de/webapps/mpp/ua/privacy-full

can be called up.

Processing of your personal data in third countries

By using PayPal, your personal data will be processed in the United States of America. PayPal (Europe) S.á.r.l. & Cie. S.C.A. is the sole controller for this processing.

2.3.2 Payment by credit card

Processing purposes

If you have selected the payment method "credit card" when creating a parcel label and pay by credit card, your data required for the payment process will be transmitted to our payment service provider Braintree. This is necessary to enable your credit card payment.

Type of data and security

The following data is used or processed during credit card payment:

First name and surname
Credit card number
Validity of the credit card
Credit card verification number (CVV)

Hermes also secures payment by credit card with 3D Secure. You must be registered with 3D Secure to use this service.

3D Secure offers advantages to cardholders and Hermes by adding an additional level of authentication. If the cardholder is registered with 3D Secure, the issuing bank decides during the checkout process whether the cardholder's identity can be verified based on the cardholder's submitted data and device or whether an additional authentication process is required. If additional authentication is required, our payment service provider Braintree will automatically start a process provided by the issuing bank to verify the cardholder's identity via a one-time SMS passcode, the issuing bank's mobile app, biometric methods or other means.

The following data is transferred in the 3D Secure process:

Payment amount
e-mail
Sender address
First name and surname
Street name
POSTCODE
Country
Duration of storage

Please refer to the privacy policy of our payment service provider Braintree at:

https://www.braintreepayments.com/de/legal/braintree-privacy-policy

Possibility of erasure/objection and deletion

Please contact our payment service provider Braintree. You can find further information at: https://www.braintreepayments.com/de/legal/braintree-privacy-policy

Further information

The European operating company of Braintree is:

PayPal (Europe) S.á.r.l. & Cie. S.C.A.

22-24 Boulevard Royal,

2449 Luxembourg, Luxembourg

PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" via PayPal. PayPal uses the result of the credit check regarding the statistical probability of non-payment for the purpose of deciding on the provision of the respective payment method. The credit report may contain probability values (so-called score values). If score values are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Among other things, address data is included in the calculation of the score values.

The applicable data protection provisions of PayPal may be retrieved under the following link:

https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Processing of your personal data in third countries

By using our payment service provider Braintree, your personal data will be processed in the United States of America. PayPal (Europe) S.á.r.l. & Cie. S.C.A. is the sole controller for this processing.

2.4 Postal services

2.4.1 Collection at the front door

You have the option of ordering your national private service shipment or your suitcase and luggage for collection by calling our customer service or online. You can also arrange for your luggage to be picked-up via the Deutsche Bahn website or at a Deutsche Bahn counter.

Processing purposes

We process your data for the pick-up of your shipment at the front door.

Type of data

The following data is collected for the pick-up:

Name of the sender
Address of the sender (as pick-up location)
Collection date

Optional details are:

E-mail address
Telephone number

Legal basis

The legal basis for data collection and processing in this context is Art. 6 (1) (b) GDPR. The processing of personal data is carried out to ensure a functioning postal service and is therefore in the public interest.

The legal basis for the collection of the optional data is Art. 6 (1) (a) GDPR your consent by entering the data.

Duration of storage

The data relating to your shipment will be deleted when it is no longer required for the provision of the respective service and the statutory retention periods have expired.

Possibility of erasure/objection and deletion

You can revoke the use of your e-mail address and/or your telephone number for the future at any time. Please send your erasure to:

datenschutz@myhermes.de

Further information

The data will be disclosed to Hermes Germany GmbH, our service providers and the consignee.

Obligation to provide your personal data

You are not required to disclose your personal data. However, the service cannot be provided without the required personal data mentioned above. The remaining information is voluntary.

2.4.2 Delivery to the front door: original consignee

Processing purposes

You’ll receive your package at your front door. When you accept your package, you sign directly on the scanner’s display. If your delivery is carried out via our Ident Service or the TAN Service, we process additional data to securely verify your identity. You can find detailed information about this process and the respective data processing in the appropriate sections below.

