Information about data use pursuant to the General Data Protection Regulation (GDPR):

Mandatory information according to Art 13 and 14 GDPR of a purely informative nature.

Updated: August 2026

1. What information is available on this page?

Österreichische Post AG (hereinafter referred to as "Austrian Post", "we", "us") processes your personal data in full compliance with the provisions of data protection law, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act and all other applicable laws. 

In this document, you will find information about data processing that takes place during the processing of parcels and certified letter mail items. This document includes the following sections:

• To whom is this information addressed? (item 2)
• Who is responsible for the processing of your data? (item 3)
• Information about possible data processing (item 4)
• With whom are we allowed to share your data? (item 5)
• Automated decision-making and profiling (item 6)
• What rights do you have? (item 7)
• How can you get in touch us? (item 8)

Information about the use of cookies on our websites is available at Data protection.
If you are looking for information on specific Austrian Post products or services – such as our online services, advertising and marketing, or business customer relations – you can find them in the selection field on the right-hand side. If you need printed copies of the information provided on this page or on additional pages, please contact the staff at our service locations.

2. To whom is this information addressed?

This privacy policy is addressed to all our customers who send or receive parcels or certified letters via our company.

3. Who is responsible for the processing of your data?

The responsible party for data processing described on this page is

Österreichische Post AG,
Rochusplatz 1,
1030 Vienna,
Austria

4. Information about possible data processing

4.1. Handling of parcels and tracked letter mail items
Your data will be processed for the provision (handling and fulfillment) of postal services, in particular shipping and delivering parcels and tracked letter mail.

Which of your data can we process for this purpose?
For this purpose, we process the following data:
Address data, contact details, item data, personal master data, payment data, order and invoice data, signatures and digital signatures, login and account data, other documents, powers of attorney, image, audio and video data, identity document data

What is the legal basis for this processing?
The legal basis for this processing is

• the shipping contract (Art. 6 (1) (b) of the GDPR);
• our legal obligations (Art. 6 (1) (c) of the GDPR) in accordance with the Austrian Postal Market Act, the Austrian Delivery Act (esp. for official items), regulatory requirements, documentation obligations as well as requirements under company and capital market law, tax or corporate law and auditing and reporting obligations as well as  Section 23 (2) of the Austrian Customs Law Enforcement Act and other customs regulations (execution of customs services);
• the public interest in postal delivery (Art. 6 (1) (e) of the GDPR);
• and our legitimate interest (Art. 6 (1) (f) in optimising the delivery as well as to handle item inquiries and claims.

How long can your data be stored?
Recipient data will be processed in the distribution centre for a maximum of 3 years from the time the item was recorded.

Billing data and customs-related data processed in connection with the handling and delivery of all items will be retained, depending on the relevant data category, in accordance with the statutory retention periods set out in Section 132 of the Austrian Federal Tax Code and Section 212 of the Austrian Commercial Code. Where there are additional legal grounds for retention or pending legal proceedings, the relevant data may be retained for a longer period where necessary.

Data on tracked letter mail items can be processed for a maximum of 5 years from the start of storage. 

With whom are we allowed to share your data? 

Processors
Public authorities
International partners of Austrian Post

In the area of postal services, international item data may, given the contractual duty to deliver mail and the Treaty of Bern for international mail delivery signed by Austria, be processed in any third-country in the world, provided that this is necessary for the delivery of a specific item (Article 49 (1) (b), (c), (d) of the GDPR).

For delivery purposes, address data that cannot be read automatically at our distribution centres are coded remotely via video on our behalf. For this purpose, we use a contract processor in Vietnam.
In such cases, the data transfer is based on EU Standard Contractual Clauses, together with a documented case-by-case assessment of the adequacy of the level of protection (safeguard pursuant to Article 46 GDPR); these are available upon request at post.at/sonstigedatenschutzanliegen.

Other information about this processing:
If you do not provide the data necessary for the item, we will not be able to process the item.

4.2. Redirection orders and advance dispositions
Your data will be processed to carry out advance dispositions and redirection orders and thus for logistics purposes, because without this data it is not possible to carry out your orders. Even after the end of the agreement, the names and current address of all persons will continue to be processed in order for us to deliver items. If you have moved, we will make a note for the old address that the persons in question have moved.

Which of your data do we process for this purpose? 
For this purpose, we process the following data:
Address data, contact details, personal master data, identity document data

What is the legal basis for this processing?
The legal basis for this processing is

• the contract for advance dispositions and redirection orders that we have concluded with you (Art. 6 (1)  (b) of the GDPR);
• our legal obligation according to Section 18 of the Austrian Delivery Act, Section 32 (5) and Section 35 (2) of the Austrian Postal Market Act, which regulate redirections as well as the transfer to other postal service providers (Art. 6 (1)  (c) of the GDPR);
• our legitimate interest (Art. 6 (1)  (f) of the GDPR) in optimising the service;
• Data storage after the end of the contract is in the public interest in order to be able to deliver your items automatically and thus quickly and cost-effectively (Art. 6 (1) (e) of the GDPR).

How long can your data be stored?
Your order-related data will be retained in accordance with the statutory retention periods set out in Section 132 of the Austrian Federal Tax Code  and Section 212 of the Austrian Commercial Code. Where there are additional legal grounds for retention or pending legal proceedings, the relevant data may be retained for a longer period where necessary.
For logistics reasons, we will store your data as long as required for the delivery of items to your address, e.g., to plan the delivery process. This also includes the general entry of information that you receive mail at a given address or that you have moved from an address.

