Welcome to Royal Mail Group’s privacy notice.
Royal Mail Group is committed to respecting your privacy and protecting your personal data. This privacy notice explains how we collect and use your personal data and tells you about your privacy rights.
We’ve updated the privacy notice to take into account the requirements of the General Data Protection Regulation (GDPR).
We’ve split the privacy notice into sections so that you can click through to the specific areas below.
- About Royal Mail Group and this privacy notice
- Personal data we use
- How we use personal data
- Information about marketing
- Who do Royal Mail Group share data with?
- Security and fraud prevention
- Transfers of personal data outside of the UK
- How long do we keep personal data?
- Your legal rights
- How to contact us
- Website use and cookies
- Changes to our privacy notice
About Royal Mail Group and this privacy notice
This privacy notice provides you with information about how Royal Mail Group collects and processes personal data. This includes personal data we will collect about you when you use our websites, or when you use or are a recipient of our services, as well as some information which we obtain from other sources. Personal data is information which relates to an identifiable living person. This may be information such as your name, address, email address and other personal details.
Royal Mail Group includes Royal Mail and Parcelforce Worldwide. The data controller processing your personal data will be Royal Mail Group Limited unless we specify otherwise. Our address is:
Royal Mail Group Limited
100 Victoria Embankment
When you use or receive products or services from Royal Mail Group, where appropriate, we will provide information about how that personal data will be used. This privacy notice should be read together with any other fair processing notice or additional information that we may provide.
Personal data we use
Royal Mail Group uses various types of personal data. This includes information you provide to us and information we create when providing services to you or other customers. For more details of the personal data we process, and how this data collected or obtained, see the table below.
|Categories of data||Description||Source|
|Contact Information||This includes your name, address and other contact information, such as your email address and phone numbers.
If you work for one of our business customers we will record your business’s name, your position in the business; and the business’s address, email address and telephone numbers.
|This information is provided by you when you use our websites, when you contact us directly, or when you use or are a recipient of Royal Mail Group services.
You will also provide this information to Royal Mail Group where you complete one of our forms or apply for a service online, such as when setting up a Redirection for your mail. We also obtain some of this data when scanning mail in our network.
Alternatively, we may obtain personal details from third parties. For example, if we acquire third party marketing data or information from, or derived from, public sources such as the electoral roll.
|Financial details||Records of your payments and your payment information, such as credit or debit card payment details.||You provide this information yourself when you use our services or provide it to receive a payment .
We may also receive this information from third parties, such as banks and credit reference agencies when we obtain authorisation for a payment you make or when undertaking an identity check.
|Marketing preferences||Data recording your preference to receive marketing communications or; where you have been provided with an opportunity to opt-out of marketing.||This information will be created when you provide contact information in the course of an interaction with Royal Mail Group, such as when you apply for a service or where you register with one of our websites, or when you update your marketing preferences.
|Customer records||Records of products and services that you have used. This includes records of letters and parcels you send if you are an account customer or if you provide your name and address as the sender of a letter or parcel.
|You provide much of this information yourself when you use our services. We will also generate this information in the course of providing our services.
|Address history||Your old address and your new address when you arrange a Redirection||You provide this information yourself if you use our Redirection service. We can also receive this information if someone else in your household applies for a Redirection.
|Address data||In limited cases, a building or delivery point address may include personal data (for example, where a delivery point/property is identified by the occupier’s surname).||Royal Mail Group may receive this information from you or from a local authority.|
|Contact history||These are details of any enquiry, complaint or claim you have made to Royal Mail Group and may include copies of correspondence and call recordings.
|You will provide this information to us when you contact us to make an enquiry or complaint. We will also create records relating to this contact.|
|Proof of delivery information||Records of delivery including the signature, name and address of people who sign for or accept delivery of mail items.
|You provide this information if you accept delivery of a mail item, including when you accept delivery of an item for another person, such as a neighbour.|
|International shipping details
|Information relating to international letters and parcels. This includes: shipper name and address, receiver name and address, description of the goods, number of pieces, weight and value of shipment.||Royal Mail Group receives this information from overseas postal authorities. If you send or receive a letter or parcel from overseas, Royal Mail Group will be provided with personal data required for customs and tax clearance or for security screening.
|Recipient information||Records of letters or parcels delivered to you and the services used by the sender.
Your name and address is used to collect, sort, track and deliver an item to you. A sender may also provide us with contact information for you, such as your phone number or email address, so that we can provide delivery updates
|We receive this information from the senders of mail items or collect data from the outside of mail items in order to route them through our network efficiently for delivery.
