Privacy statement - Parcel services

Statement updated on 24 April 2026

Oy Matkahuolto Ab
Business identity code 0111393-9

(Hereinafter “Matkahuolto” or “We”)

This privacy policy describes how Matkahuolto processes its customers’ personal data, which Matkahuolto collects in connection with its parcel services, as well as for the purpose of providing related customer service and communications. Matkahuolto offers its customers a variety of parcel services through its sales channels.

Parcel services refer to the transportation of goods and their delivery to recipients by Matkahuolto.

Matkahuolto is the controller of the personal data processed by it in connection with the provision of parcel services. As data protection is all about trust, the protection of your privacy and personal data is of great importance to Matkahuolto. This is why Matkahuolto collects your personal data only to the extent necessary to provide its services.

A more detailed description of the ways in which your personal data is processed and the purposes of such processing is provided in this privacy statement. When we process your personal data for the purposes described below, you are the data subject referred to in the privacy statement and have the rights laid out in section 9.

What is described in this privacy statement only applies to the ways in which Matkahuolto or the parties acting on its behalf process data. Matkahuolto’s electronic services may contain links to third-party websites or services. Matkahuolto is not responsible for the privacy policies of these services, so we recommend that you review them separately.

1. Contact details related to the processing of personal data

Oy Matkahuolto Ab
Customer Service Centre
P.O. Box 100
00101 Helsinki
tietosuoja@matkahuolto.fi

2. What data do we process?

In connection with its parcel services, Matkahuolto processes the personal data of consignors and consignees, or their representatives or persons authorised by them (data subjects), when such processing is necessary for Matkahuolto to provide services to data subjects and to develop its services.

In connection with the provision of parcel services, Matkahuolto may process the following personal data:

• full name of the consignor (or their representative) and the consignee (or their representative);

• registration information required for any electronic customer account, such as username, password, or other unique identifier;

• demographic information, such as age, gender, title, occupation and native language;

• the consignee’s identification and contact details for the delivery of the consignment and the related arrival notification, depending on the case: phone number, email address and/or postal address; the delivery address for the consignment; information regarding the contents of the consignment; the suffix of the consignee’s personal identity code to verify the identity of the consignee’s authorised representative; and location data to open the compartment of an outdoor parcel locker using the Paketit app (solely for establishing a Bluetooth connection);

• the consignee’s or their authorised representative’s acknowledgement of receipt, which is stored as proof of delivery and provided to the consignor in accordance with the contract of carriage;

• billing or payment information;

• customer relationship information, such as your contacts with Matkahuolto customer service, including recorded customer service calls and customer feedback you provide; and

• other information received from the data subject, such as complaints, messages and replies to Matkahuolto’s inquiries and surveys.

When you register as a user of Matkahuolto’s electronic services, you may be asked to provide the following personal data: name, contact information, date of birth, phone number, password and, if applicable, billing information, such as a billing address and/or bank details.

When you use Matkahuolto’s electronic services, such as the Paketit app, we may collect metadata related to your use of the services, such as where you accessed the services, the duration of your visit, the amount of data transferred, the type of web browser, IP address, operating system and user interface, as well as the browser version and language. If you visit the electronic services without registering or logging in, Matkahuolto will only process the above metadata. Based on this data, individual users cannot be identified unless you register or log in to the service, or provide your information when making a purchase. This data may be collected using cookies or other similar technologies; for more information, please see our Cookie Policy.

Matkahuolto’s Paketit app uses Meta’s services to collect data on app usage and events related to conversion paths, such as app installation, launch, registration, login and purchase transactions. This data is used to measure, optimise and target advertising, as well as to improve the app experience. Meta may combine this data with other information it has collected about you in accordance with its privacy policy.

The Paketit app also uses Google’s Firebase services for technical troubleshooting and usage analysis. Google processes this data in accordance with its own privacy policy.

3. Purposes and legal bases for the processing of personal data

Matkahuolto processes the personal data of customers using its parcel services for the purposes described below. Personal data is processed only on legal bases according to data protection legislation.

The purpose of processing based on consent is always clearly stated when consent is sought. Failure to provide the required information may prevent the creation of a customer account or the provision of services.