Type of data

When you accept your shipment, your signature is recorded. For certain shipments, your ID number, date of birth or PIN will also be recorded to uniquely identify you.

Legal basis

The legal basis for data collection and processing in this context is Art. 6 (1) (b) GDPR in relation to the fulfilment of the contract with the sender. As far as the consignee's data is concerned, the provisions of § 68 PostG authorise the processing of personal data to ensure a functioning postal system and are therefore in the public interest in accordance with Art. 6 (1) (e) GDPR. The authorisation pursuant to § 68 (3) s. 1PostG also includes the processing of personal data of consignees, insofar as this is necessary for the proper delivery of postal items.

Duration of storage

The data relating to your shipment will be deleted when it is no longer required for the provision of the respective service and the statutory retention periods have expired.

Further information

The data will be disclosed to Hermes Germany GmbH, our service providers and, in individual cases, to the commercial consignor.

Obligation to provide your personal data

You are not obliged to provide your data. If you wish to use the above-mentioned function, the processing of your personal data is mandatory.

2.4.3 Delivery to the front door: substitute consignee (neighbour or other third party)

Processing purposes

A neighbour or another third party receives your shipment on your behalf. The processing of the associated personal data serves to document the delivery to a substitute consignee who has received your shipment on your behalf, as well as to prove to the sender and consignee that the postal items have been properly delivered. In individual cases, this also serves as proof to the replacement consignee. We will also inform you as the consignee so that you know who you can collect your shipment from.

Type of data

If a neighbour or other third party accepts your shipment, their signature, name and address will be recorded.

Legal basis

The legal basis is Art. 6 (1) (e) GDPR in conjunction with § 68(3)PostG. The processing of personal data is carried out to ensure the proper functioning of the postal service and is therefore in the public interest. This also includes the authorisation to process the personal data of substitute consignees, insofar as this is necessary for the proper delivery of postal items.

Duration of storage

The data relating to your shipment will be deleted when it is no longer required for the provision of the respective service and the statutory retention periods have expired.

Further information

The data will be disclosed to Hermes Germany GmbH, our service providers, the sender and the consignee to the extent necessary.

Obligation to provide personal data

The processing of personal data is mandatory for delivery to a substitute consignee.

2.4.4 IdentService

Processing purposes

With the IdentService, the business consignor can request that the shipment is only delivered to the original consignee at the front door. To ensure that the shipment is delivered to the original consignee, the business consignor specifies verification modules that can be used to clearly identify the original consignee using their ID.

Type of data

The following data is processed as part of the IdentService:

Consignee name
Date of birth
ID card number

Legal basis

ID data is processed on the basis of the provisions of § 69 PostG. Accordingly, we may request that you identify yourself by presenting a valid identity card, passport or other suitable identification documents to ensure the proper execution of the postal service. The ID data will be stored in accordance with § 69 (2) PostG if there is a special interest in preserving evidence. Our special interest in preserving evidence for the storage of the ID number arises from the fact that we must be able to account to our contractual partners for the fact that we have handed over the parcels to the addressee. Pursuant to § 69 (3) PostG, the processing of ID data is permitted to provide evidence of the proper execution of the postal service.

Duration of storage

The data relating to your shipment will be deleted when it is no longer required for the provision of the respective service and the statutory retention periods have expired. Your ID data will be deleted by us as soon as the purpose of storage no longer applies, at the latest 6 months after expiry of statutory or contractual limitation periods, § 69 (4) PostG.

Obligation to provide personal data

You are not required to disclose your ID details, but if you do not wish to show them as part of the IdentService, we will not be able to hand over your parcel.

2.4.5 Creation of a return note

Processing purposes

The purpose of the processing is to create a return label for your return to a business consignor. There are two different options for the return label. Firstly, you can print out the return label as a PDF document yourself and stick it on. You can then simply hand in the parcel at a Hermes parcel shop. The other option is that a QR code is generated for you, which you simply show in a Hermes ParcelShop. They will print out your return label and stick it on the parcel.

