Privacy policy in-store products 

Information about the use of data pursuant to the General Data Protection Regulation (GDPR):

Mandatory information pursuant to Articles 13 and 14 of the GDPR, provided for informational purposes only
Updated: August 2026

1. What information is available on this page?

Österreichische Post AG (hereinafter referred to as "Austrian Post", "we", "us") processes your personal data in full compliance with the provisions of data protection law, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DPA) and all other applicable laws.

In this document, you will find information about data processing performed in relation to online products and services. This document includes the following sections:

• To whom is this information addressed? (item 2)
• Who is responsible for the processing of your data? (item 3)

   

• Information about possible data processing (item 4), in particular
  • Alternative delivery address such as PO box and vacation hold mail (item 4.1)
  • Customer management, inquiries and complaints from hilately customers (item 4.)
  • Advertising activities and sending newsletters to philately customers (item 4.4)

     

• With whom are we allowed to share your data? (item 5)
• Automated decision-making and profiling (item 6)
• What rights do you have? (item 7)
• How can you get in touch us? (item 8)

Information about the use of cookies on our websites is available at Data protection.

If you are looking for information on specific postal products or services such as mail and parcel delivery, advertising and marketing or business customer relations, you will find it in the selection field on the right-hand side. If you need printed copies of the information provided on this page or on additional pages, please contact the staff at our service locations.

2. To whom is this information addressed?

This data protection policy is addressed to all customers who purchase or use our in-store products.

3. Who is responsible for the processing of your data?

The responsible party for data processing described on this page is

Österreichische Post AG,
Rochusplatz 1,
1030 Vienna,
Austria

4. Information about possible data processing

4.1 Alternative delivery address such as PO box and vacation hold mail
We process your data as part of the PO box, PO box plus or vacation hold mail service in order to redirect letters and parcels addressed to you as requested.

Which of your data may we process for this purpose?
Personal master data, contact details, address data, identity document data, signatures and digital signatures, order and invoice data

What is the legal basis for this processing?
The legal basis for this processing is the contract for the PO box, PO box plus or vacation hold mail service (Art, 6 (1) (b) of the GDPR) that we have concluded with you.

How long will your data be stored?
For the purpose of redirecting your letters and parcels, your data will be stored for a maximum of 100 days from the date of processing of the physical contract or 31 days (metadata) from the date of transmission to the controller.

With whom are we allowed to share your data?
For contract archiving purposes, your data may be transmitted to the following categories of recipients:

Processors

Other information about this processing:
You are under no contractual or legal obligation to provide your data. The aforementioned data are required for the conclusion of a contract. If you do not provide the aforementioned data, we will not be able to provide the "PO box, PO box plus or vacation hold mail" service.

4.2 Customer management, inquiries and complaints from philately customers
We process your data as part of our customer management activities and the processing of inquiries and complaints from our philately customers.

Which of your data may we process for this purpose?
Personal master data, contact details, address data, payment data, contractual agreements, order and invoice data

What is the legal basis for this processing?
The legal basis for this processing is

• the contract for our philately products and services (which we have concluded with you (Art. 6 (1) (b) of the GDPR),
• as well as the protection of our legitimate interests (Art. 6 (1)

How long can your data be stored?
For the purpose of customer management or for processing your inquiries and complaints, your data will be stored for a maximum of 3 years from the last contact we had with you or from receipt of the inquiry/complaint.

With whom are we allowed to share your data?
For the purpose of processing your inquiries or complaints, your data may be transmitted to the following categories of recipients:

Processors

Other information about this processing:
You are under no contractual or legal obligation to provide your data. If you do not provide the aforementioned data, we will not be able to process your inquiries and complaints.

4.3 Advertising activities and sending newsletters to philately customers
We may process your data for advertising purposes and sending newsletters to philately customers in order to send you information about our philately products and services.

Which of your data may we process for this purpose?
Personal master data, contact data, address data

What is the legal basis for this processing?
The legal basis for this processing is

• Your consent (Art. 6 (1) (a) of the GDPR), which we obtain as necessary in accordance with the law. You can revoke this consent at any time without giving reasons with future effect
• as well as our legitimate interest for the purpose of direct marketing (Art. 6 (1) (f) of the GDPR) if the legal requirements are met.

How long can your data be stored?
Your data collected for the purpose of carrying out advertising activities and sending newsletters to philately customers will be deleted 3 days after the advertising activity has been carried our or the newsletter has been sent. 

Other information about this processing:
You are under no contractual or legal obligation to provide your data. If you do not provide us with the above data, we will be unable to provide you with information about our philately products and services.

5. With whom are we allowed to share your data?

To learn with which recipient categories we are allowed to share your data, please see the section "Information about possible data processing". A detailed description of Austrian Post recipients and/or categories of recipients is available under item 5 in the document Data protection.

6. Automated decision-making and profiling

As a general rule, no automated decision-making or profiling pursuant to Article 22 (1) and (4) GDPR is carried out in data processing at Austrian Post.

7. What rights do you have?

You have the right of access to your personal data that we process as a controller. For more information, please refer to Article 15 of the GDPR.

Under certain conditions, you may request the restriction of processing as well as the rectification and deletion of your personal data.  For more information, please refer to Articles 16 to 19 of the GDPR.

In addition, under certain conditions, you also have the right to data portability, meaning that we would give you all personal data you have disclosed to us in a structured, standard, and machine processable format. For more information, please refer to Article 20 of the GDPR.

As a data subject, you have the right to object to the use of your data if the processing serves the purpose of direct marketing. In addition, you have the right to object at any time to the processing of your data carried out in the legitimate interests of Austrian Post or third parties if reasons arise from your specific circumstances. For more information, please refer to Article 21 of the GDPR. The processing of your personal data may be based on your consent pursuant to Art. 6 (1) (a) of the GDPR. You can revoke this consent at any time without the need to state reasons with future effect. Until then, we will lawfully process your data.

For information about the legal basis of our data processing, please see item 4 ("Information about possible data processing").

In addition, you have the option of filing a complaint with the Austrian Data Protection Authority:

Austrian Data Protection Authority,
Barichgasse 40-42,
1030 Vienna
Austria

Telephone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at

8. How can you get in touch with us?

Would you like to exercise your rights or do you have further questions, suggestions, or feedback?
To contact Austrian Post's data protection officer or to exercise your rights, please use one of the contact options listed under item 8 of our general data protection policy: post.at/Datenschutz.