Update: April 1, 2019

Data protection policy "Correos Market"

1. Responsible for treatment

The controller is "Sociedad Estatal Correos y Telégrafos, S.A., S.M.E" (hereinafter,"Correos"),with CIF A-83052407 and registered office at Via Dublin no 7 (Campo de las Naciones) 28070 Madrid (Spain).

To ensure the proper management of such processing, Correos has appointed a Data Protection Officer (DPD or DPO), to whom you can contact for any matter you require in relation to them through the following email address: dpdgrupocorreos@correos.com

1. Purpose of treatment and legitimizing bases

The processing of your data pursues the following purposes:

• A. User registration and online order management

Your data will be processed to: (i) process your registration as a user/customer; (ii) register your order online and develop the sales process that includes from the receipt of the order to its delivery and, where appropriate, the management of the guarantees; (iii) process and respond to your questions, queries or complaints.

The products and services marketed through the Platform www.market.correos.es  belongs to:

• Third-party companies with which Correos has signed an agreement to market their products.

The basis on which this processing is referred is the performance of a contract or the application of pre-contractual measures at the request of the data subject.

• B. Sending offers and promotions of Postal products and services

If you give your consent, Correos may send you by any electronic or non-electronic channel commercial information related to the provision, improvement and updating of our products and services, new rates and discounts.

This business information may be generic or personalized. In the latter case it will involve the prior processing of your data with the aim of being able to carry out your profiling and carterization, determine tastes, preferences and needs and, based on them, identify the offers that may be most interesting.

At any time, you may revoke your consent free of charge and not receive new offers and promotions by mailing you to the above address or by email to the address derechos.protecciondatos.correos@correos.com or through our customer service. Likewise, in any electronic commercial communication you will be informed, again, of your right to revoke your consent.

• C. Sending offers and promotions from other companies in the Correos Group and third parties

If you give your consent, Correos may send you by any electronic or non-electronic channel offers and promotions of:

Other companies of the Correos Group that provide services related to the sectors of: that belong to the activities of parcel services, value added to the postal service, logistics, marketing and telecommunications.

Other companies with which Correos has signed different collaboration agreements and that may belong to sectors such as telecommunications, finance, large consumption, health and NGOs.

This business information may be generic or personalized. In the latter case it will involve the prior processing of your data with the aim of being able to carry out your profiling and carterization, determine tastes, preferences and needs and, based on them, identify the offers that may be most interesting.

At any time, you may revoke your consent free of charge and not receive new offers and promotions by mailing you to the above address or by email to the address derechos.protecciondatos.correos@correos.com or through our customer service. Likewise, in any electronic commercial communication you will be informed, again, of your right to revoke your consent.

• D. Data communication to other companies in the Correos Group and to third parties

If you give your consent, Correos may communicate your data to the companies of the Correos Group and to third parties whose sectors are detailed in the previous purpose in order that these companies can send you, directly and without the intermediation of Posts, offers and promotions related to their products and services.

• E. Enrich your information

In case you give your consent, Correos may obtain more information about its characteristics, tastes and needs through the information provided by different external sources such as Public Registries, Catastro, Social Networks, geomarketing tools, databases of economic information such as INFORMA, credit information files such as ASNEF, BADEXCUG... with the aim of making improvements to our products and services and/or adapting or choosing the offers of those products and services that best fit your specific profile.

• F. Comply with legal obligations

Among the different legal obligations that Correos assumes are those arising from the application of the postal regulations (Law 43/2010 of the universal postal service, the rights of users and the postal market) and the duty of secrecy of communications (art. 18 of the Constitution), as well as the tax regulations.

In compliance with these obligations, Correos may communicate your data to the Public Administrations and courts, provided that such information is required in accordance with the established legal processes.

• G. Statistical information and satisfaction surveys

Correos has a legitimate interest in knowing both the opinion of its customers regarding its products and services and its consumption habits (e.g. frequency/recurrence in the contracting of the different services) in order to be able to offer products and services more tailored to their needs and improve both the current products and services and their contracting process.

To achieve the objective set out in the previous paragraph, Correos may process your data and:

Conduct satisfaction surveys both telephone and electronic, even once you cease to be a customer, in the latter case to know the reasons for your departure.

In the event that during the satisfaction survey the customer expresses his opinion on the products and services of one of the companies of the Postal Group, the result of the survey and the identifying data of the participant may be communicated to the company of the Correos Group whose services are valued.

Proceed to its anonymization, so that the information of their consumption habits cannot be relinked with their person and, after that, carry out statistical and econometric studies (e.g. know the life cycle of the client and / or identify models of propensity to abandonment).

• H. Evaluation of the quality of the products purchased.

Correos intends to know the opinion of its customers regarding the products purchased in order to improve the service and help other users in the purchase of a product.

To achieve the objective set out in the previous paragraph, Correos may ask registered customers to make an assessment of the product purchased, being able to comment on them.