Optionally, you can send the return slip (PDF and QR code) to the email address you have provided.

Type of data

We process the following data when creating a return note and this is mandatory information:

First name of the sender
Surname of the sender
Address of the sender

The following details are optional:

Customer reference
E-mail address

We will only process the sender data you provide on the returns slip for the purpose of clarifying the shipment if, for example, the shipment you have returned cannot be delivered.

Legal basis

The legal basis for the collection and processing of data in connection with the creation of the return label is Art. 6 (1) (b) GDPR.

The legal basis for the processing of your e-mail address and your customer reference is Art. 6 (1) (a) GDPR. The consent here is to enter your data.

Duration of storage

The data relating to your return and your customer reference will be deleted after one year. We will delete the email address you provided after sending the email with the PDF document or QR code.

Possibility of erasure/objection and deletion

You can revoke the use of your e-mail address and your customer reference for the future at any time. Please send your erasure to:

datenschutz@myhermes.de

Obligation to provide your personal data

You are not required to disclose personal data. However, without the aforementioned required personal data, a return slip cannot be created. The remaining information is voluntary.

2.5 Refund of purchased reseller labels

Processing purposes

You have the option of cancelling your parcel label using a contact form and sending us your details directly so that we can refund your costs.

Type of data

In order to refund and cancel your parcel label, we require the following personal data:

Order number / shipment number
Your payment receipt
First name, surname
E-mail address
Postal address
Bank details (account holder, IBAN)

The following information is provided voluntarily:

BIC / SWIFT

Legal basis

The legal basis for the collection and processing of data in connection with the cancellation and refund is Art. 6 (1) (b)GDPR. The data you enter is required for the reversal transaction.

Duration of storage

The data you enter will be deleted when it is no longer needed to provide the respective service and the statutory retention periods have expired.

Obligation to provide your personal data

You are not required to disclose your personal data. However, the service cannot be provided without the required personal data mentioned above. The remaining information is voluntary.

3 ParcelShop

3.1 ParcelShop: parcel collection by the original consignee

Processing purposes

You collect your parcel from one of our ParcelShops.

Type of data

When you collect your shipment, information about your ID document (number, type, country of issue) is recorded.

For certain shipments, your date of birth, the completion of your ID number or a TAN or QR code are also recorded to uniquely identify you.

Legal basis

ID data is processed on the basis of the provisions of § 69 PostG. Accordingly, we may request that you identify yourself by presenting a valid identity card, passport or other suitable identification documents in order to ensure the proper execution of the postal service. The ID data will be stored in accordance with § 69 (2) PostG if there is a special interest in preserving evidence. Our special interest in preserving evidence for the storage of the ID number arises from the fact that we must be able to account to our contractual partners for the fact that we have delivered the parcels to the addressee. Pursuant to § 69 (3) PostG, the processing of ID data is permitted in order to provide evidence of the proper execution of the postal service.

Duration of storage

The personal data will be deleted by us as soon as the purpose of storage no longer applies, at the latest 6 months after expiry of statutory or contractual limitation periods, § 69 (4) PostG.

Erasure option

Erasure before the end of the 6 months is unfortunately not possible.

The legality of the storage of ID card data by postal service providers is expressly confirmed by the Federal Data Protection Commissioner:

https://www.bfdi.bund.de/DE/Buerger/Inhalte/Post/SpeicherungvonAusweisdaten.html

Further information

For what purpose is the ID number recorded?

Hermes stores the ID number as evidence of correct delivery § 69 (2) and (3) PostG, as the parcel itself is addressed to the ParcelShop. The ParcelShop address is not sufficient in the event of a complaint.

To whom is the personal data transmitted?

Proof of delivery is sent to the commercial sender of the parcel. This consists of the shipment number, the shipment status and the time of the status.

