Privacy Notice

Welcome to Royal Mail Group’s privacy notice.

Royal Mail Group is committed to respecting your privacy and protecting your personal data. This privacy notice explains how we collect and use your personal data and tells you about your privacy rights.

We’ve updated the privacy notice to take into account the requirements of the General Data Protection Regulation (GDPR).

We’ve split the privacy notice into sections so that you can click through to the specific areas below.

  • About Royal Mail Group and this privacy notice

    This privacy notice provides you with information about how Royal Mail Group processes personal data. This includes personal data we will collect about you when you use our websites, or when you use or are a recipient of our services, as well as some information which we obtain from other sources.

    Personal data is information which relates to an identifiable living person. This may be information such as your name, address, email address and other personal details.

    Royal Mail Group includes Royal Mail and Parcelforce Worldwide. The data controller processing your personal data will be Royal Mail Group Limited unless we specify otherwise. Our address is:

    Royal Mail Group Limited

    100 Victoria Embankment

    London

    EC4Y 0HQ

    When you use or receive products or services from Royal Mail Group, we will, where appropriate, provide further information about how that personal data will be used. This privacy notice should be read together with any other fair processing notice or additional information that we may provide. 

  • Personal data we collect

    Royal Mail Group uses personal data for different purposes. This includes information you provide to us and information we create when providing services to you or other customers. For more details of the personal data we process, and how this data collected or obtained, see the table below.

    Categories of data

    Description

    Source

    Contact Information

    This includes your name, address and other contact information, such as your email address and phone numbers.

    If you work for one of our business customers we will record your business’s name, your position in the business and the business’s address, email address and telephone numbers. 

    This information is provided by you when you use our websites, when you contact us directly or when you use or are a recipient of Royal Mail Group services.

    You will also provide this information to Royal Mail Group where you complete one of our forms or apply for a service from us online, such as when setting up a Redirection for your mail. We also obtain some of this data when scanning mail in our network.

    Alternatively, we may obtain personal details from third parties. For example, where we acquire third party marketing data or information from, or derived from, public sources such as the electoral roll. 

    Financial details

    Records of your payments and your payment information, such as credit or debit card payment details.

    You provide this information yourself when you use our services or provide it to receive a payment.

    We may also receive this information from third parties, such as banks and credit reference agencies when we obtain authorisation for a payment you make or when undertaking an identity check.

    Marketing preferences

    Data recording your preference to receive marketing communications or where you have opted-out of marketing.

    This information will be created when you provide contact information in the course of an interaction with Royal Mail Group, such as when you apply for a service or where you register with one of our websites, or when you update your marketing preferences.

    Customer records

    Records of products and services that you have used. This includes records of letters and parcels you have sent if you are an account customer or if you provide your name and address as the sender of a letter or parcel. 

    You provide much of this information yourself when you use our services. We will also generate this information in the course of providing our services.

    Address history

    Your old address and your new address when you arrange a Redirection.

    You provide this information yourself if you use our Redirection service. We can also receive this information if someone else in your household applies for a Redirection.

    Address data

    In limited cases, a building or delivery point address may include personal data (for example, where a delivery point/property is identified by the occupier’s surname). 

    Royal Mail Group may receive this information from you or from a local authority.

    Contact history

    These are details of any enquiry, complaint or claim you have made to Royal Mail Group and may include copies of correspondence and call recordings. 

    You will provide this information to us when you contact us to make an enquiry or complaint. We will also create records relating to this contact.

    Proof of delivery information

    Records of delivery including the signature, name and address of people who sign for or accept delivery of mail items.

    You provide this information if you accept delivery of a mail item, including when you accept delivery of an item for another person, such as a neighbour.

    International shipping details

     

    Information relating to international letters and parcels. This includes: shipper name and address, receiver name and address.

    Royal Mail Group receives this information from overseas postal authorities. If you send or receive a letter or parcel from overseas, Royal Mail Group will be provided with personal data required for customs and tax clearance or for security screening. 

