Whistl Privacy Notice for Mail

When handling untracked mail items, Whistl UK Limited (“Whistl”) acts as a data controller in that it retains control over the manner in which it processes relevant personal data in order to deliver relevant items provided by its customers to the addressees of each item.  Whistl processes this data for the purpose of its Legitimate Interests in enabling successful delivery to fulfil commercial contracts with its customers.

The data processed consists of name and address information.  Data may be connected with either business or home addresses.  While there may be personal data relating to vulnerable persons or to children, this will not be identifiable to Whistl, nor is the purpose of processing related to that status.

Whistl’s processing involves reading addresses manually or by a sortation machine in order to sort the mail to the correct geographical location.  The reading takes less than 2 seconds and an image of the front of the item is recorded and stored for 90 days, where it may be retrieved to assist with delivery and invoicing queries.  The application used for image storage is provided by the third-party processor:

-          Prime Vision BV, Olof Palmestraat 10, 2616LR Delft, Netherlands.

In a small number of cases where an address cannot be read in this way, this image is transmitted to third-party processors for further manual reading services.  The processors used for this purpose are:-

-          PostNL Data Solutions BV, Waldorpstraat 3, 2521CA The Hague, Netherlands.

-          Straive, 77 Robinson Road, #13-00, Singapore 068896.  (Straive’s processing for Whistl takes place in the Philippines or Vietnam).

PostNL Data Solutions receives the image from Whistl into their systems and allows personnel from Straive access to read the personal data.  This international transfer of data is covered by an appropriate safeguard (Standard Contractual Clauses) and a supporting transfer risk assessment of its safety.

No automated decision-making or profiling, under the definitions of UK GDPR, takes place in relation to the data processed.

Data subjects have certain statutory rights, with which Whistl are fully compliant.  Those that are relevant to our processing of mail are:

• The right to be informed.  We will tell you how we use and store your data (in this Privacy Notice) and will inform you if this changes in any way by updating this notice.
• The right of access, and the right to data portability.  You have the right to access any record we have of your personal data and to verify that we are using it lawfully, and also the right to ask us to provide it to another company of your choice.  The only data we may hold in relation to mail you have received is a temporary image of the item itself.  Should you wish to check for this, you should advise us of the date the mail was received and the details of the sender to enable us to search for any stored image.
• The right to rectification, the right to erasure, and the right to restrict processing.  The only data we may hold in relation to mail you have received is a temporary image of the mail itself.  We do not hold any permanent data records and we do not re-use that image, so should you wish to have the original record erased or corrected, or change the way it is used in the future, you should contact the sender of the mail to arrange this.
• The right to object.  Similar to some of the above rights, you have the right to object to certain usages of your data on grounds relating to your particular situation or if you dispute our Legitimate Interests as stated above.  You should contact either us or the sender of the mail should you wish to do so.
• The right to complain to a supervisory authority.  If you are unhappy with how we are processing your data, you can lodge a complaint to the Information Commissioner’s Office (ico.org.uk).

In any case, listed above where you are required to contact us, or with any other queries about our use and storage of your data, please email or write to us as below.
Whistl UK Limited (address: Network House, Third Avenue, Marlow, SL7 1EY) is registered with the ICO, registration number X692857X.

For further information or questions regarding the processing of data, please e-mail gdpr@whistl.co.uk

Implementation of Policy

This policy was last updated on 1st September 2023.