InPost App Privacy Notice

Last Updated: September 2023

The protection of your personal data is very important to us. This notice explains how and why we use personal data in connection with our app. This notice also provides contact information and important information about your data protection rights.

Who we are and how to contact us:

We are InPost UK Limited (company number 08090698). We are responsible for deciding how and why we use the personal data collected in connection with our app.

If you have any questions about this privacy notice or our use of personal data, or if you want to exercise your data protection rights please contact our Data Protection Officer on [email protected].

What personal data do we collect from and about you?

App users:

When you use our app you will be asked to provide us with certain information in order to create an account and sign up to our service. This may include, for example:

your name;
your mobile number;
billing address, delivery address and email address;
parcel details; and
bank account and payment card details (which will be held by our third party payment processor).

We need this information in order to provide our services to you. If you don’t provide it, you will not be able to set up an account or use our services via the app.

We also

collect details of your marketing preferences and app settings;
record purchases and order history;
process information within any correspondence you send to us or otherwise get in touch with us;
assign tracking references to orders placed via our service;
collect device information; and
analyse how our app is used.

Parcel recipients:

If you are a recipient of a parcel sent via our app, we may receive your name, address, contact number and email address from the sender for delivery purposes.

Accessing our lockers:

Please be aware for security purposes we use CCTV at our locker sites and so your image may be captured when you deposit or collect a parcel from our lockers.

Why do we use your personal data and what is our lawful basis for doing so?

Under data protection law we must tell you why we use your personal data and identify a lawful basis for using your personal data.

Necessary for performance of a contract:

We primarily use personal data in order to provide our services to you. This may includes (as app functionality changes from time to time):

to register you as new customer or recognise you as a returning customer;

to process orders placed through our app;

to deliver parcels sent by you or to you; and

to send you messages by email, SMS or push notification via the app in relation to: the delivery of a parcel; status updates; and locker locations; and payment, deposit and collection receipts; and

to process refunds (where applicable).

Where applicable, we use your data for the above purposes in order to fulfil our obligations under our contract with you.

Our legitimate interests, or those of a third party:

We may use your personal data where we need to for purposes which are in our or a third party’s legitimate interests. When relying on this basis, we consider our legitimate interests and the potential impact on your rights and interests and weigh these up.

If you are the recipient of a parcel but you are not an app user or you do not otherwise have a contract with us directly, then we rely on legitimate interests for use of your personal data for the purposes set out above. It's in your interests to receive your parcel, and it is both our and the parcel sender's interests for us to use your data to deliver it to you.

We also rely on legitimate interests for use of your personal data for the following purposes:

to respond to enquires, communications and complaints you send us and provide customer services;
to communicate with you where necessary for essential service messages;
to administer the app and maintain customer records;
for fraud prevention and detection;
for account verification and security purposes;
to better understand how our app is used for product and business development purposes so we can develop the best product we can;
for security and crime prevention purposes via the implementation of CCTV at our locker sites;
to exercise legal rights and defend legal claims; and
to the extent necessary for the purpose of the administration of a sale or possible sale of our business, assets or the restructuring of our business.

Consent:

Sometimes we may ask for your consent to use your personal data for a particular purposes. Where we ask for consent you will have the right to change your mind at any time. You can usually do this by changing the settings on your app. You can also contact our DPO at [email protected].

We ask for your consent:

to send you marketing messages by push notifications, email and/or SMS. You can change your marketing preferences at any time via the app. You can also unsubscribe to email or SMS marketing by using the unsubscribe link within the email or following the instructions within the SMS;
to use your location data, which is relevant for certain features of our app, such as alerting you to nearby locker locations. You can modify your settings on the app or your device anytime to switch this off (although if you do, that particular feature may not be available to you); and
to use tracking technologies.

To comply with our legal obligations:

In certain circumstances, we may be obliged to process your personal data in order to comply with our legal obligations. This might include, but is not limited to, processing required for tax and accounting purposes; and to enable us to fulfil our compliance and other obligations under relevant legislation or regulation.

Who do we share your personal data with?

We use the following types of service providers in connection with our app who may have access to your personal data in order to provide their services:

transport companies and couriers;
payment and refund processors;
insurers responsible for covering potential damage to parcels;
IT solutions providers;
customer helpline and customer services providers;
marketing providers;
professional services providers (for example, accountants and lawyers).

We share personal data with our group companies where necessary for operational purposes.

We will share personal data with potential buyers, group companies and/or business partners where necessary for a reorganisation, restructuring, merger, sale or transfer of assets involving InPost or our app.

We will share personal data where necessary to establish, exercise or defend our legal rights. We will share personal data where required by the courts, regulators or law (including where necessary to HMRC) and also to report suspected fraudulent or other unlawful activity to law enforcement.

International transfers

From time to time we may transfer your personal data to members of the InPost Group or to third parties based outside the UK. Their processing of your personal data will therefore involve a transfer of data outside the UK.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring that either:

we will only transfer your personal data to countries that been deemed to provide an adequate level of protection for personal data (for example, those in the EEA); or
where we transfer personal data to certain service providers located in other countries, (i) we will assess whether that country offers protections for personal data which are essentially equivalent to those offered in the UK; and (ii) we will use specific contractual terms to give personal data appropriate safeguards.

How long do we hold your personal data for?

We retain your personal data for as long as we have a lawful reason to do so, which includes providing our services to you, complying with legal and regulatory obligations, and resolving disputes and enforcing agreements.

We retain your personal data while you hold an account with us to enable us to provide our services to you. Once you delete the app or close the account we will store your personal data for no longer than the limitation period of any claims for the provision of services by us, which is generally 6 years.

In determining how long to hold your personal data we will consider legal and regulatory requirements and also whether it is necessary for us to keep it to achieve the purposes we’ve described in this policy. Where it is no longer necessary for us to keep it, we’ll delete it or we’ll anonymise it so that you cannot be identified from it.

Your data protection rights

If we hold your personal data you have the following rights:

to be informed about how we use your personal data (which is what this notice is for);
to access a copy of the personal data we hold about you;
to require us to correct any inaccuracies in your personal data;
where we have sought your consent, to withdraw your consent at any time (although please note that generally we do not rely on consent to use your personal data);
to ask us not to process your personal data for direct marketing purposes.
to restrict our use of your personal data;
to object to our use of personal data;
to require us to provide a copy of your personal data to others; and
to require us to erase your personal data.

There are exceptions to the rights of individuals in relation to their personal data and, in certain circumstances, your rights may be limited. The Information Commissioner’s Office provides more information about data protection rights –www.ico.org.uk.

If you wish to exercise any of your rights please contact our Data Protection Officer on [email protected].

You also have the right to complain to the Information Commissioner’s Office (which is the UK’s data protection regulator) about our use of your personal data. For more information please see: https://ico.org.uk/make-a-complaint/. We ask that in the first instance you contact us so that we can try to address your concerns directly.

Updates to this privacy notice

We may update this privacy notice from time to time to make sure it is up to date. When we do, we will revise the “last updated” date at the top of the notice. We’ll endeavour to make you are aware of material changes to it but we suggest you also check this notice from time to time so that you know our latest privacy practices.