    Recipient information

    Records of letters or parcels delivered to you and the services used by the sender.

    Your name and address is used to collect, sort, track and deliver an item to you. A sender may also provide us with contact information for you, such as your phone number or email address, so that we can provide delivery updates

    We receive this information from the senders of mail items or collect data from the outside of mail items in order to route them through our network efficiently for delivery.

    Royal Mail Group will also receive personal data from overseas postal authorities. Where an item is sent to you from overseas we will receive information required for transport, customs clearance, security screening and delivery. 

    Recordings of you

    Images recorded on CCTV and other equipment which are used to protect our customers, employees and property. 

    We may record images of you if you a visit a location where CCTV is in operation. 

    Images of you

    Photographs of individuals, for example, where an image is uploaded to be printed on a personalised product or stamp.

    Royal Mail Group may receive photographs and images of individuals where these are provided by you or a third party. For example, if you upload your image onto one of our websites.
  • How we use personal data

    Royal Mail Group processes personal data for a number of different purposes. Royal Mail Group will only process your personal data where there is a legal basis for doing so under data protection laws and the table below identifies these (more than one lawful basis may apply in some situations).  In summary, the relevant legal bases are:

    (a)      Consent: you give consent for us to process your data for a specific purpose.

    (b)      Contract: the processing is necessary for a contract or agreement with you.

    (c)       Legal Obligation: the processing is necessary to comply with the law.

    (d)      Legitimate Interests: the processing is necessary for legitimate interests pursued by Royal Mail Group or another organisation.

    The purposes for which we process personal data and the legal bases for doing so in each case are:

    Purpose

    Lawful bases of processing

    Providing services to you where there is a contract or agreement in place with you. 

    Contract – we need to process your data to provide these services to you in accordance with that contract or agreement. 

    Providing postal services to you when you have paid us to do so but we don’t have a contract or agreement in place with you, such as in some circumstances when you send a letter or parcel using our services.

    Certain Royal Mail products or services have terms and conditions detailed in documents called ‘Schemes’. These Schemes are published under the Postal Services Act 2000 and mean that it is not necessary for Royal Mail to have individual contracts with each and every customer purchasing these products or using these services. You can find more information here: https://www.royalmail.com/non-contract-terms-and-conditions

    Legitimate Interests – we need to process your data to provide these postal services, including delivering the letter or parcel to you and providing additional services, such as delivery updates.

    Providing postal services to a third party, such as when someone sends you a letter or parcel and we use your data to deliver it or provide delivery updates.

    Legitimate Interests – we need to process your data to provide these postal services, including delivering the letter or parcel to you and providing additional services, such as delivery updates.

    Providing postal services via a third party, where you have agreed to accept delivery of an item on behalf of another person (such as a neighbour) and you have provided your details to enable us to record the delivery, including where we inform the sender and the intended recipient of Royal Mail Group services that you have taken delivery of the item.

    Legitimate Interests and consent – we need to process your data to provide the sender and recipient with your details in order to complete the delivery and to allow the delivery to be properly tracked within the postal service.  In some circumstances, we will obtain your consent to do this, otherwise we have a legitimate interest to do so.

    As part of Royal Mail Group track and trace services, where we provide a service which informs both the sender and recipient of Royal Mail Group services about the delivery status and timing of that service.

    Legitimate Interests – we need to monitor the delivery status of Royal Mail Group Services to improve our service and provide better information to our customers.

    Customer services – dealing with enquiries, complaints or claims relating to our services. 

    Legitimate Interests – we may need to process your data so we can handle and resolve any enquiry, complaint or claim raised by you or another person.

    Providing data services to other organisations, namely our business customers, to help them run their businesses better, and to the UK Government. For example, we provide services for the purposes of maintaining and updating accurate address data, for identity verification or fraud prevention purposes, and for helping businesses to target their marketing.

    Legitimate Interests – our business customers and the UK Government have a legitimate interest to process data in these ways, and we have a legitimate interest to process personal data to support them to do so.  In each case, we need to process your personal data to pursue those interests.

