Privacy policy

Last revised on 18.11.22

1. Object and purpose of this general privacy policy

Since its creation, bpost has attached great importance to privacy and it is one of the fundamental values on which its policy is based. The clearest example of this is the strict observance of the secrecy of correspondence (secrecy of correspondence) in accordance with the Belgian constitution and the European Convention for the Protection of Human Rights and Fundamental Freedoms.
In an increasingly digital world, bpost needs to collect and process personal data in order to provide the products and services it offers.
This General Privacy Policy explains in general terms how bpost collects and processes your personal data when you use bpost's websites (www.bpost.be and other websites), applications, products and services or when you interact with bpost in any other way (e.g. by calling the bpost call centre).
For specific bpost websites (e.g. https://career.bpost.be/en), applications (e.g. My bpost), products and services, bpost additionally provides a Specific Privacy Policy per website, application, product or service. This specific Privacy Policy must be read in conjunction with this General Privacy Policy. The Specific Privacy Policy per website, application, product and service is available on the relevant website and within the relevant application or via this link.
In case of conflict between the General Privacy Policy and the Specific Privacy Policy, the Specific Privacy Policy shall prevail.

2. Who is the data controller?

The Controller is bpost SA, a limited liability company under public law with registered offices at Anspach Boulevard 1 box 1, 1000 Brussels BE 0214.596.464. Hereinafter also referred to as "we" or "us".

3. What personal data do we collect, for what purposes and on what legal basis?

Personal data
bpost collects and processes the following categories of personal data:

Identification data such as name, first name and signature
Address details (as provided directly by the persons concerned or as indicated on a letter or package)
Contact details such as e-mail address and telephone number
Details of mail or parcels sent as part of bpost's postal and parcel activities
Transaction data such as information on products or services purchased, VAT number and company number
CVs and other information communicated in the context of a job application at bpost via the careers website (https://career.bpost.be)
Online and technical information such as information on the use of the bpost websites and applications, IP addresses and information on the device used to access the bpost websites and applications, language preference on the website and website behaviour (e.g. pages visited on the bpost websites)
Information resulting from your interaction with bpost such as feedback to satisfaction surveys, content of emails and complaints
Derived information is information that bpost derives from certain personal data.
Telephone calls and related data (i.e. caller identification, telephone number, time and duration of the call and the service to which the call relates) in the event of contact with the bpost contact centre or any other telephone contact with bpost (e.g. with the sales centre).
Data obtained from public sources (Statbel, DoNotCallMe, Robinson and SFP Finances lists).
Camera images (see point 4)

These personal data are collected via the bpost websites and applications, digital or paper forms, by e-mail or telephone or via cookies and similar technologies and, as regards camera images, when you visit bpost sites. For more information on cookies and similar technologies, please refer to our Cookie Policy.
In principle, bpost does not collect personal data from children. bpost's products and services are not intended for children and bpost does not promote or market its products or services to children. If you believe that we have collected and used personal data relating to a child without appropriate consent (from a person who is competent and entitled to give consent), please notify us using the information form so that we can immediately remove such data from our systems and make other necessary corrections.

Purposes and legal grounds
The purposes and legal grounds for processing personal data are set out in the table below.
If bpost wishes to process your personal data for another purpose, it will ask for your permission where necessary.