How do we combine customers’ personal data?

Matkahuolto may combine personal data collected through the use of various services to provide a better customer experience. To combine your data, you must be registered as a user of our electronic services and deal with Matkahuolto through your electronic customer account.

If you do not use an electronic customer account, Matkahuolto will process your data only in connection with individual services and will not combine data from different services.

Matkahuolto may use combined data to personalise its services and marketing, as well as to target its advertising. For this purpose, Matkahuolto may create a profile of you based on your transaction history and how you use our services. Profiling does not result in automated decision-making that would have legal or other significant effects on you.

Data subject’s obligation to provide proof of identity

The Road Transport Agreements Act (345/1977) requires the consignor or carrier to include certain information on the shipping document. The provision of this information to Matkahuolto is based on an obligation under the Road Transport Agreements Act.

Consignments to be handed over personally can only be handed over to the consignee or to a person authorised by the consignee. This requires verification of identification, and the consignee’s name is recorded on the acknowledgement of receipt. Parcel deliveries are handed over to the person present at the address, and identification is verified if the consignement includes the “Handing over personally” additional service. If the consignee or their authorised representative refuses to provide proof of identity, Matkahuolto cannot verify their identity and therefore cannot release the consignment.

Other consignments picked up at service points are handed over to the recipient based on the pick-up code provided, in which case no ID or authorisation is needed.

4. Electronic direct marketing

Matkahuolto will not use your personal data for direct electronic marketing without your prior consent. You may withdraw your consent at any time by contacting Matkahuolto’s customer service.

Matkahuolto has the right to send electronic direct marketing without separate consent if the data subject’s contact information was obtained in connection with a previous purchase, the marketing relates to products or services belonging to the same product group, and the data subject has not objected to the marketing. You have the right to object to the use of your personal data for direct marketing purposes at any time by contacting Matkahuolto’s customer service.

5. Regular sources of data

Matkahuolto regularly collects personal data from the following sources:

• The data subject: data is collected when parcels are sent, as well as at other times when the data subject interacts with Matkahuolto through its physical or digital channels and when the data subject participates in marketing campaigns or customer feedback surveys.

• Consignor or other partner: The data may be disclosed to Matkahuolto by the consignor, Matkahuolto’s partner, or a company or online shop whose shipments are carried by Matkahuolto.

6. Disclosures and transfers of personal data

Matkahuolto may disclose the personal data of data subjects to the following recipient groups:

• Matkahuolto’s delivery chain, i.e. partner carriers and distributors, and service network, i.e. dispatch and pick-up points: Matkahuolto may disclose personal data to its partners and subcontractors in the delivery chain to the extent they need such data to carry out the duties assigned to them, such as the carriage, handover and distribution of parcels and dispatch of arrival notices or customer satisfaction surveys.

• Payment service providers: In our digital sales channels, we use third parties as payment service providers. In addition to the personal data disclosed by Matkahuolto (name and email address), payment service providers may request additional information depending on the payment method chosen. This additional information will not be processed or stored by Matkahuolto. Instead, it will be handled by the payment service provider in accordance with its own privacy statement.

• Information system suppliers and other service providers: Matkahuolto may transfer personal data to information system suppliers and other service providers for the purpose of providing services or completing tasks they have been assigned to carry out, such as IT system maintenance, customer service or other data processing tasks. Matkahuolto’s Paketit app uses Meta’s services for measuring, optimising and targeting advertising, as well as for improving the app’s user experience, and Google’s services for technical troubleshooting and usage analysis. Meta and Google process this data in accordance with their privacy policies.

When disclosing personal data to service providers acting as processors, Matkahuolto has ensured, for example, through contractual arrangements, that the processor acting on its behalf processes such data only in accordance with the written instructions issued by Matkahuolto for the performance of the processor’s tasks and exclusively for the purposes indicated in this privacy statement. Also, Matkahuolto has ensured that access to personal data is limited to persons who need to access it for work-related reasons.

