DPD UK Privacy Notice

DPDgroup Limited (DPD UK) is one of the UK's leading parcel delivery services. We deliver parcels whether destined for the UK or elsewhere in the world.

At DPD UK we take data protection seriously and regularly update all of our policies, procedures and documents to ensure we meet the requirements of the data protection laws (Data Protection Act 2018, UK GDPR and EU GDPR).

This Privacy Notice will inform you about what personal information we collect from you, how we use it, how long we hold it for, who we share it with, and how we look after it.

General Information

The data protection laws protect the rights and freedoms of living, identifiable, individuals known under the data protection laws as Data Subjects.

Your personal information is any information that identifies and relates to you personally.

There are a number of Data Subject rights in relation to your personal information, which you can read more about in this Privacy Notice.

Data Controller

Where DPD UK processes your personal information in the circumstances set out in this Privacy Notice, DPD UK acts as a data controller. This means that upon balance we decide why we collect personal information and how we use it.

Information Commissioner's Office (ICO)

DPD UK is registered with the Information Commissioner's Office (ICO) as a 'data controller' at:

DPDgroup UK Limited
Roebuck Lane
Smethwick
West Midlands
B66 1BY

ICO Ref: Z6834529

If you would like to get in contact with us about a data protection matter or anything contained within this Privacy Notice, please see the 'Contact Us' section below.

Who do we collect information about?

In order to operate our parcel delivery service we collect personal information about our 'Customers', 'Consignees' and general members of the public.

• A 'Customer' is a person or organisation who has a contract with DPD UK to deliver and or collect parcels. For more information about how we use the personal information of our Customers, please see the ‘Customers’ section of this Privacy Notice.
• A 'Consignee' is someone who is intended to have a delivery and or collection from DPD UK. For more information about how we use the personal information of Consignees, please see the ‘Consignees’ section of this Privacy Notice.
• A 'Member of the General Public' is an individual excluding Customers or Consignees whose personal information may be collected by DPD UK. For more information about how we use the personal information of a member of the general public, please see the ‘General Public’ section of this Privacy Notice.
• Children - We do not provide delivery and or collection services directly to children nor purposely collect personal information about them.

Why do we need the personal information that we collect?

We collect and use your personal information in order to provide a dynamic parcel delivery service.

Are we allowed under the data protection laws to collect and use your personal information?

DPD UK must have a legal basis to process your personal information. Please see "Your personal information in detail" below.

The use of AI (Artificial Intelligence)

We may use artificial intelligence (AI) to provide a better user experience. Our AI systems are designed to process your data securely and in accordance with applicable data protection laws.

Your personal information in detail - Customers

Where do we get your personal information from?

Directly from you when you provide your personal information in order to enter into an agreement with DPD UK to provide a delivery service.

Personal Information Types	What does this include?	How do we use this information?	Lawful Basis for processing
Your identity and contact details	Individual and business contact name and address Authorised signatory Telephone number Email address	To enter into a contract for delivery and collection Deal with queries, complaints and claims Maintain the business relationship	Contract
Your identity and contact details	Authorised signatory	Prevent fraud	Legitimate Interest
Your identity and contact details	Individual and business contact name and address (including country and Customer Ref number)	Prevent the export transit of parcels to and from individuals and businesses on international sanction and embargo lists	Legal Obligation
Your identity and contact details	Email address	Customer communications, service updates, marketing and surveys	Consent
Financial Information	Bank account details	Billing and invoicing	Contract
Financial Information	Email address Business address	Billing and invoicing	Contract
MyDPD	MyDPD login	Allow you to use the MyDPD platform, manage deliveries and assist with technical issues	Contract

Your personal information in detail - Consignees

Where do we get your personal information from?

We receive your personal information from our Customers in order to provide a delivery and collection service to you.