Purposes	Legal grounds
For the provision of postal and parcel services, for the negotiation, conclusion and/or performance of an agreement that you (or your organisation) conclude or have concluded with bpost in relation to specific products and/or services, to provide and follow up on the requested products and/or services, for the management of these agreements, for invoicing and collections within the framework of these agreement(s)	If bpost has an agreement with the data subject, the processing for these purposes is necessary for the conclusion or performance of the agreement between bpost and the data subject. In the absence of such an agreement with the data subject, the processing will be necessary for bpost's legitimate interest in processing data relating to individuals in the context of these agreements. Certain processing operations may also be necessary for a legal obligation incumbent on bpost.
To be able to process your question, communication or request and, if necessary, to reply to it (e.g. to provide you with requested information on bpost's products or services), in the context of applying for or providing bids or requests for offers, for support and incident handling with respect to the bpost products or services, for general customer management	If bpost has an agreement with the data subject, the processing for these purposes is necessary for the conclusion or performance of the agreement between bpost and the data subject. If the question, communication or request is not linked to an agreement between the data subject and bpost or if the support or interaction with the data subject is not strictly necessary for the performance of the agreement, the processing is based on bpost's legitimate interest in ensuring good relations with its customers or third parties.
To improve bpost's websites, applications, products and services (e.g. by collecting feedback through satisfaction surveys, market studies or recording telephone calls)	This processing is based on the legitimate interest of bpost to continuously improve and adapt its websites, applications, products and services. In the case of calls to the banking service (Postinfo, option 1 of 02 278 50 44), processing is based on the legal obligation arising from MiFID II legislation (Directive 2014/65/EU on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU).
To improve its sorting and delivery processes so that mail arrives in the right mailbox (e.g. by using automated recognition techniques to identify incorrect or incomplete addresses and by comparing these incorrect or incomplete addresses with correct address data available to bpost in its operational databases used in the distribution of mail (e.g. database with addresses of physical delivery points).	This processing is based on Article 3§3 of the Royal Decree on Postal Services (14.03.2022) for the comparison of incorrect or incomplete addresses. This processing is based on bpost's legitimate interest in optimising its sorting and delivery processes and thus ensuring that mail is delivered to the correct recipient.
To send advertising, personalised or otherwise, on bpost's products and services by post or by e-mail, or within bpost's applications; to display advertising, personalised or otherwise, on bpost's websites or within bpost's applications. For certain products and services (to the extent specified in the Specific Privacy Policy), bpost uses social media to show customers personalised advertising on bpost's products and services based solely on their website behaviour (which is collected via cookies or similar technologies).	This processing is based on bpost's legitimate interest in promoting its products and services. Where required by law, your consent will be sought.
To send informative or operational messages concerning bpost's products and services (for example, messages concerning changes in legislation that affect the use of bpost's services and products; messages concerning bpost's operational functioning; messages concerning the validity of certain products such as stamps) and to send warnings concerning illegal practices that could affect bpost's customers or application users (for example, sending alerts concerning phishing practices that abuse bpost's name).	If bpost has an agreement with the data subject, the processing for these purposes is necessary for the conclusion or performance of the agreement between bpost and the data subject. If the communication is not linked to a contract between the data subject and bpost or if it is not strictly necessary for the performance of the contract, this processing is based on the legitimate interest of bpost to inform its customers and the users of its applications about matters relating to bpost's products and services and thus to strive for the improvement of its services, also in view of its position as a public law company.
For processing online applications	This processing of personal data is necessary for the (possible) conclusion of an agreement with bpost.
For responding to requests concerning personal data (e.g. access or deletion) on the basis of the General Data Protection Regulation	The processing of personal data in the context of such requests is necessary in order to comply with a legal obligation incumbent on bpost (GDPR articles 12-22).
To ensure the safety of its staff and property, and if necessary to collect evidence of accidents, thefts or other incidents by means of surveillance cameras	The processing of personal data by means of surveillance cameras is based on bpost's legitimate interest in protecting its staff and property. For more information on the surveillance cameras, please see point 4 .
To evaluate or carry out an acquisition , merger, demerger, restructuring, reorganisation, dissolution or other sale or transfer of some or all of bpost's assets, whether by way of transfer of all or part of the business, or as part of bankruptcy, liquidation or similar proceedings, where personal data held by bpost form part of the transferred assets	The processing for these purposes is necessary for the legitimate interest of bpost in carrying out the said business transactions in order to implement its business strategies or grow its business.
For accountability purposes, the combating of fraud, crimes and infringements, and the management of disputes and any legal proceedings, in order to comply with legal obligations or court orders	These processing operations are necessary for a legal obligation to which bpost is subject or, in the absence of such an obligation, for the legitimate interest of bpost in defending itself before the courts and in combating fraud, offences and infringements.

4. Where does bpost use camera surveillance ?

bpost has installed surveillance cameras in private places accessible to the public in order to ensure the safety of its staff and property on the one hand, and to clarify the circumstances of an accident, theft or other incident on the other.
On major bpost sites (sorting centres, head office, EMC/Brucargo, Jemelle, Mechelen stamping house, Cargoville), images are visualised in real time by the operators of a certified external video room that, if necessary, calls for an intervention in the event of violation, damage or disruption of public order.
In the other bpost sites, the images are consulted by bpost or the certified external monitoring centre in the event of theft, incidents or alarms.

5. bpost account

You will be able to log in to the various applications and access the various services offered by bpost via the bpost account. Registration is required to verify your identity and so protect your data as part of bpost’s identity and access management.

For more information on the bpost account? Read the dedicated privacy notice.

6. The use of your personal data for commercial purposes

bpost also uses customer data for commercial purposes. For example, to send you advertisements or for analyses aimed at getting to know our customers better. To this end, bpost wants to give its customers control over their data: you decide which data we can use. To this end, we have developed a system of five Privacy Levels that allow for different uses of data. You can choose from these levels and manage your choice at any time via our "Your data, your choice dashboard". Depending on the service, this direct marketing communication will take place via various channels such as letter, e-mail, telephone, or via advertising platforms (such as Google, Facebook, Twitter, LinkedIn etc.). This is also specified in the applicable Specific Privacy Statement. bpost also checks the Do Not Call Me and Robinson lists to ensure that your commercial communications choices are respected.