    Marketing our own products and services directly to our customers and prospective customers.

    Legitimate Interests & Consent – we have a legitimate interest to market our products and services to existing and prospective customers, and sometimes need to process your data to do this. In some circumstances, we will obtain your consent to send marketing communications.

    You always have the right to opt-out of direct marketing. See section 4 below for more information about marketing.

    Enhancing our customers' experience of our services and websites. For example, we use information on your visits to our websites to evaluate and understand how different people navigate our websites and how long they spend on particular pages

    Legitimate Interests – we sometimes need to process personal data to understand how you use our services so we can enhance them.

    Market research and analysis, and the development of new services. For example, we may develop new postal services or new data services for business customers (for the purposes of maintaining accurate address data, for identity verification or fraud prevention purposes, and for helping businesses to target their marketing).

    Legitimate Interests – we sometimes need to process personal data to develop new services we can offer you and others.

    Security, preventing fraud and money laundering, and taking action against fraudsters or people who commit an offence.

    Legitimate Interests – we sometimes need to process personal data to protect rights, property and personal safety. See section 6 below for more information about security and fraud prevention.

    Customs and tax clearance, and security screening when sending or receiving post to or from overseas.

    Legal Obligation – we need to process personal data to comply with revenue and customs regulations.

    Prevention and detection of crime – including the use of CCTV to protect our customers, employees and property.

    Legitimate Interests – we sometimes need to process personal data to protect the rights, property and the personal safety of our staff and customers.

    Complying with the law, including regulatory requirements. For example, Royal Mail Group is required by Postal Services legislation to maintain the Postcode Address File (PAF) and to make it available to people or organisations wishing to use it on reasonable terms.

    Legal Obligation – to comply with our legal obligations, including regulatory conditions relevant to postal operators, and health and safety legislation, we sometimes have to process personal data.

     

    Where more than one basis has been set out in the table above, you may contact us using the details below if you need details about the specific lawful basis on which we rely to process your personal data in a particular situation.

  • Information about marketing

    Marketing

    Royal Mail Group would like to keep in touch with you about our products, services and offers that might interest you. You have a choice whether you wish to receive these communications and may object at any time.

    Royal Mail Group won’t send individuals these communications if you opt out or otherwise ask us to stop direct marketing. Where we collect contact information from you, which may be used for marketing purposes, we will provide you with an opportunity to object to marketing.

    Organisations can process personal data for direct marketing purposes where it is necessary for their legitimate interests. Royal Mail Group has a legitimate interest in promoting its products and services but will always comply with privacy regulations and individuals’ right to object to marketing.

    We may use your personal data to enable us to provide you with targeted marketing content through social media and online.

    To personalise your experience

    We want to ensure that marketing communications relating to our products and services, including online advertising, are relevant to your interests. To do this, we may use your personal data to understand your interests better, so that we can try to predict what other products, services and information you might be most interested in. This enables us to tailor our communications to make them more relevant and interesting for you. Looking at your browsing behaviour and purchases helps us to understand you as a customer better and it allows us to provide you with personalised services and communications. We may also measure your responses to marketing communications relating to products and services we offer, which enables us to offer you products and services that better meet your needs as a customer.

     

    Changing your marketing preferences:

    You can change your marketing preferences online, over the phone, using the ‘unsubscribe’ link in our marketing emails, replying STOP to the short code in our marketing text messages or by writing to us at any time. The choice is entirely yours, but if you say you do not want to receive marketing information from us this will prevent you from receiving offers or hearing about other products which may be of interest to you.

    You may still receive service-related communications from us. For example, you may still receive a message to confirm your order and provide important information about your use of our products or services.

    If you have registered through our royalmail.com or parcelforce.com websites, you can change your marketing preferences online at any time:

    • Marketing preferences provided through royalmail.com
    • Marketing preferences provided through parcelforce.com
      • Account customers can change their preferences for receiving marketing communications through the ‘My Profile’ section of the Parcelforce website: https://www.parcelforce.com/user/login

    You can also contact our Information Rights team to ask us to stop sending marketing emails, letters or other forms of direct marketing – information.rights@royalmail.com

     

    Market research

    We like to hear your views as this can help us to improve our products and services. So from time to time we may contact you for market research purposes. You always have the choice about whether to take part in our market research.