Royal Mail Group will also receive personal data from overseas postal authorities. Where an item is sent to you from overseas we will receive information required for transport, customer clearance and delivery.
|Recordings of you||Images recorded on CCTV and other equipment which are used to protect our customers, employees and property.
|We may record images of you if you a visit a location where CCTV is in operation.
|Images of you||Photographs of individuals, for example, where an image is uploaded to be printed on a personalised product or stamp.
|Royal Mail Group may receive photographs and images of individuals where these are provided by you or a third party. For example, if you upload your image onto one of our websites.|
How we use personal data
Royal Mail Group processes personal data for a number of different purposes. Royal Mail Group will only process your personal data where there is a legal basis for doing so under data protection laws and the table below identifies these (more than one lawful basis may apply in some situations). In summary, the relevant legal bases are:
(a) Consent: you give consent for us to process your data for a specific purpose.
(b) Contract: the processing is necessary for a contract or agreement with you.
(c) Legal Obligation: the processing is necessary to comply with the law.
(d) Legitimate Interests: the processing is necessary for legitimate interests pursued by Royal Mail Group.
The purposes for which we process personal data and the legal bases for doing so in each case are:
|Purpose||Lawful bases for processing|
|Providing services to you where there is a contract or agreement in place with you.
|Contract – we need to process your data to provide these services to you in accordance with that contract or agreement.|
|Providing postal services to you when you have paid us to do so but we don’t have a contract or agreement in place with you, such as in some circumstances when you send a letter or parcel using our services.
Certain Royal Mail products or services have terms and conditions detailed in documents called ‘Schemes’. These Schemes are published under the Postal Services Act 2000 and mean that it is not necessary for Royal Mail to have individual contracts with each and every customer purchasing these products or using these services. You can find more information here: https://www.royalmail.com/non-contract-terms-and-conditions
|Legitimate Interests – we need to process your data to provide these postal services for which you have paid.|
|Providing postal services to a third party, such as when someone sends you a letter or parcel and we use your data to deliver it.||Legitimate Interests – we need to process your data to provide these postal services, including delivering the letter or parcel to you and providing additional services, such as delivery updates.|
|Providing postal services via a third party, where you have agreed to accept delivery of an item on behalf of another person (such as a neighbour) and you have provided your details to enable us to record the delivery, including where we inform the sender and the intended recipient of Royal Mail Group services that you have taken delivery of the item.||Legitimate Interests and consent – we need to process your data to provide the sender and recipient with your details in order to complete the delivery and to allow the delivery to be properly tracked within the postal service. In some circumstances, we will obtain your consent to do this, otherwise we have a legitimate interest to do so.|
|As part of Royal Mail Group track and trace services, where we provide a service which informs both the sender and recipient of Royal Mail Group services about the delivery status and timing of that service.||Legitimate Interests – we need to monitor the delivery status of Royal Mail Group Services to improve our service and provide better information to our customers.|
|Customer services – dealing with enquiries, complaints or claims relating to our services.||Legitimate Interests – we may need to process your data so we can handle and resolve any enquiry, complaint or claim raised by you or another person.|
|Providing data services to other organisations, namely our business customers, to help them run their businesses better, and to the UK Government. For example, we provide services for the purposes of maintaining and updating accurate address data, for identity verification or fraud prevention purposes, and for helping businesses to target their marketing.||Legitimate Interests – our business customers and the UK Government have a legitimate interest to process data in these ways, and we have a legitimate interest to process personal data to support them to do so. In each case, we need to process your personal data to pursue those interests.
|Marketing our own products and services directly to our customers and prospective customers.||Legitimate Interests & Consent – we have a legitimate interest to market our products and services to existing and prospective customers, and sometimes need to process your data to do this. In some circumstances, we will obtain your consent to send marketing communications.
You always have the right to opt-out of direct marketing. See section 5 below for more information about marketing.
|Enhancing our customers’ experience of our services and websites. For example, we use information on your visits to our websites to evaluate and understand how different people navigate our websites and how long they spend on particular pages.||Legitimate Interests – we sometimes need to process personal data to understand how you use our services so we can enhance them.|
|Market research and analysis, and the development of new services. For example, we may develop new postal services or new data services for business customers (for the purposes of maintaining accurate address data, for identity verification or fraud prevention purposes, and for helping businesses to target their marketing).||Legitimate Interests – we sometimes need to process personal data to develop new services we can offer you and others.|
|Security, preventing fraud and money laundering, and taking action against fraudsters or people who commit an offence.||Legitimate Interests – we sometimes need to process personal data to protect rights, property and personal safety. See section 4 below for more information about security and fraud prevention.|
|Customs and tax clearance, and security screening when sending or receiving post to or from overseas.||Legal Obligation – we need to process personal data to comply with revenue and customs regulations.|
|Prevention and detection of crime – including the use of CCTV to protect our customers, employees and property.||Legitimate Interests – we sometimes need to process personal data to protect the rights, property and the personal safety of our staff and customers.|
|Complying with the law, including regulatory requirements.||Legal Obligation – to comply with our legal obligations, including regulatory conditions relevant to postal operators, and health and safety legislation, we sometimes have to process personal data.|
Where more than one basis has been set out in the table above, you may contact us using the details below if you need details about the specific lawful basis on which we rely to process your personal data in a particular situation.