Ratings, and product reviews, will be made by you voluntarily, and will be visible alongside your identifying data to any user visiting the Platform. If you prefer that your identifying data, first and last name, are not visible on the Platform, you can make your assessments and comments anonymously by checking the option called "hide my identifying data"

Correos performs this processing based on the consent given by you by checking the box enabled for this purpose.

1. Type of data processed

For the purposes set out in the previous section, it is a set of personal data that we can divide into the following sources and categories:

• A. Directly provided data:

At the time of registration in the web portal, or when making the purchase of a product, through the completion of the forms for this purpose enabled. These data are:

• Identification data (e.g. name, email, telephone number, address, NIF, etc.)
• Job details (e.g. company)

At the time of product evaluation;

• The comments made by the client; including the first and last name in case you have not selected the option called "hide my identifying data".

The customer guarantees that, the data provided to Correos for the provision of the requested services, and the acquisition of the products offered, respond truthfully to the actual situation and that it will communicate any modification affecting them. Consequently, the customer will be liable to Correos and third parties for any damages caused as a result of the breach of the obligations assumed in this clause.

• B. Data collected indirectly:

All data that, if you have given your consent, Correos collects from the type of external sources listed in the purpose 2.E.

• C. Data derived from the provision of the service itself and the relationship entered into with the customer:

Including information such as the history of products purchased, as well as their characteristics, claims or requests for information and any other data generated in the legal relationship entered into with the interested party.

1. Data retention period

Your personal data will be kept as long as they are necessary for the development of the contractual relationship. After this period the data will be deleted in accordance with the provisions of the data protection regulations which implies its blocking, being available only at the request of Judges and courts, the Public Prosecutor's Office or the competent Public Administrations during the limitation period of the actions that may derive to be subsequently eliminated. The limitation periods vary depending on the type of service, for example purposes, in general the limitation period for most personal civil actions is 5 years.

In addition, Correos will block customers who are inactive for a period of 6 years. Users registered on the Correos Market Platform will be considered as an inactive customer, but who have not made any transactions on it for more than 5 years.

1. Data communications

If you give your consent, Correos may communicate your data to third parties in sectors such as marketing or telecommunications in order that these companies can offer you their products or provide additional services to those contracted. In addition, it is reported that for the correct execution of the contract and the fulfillment of the purposes indicated above, it will be necessary to share information related to you with companies providing some of the services.

Among the different legal obligations that Correos assumes are those arising from the application of the postal regulations (Law 43/2010 of the universal postal service, the rights of users and the postal market) and the duty of secrecy of communications (art. 18 of the Constitution), as well as the tax regulations.

In fulfilling these obligations, and within the purpose described as "online order management", Correos may communicate your data to the Public Administrations and courts, provided that such information is required in accordance with the established legal processes.

In addition, and also in relation to the purpose of managing the online order, whenever requested, your data may be transferred to the third party marketing products to proceed with the issuance of the corresponding invoice.

1. Your rights

Our data protection regulations give you a number of rights in relation to the processing of data involving our services that we can summarize in the following:

• Right of access: Know what kind of data we are dealing with and the characteristics of the processing we are carrying out.
• Right of rectification: To be able to request the modification of your data because they are inaccurate or not truthful.
• Right of portability: To be able to obtain a copy in an interoperable format of the data being processed.
• Right to restriction of processing in cases contained in the Law.
• Right to erasure: Request the deletion of your data when the processing is no longer necessary.
• Right to object: Request the cessation of sending of commercial communications in the terms indicated above.
• Right to revoke the consent given.

You can exercise your rights through one of the following channels, indicating the right to exercise and accompanying a copy of the National Identity Document or equivalent document in addition to any other documentation that you deem appropriate:

1. Postal Address: Via Dublin No. 7 (Field of Nations) 28070 Madrid (Spain)
2. Email: derechos.protecciondatos.correos@correos.com

On the website of the Spanish Data Protection Agency (AEPD) you can find a series of models that will help you in the exercise of your rights. We also inform you, you have the right to lodge a complaint with the supervisory authority (in Spain, the AEPD) if you consider your rights to be infringed.

1. Third-party data

For the provision of certain services it may be necessary to provide us with the personal and contact details of third parties, such as the first name, surname, postal address, email address, contact telephone number and other data or equivalent means of contact of the recipient of a communication or shipment.

Correos will only process this data to proceed with the delivery of the communication or shipment. In addition, in order to improve the provision of the service, the telephone number or the email address may be used in order to inform the recipient about the estimated delivery dates and to deal with any incident that could affect it.

In this sense, the client guarantees the veracity and updating of the data of the recipient and, where appropriate, ensures that he has complied with all those obligations that, in matters of data protection, are attributable to him, having obtained the consent of the recipient to have Correos carry out the processing set out in the preceding paragraphs, if such necessary consent.