PRIVACY POLICY
Nova Post LLC (or also known as “Nova Post” or “Nova Poshta”, “Company”) attaches great importance to the security and confidentiality of your personal data. This Privacy Notice (the "Notice", the “Policy”, the “Privacy Policy”) explains our practices in relation to the processing of personal data of individuals.
This Policy applies to the processing of personal data by Nova Post or another company within Nova group (“Partner”) which may act as joint controller, in the cases described below.
Please note that in certain circumstances, third parties may (also) be responsible for the processing of your personal data. In that case, we recommend that you consult the privacy policies of these third parties. For example, if you download Nova Post's plug-in on Claude, you should check its Privacy policy. If you download Nova Post's plug-in on ChatGPT, then check its Privacy policy.
GENERAL INFORMATION
Whenever you see a reference to “we” in this privacy notice, it actually refers to Nova Post LLC:
Full legal name: Nova Post LLC
Legal address: 103 Stolychne Highway, building 1, floor 9, 03026, Kyiv, Ukraine;
E-mail: [email protected]
Contact number: +380-800-500-609
Website: https://novaposhta.ua/en/
We are the data controller responsible for the collection and use of your personal data in the manner explained in this privacy policy. To ensure better protection of personal data, the Company has appointed a Data Protection Officer. If you have any questions, comments or requests regarding the protection and processing of your personal data, you may contact the DPO:
E-mail: [email protected]
Be sure to include your name, surname, email address, as well as detailed questions, comments, complaints or requests in all correspondence.
PERSONAL DATA PROTECTION LAW
When we process personal information we follow the rules and provisions of the Ukrainian law on personal data protection (Law of Ukraine № 2297 – VI). In addition, the company applies the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) as the best practice for the protection of personal data.
PROTECTION OF INFORMATION
By applying appropriate technical and organisational measures, Nova Post makes all physical and technical efforts to protect personal data from loss, damage, disclosure to unauthorised persons, alteration, or improper use.
When you install the Nova Post plugin on AI platforms such as ChatGPT or Claude, we implement specific technical measures to help protect your data by preventing personal data from being shared with these platforms.
All communications regarding personal data protection are recorded, explained in detail, and analysed in accordance with applicable law.
DATA SUBJECTS RIGHTS
1. We are pleased to inform you of your rights regarding the processing of personal data in accordance with the laws of Ukraine:
- To know about the sources of collection, location of their personal data, purposes of their processing, location or place of residence (stay) of the owner or manager of personal data, or to give a corresponding order to obtain this information from persons authorised by them, except in cases established by law;
- Receive information about the conditions for granting access to personal data, including information about third parties to whom his/her personal data is provided;
- To access their personal data;
- To receive a response no later than thirty calendar days from the date of receipt of the request, except in cases provided for by law, on whether his or her personal data is processed, as well as to receive the content of such personal data;
- To submit a reasoned request to the personal data controller with an objection to the processing of their personal data;
- To submit a reasoned request to change or destroy their personal data by any owner and manager of personal data if such data is processed illegally or is unreliable;
- To protect their personal data from unlawful processing and accidental loss, destruction, damage due to intentional concealment, failure to provide or untimely provision, as well as to protect against the provision of information that is inaccurate or defamatory of the honour, dignity and business reputation of an individual;
- File complaints about the processing of their personal data with the Ukrainian Parliament Commissioner for Human Rights or a court;
- Apply legal remedies in case of violation of personal data protection legislation;
- To make reservations about the restriction of the right to process their personal data when giving consent;
- Withdraw consent to the processing of personal data (if granted);
- Know the mechanism of automatic processing of personal data;
- To be protected against an automated decision that has legal consequences for him or her.
2. In addition to the Ukrainian legislation on personal data protection, Nova Post is committed to ensuring your rights under the GDPR. The rights of personal data subjects in accordance with the GDPR:
A. to receive information and have access to data concerning him/her (data subject's right of access under Article 15 of the GDPR);
B. to correct their personal data that is incorrect and to update their data (right to data rectification, Article 16 GDPR);
C. request the deletion of your personal data (right to data erasure under Article 17 of the GDPR);
D. requests for termination of processing (right to restrict processing under Article 18 of the GDPR);
E. to request the transfer of data to another controller (right to data portability pursuant to Article 20 of the GDPR);
F. objecting to the processing of his/her personal data (right to object under Article 21 of the GDPR).
EXERCISE THE DATA SUBJECT RIGHTS
Access to personal data. You shall have the right to request confirmation from us as to whether we are processing personal data relating to you and, in such cases, to request access to your personal data that we are processing.