Information about marketing
Royal Mail Group would like to keep in touch with you about our products, services and offers that might interest you. You have a choice whether you wish to receive these communications and may object at any time.
Royal Mail Group won’t send individuals these communications if you opt out or otherwise ask us to stop direct marketing. Where we collect contact information from you, which may be used for marketing purposes, we will provide you with an opportunity to object to marketing.
Organisations can process personal data for direct marketing purposes where it is necessary for their legitimate interests. Royal Mail Group has a legitimate interest in promoting its products and services but will always comply with privacy regulations and individuals’ right to object to marketing.
We may use your personal data to enable us to provide you with targeted marketing content through social media and online.
To personalise your experience
We want to ensure that marketing communications relating to our products and services, including online advertising, are relevant to your interests. To do this, we may use your personal data to better understand your interests so that we can try to predict what other products, services and information you might be most interested in. This enables us to tailor our communications to make them more relevant and interesting for you. Looking at your browsing behaviour and purchases helps us to better understand you as a customer and it allows us to provide you with personalised services and communications. We may also measure your responses to marketing communications relating to products and services we offer, which enables us to offer you products and services that better meet your needs as a customer.
Changing your marketing preferences:
You can change your marketing preferences online, over the phone, using the ‘unsubscribe’ link in our marketing emails, replying STOP to the short code in our marketing text messages or by writing to us at any time. The choice is entirely yours, but if you say you do not want to receive marketing information from us this will prevent you from receiving offers or hearing about other products which may be of interest to you.
You may still receive service-related communications from us. For example, you may still receive a message to confirm your order and provide important information about your use of our products or services.
If you have registered through our royalmail.com or parcelforce.com websites, you can change your marketing preferences online at any time:
- Marketing preferences provided through royalmail.com
- You can change your preferences for receiving marketing communications through the ‘My Account’ section of the Royal Mail website: https://www.royalmail.com/user/login
- Marketing preferences provided through parcelforce.com
- Account customers can change their preferences for receiving marketing communications through the ‘My Profile’ section of the Parcelforce website: https://www.parcelforce.com/user/login
You can also contact our Information Rights team to ask us to stop sending marketing emails, letters or other forms of direct marketing – email@example.com
We like to hear your views as this can help us to improve our products and services. So from time to time we may contact you for market research purposes. You always have the choice about whether to take part in our market research.
Who do Royal Mail Group share data with?
Internal Royal Mail Group
Relevant employees or agents within Royal Mail Group may access your data for the purposes set out above. For example, if you contact us with an enquiry or complaint, your information will be seen by relevant employees within our Customer Services teams. Categories of recipients outside of Royal Mail Group are listed below:
We share personal data with Royal Mail Group customers for the purposes of providing services to them. For example, this includes the provision of proof of delivery and status of delivery information for items we have delivered or data shared in accordance with the terms and conditions of specific services.
Selected third parties
Information will be shared with specific categories of third parties where customers have indicated they wish to receive information about products, services or promotions that may be of interest to them.
Royal Mail Group may share personal data with other organisations or public bodies for legal purposes, such the police, law enforcement agencies, fraud prevention agencies and other bodies where is necessary or appropriate for the prevention or detection of crime or to protect the rights, property or safety of any person.
Royal Mail Group will share personal data with overseas postal authorities. If you send a letter or parcel overseas, Royal Mail Group will provide the data required for customs and tax clearance or for security screening. This information will normally include: shipper name and address, receiver name and address, description of the goods, number of pieces, weight and value of shipment.
Royal Mail Group will also share personal data relating to the addressee/recipient of an item which is sent overseas. Where an item is sent overseas, we will provide overseas postal authorities with information required for transport, customer clearance and delivery.
Disclosures required by law or for regulatory purposes
Royal Mail Group may be required to disclose certain personal data because it is required by law or for the purposes of legal proceedings.
Personal data may be shared with regulators, such as the Information Commissioner, where necessary or appropriate for regulatory purposes such as compliance with legal obligations.
Security and fraud prevention
If false or inaccurate information is provided and fraud is identified, details will be passed to fraud prevention agencies. Information may be shared through the Cifas National Fraud Database (https://www.cifas.org.uk/services/national-fraud-database). Law enforcement agencies may access and use this information. Royal Mail Group and other organisations may also access and use this information to prevent fraud and money laundering, for example, when:
- Checking details on applications for credit and credit-related or other facilities
- Managing credit and credit-related accounts or facilities
- Recovering debt
- Checking details on proposals and claims for all types of insurance
- Checking details of job applicants and employees
We and other organisations will also access and use the information recorded by fraud prevention agencies from other countries.