Obligation to provide your personal data

You are not obliged to disclose your ID data. However, without processing your ID data, we cannot hand over your shipment to you.

3.2 ParcelShop: parcel collection by an authorised representative

Processing purposes

You use the one-off authorisation to collect a parcel from the ParcelShop to authorise another person to collect your parcel from the ParcelShop.

Type of data

If you have your shipment collected by an authorised representative, information on the name of the authorised representative and the authorised representative's ID document (number, type, country of issue) will be recorded.

Legal basis

The legal basis for the processing and storage of ID data when a parcel is collected from the ParcelShop is set out in the Postgesetz (PostG).

ID data is processed on the basis of the provisions of § 69 PostG. Accordingly, we may request that you identify yourself by presenting a valid identity card, passport or other suitable identification documents in order to ensure the proper execution of the postal service. The ID data will be stored in accordance with § 69 (2) PostG if there is a special interest in preserving evidence. Our special interest in preserving evidence for the storage of the ID number arises from the fact that we must be able to account to our contractual partners that we have handed over the parcels to the addressee or the authorised person. Pursuant to § 69 (3) PostG, the processing of ID data is permitted in order to provide evidence of the proper execution of the postal service.

Duration of storage

Hermes stores the ID number as evidence of correct delivery to the authorised representative § 69 (2) and (3) PostG.

The personal data will be deleted by us as soon as the purpose of storage no longer applies, at the latest 6 months after expiry of statutory or contractual limitation periods, § 69 (4) PostG.

Erasure option

Erasure before the end of the 6 months is unfortunately not possible.

The legality of the storage of ID card data by postal service providers is expressly confirmed by the Federal Data Protection Commissioner:

https://www.bfdi.bund.de/DE/Buerger/Inhalte/Post/SpeicherungvonAusweisdaten.html

Further information

The data recorded in the ParcelShop is stored in the systems of Hermes Germany GmbH. Proof of delivery is sent to the business consignor of the parcel. This consists of the shipment number, the shipment status and the time of the status.

Obligation to provide your personal data

You are not obliged to disclose your ID data. However, without processing your ID data, we cannot hand over your shipment to you.

3.4 ParcelShop: Delivery of private parcels

Processing purposes

You hand in a parcel that you want to send privately at the ParcelShop.

Type of data

The address data that you have entered online or by hand on the parcel label will be processed.

Legal basis

The legal basis for data collection and processing in this context is Art. 6 (1) (b) GDPR in relation to the fulfilment of the contract with the sender. As far as the consignee's data is concerned, the provisions of § 68 PostG authorise the processing of personal data to ensure a functioning postal system and are therefore in the public interest in accordance with Art. 6 (1) (e) GDPR. The authorisation pursuant to § 68 (3) s. 1PostG also includes the processing of consignees' personal data if this is necessary for the proper delivery of postal items.

Duration of storage

The personal data will be deleted by us as soon as the purpose of storage no longer applies, at the latest 6 months after expiry of statutory or contractual limitation periods.

Further information

The data will be disclosed to Hermes Germany GmbH, our service providers and the consignee.

Obligation to provide your personal data

You are not required to provide any personal information. Delivery will not be possible without the personal information required above.

4 TAN-secured delivery

“TAN-secured delivery" is a special type of delivery. Successful delivery is only possible after entering the correct TAN or scanning the correct QR code.

Processing purposes

To provide consignees the TAN and QR code before delivery of the shipment, we use the e-mail address provided by the business consignor for communication purposes of the TAN or QR code, as well as a link to track the shipment.

Type of data

We process the following data:

Consignee's email address provided to us by the business consignor along with other standard consignee information

Legal basis

The legal basis for data collection and processing in connection with TAN-secured delivery is Art. 6 (1) (b) GDPR. As far as the consignee's data is concerned, the provisions of § 68 PostG permit the processing of personal data to ensure a functioning postal system and are therefore in the special public interest pursuant to Art. 6 (1) (e) GDPR.