Directly from you

You may provide us with your personal information directly whenever you:

• contact us directly;
• use our websites, chatbots or Apps;
• fill in one of our forms;
• apply online for a service from us; or
• use or receive our services

Personal Information Types	What might this include?	How do we use your personal information?	Lawful Basis for processing
Your identity and contact details	Full name Address (Including country) Telephone number Email address	Deliver or collect a parcel Contact you in the event assistance is required to deliver or collect a parcel Assist with any queries or complaints Provide delivery notifications as part of our 'Predict' & 'Follow My Parcel' tracking services Send you requests to complete delivery experience surveys Investigate the loss of parcels that you have not received Prevent the export transit of parcels to and from individuals and businesses on international sanction and embargo lists	Legitimate Interest Consent Legal Obligation
Your delivery preferences and location	Preferred delivery address/location A map pinpoint of your address including What3Words location Proof of delivery notes and or a photo of the delivery location Details of whether you require more time to answer the door	Assist with parcel delivery and collections Investigate the loss of parcels that you have not received	Legitimate Interest Consent
Records of enquiries ref queries, complaints and claims	Personal information held within our delivery systems, emails, letters, chatbot and social media messages, call recordings and any other records of communication used to contact us in relation to a parcel delivery Specific details relevant to your complaint, query or claim which may include special category or 'sensitive personal information' that you have shared with us including information on your health, religion or ethnicity	Assist and investigate any claims or complaints made against DPD UK	Legitimate Interest Consent
CCTV footage and audio recordings	Images recorded on CCTV, other surveillance devices and DPD delivery robots Images of road environments Call recordings	Assist and investigate any claims or complaints made against DPD UK Prevention and detection of crime Assist with insurance claims Training and monitoring purposes Parcel delivery (DPD Robot)	Legitimate Interest Consent
YourDPD App	YourDPD App username and password	Allow you access to the YourDPD App and assist with technical issues	Consent
YourDPD App	Profile Photo	Personalise your App experience	Consent
YourDPD App	Home, work or other address(s)	To deliver a parcel to your preferred delivery location.	Consent
YourDPD App	Mobile phone number Email address	App verification purposes Identify your deliveries using your mobile phone number and email addresses linked to your App profile. Contact you in the event assistance is required to deliver the parcel Delivery notifications	Legitimate Interest Consent
YourDPD App	Preferred delivery address/location A map pinpoint of your address including What3Words location Proof of delivery notes and or a photo of the delivery location Details of whether you require more time to answer the door	Assist with parcel delivery and collections Investigate the loss of parcels that you have not received	Legitimate Interest Consent
YourDPD App	Delivery history including: Parcel number, name of sender and recipient date and time of delivery	Evidence delivery	Legitimate Interest
Details provided to us in relation to alleged criminal offences / incidents	Incident reports, investigation notes and or evidence	Investigate incidents for prevention and detection of crime	Legitimate Interest

Your personal information in detail - General Public

Where do we get your personal information from?

Directly from you

Unless you have specifically requested or used our services you may provide us with your personal information directly whenever you:

• contact us directly;
• use our websites, chatbots or Apps;
• fill in one of our forms;
• apply online for a service from us; or
• use or receive our services
• captured by DPD CCTV and or other surveillance devices

Personal Information Types	What might this include?	How do we use your personal information?	Lawful Basis for processing
Your identity and contact details	Full name Address Mobile telephone number or landline Email address	Assist with any queries, complaints or claims	Consent
Records of enquiries ref queries, complaints and claims	Personal information held within our systems, emails, letters, chatbot and social media messages, call recordings and any other records of means used to contact us in relation to a complaint, query or claim Specific details relevant to your complaint, query or claim which may include special category or 'sensitive personal data' that you have shared with us including information on your health, religion or ethnicity)	Assist and investigate any claims or complaints made against DPD UK	Consent
CCTV footage and audio recordings	Images recorded on CCTV, other surveillance devices and DPD delivery robots Images of road environments Call recordings	Assist and investigate any claims or complaints made against DPD UK Prevention and detection of crime Assist with insurance claims Training and monitoring purposes Parcel delivery (DPD Robot)	Legitimate Interest Consent
Details provided to us in relation to alleged criminal offences / incidents	Incident reports, investigation notes and or evidence	Investigate incidents for prevention and detection of crime	Legitimate Interest
Details provided to us in relation to alleged criminal offences / incidents	Records of your complaint or enquiry may be used to investigate any claims or complaints made against DPD UK	We use this information to investigate, prevent and detect unlawful acts	Legitimate Interest

How do we protect your personal information?