Correction of personal data. If you believe that information about you is inaccurate or incomplete, you shall have the right to request to correct it.
Withdrawal of consent. Since we process your personal data based on your consent, you shall have the right to withdraw your consent to the processing of personal data at any time.
Objection to data processing for the purpose of providing direct marketing and sending commercial & marketing information. You shall have the right to object to the processing of your personal data for the purpose of targeted advertising at any time.
Objection to processing based on legitimate interests. You shall have the right to object to the processing of personal data that we process based on our legitimate interests; however, we will continue to process your data even though you object unless we have legitimate reasons to continue processing it. To exercise the above rights, please send a written request to us or our DPO as set out in Section 1 hereof.
Removal. In certain circumstances, you have the right to ask us to delete your personal data, but this does not apply where the law requires us to retain the data. To exercise the above rights, please send a written request to us or to our DPO as specified in Section 1 of this Policy.
Restrictions on processing. Under certain circumstances, you shall have the right to restrict the processing of your personal data. Please note that if you make a request to restrict the processing of your data, this may affect your ability to receive our services. To exercise the above rights, please send a written request to us or our DPO as specified in Section 1 hereof.
Data transfer. Finally, you shall have the right to receive or transfer your personal data to another Data Administrator. These rights only include data that you have provided to us based on your consent or contract and where the processing is automated. To exercise the above rights, please send a written request to us or our DPO as specified in Section 1 hereof.
PERSONAL DATA AND PURPOSES OF PROCESSING
1. In order to provide services and perform the contract (in accordance with clause 3, part 1, article 11 of the Law of Ukraine "On Personal Data Protection"), Nova Post, as the Administrator, processes the following necessary personal data:
A. Sender's data: sending address, necessary contact details, signature, payment information and other data required to perform the service ordered by the sender;
B. Recipient's data: name and surname, signature, address, postal code, city, country, as well as, optionally, other data necessary for the implementation of the service provided by the sender or specified by the recipient, in particular, e-mail address, telephone number;
C. Other data: registration and contact details of persons acting on behalf of the sender or recipient (e.g. name, surname, telephone number, email address, signature).
The description and tracking number of the postal item, payment details of the sender and recipient, as well as other data necessary for the direct marketing of products/services and the provision of services, are transferred by the Administrator to the Partner based on the User’s consent and the Administrator’s legitimate interest.
2. Providing personal data is voluntary, but necessary for the performance of the Services provided by Nova Post. If the Sender provides additional personal data of the Recipient in connection with the choice of one of the Additional Services, the Sender is responsible for the correct collection of this data, in particular for obtaining the Recipient's consent to their transfer to Nova Post.
3. In some cases, data is also processed:
А. In accordance with the requirements of Article 6 of the Law of Ukraine "On Personal Data Protection", we process your personal data on the basis of your explicit consent. This may include, but is not limited to, processing your date of birth to send you birthday greetings or to provide you with marketing materials such as discounts or promotions. We may also process your contact details, such as telephone or e-mail, to send you marketing offers or company news.
You have the right to withdraw your consent at any time, and this will not affect the lawfulness of the data processing that has been carried out prior to the withdrawal.
B. In accordance with Article 11 of the Law of Ukraine "On Personal Data Protection", we process your data on the basis of our legitimate interests. This may include, among other things, verifying your solvency to prevent fraud and ensure the proper operation of the company. We also process data as part of our compliance programmes and to comply with legal requirements, including sanctions. We may conduct surveys about your satisfaction with the services we provide, including telephone surveys, to analyse your responses and provide feedback. In addition, we maintain video surveillance at our branches to ensure the safety of our customers, employees and property.
4. As a registered postal operator, Nova Post also processes personal data in order to fulfil its legal obligations arising from the requirements of the Law of Ukraine "On postal service" and the Law of Ukraine "On Accounting and Financial Reporting in Ukraine". This includes, in particular, proper payment for services rendered, handling complaints and fulfilment of other obligations arising in the course of providing services.
5. The use of the business account and the application of Nova Post may involve the processing of personal data for the following purposes:
А. Placing an order and providing services necessary for its execution.