Duration of storage

Your e-mail address will be stored for a period of 30 days.

Obligation to provide your personal data

You are not required to disclose personal data. TAN-secured delivery is not possible without the aforementioned required personal data.

5 Shipment tracking

5.1 Shipment tracking for myhermes.de

Processing purposes

If you want to track a shipment, you need to enter the shipment number, order number or receipt number of the relevant shipment. If the number entered is known in the Hermes system, you will receive information on the progress of the shipment, the expected delivery time and the delivery location.

Type of data

The following data is processed as part of shipment tracking:

Shipment number
Order number
Receipt number
Name of the sender
Name and address of the consignee,

Possible optional information depending on the method of delivery:

Name of the replacement consignee
Alternative delivery locations
Product and service designations
ParcelShop

Legal basis

Duration of storage

The data relating to your shipment will be deleted when it is no longer required for the provision of the respective service and the statutory retention periods have expired. The data relating to your shipment can be viewed on the shipment tracking system for a further 90 days after delivery.

Obligation to provide your personal data

You are not required to provide any personal information. Delivery will not be possible without the personal information required above.

5.2 Live tracking

Processing purposes

The purpose of this processing is to enable you to use the live tracking feature to estimate the arrival time of your Hermes shipment and to see how far away the delivery driver is. After entering your postcode, an interactive map will appear where you can follow the live tracking.

Please note that live tracking is only available for selected shipments.

Type of data

After entering your postcode, the interactive map will be displayed. The following data is used to display the map and search for locations:

IP address
Metadata (e.g., timestamp)
Location (in order to provide the correct map view, this is not your current location, but the location of your recipient's address)

Legal basis

The legal basis for processing your data is Article 6(1) lit. b GDPR, which serves to fulfil the contract with the sender. 6(1)(b) GDPR, and is necessary for the fulfilment of the contract with the sender.

Duration of storage

For information security purposes, the storage period for the aforementioned data is 30 days.

Additional information

The map and live tracking are provided by the following service provider:

HERE Global B.V (parent company)
Kennedyplein 222-226
5611 ZT Eindhoven
Netherlands

Processing of your personal data in third countries

We generally commission the processing of your personal data within the European Union. However, your personal data may be processed in a so-called third country. We have therefore implemented appropriate safeguards to ensure an adequate level of data protection, in accordance with Chapter 5 of the GDPR, particularly Art. 45 and Art. 46 of the GDPR.

Obligation to provide your personal data

You are under no obligation to disclose your data. However, without this information, it will not be possible to use the live tracking feature.

6 Delivery on request

6.1 One-off Hermes delivery on request

Processing purposes

You can use the Hermes delivery option to book an alternative delivery location (preferred drop-off location, preferred neighbour or preferred ParcelShop) or an alternative delivery day for your shipment on a one-off basis.

Type of data

The following data will be processed as part of the Hermes delivery service:

Shipment number
Name of the original consignee
Address of the original consignee

Details depending on your booking:

Name and address of the replacement consignee (desired neighbour)
Desired storage location (desired storage location)
Booked ParcelShop

Legal basis

Please note when entering third-party data, you always must obtain prior permission from the owner of this personal data. We assume that the consignee has consented to the transfer of the data to us. The processing of the data of the replacement consignee (desired neighbour) therefore requires their consent in accordance with Art. 6(1) (a) GDPR.

The legal basis for data collection and processing in this context is Art. 6 (1) (b) GDPR for the fulfilment of the delivery service you have booked.

Duration of storage

We use this data exclusively to provide you with the requested service and delete it as soon as its storage is no longer required for the provision of the respective service and the statutory retention periods have expired.

Obligation to provide your personal data

You are not obliged to disclose personal data. However, without the above-mentioned required personal data, the desired delivery cannot be used. The remaining information is voluntary.

6.2 Permanent Hermes delivery on request

Processing purpose

You can use the permanent Hermes desired delivery to permanently set up a delivery to a drop-off location (permanent desired drop-off location) for all your Hermes shipments or have them permanently sent to a ParcelShop (permanent desired ParcelShop).