With whom are we allowed to share your data?
For the purpose of fulfilling the contract as well as for legal obligations, your data may be transferred to the following recipients/categories of recipients: 

Postal service providers
Processors
Public authorities

Other information about this processing:
You are under no contractual or legal obligation to provide your data for this service. If you do not provide the above information, advance dispositions and redirection orders cannot be set up.

4.3. Handling of AllesPost customer data by Austrian Post Customer Service (PKS)
If you are a customer of the product AllesPost (AP), your data may be used by the Austrian Post Customer Service (PKS) to contact you in two cases:

• If an AP customer reports to the PKS that he/she is missing an item and it turns out that the item was mistakenly delivered to you as an AP customer. PKS will contact you to arrange for the item to be picked up.
• If an AP customer reports to thePKS that he/she has received an item that belongs to you as an AP customer. PKS will contact you to arrange for re-delivery to you.

The PKS can contact you in writing or by telephone. For this purpose, we use the e-mail address or telephone number that you have entered in your AllesPost account or in your Austrian Post account.

Which of your data can we process for this purpose?
Address data, contact details

What is the legal basis for this processing?

The legal basis is

• the contract for the product AllesPost which we have concluded with you (Article 6 (1)  (b) of the GDPR);
• Our legitimate interest in ensuring that AllesPost items are properly delivered and that losses/misdeliveries are avoided for the benefit of our customers.

4.4 Sending item-related status information
We process your data for delivering item-related status information. In doing so, you will be informed about the status of the item on behalf of the sender. This information can be provided either via text message or e-mail. If an item can be matched to a user registered with Austrian Post, the recipient will be informed about the item assigned to them via the Austrian Post app. If delivery abroad is requested, we will disclose the contact details provided by the sender of the item to the delivery service in the destination country so that it can keep you informed about the status of the item.

Which of your data do we process for this purpose?
For this purpose, we process the following data:
Personal master data, contact details, item data

What is the legal basis for this processing?
The legal basis for this processing is

• The legal bases are the performance of the contract with the senders (Article 6(1)(b) GDPR);
•  our legitimate interests pursuant to Article 6(1)(f) GDPR in informing recipients about incoming items.

How long will your data be stored?
Your data collected for the purpose of sending status information on items will be deleted immediately after the item was delivered.

With whom are we allowed to share your data?
For the purpose of sending item-related status information, your data may be transferred to the following categories of recipients:

Processors
International partners of Austrian Post

We work with a processor in Turkey to host a text message platform. In these cases, the transfer of data is based on EU standard data protection clauses (safeguard pursuant to Art. 46 of the GDPR) including a documented case-by-case assessment of the adequacy of the level of protection; These are available upon request at post.at/sonstigedatenschutzanliegen.

We also use an IT service provider based in Ireland and the USA to facilitate the technical delivery of e-mails. For this purpose, e-mail addresses and the content of the status information sent may be transferred to the USA.

In such cases, the transfer of data is based on the Data Privacy Framework, under which the provider is certified (and is therefore covered by an adequacy decision pursuant to Article 45 GDPR). As an additional safeguard, EU Standard Contractual Clauses have also been concluded, together with a documented case-by-case assessment of the adequacy of the level of protection (safeguard pursuant to Article 46 GDPR). These are available upon request at post.at/sonstigedatenschutzanliegen.

5. With whom are we allowed to share your data?

To learn with which recipient categories we are allowed to share your data, please see the section "Information about possible data processing". A detailed description of Austrian Post recipients and/or categories of recipients is available under item 5  in the document Data protection.

6. Automated decision-making and profiling

As a general rule, no automated decision-making or profiling pursuant to Article 22 (1) and (4) GDPR is carried out in data processing at Austrian Post.

7. What rights do you have?

You have the right of access to your personal data that we process as a controller. For more information, please refer to Article 15 of the GDPR.

Under certain conditions, you may request the restriction of processing as well as the rectification and deletion of your personal data. For more information, please refer to Articles 16 to 19 of the GDPR.

In addition, under certain conditions, you also have the right to data portability, meaning that we would give you all personal data you have disclosed to us in a structured, standard, and machine processable format. For more information, please refer to Article 20 of the GDPR.

As a data subject, you have the right to object to the use of your data if the processing serves the purpose of direct marketing. In addition, you have the right to object at any time to the processing of your data carried out in the legitimate interests of Austrian Post or third parties if reasons arise from your specific circumstances. For more information, please refer to Article 21 of the GDPR. The processing of your personal data may be based on your consent pursuant to Art. 6 (1) (a) of the GDPR. You can revoke this consent at any time without giving reasons with future effect; until then, we will process your data lawfully.

For information about the legal basis of our data processing, please see item 4 "Information about possible data processing").

Would you like to exercise your rights or do you have further questions, suggestions, or feedback? In this case, please go to item 8 ("How can you get in touch with us?") and contact the indicated person.

In addition, you have the option of filing a complaint with the Austrian Data Protection Authority:

Austrian Data Protection Authority, 
Barichgasse 40-42, 
1030 Vienna
Austria

Telephone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at

8. How can you get in touch with us?

Would you like to exercise your rights or do you have further questions, suggestions, or feedback?
To contact Austrian Post's data protection officer or to exercise your rights, please use one of the contact options listed under item 8 of our general data protection policy: post.at/Datenschutz.