B. Tracking of shipments - the shipment number and information about its status.
C. Contact via the contact form - data sent via the contact form, such as name and surname, address, postal code, city, e-mail address, necessary for processing and responding to the request. Consent to the processing of data such as e-mail address, telephone number may be necessary for communication and submission of a commercial offer.
D. Communication with a consultant via chat - the data sent during a conversation with a consultant, such as e-mail address, name and surname, address, postal code, city, are processed in order to verify the question asked and provide an answer to the question.
E. Shipment forwarding - through the business account and the application of Nova Post, the Sender or the Recipient can change the delivery address. For this purpose, we collect the following personal data:
- name and surname of the recipient;
- street / house number;
- postal code / place of residence;
- email address.
6. Geolocation. We process your personal data, including information about your location, to help you find the nearest branch or parcel locker. The use of this function is not mandatory and is not required for the proper use of the application.
The legal basis for processing your data is your consent, which you provide when you install the mobile application and authorise the use of geolocation services for your mobile device. You have the opportunity to change or withdraw your consent at any time via your phone settings, which will not affect the lawfulness of the data processing until the consent is withdrawn.
7. Direct marketing and sales promotion. In order to inform you about promotions and new offers of goods and services, including those of business entities operating under the trademarks (brands) “Nova Post”, “NovaPay”, and the Partners, the Administrator will process your data provided during registration on the Website/Application.
The legal basis for data processing is the Administrator’s legitimate interest, which consists in the direct marketing of the Administrator’s and its Partners’ products and services (Article 6(1)(f) of the GDPR).
10. Registration and recording of telephone conversations. Personal data and categories of data subjects in the register.
The following identification data of telephone calls are recorded:
- Call start and end times;
- Call start and end times;
- Subscriber number;
- I called the service number;
- Name and telephone number of the official.
All calls to service numbers are recorded. Recordings are made in a predefined manner. The recording starts after the call is answered and ends with a ring tone.
The following details of chat and chatbot sessions are recorded:
- Time of the session
- Name of the consultant and client in the chat
Chat sessions store the content of the session between the client and the consultant, and chatbot sessions store the content of the session between the automated chatbot and the client.
The content of the chatbot's responses is mainly collected from the website and other publicly available sources accessible to everyone. At the beginning of the session, customers are provided with instructions for use.
The customer is not asked any personal questions, and the customer cannot resolve personal issues using the chatbot service. If a customer provides digital identification data, such as a phone number, to the chatbot service, the data is automatically deleted after one hour.
If we send an SMS request to a customer who has contacted our service number by telephone, the following data is recorded:
- Request time;
- Customer phone number;
- Written responses to customer requests.
To identify customers who receive information about the actual beneficial owners, the following data is recorded:
- Name of the person and identification code.
- sending commercial and marketing information via electronic communication means and push notifications. For the purpose of informing you about promotions and new products of the Administrator and the Partners through electronic communication means (SMS, email, push notifications), the Administrator will process your data for which you have voluntarily given consent to use, as described above.
The legal basis for data processing is the consent obtained by the Administrator (Article 6(1)(a) of the GDPR). You have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. - on the basis of your separate consent, when it comes to sending marketing information by electronic means of communication, such as e-mail, SMS, public communication channels (in particular, in messengers such as Telegram, Viber or other similar applications). In particular, this may include: birthday greetings, information about promotions, special offers, as well as notifications about goods and services promoted both in cooperation with partners and independently by third parties. Such consent is provided voluntarily by activating the appropriate option in the settings or other interaction with the mobile application or business account.
8. Selection of candidates. During the recruitment process, the following categories of your data will be processed for the purposes and on the lawful basis.
- Basic data (name, date of birth), if possible;
- Contact information (address, telephone number, email address, etc.), if available;
- Application details (CV, motivation letter, certificates, references, interview notes and any data you provide to us or wish to provide during the interview);
- Photos, videos, if possible;
- Citizenship and work permit, if applicable;
- Health information for work, if available;
- A criminal record if it relates to a vacancy advertised, for example, for drivers;
Data that you have provided through publicly available platforms used for professional purposes, in accordance with the applicable terms and conditions of the company responsible for managing the platform;
Communication and means of communication (e.g. confirmation of your application or information about a telephone/video interview, if applicable).
In addition to these categories of data, to evaluate each job application, we need data that tells us how well you fit the position.