Type of data

The following data will be processed as part of the permanent digital Hermes delivery service:

Name of the original consignee
Address of the original consignee
E-mail address

Details depending on your booking:

Booked storage location
Booked ParcelShop

Legal basis

The legal basis for data collection and processing in this context is Art. 6 (1) (b) GDPR for the fulfilment of the delivery service you have booked.

Duration of storage

We use this data exclusively to provide you with the requested service and delete it as soon as its storage is no longer required for the provision of the respective service (e.g. after erasure) and the statutory retention periods have expired.

Possibility of erasure/objection and deletion

You can cancel the fulfilment of your permanent Hermes delivery request at any time with effect for the future: https://www.myhermes.de/empfangen/wunschzustellung/dauerhaft/aendern/

Obligation to provide your personal data

You are not obliged to disclose personal data. However, without the above-mentioned required personal data, the desired delivery cannot be used. The remaining information is voluntary.

7 Notification card

7.1 One-off parcel notification and digital notification card

Processing purposes

You will receive a parcel notification and a digital notification card from us by email if your email address has been sent to us by the sender of the parcel for this purpose.

Type of data

We need your e-mail address for the purpose of the digital notification card and parcel notification.

Legal basis

The legal basis for the processing of your personal data is generally Art. 6 (1) (a) GDPR, the consent to the parcel notification and the digital notification card.

Duration of storage

The data is automatically deleted after 30 days.

Possibility of erasure/objection and deletion

If you no longer wish to receive these messages from Hermes, you can unsubscribe directly via the "Unsubscribe" link in the respective email. Please note that we will then also be unable to inform you if we have left a shipment with a neighbour, for example.

Obligation to provide your personal data

You are not required to disclose personal data. However, if you do not give your consent, you will not receive a digital notification card.

7.2 Analogue notification card for requested delivery

Processing purposes

You use the notification card either to issue Hermes with a one-off drop-off authorisation for the delivery of a shipment or to request a desired neighbour delivery or desired ParcelShop delivery.

Type of data

The following data must be entered for the desired storage location:

Your first name and surname
Your address
Desired storage location
One-off parking authorisation

If you would like delivery to a preferred neighbour or preferred parcel shop, the following data is relevant here:

First name and surname or name of the ParcelShop
Address

The telephone number or e-mail address are optional.

Legal basis

Please note when entering third-party data, you always must obtain prior permission from the owner of this personal data. We assume that the consignee has consented to the transfer of the data to us. The processing of the data of the substitute consignee (desired neighbour) therefore requires their consent in accordance with Art. 6 (1) (a) GDPR.

Data processing is carried out based on Art. 6 (1) (b) GDPR.

Duration of storage

The authorisation data will be stored until the authorisation is revoked or the authorisation has not been used for 1075 days because Hermes Germany has not received a suitable delivery order.

Possibility of erasure/objection and deletion

The erasure of the power of attorney must be submitted in writing either by post or by e-mail to Hermes Germany Customer Service.

E-mail: info-paket@myhermes.de

Postal address:

Hermes Germany GmbH

Essener Bogen 1

22419 Hamburg

The data will be blocked promptly after receipt of the erasure. Once the authorisation has been blocked, any further shipments will be delivered to the postal address provided by the sender.

The final deletion of the data takes place 365 days after the data has been blocked.

Further information

The data becomes known to Hermes Germany GmbH, our service providers and clients.

Obligation to provide your personal data

You are obliged to disclose your personal data based on contractual regulations.

8 Permanent notification function

Processing purposes

If you have registered for permanent notification on our website, you will receive a notification for every parcel sent with Hermes. We will send this notification to the e-mail address you have provided. You will then receive information such as the announcement, updates (previous deliveries/delays) and delivery messages.