Transfers of personal data outside of the UK
We may send transfer personal data outside of the UK where a Royal Mail Group company or other body outside of the UK needs to process information for the purposes stated in this privacy notice.
We may send information outside of the UK where we use a service provider or technology provider based overseas. Where we send personal data outside the European Economic Area (“EEA”) we will ensure that suitable safeguards are in place to protect the information. For example, these safeguards might include:
- We’ll use the model contractual clauses provided by the European Commission
- The European Commission will decide that the country or international organisation has an adequate level of personal data protection
- The information will be handled by an organisation that is providing a level of protection that’s approved by the European Commission. For example, the Privacy Shield scheme for organisations based in the USA
International Postal Services
Where letters or parcels are sent overseas, personal data may need to be shared between postal authorities in different countries. Personal data that Royal Mail Group collects from you may be transferred to, or stored or processed at a destination within or outside the European Economic Area (“EEA”) by ourselves or one of our suppliers in accordance with applicable laws on data protection. Such processing may include, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services.
How long do we keep personal data?
Royal Mail Group policy is to only retain information for as long as it is required for the purpose or purposes for which we use it. We will determine how long to retain different data based on the following requirements:
- How long the information is needed for the purpose or purposes it is used for.
- Legal and regulatory requirements – such as where Royal Mail Group needs to retain customer records and records of purchases for an additional period of time in order to comply with the law or in case of potential claims.
Your legal rights
If you wish to exercise your individual rights in respect of your personal data please contact our Information Rights Team: firstname.lastname@example.org. You have the following rights:
The right to be informed
Royal Mail Group will provide you with ‘fair processing information’ where we collect personal data from you (e.g. when you open an account or apply for a service online) and also through privacy notices such as this one.
Right of access
You have the right to access your personal data and details of how we process them.
You can request details of the personal data Royal Mail Group holds about you, by contacting our Information Rights Team – email@example.com.
Proof of identification is required in order to protect your information. We also request that applicants state which information and processing activities their request relates to (e.g. which Royal Mail Group services does the request relate to) as well as likely dates of the processing. An optional application form may be provided to assist us in confirming your identity and locating the information you require.
Right to rectification
You have the right to have personal data about you rectified if it is inaccurate or incomplete.
Royal Mail Group will ensure that personal data is kept accurate and up to date as far as is reasonably possible. However, Royal Mail Group relies on customers to ensure that some of the information it holds about them is accurate and up-to-date. We encourage customers to inform Royal Mail Group of any changes to their information (e.g. by updating your account details on Royal Mail Group websites).
Right to object
You have the right to object to direct marketing as set out in section 5 above. Individuals also have the right to object to the processing of personal data based on legitimate interests or the performance of a task in the public interest.
Right to erasure
You have the right to request that we delete or remove of personal data from our records where there is no legitimate reason for us to continue processing it. Where personal data is still needed for legitimate purposes, it will not be possible to delete that data and some requests may therefore be declined.
Right to restrict processing
You have the right to ‘block’ the processing of personal data in limited circumstances. This right may apply:
- If the accuracy of your personal data needs to be verified,
- If the legal basis for processing your personal data is disputed and needs to be considered by Royal Mail Group,
- If processing was unlawful but you do not want personal data to be deleted, or;
- If personal data is no longer required Royal Mail Group but you want the data to be retained for the purposes of a legal claim.
Right to data portability
This right only applies to personal data which you have provided to us, which we use on the basis of your consent or to perform a contract with you.
The right to data portability enables individuals to reuse their personal data across different services; allowing them to move or copy data from one organisation to another if they choose.
Your right to withdraw consent
Where we process your personal data based on your consent, you have the right to withdraw that consent.
How to contact us
Customers with enquiries relating to products or services provided by Royal Mail can contact Royal Mail Customer Services for assistance: Royal Mail Customer Services
Customers with enquiries relating to products or services provided by Parcelforce Worldwide can contact Parcelforce Worldwide Customer Services for assistance: http://www.parcelforce.com/contact-us
For enquiries relating to your personal data you can contact our Information Rights team directly:
Information Rights and Governance Team
Royal Mail Group
Our Data Protection Officer
You can contact Royal Mail Group’s Data Protection Officer at
Royal Mail Group
100 Victoria Embankment
Right to complain to the supervisory authority
If you believe we have failed to comply with our legal obligations, you have the right to complain to the Information Commissioner’s Office at the following address:
Information Commissioner’s Office
Website use and Cookies
Changes to our privacy notice
We will keep our privacy notice under regular review and will place any updates on this webpage. This privacy notice was last updated 16 May 2018