Our Privacy Levels
Level Limited - "Strictly operational information": With this first level, bpost will not use your data for commercial purposes. You will therefore not receive any advertising from bpost. No commercial profiles will be created of you and you will continue to receive communications for operational purposes. You cannot stop this as long as you are a customer because these communications are necessary for bpost to carry out our agreement with you as a customer.
Level Additional - "Additional recommended information": If you choose this level you will receive advertising, but it will not be personalised and no profile will be created about you. Only your user data will be used to send you advertisements for products or services similar to those for which you are our customer. This is because we have a legitimate interest in sending this type of advertising to our customers (soft opt-in).
Level Optimal - "Tailor-made information": This level stands for personalised advertising for bpost products, services and applications. This use will only take place if you have given your specific consent. From the personal data that bpost collects regarding your use of our websites, applications, services or products, bpost derives information regarding your interests and preferences. Based on these interests and preferences, bpost creates profiles and uses these profiles to send or display personalized advertisements. We therefore use user data and transaction data. To find out what user data and transaction data are, please refer to the Specific Privacy Declarations of the products, services and applications). It is important to note that we do not use all of this data. For example, we will never use your copy of an ID card, your photo (should we have it), or your national registration number in commercial analyses or to build profiles of you.

Bpost has established the categories of similar products according to its products, services and applications as well as the categories of customers concerned (relations with professional customers or relations with non-professional customers). A detail of these categories can be obtained on request.

Data quality level: If you choose this level, you authorise us to communicate your data (surname, first name, e-mail address, language, title, date of birth) to third-party companies in order to update their databases. This data will therefore only be provided if these companies already know you, request it and if you have given your consent. This level is different from our legal obligation to provide your new postal address to companies that request it, unless you object, in order to improve postal activities within the framework of Article 3 of the Royal Decree of 14 March 2022 on postal services (bpost's Move service).

For the time being, the data quality level only applies to the data collected within the framework of the bpost Move service.

Data Supply level: If you choose this level, you give us your consent for us to draw up a profile on the basis of the information you have provided to us, and for us to transfer your data to third-party companies so that they can contact you to promote their services and actions.

At the moment, the data supply level only applies to data collected in the context of our SelectPost questionnaires. For more information on the companies to whom we may transfer your data, please refer to the Selectpost specific privacy notice.

How can you adjust your Privacy Level?

Via our Dashboard"
By exercising your rights via our webform
By letter

7. Does bpost use your personal data for profiling or automated decision-making?

bpost does not systematically carry out automated decision making within the meaning of Article 22 of the General Data Protection Regulation, namely automated decision making with a legal or significant consequence for you. This would be the case, for example, when a decision on whether or not to subscribe to a particular service is taken by a computer program without the involvement of a bpost employee.
Exceptionally, if bpost were to engage in automated decision-making in the context of a specific web site, application, product or service, this would be stated in the applicable Specific Privacy Policy for the web site, application, service or product.

8. With whom do we share your personal data?

In the context of the purposes referred to under point 3 , bpost may use service providers that process personal data in the name and on behalf of bpost. These service providers may be third parties or other entities of the bpost group. In such case, these service providers act as processors. In particular, bpost may use companies providing the following services: hosting and ICT services, marketing services, logistics services, archiving services.
bpost may also transfer your personal data to consultants and professional service providers acting as data controllers, such as lawyers, accountants and auditors. Your personal data may also be transferred to third parties in the context of a corporate transaction such as a demerger, merger or acquisition.
Where indicated in the Specific Privacy Policy, for certain products and services bpost may also share aspects of customers' website behaviour with social media in order to show those customers personalised advertising on bpost products and services or to prevent less relevant advertising from being shown.
bpost may also communicate your personal data to third parties if required to do so by law or following a request or order from the authorities.
Where required, bpost will seek your consent before disclosing your personal data to third parties. bpost will not rent or sell your personal data to third parties unless you have given your specific consent to bpost to do so.

9. Are your personal data transferred to countries outside the european economic area?

Certain service providers or third parties to whom your personal data are transferred may be located in a country outside the European Economic Area where the data protection rules differ from those applicable in Belgium and elsewhere in the European Economic Area. In such a case, bpost takes the necessary measures to ensure an appropriate level of protection for your personal data and provides at least one of the following guarantees:

The personal data are transferred to a country that is deemed to provide an adequate level of protection for personal data. This is the case for countries for which the European Commission has issued an adequacy decision, such as the United Kingdom.
For transfers to countries that are deemed not to provide an adequate level of protection (so-called "third countries"), bpost provides additional safeguards, such as the conclusion of standard contractual clauses of the European Commission, which ensure that personal data is given protection equivalent to that provided in the European Economic Area.