  • Who do Royal Mail Group share data with?

    Internal Royal Mail Group

    Relevant employees or agents within Royal Mail Group may access your data for the purposes set out above. For example, if you contact us with an enquiry or complaint, your information will be seen by relevant employees within our Customer Services teams. Categories of recipients outside of Royal Mail Group are listed below:

    Customers

    We share personal data with Royal Mail Group customers for the purposes of providing services to them. For example, this includes the provision of proof of delivery and status of delivery information for items we have delivered or data shared in accordance with the terms and conditions of specific services.

    Selected third parties

    Information will be shared with specific categories of third parties where customers have indicated they wish to receive information about products, services or promotions provided by those third parties that may be of interest to them.

    Royal Mail Group may share personal data with other organisations or public bodies for legal purposes, such the police, law enforcement agencies, fraud prevention agencies and other bodies where is necessary or appropriate for the prevention or detection of crime or to protect the rights, property or safety of any person.

    Postal authorities

    Royal Mail Group will share personal data with overseas postal authorities. If you send a letter or parcel overseas, Royal Mail Group will provide the data required for customs and tax clearance or for security screening. This information will normally include: shipper name and address, receiver name and address.

    Royal Mail Group will also share personal data relating to the addressee/recipient of an item which is sent overseas. Where an item is sent overseas, we will provide overseas postal authorities with information required for transport, customer clearance and delivery.

    Disclosures required by law or for regulatory purposes

    Personal data may be shared with regulators, such as the Information Commissioner, where necessary or appropriate for regulatory purposes such as compliance with legal obligations.

  • Security and fraud prevention

    If false or inaccurate information is provided and fraud is identified, details will be passed to fraud prevention agencies. Information may be shared through the Cifas National Fraud Database (https://www.cifas.org.uk/services/national-fraud-database). Law enforcement agencies may access and use this information. Royal Mail Group and other organisations may also access and use this information to prevent fraud and money laundering, for example, when:

    • Checking details on applications for credit and credit-related or other facilities
    • Managing credit and credit-related accounts or facilities
    • Recovering debt
    • Checking details on proposals and claims for all types of insurance
    • Checking details of job applicants and employees

    We and other organisations will also access and use the information recorded by fraud prevention agencies from other countries.

  • Transfers of personal data outside of the UK

    We may send transfer personal data outside of the UK where a Royal Mail Group company or other body outside of the UK needs to process information for the purposes stated in this privacy notice.

    We may send information outside of the UK where we use a service provider or technology provider based overseas. Where we send personal data outside the European Economic Area ("EEA") we will ensure that suitable safeguards are in place to protect the information. For example, these safeguards might include:

    • We’ll use the model contractual clauses provided by the European Commission
    • The information will be handled by an organisation that is providing a level of protection that’s approved by the European Commission. For example, the Privacy Shield scheme for organisations based in the USA

    International Postal Services

    Where letters or parcels are sent overseas, personal data may need to be shared between postal authorities in different countries.  Personal data that Royal Mail Group collects from you may be transferred to, or stored or processed at a destination within or outside the EEA by ourselves or one of our suppliers in accordance with applicable laws on data protection. Such processing may include, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services.

  • How long do we keep personal data?

    Royal Mail Group policy is to only retain information for as long as it is required for the purpose or purposes for which we use it. We will determine how long to retain different data based on the following requirements:

    • How long the information is needed for the purpose or purposes it is used for.
    • Legal and regulatory requirements – such as where Royal Mail Group needs to retain customer records and records of purchases for an additional period of time in order to comply with the law or in case of potential claims.
  • Your legal rights

    If you wish to exercise your individual rights in respect of your personal data please contact our Information Rights Team: information.rights@royalmail.com. You have the following rights:

    The right to be informed

    Royal Mail Group will provide you with ‘fair processing information’ where we collect personal data from you (e.g. when you open an account or apply for a service online) and also through privacy notices such as this one.

