Privacy Notice for the PostNord App

On this page

1. When you use your PostNord account

You can use the app without logging in, or by creating an account and verifying your email address. You can also verify your profile using electronic identification (eID), allowing more shipments addressed to you to be added to the app automatically.

If you are logged in with your PostNord account, we process the information needed to administer your account and give you access to the services and features linked to it.

We process:

• name
• email address
• address
• phone number
• login and account details
• information about services and shipments linked to your account.

When you log in to the app, information about the parcels and deliveries linked to your PostNord account is retrieved. This means you can see current shipments and past delivery history linked to the account.

Why do we process personal data?

We process your data to provide the PostNord account and the features you use.

Legal basis

Performance of a contract.

How long do we retain personal data?

We retain the data for as long as the account is active. If you close the account, or if you have not used it for 2 years, we will delete the data.

2. When you track and manage parcels and deliveries

When you track or manage a shipment in the app, we process the data needed to display and administer the delivery.

We process:

• name and contact details
• parcel ID or tracking number
• information about the sender and recipient
• delivery address
• selected delivery location
• delivery preferences
• status and history of the shipment.

We also process information about the choices you make in connection with the delivery, for example if you change the delivery time.

Why do we process personal data?

We process your data to carry out the delivery and administer your account, as well as to follow up and ensure a correct and secure delivery. Personal data may also be retained or disclosed to the extent we are required by law.

Legal basis

Performance of a contract and our legitimate interest in ensuring a correct and secure delivery. Where we are required by law to retain or disclose personal data, the processing is based on a legal obligation.

How long do we retain personal data?

The data is retained to administer deliveries and handle any claims. Parcel and delivery history is retained for 5 years.

When you make a delivery choice, for example changing the delivery time or choosing to collect the shipment from a service point, data about your choice is retained for 30 days.

3. When you collect a parcel from a parcel locker

When you use the app to collect a shipment from a parcel locker, we process the data needed to ensure that the correct shipment is released to the correct recipient and to enable the parcel locker to be opened.

We process:

• your user data
• information about the shipment
• information about the relevant parcel locker
• time of opening or collection
• technical information needed for communication between the app and the parcel locker.
• Bluetooth and location access are required to collect parcels from parcel lockers.
• Electric identification (eID) is only used for certain shipments.
• In other cases, opening the parcel locker may be permitted if the shipment details match the details of your logged-in PostNord account  

Why do we process personal data?

We process the data to provide the delivery service and ensure the secure delivery of the shipment.

Legal basis

Performance of a contract and our legitimate interest in ensuring that the correct shipment is released to the correct recipient and in preventing fraud or unauthorised access at collection.

How long do we retain personal data?

Events linked to a parcel ID are retained for 1 year. Data about shipments collected using electronic identification is retained for 13 months.

4. When you purchase products and services in the app

The service covers digital stamps, letter mail, registered mail, parcels, international parcels, trackable letters, home deliveries, and deliveries to an agent. To provide the service, we process the data required to carry out and administer the purchase.

We process:

• contact details
• information about the product or service
• payment and transaction information
• order and receipt details
• information about the sender and recipient, where necessary for the service  

When you make a payment, information such as card details, phone number, name and account details are processed by our payment service providers to carry out and administer the payment.

Why do we process personal data?

We process your data to carry out your purchase and provide the product or service you have ordered.

Legal basis

Performance of a contract.

How long do we retain personal data?

We need to retain certain data about purchases and payments to comply with legal obligations, for example under accounting legislation. Such data is retained for at least 7 years, calculated from the end of the calendar year in which the financial year ended. If applicable legislation requires a longer retention period, the data is retained in accordance with that obligation.

Other data is normally retained for 2 years, while customer data such as email address and phone number is retained for 7 months. 

5. When you contact us

If you contact us via chat or any other contact function in the app, we process the personal data needed to help you with your matter.

We process:

• name and contact details
• information about a shipment
• details of your matter
• the information that you provide to us

Why do we process personal data?