DPD UK is committed to protecting your personal information and ensuring that we have appropriate technical and organisational measures in place to do so.

DPD UK Ltd (DPD UK) is an ISO/IEC 27001:2013 and ISO/IEC 27701:2019 approved company. You can view our certificates of accreditation below:

ISO/IEC 27001:2013
ISO/IEC 27701:2019

ISO/IEC 27001 is the world’s best-known standard for information security management systems (ISMS) and their requirements. Additional best practice in data protection and cyber resilience is covered by the standards in the ISO 27701. Complying with the requirements of ISO 27001 and 27701 enables us to manage the security of our data assets such as financial information, intellectual property, and information entrusted to us by our Customers and Consignees.

ISO 27701 is a framework for data privacy that builds on ISO 27001. This standard guides us on best practices on policies and procedures that should be in place to comply with data protection laws and other data protection/privacy regulations.

ISO 27701 is a way of demonstrating to our Customers, Consignees, general public, external organisations and internal stakeholders, that mechanisms are in place to keep personal information safe and to comply with the data protection laws.

The transmission of information over the internet is inherently insecure, and we cannot guarantee the security of personal information sent over the internet. Once we have received your information, we will use strict procedures and security features to prevent unauthorised or unlawful processing and accidental loss, destruction, or damage of your personal information in line with our global industry-standard ISO 27001 & 27701 certification and accredited policies and procedures.

Where we have given you (or where you have chosen) a password that enables you to access certain parts of our service, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

In the unfortunate event that a personal data breach incident should occur, we have industry standard processes to deal with such instances. If the personal data breach incident involves your personal information and if it is deemed as a high risk, we will notify you without undue delay and inform the UK’s data protection supervisory authority, the Information Commissioner's Office (ICO) within 72 hours.

Overseas transfer of personal information

We may transfer your personal information outside the UK and the European Economic Area (EEA) with other third party organisations who provide various services in order for us to manage our delivery service business.

Before DPD UK allows any personal information to be shared, we will first seek to transfer the personal information to countries which are considered to offer an adequate level of protection by the UK and European Commission. However, should DPD UK send personal information to a country which is not deemed to be adequate, DPD UK will ensure that your personal information receives an adequate level of protection, by entering into appropriate Standard Contractual Clauses (UK SCC’s), international data transfer agreements (IDTAs) and or UK Addendum. We also ensure that third party suppliers are certified under appropriate data protection and IT Security schemes.

How long do we keep your personal information for?

The data protection laws state that we are only allowed to keep personal information for as long as is necessary.

Who do we share your personal information with?

Third party suppliers

In order for DPD UK to comply with our responsibilities as a parcel delivery services provider, we may share your personal information with third-party suppliers (data processors) and other entities in DPD Group who help us to run our business.

DPD UK only allows its third party suppliers to handle your personal information when they have confirmed that they can apply appropriate data protection and IT security controls. We also impose strict contractual obligations on third-party suppliers relating to data protection and IT security as dictated by the data protection laws. Such third party suppliers can only use your personal information to provide services to DPD UK and for no other purposes.

For further information regarding which third-party suppliers (data processors) process your personal information and the reasons why, click here.

Where required by law or for regulatory purposes

We may also share your personal information with other organisations and regulatory bodies to prevent and detect crime or to protect someone's rights, property or safety. These organisations may include the Police, law enforcement agencies and fraud prevention agencies to name a few.

We may also have to share your information with:

• The courts, and people or organisations with which we are in dispute, as part of legal action; and
• Regulators such as the Information Commissioner, to meet our legal or regulatory responsibilities

In some circumstances, such as under a court order, we are legally obliged to share information. We may also share information about you with third parties including government agencies and external auditors. For example, we may share information about you with HMRC for the purpose of collecting tax.

Your data subject rights

Right to be informed

An organisation has a legal obligation to provide you with clear, informative, and easily accessible information about your personal information and our use of it. This is in the form of a Privacy Notice.

Right of access

You have the right to ask an organisation for copies of your personal information. There are some exemptions, which means you may not always receive all the information that is processed.