    Right of access

    You have the right to access your personal data and details of how we process it.

    You can request details of the personal data Royal Mail Group holds about you, by contacting our Information Rights Team – information.rights@royalmail.com.

    Proof of identification is required in order to protect your information. We also request that applicants state which information and processing activities their request relates to (e.g. which Royal Mail Group services does the request relate to) as well as likely dates of the processing. An optional application form may be provided to assist us in confirming your identity and locating the information you require.

    Right to rectification

    You have the right to have personal data about you rectified if it is inaccurate or incomplete.

    Royal Mail Group will ensure that personal data is kept accurate and up to date as far as is reasonably possible. However, Royal Mail Group relies on customers to ensure that some of the information it holds about them is accurate and up-to-date. We encourage customers to inform Royal Mail Group of any changes to their information (e.g. by updating your account details on Royal Mail Group websites).

    Right to object

    You have the right to object to some uses of personal data, such as direct marketing as set out in section 4 above. Individuals also have the right to object to the processing of personal data based on legitimate interests or the performance of a task in the public interest.

    Right to erasure

    You have the right to request that we delete or remove of personal data from our records where there is no legitimate reason for us to continue processing it. Where personal data is still needed for legitimate purposes, it will not be possible to delete that data and some requests may therefore be declined.

    Right to restrict processing

    You have the right to ‘block’ the processing of personal data in limited circumstances. This right may apply:

    • If the accuracy of your personal data needs to be verified,
    • If the legal basis for processing your personal data is disputed and needs to be considered by Royal Mail Group,
    • If processing was unlawful but you do not want personal data to be deleted, or;
    • If personal data is no longer required Royal Mail Group but you want the data to be retained for the purposes of a legal claim.

    Right to data portability

    This right only applies to personal data which you have provided to us, which we use on the basis of your consent or to perform a contract with you.

    The right to data portability enables individuals to reuse their personal data across different services; allowing them to move or copy data from one organisation to another if they choose.

    Your right to withdraw consent

    Where we process your personal data based on your consent, you have the right to withdraw that consent.

  • How to contact us

    Customers with enquiries relating to products or services provided by Royal Mail can contact Royal Mail Customer Services for assistance: Royal Mail Customer Services

    Customers with enquiries relating to products or services provided by Parcelforce Worldwide can contact Parcelforce Worldwide Customer Services for assistance: http://www.parcelforce.com/contact-us

    For enquiries relating to your personal data you can contact our Information Rights team directly:

    Information Rights and Governance Team
    Royal Mail Group
    Pond Street
    SHEFFIELD
    S98 6HR

    Email: information.rights@royalmail.com

     

    Our Data Protection Officer

    You can contact Royal Mail Group’s Data Protection Officer at

    Royal Mail Group

    100 Victoria Embankment

    London

    EC4Y 0HQ

    Email: information.rights@royalmail.com

     

    Right to complain to the supervisory authority

    If you believe we have failed to comply with our legal obligations, you have the right to complain to the Information Commissioner’s Office at the following address:

    Information Commissioner’s Office

    Wycliffe House

    Water Lane

    Wilmslow

    SK9 5AF

    www.ico.org.uk

  • Website use and Cookies

    We may record information about the devices used to access our websites and information about your use of those websites, such as the pages you have visited. We also use cookies to provide us with information about how our websites are used. Cookies are text files placed on your computer when you use a website. For details of Cookies used by Royal Mail Group websites, including targeting or advertising cookies, please refer to the Cookies Policy on our websites, including:

    www.royalmailgroup.com

    www.royalmail.com

    www.parcelforce.com

    www.mailmen.co.uk

    www.senditnow.com

Changes to our privacy notice

We will keep our privacy notice under regular review and will place any updates on this webpage. This privacy notice was last updated 18 May 2018.