We process your data to be able to answer questions, provide customer service and handle complaints or claims.

Legal basis

Performance of a contract or our legitimate interest in being able to provide customer service and handle your matter.

How long do we retain personal data?

Customer matters are normally closed after the contact has been completed, but may, if needed, be handled further internally or become complaint cases. Chat conversations are retained for 3–5 years depending on the type of matter.

6. Push notifications and messages

We may send push notifications to inform you about, for example:

• the status of a shipment
• delivery
• purchases or orders
• changes affecting a service
• other service messages

Why do we process personal data?

We process the data needed to send the notification, for example information about your shipment and the technical information required for the push notification.

Legal basis

Performance of a contract, or our legitimate interest in communicating with you about the service.

7. Information on how the app is used

When you use the PostNord app, certain technical information may be processed to ensure the app functions safely and correctly.

We process:

• IP address
• information about the device and operating system
• app version and crash reports

Why do we process personal data?

We process such information when it is necessary to provide and protect the app, prevent misuse and address technical errors.

We also use technical tools to understand how the app is used and to improve, test and develop the app and our services.

Legal basis

We process personal data necessary to provide and protect the app based on performance of a contract and legitimate interest. Analytics requiring consent is only carried out with your consent, which you can withdraw at any time.

How long do we retain personal data?

Information about the cookies and similar technologies used can be found in our cookie policy. To detect and address technical errors, we use Crashlytics, where the data is stored for 90 days. For statistics and analysis, we use Google Analytics, where the data is stored for 14 months.

8. Permissions on your phone

Certain features in the PostNord app may need access to functions on your phone.

To be able to offer certain features in the app, we may request access to your location information, Bluetooth and camera. 
Location information and Bluetooth are used to collect shipments from parcel lockers and to find the nearest PostNord location or service point. The camera is used to scan barcodes. 

You decide for yourself whether the app may access such functions through the settings on your phone. When you grant the app access to a function, we only process the information needed for the function you are using.

9. Who do we share your personal data with?

To be able to provide the PostNord app, we may share your personal data with other companies within the PostNord Group and with suppliers that help us provide the service, such as suppliers of:

• IT and operational services
• payment solutions
• customer service
• analytics and troubleshooting services
• security services

The suppliers that process personal data on our behalf may only process the personal data in accordance with our instructions and the requirements under our agreements.

Transfer to third countries

Personal data may be processed or transferred to countries outside the EU/EEA. 
If such a transfer takes place, we ensure that a valid transfer mechanism under the GDPR is in place, for example the EU–US Data Privacy Framework, the European Commission's standard contractual clauses (SCCs), or an adequacy decision. 
Supplementary safeguards are applied where necessary.

More information about recipients and any processing of personal data outside the EU/EEA is available in PostNord Oy's general privacy notice. 

10. How long do we retain the personal data?

We do not retain personal data for longer than necessary for the purposes for which it was collected or as required by law. Specific retention periods are provided in the relevant sections above.

11. Your rights

You have the right to obtain information about how we process your personal data and may, depending on the situation, among other things have the right to:

• access your personal data
• have inaccurate personal data corrected
• request that personal data be deleted
• request that the processing be restricted
• object to processing based on legitimate interest
• obtain certain personal data in a transferable format
• withdraw a consent that you have given

You may exercise your rights by contacting PostNord Oy using the contact details provided at the beginning of this privacy notice.

If you believe that we are processing your personal data in violation of data protection legislation, you also have the right to lodge a complaint with the Finnish data protection authority, the Data Protection Ombudsman. More information about lodging a complaint is available on on the website of the Office of the Data Protection Ombudsman. The Finnish Transport and Communications Agency Traficom supervises compliance with the rules on storing information on your device and accessing information on your device through cookies and similar technologies. You can lodge a complaint about these matters with Traficom.

12. More information

This privacy notice supplements PostNord Oy’s general privacy notice. There you can find additional information about how we protect personal data, recipients of the data, processing outside the EU/EEA, your rights and how to contact PostNord or our Data Protection Officer.