Right to rectification

If an organisation holds information about you that you believe is incorrect or incomplete, you have the right to have inaccurate personal information rectified, or completed if it is incomplete.

Right to be forgotten/erasure

You have the right to ask an organisation to erase your personal information in certain circumstances.

Right to portability

You have the right to ask an organisation to transfer your personal information to another organisation. This right only applies to personal information you have provided to DPD UK.

Right to object

You have the right to object to an organisation processing your personal information further.

Right to restrict processing

You have the right to ask an organisation to limit the way they use your personal information.

Rights in relation to automated decision making including profiling

DPD UK will not use automated decision-making or profiling to make any decisions that will have a legal effect upon you or otherwise significantly affect you, and you have the right not to be subject to such decisions.

Right to withdraw your consent to our use of your personal information

If you have agreed that DPD UK may use your personal information, you can withdraw that agreement at any time.

To withdraw your consent, please contact dsrr@dpdgroup.co.uk

Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

How to exercise your data subject rights

• You can make a data subject rights request verbally or in writing, including via chatbot or social media;
• To maintain the security of your information, for the right of access requests we will need to reasonably verify your identity before we provide you with a copy of any information we may hold;
• We have one calendar month from the date of receipt of your request or receipt of the identification information requested in which to provide you with the information referred to above and copies of your information.
• Your request may be extended by an additional two months if the request is complex or if you submit a number of requests;
• We are obliged to inform you within the first month if we need to exercise our right to extend the disclosure period by up to an additional two months;
• There is no charge or fee for the provision of this information in the first instance however, manifestly unfounded or excessive requests plus subsequent copies may attract a reasonable administration fee;
• DPD UK can refuse to provide the information if an exemption or restriction applies, or if the request is manifestly unfounded or excessive

If you wish to exercise any of your data subject rights with DPD UK, please email: dsrr@dpdgroup.co.uk.

Some of our vehicles are equipped with forward-facing dash cams and record the road environments during delivery. If you have been recorded by one of these dashcams, you can find out more information here. Please note that DPD UK is not the Data Controller of this processing.

Third party links

You may find links to third party websites on our websites. These third party websites should have their own Privacy Notices which you should check before sharing any personal information. We do not accept any responsibility or liability for any processing of your personal information by such third parties because it is out of our control. Always check their Privacy Notice first.

How you can help keep your personal information secure

You can help keep your personal information safe – not just on our website, but whenever you provide information online.

Here are some simple ways you can improve the security of your information:

• Ensure that your devices always have the latest security updates;
• Use strong passwords and do not reuse them across multiple websites;
• Keep your passwords private;
• Learn about how email scams operate and exercise caution when using email - learn more here

Changes to our privacy notice

We reserve the right to update this Privacy Notice at any time, and we will provide you with a new Privacy Notice when we make any substantial updates.

We may also notify you in other ways from time to time about the processing of your personal information.

If you have any questions about this Privacy Notice, please contact dpo@dpdgroup.co.uk

Complaints

If you wish to make a complaint about the collection or use of your personal information, please contact us in the first instance so that we may seek to resolve your complaint.

Your right to make a complaint to the ICO

You have the right to lodge a complaint with the ICO, (the UK supervisory authority for data protection issues) if you are not satisfied with the way in which we have handled your personal information. The ICO can be contacted at the following address:

Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire
SK9 5AF

or:

Helpline number: 0303 123 1113

Email: www.ico.org.uk/global/contact-us/email

Website: http://www.ico.org.uk

Contact Us

Data Protection Officer

We have appointed a DPO to oversee compliance with this Privacy Notice. If you have any questions about this Privacy Notice or how we handle your personal information you can contact Donna McMullan at:

Email: dpo@dpdgroup.co.uk

or via our postal address address:

Data Protection Officer,
Legal Office
DPD UK
Roebuck Lane
Smethwick
B66 1BY

If you have a query or complaint in relation to a parcel or delivery, please note that the Data Protection Team is unable to assist you as we do not have access to parcel delivery systems. Instead, you will need to contact our Customer Services Team in one of four ways via our website.

Last updated: November 2024