To manage our relationship with you, including:
- To assess your suitability for the job (purpose), the legal basis for processing is the performance of a contract;
- To organise and conduct (video) interviews (purpose), the legal basis for processing is the performance of a contract;
- To verify your data against applicable sanctions lists and laws (purpose), the lawful basis for processing is a.) legal obligation and b.) legitimate interest.
We collect data directly from you when you provide your details on our careers website or through other communication channels. When you use another channel, for example through publicly available platforms used for professional purposes, such as LinkedIn, we will process your data in accordance with the applicable terms and conditions of that platform. When we work with recruitment agencies, we receive your data indirectly. In this case, these agencies are responsible for ensuring the accuracy of the data and transferring it to us in accordance with applicable law.
9. Video cameras and video surveillance. We monitor and process your personal data when you visit our branches, both for your personal safety and for the safety of our employees, customers and property. Video surveillance is carried out in compliance with strict security and confidentiality rules using state-of-the-art technology and equipment. Video surveillance recordings are stored in our systems for up to 30 calendar days.
INTERNATIONAL DATA TRANSFER
1. Personal data is transferred to third countries if the services provided by Nova Post are also to be performed in a third country. Personal data may also be transferred to subcontractors of Nova Post (for example, organisations that deliver shipments to the territory of a third country) and organisations that provide tax, legal, audit and settlement consultations to Nova Post, if they operate in a third country.
2. Nova Post does not transfer personal data to international organisations.
3. Nova Post does not transfer personal data to third countries if it is impossible or contrary to generally accepted law.
4. The level of protection of personal data outside the European Economic Area ("EEA") does not coincide with the level provided for by European legislation. Therefore, Nova Post transfers personal data outside the EEA only when it is necessary, ensuring an adequate level of data protection, mainly through.
A. cooperation with personal data processing entities in countries for which a relevant decision of the European Commission has been issued to ensure an adequate level of personal data protection;
B. use of standard contractual clauses issued by the European Commission, provided that an appropriate level of personal data protection is ensured;
5. In the event of a reasonable intention to transfer personal data outside the EEA, other than as stated above, Nova Post will notify this fact at the appropriate stage of data processing in accordance with applicable law.
COMPLAINTS
1. If you have a complaint about how Nova Post processes your data, please send it in writing, providing as much detail as possible, using the contact information in Section I of this Policy. Nova Post will work with you to resolve any issues without delay.
2. The personal data protection authority in Ukraine is the Office for Protection of Personal Data of the Secretariat of the Commissioner of the Verkhovna Rada of Ukraine for Human Rights
You can address your complaints or suggestions to it if you believe that your rights have been violated in respect of the personal data processing.
DATA EXCHANGE
1. Nova Post may provide personal data:
A. To the Administrator’s Partners for the purpose of informing about promotions and new offers of goods and services (in accordance with Article 6(1)(a) and (f) of the GDPR), to all companies that are directly and/or indirectly owned or controlled by the same ultimate beneficial owners as Nova Post, as well as to subcontractors (for example, transportation partners, operating parcel drop-off points, or parcel lockers) within Ukraine and the European Union or beyond, for the purpose of delivering parcels from the sender to the recipient [in accordance with Article 49(1)(b) and (c) of the GDPR;
B. Companies that provide services to or on behalf of Nova Post (e.g. IT service providers).
C. Other persons or organisations in accordance with applicable law;
D. To banks and Partners, payment operators, for the purpose of carrying out transactions (including payments made via codes);
E. To law enforcement officials and authorities to comply with national security requirements or as part of legal proceedings to protect property, or to continue to investigate violations of the principles and policies of Nova Post, unauthorised access to or use of Nova Post equipment or any other illegal activity.
F. Mobile cellular operators (PJSC "VF Ukraine" (EDRPOU 14333937) and/or PJSC "Kyivstar" (EDRPOU 21673832) and/or LLC "Lifecell" (EDRPOU 22859846), which provide telecommunication services to the Client and process data related to the provision of such services (hereinafter referred to as the Operator), information in the following composition the Client's known telephone number in the Operator's mobile (mobile) communication network in order to prevent unauthorised access and protect interests from fraudulent actions by third parties.
2. Only the Sender and the Recipient have the right to receive information about the shipment. Nova Post may provide such information to other persons only in cases specified in the relevant provisions of the law, in particular in the Law of Ukraine "On Personal Data Protection".