In the cases where bpost uses the contractual model clauses of the European Commission for transfers to third countries, bpost has also carried out an analysis of the level of protection offered by the legislation in these third countries and, where necessary, has taken additional measures to ensure that the level of protection is essentially equivalent to that within the European Economic Area. More information on these measures (including a copy of the model clauses) can be obtained by contacting bpost as described in point 13 "How to contact bpost".

10. How long we keep your personal data?

In principle, bpost retains your personal data only for as long as necessary for the purposes described (taking account of the applicable legal retention and/or limitation periods).
Personal data linked to contractual documents (e.g. a subscription to a bpost service) are kept for a maximum period of 10 years after the termination of your contract with bpost.
Personal data relating to requests, applications and complaints shall be retained for 12 months after the request, application or complaint has been dealt with.
Camera images are kept for 30 days and telephone calls for a maximum of 6 months.
For more detailed information on the retention period for specific websites, applications, products and services, please refer to the applicable Specific Privacy Policy available on the relevant website and within the relevant application.

11. What data security measures does bpost take?

bpost takes technical and organisational security measures to protect your personal data against destruction, loss, modification, access or misuse. This includes measures to limit access to the personal data as much as possible and to grant access only when necessary. Employees who have access to the data have been informed of their obligations with regard to data security. The security measures are regularly reviewed and adjusted to ensure an appropriate level of security.

12. What rights do you have regarding your personal data?

Under the terms of the General Data Protection Regulation, you have the following rights:

Right of access - You have the right to access the personal data that bpost processes about you and to obtain a copy of these personal data (subject to certain exceptions).
Right to rectification and erasure - You have the right at any time to have your personal data rectified or erased by bpost free of charge, provided that the legal conditions for doing so are met. Personal data that bpost needs in order to fulfil ongoing orders or for which bpost is legally obliged to hold cannot be deleted.
Restriction of processing - You can require bpost, subject to compliance with the applicable legal provisions, to restrict the processing of your data.
Right to data portability - Under certain conditions, you have the right to portability of the personal data you have provided.
Objection - You may object to processing for advertising purposes or processing for the legitimate interests of bpost. You may do so even without grounds for the processing of personal data for direct marketing purposes. It may take up to 30 days for your objection to be applied to all our databases. You may therefore still receive some communications within this period.
Withdrawal of consent - If bpost processes your personal data on the basis of your consent, you have the right to withdraw it at any time. However, this withdrawal will not affect the lawfulness of the processing of your personal data for the period prior to the time of withdrawal and for processing activities based on another legal basis.
Complaint to the competent authority - You always have the right to contact the data protection supervisory authority of the Member State of the European Economic Area where you normally reside, where you have your place of work (if applicable) or where the alleged breach has taken place, and to lodge a complaint if appropriate. For Belgium, this is the Data Protection Authority (www.gegevensbeschermingsautoriteit.be).

If you wish to exercise your rights with regard to bpost, you can do so by contacting bpost using the contact details provided in point 13 "How can I contact bpost?".
When we obtain personal data directly from you, you are generally free to decide whether or not to provide bpost with the personal data, except in the event of a legal obligation. If you do not wish to provide your personal data, you may not be able to use the products or services offered by bpost, your questions may not be answered and/or you may not be able to conclude an agreement with bpost.

13. How can I contact bpost?

For questions, complaints or the exercise of your rights, please contact bpost and its data protection officer:

Online via the appropriate web form.
By post to the following address: bpost, Attn. Data Protection Office, Anspach Boulevard 1 box 1, 1000 Brussels.

For security reasons, we ask you to accompany your requests with your full contact details and a means of verifying your identity (e.g. a copy of the front of your identity card or driving license in which the photograph and the national register number or card number must be illegible). bpost reserves the right to request additional documentary evidence where necessary.
bpost may refuse requests that it considers excessive or constitute an abuse of the relevant right.

14. Amendments to this general privacy policy

bpost reserves the right to amend this General Privacy Policy, in particular in order to adapt it to a change in the provision of services or to legal and/or regulatory requirements. Amendments to this General Privacy Policy enter into force at the time of publication. We recommend that you always consult the most recent version. The date of the last revision will be mentioned at the beginning of this General Privacy Policy.

The benefits of a bpost account?