Type of data

You must enter the following data when registering for the permanent notification function:

First name
Name
Postcode
Mail address

Legal basis

The legal basis for the processing of your personal data is Art. 6 (1) (a) GDPR your consent to permanent notification by confirming your e-mail address.

Duration of storage

Your data will be stored until the permanent notification is cancelled.

Possibility of erasure/objection and deletion

You can unsubscribe at any time, for example by clicking on the link provided at the bottom of the notification or the following link on myHermes.de.

Once you have confirmed the erasure email, you will no longer receive any notifications from us about future shipments. Shipments that are still being delivered at the time of erasure will still receive information.

Obligation to provide your personal data

You are not obliged to disclose personal data. However, we cannot provide you with our parcel notifications without your data.

9 Hermes Box

9.1 Delivery to a Hermes Box

Processing purposes

We process your data based on your request to deliver your parcel to a Hermes Box. We process your e-mail address in order to send you a PIN. We need your shipment number to deliver your parcel and for unique identification.

Type of data

We process the following data:

Name
Shipment number
E-mail address

Legal basis

The legal basis for the processing of your personal data is Art. 6 (1) (b) GDPR, your contract with us for parcel delivery to a Hermes Box.

Duration of storage

Your data will be deleted when it is no longer required for the provision of the respective service and the statutory retention periods have expired.

Further information

We also use the following service provider:

Sistemas Kern S.A.U.

Calle Neptuno, 20

28229 Villanueva del Pardillo

Madrid

Spain

Processing of your personal data in third countries

Obligation to provide your personal data

You are not required to provide your personal data; if you do not provide us with your data, it will not be possible to use the Hermes Box service.

9.2 Returns via a Hermes Box

Processing purposes

We process your data due to the return of your parcel via a Hermes Box. Your e-mail address will be used to send you a voucher for receipt. We need your shipment number to return your parcel and for unique identification.

Type of data

We process the following data:

Name
Shipment number
E-mail address

Legal basis

The legal basis for the processing of your personal data is Art. 6 (1) (b) GDPR, your contract with us for the return of your parcel via a Hermes Box.

Duration of storage

Your data will be deleted when it is no longer required for the provision of the respective service and the statutory retention periods have expired.

Further information

We also use the following service provider:

Sistemas Kern S.A.U.

Calle Neptuno, 20

28229 Villanueva del Pardillo

Madrid

Spain

Processing of your personal data in third countries

Obligation to provide your personal data

You are not obliged to provide your personal data; if you do not provide us with your data, it will not be possible to use the Hermes Box service.

10 Confirmation of non-receipt

The declaration serves as documentation and proof that you, as the intended consignee of a shipment, confirm that you have not received it.

The following data is processed in the course of confirmation:

First name and surname
Street and house number
Place of residence and postcode

Depending on the type of form (paper form or digital form):

Signature in paper form
For the digital form, no signature, only field selection

The legal basis for the processing of your personal data is Art. 6 (1) (f) GDPR. Our legitimate interest is to track reported parcel losses. In individual cases, we may forward this confirmation to our service providers. The legal basis for this forwarding is Art. 6 (1) (b) GDPR and serves to fulfil the contract with the respective service provider and client.

The data is deleted when it is no longer required, and the statutory retention periods have expired.

The data is processed by Hermes Germany GmbH. In individual cases, data processing by our service providers is possible.

11 Liability and timeliness

11.1 Liability for links

It is possible that our website and our data protection information contain links to external websites of third parties over whose content we have no influence. We can therefore accept no liability for this third-party content.

The respective provider or operator of the site is always responsible for the content of the linked website. The linked site was checked for possible legal violations at the time of linking. No illegal content was recognisable at the time of linking. Permanent monitoring of the content of the linked site is not possible and unreasonable without concrete evidence of an infringement. If we become aware of an infringement, we will remove such links immediately.

11.2 Updating and modification

Parts of the privacy policy may be changed or updated by us without prior notice to you. Please check the data protection information before you use our offer in order to be up to date with any changes or updates.

Current status of the data protection information: December 2024