In addition to the above, Matkahuolto discloses personal data to third parties in the following cases:

• Matkahuolto may disclose your personal data to third parties if you have given your consent;

• Matkahuolto may disclose your personal data as required by the competent authorities or other competent parties or as required by applicable law, in accordance with current legislation; and

• If Matkahuolto sells, buys, merges, or otherwise reorganises its business, Matkahuolto or a party acting on its behalf may disclose your personal data to the buyers and their advisors.

The personal data is primarily stored in the territory of the Member States of the European Union or the European Economic Area, but processors outside the EU or EEA may have access to personal data when providing their services to Matkahuolto. If personal data is transferred outside the EU or EEA, Matkahuolto ensures that (i) the European Commission has determined that there is an adequate level of protection of personal data in the country in question; (ii) the transfers are carried out using standard contractual clauses or other equivalent arrangements approved by the European Commission; or (iii) the transfer complies with other appropriate safeguards for the transfer of personal data outside the EU or EEA. More detailed information on the applicable safeguards is available on request from Matkahuolto.

In addition, in connection with international deliveries, data may also be transferred outside the EU and EEA depending on the country in which the consignor and its partners or subcontractors are based.

The Road Transport Agreements Act and international logistics agreements impose detailed requirements as to the minimum information that the consignor or carrier is required to enter in the shipping document. This information contained in the shipping document is regularly disclosed by Matkahuolto to its partners in the delivery chain in connection with consignments destined to other countries.

7. Personal data protection policy

Manual material is stored in locked facilities at Matkahuolto locations. Electronic data is stored in a database that may only be accessed by specifically designated staff members of the controller or a party acting on its behalf, who need to access such data for work-related reasons, have received adequate training and are bound by a statutory or contract-based non-disclosure obligation.

The machine-readable service is located in a protected and locked computer room accessible only by technical personnel with access badges. The servers are protected through technical means.

All the data communications between the browser and the server environment are encrypted.

Access to servers and applications is restricted through role-based access control management.

8. Storage period and erasure of personal data

The retention period of the data is determined by the type of data involved and its intended purpose. Matkahuolto retains the personal data of data subjects in accordance with applicable legislation for only as long as the retention of data is necessary to achieve the purpose of the processing of personal data.

Matkahuolto determines the storage periods of personal data according to the following criteria:

• Your personal data will be retained for the duration of your active customer relationship. The activity of your customer relationship is determined on the basis of your use of Matkahuolto electronic services or your communication with Matkahuolto. If you have not had an active customer relationship with Matkahuolto for two years, your data will be deleted in the next quarterly data deletion process.

• Information about your direct marketing consent will be deleted if you withdraw your marketing consent or object to the processing of your personal data for direct marketing purposes.

• Your data will be deleted if you have requested the deletion of your data and Matkahuolto has no other basis for processing your personal data.

The communication sections of some of Matkahuolto services, such as your public feedback, will still display your pseudonym and related content even after your customer relationship has ended.

Matkahuolto is required to retain some of your personal details contained in your purchase, delivery and payment data in order to comply with accounting or other mandatory legislation even after the end of your customer relationship or other basis for processing personal information. Personal data forming part of accounting information is retained for the period of time required under accounting legislation (up to 10 years).

Personal data processed in connection with parcel services is retained in Matkahuolto’s operational systems for approximately two years, after which the data is archived. As the maximum period allowed for filing action under the Road Transport Agreements Act is three years, Matkahuolto archives all the data related to parcel services for at least three years. Access to archived data is strictly restricted.

When Matkahuolto no longer needs the personal data for the original purposes, the data is erased from Matkahuolto’s IT systems and other files, or the data is irrevocably anonymised.

9. Rights of the data subject

The EU General Data Protection Regulation guarantees data subjects a number of rights that you can exercise to control the processing of your personal data. You may exercise the following rights in respect of Matkahuolto insofar as Matkahuolto serves as the controller of your personal data.

• Right of access to data: You have the right to receive confirmation from Matkahuolto as to whether it is processing your personal data, as well as the right to check such data. Matkahuolto may request you to formulate your request in more detail regarding the procedure for the delivery of the data, etc.

• Right to rectification: You have the right to request that inaccurate or incorrect information be rectified or that the incomplete information be supplemented. When requesting a rectification, you need to be aware that all information cannot be changed retroactively by such a request. Specific appeal procedures exist for such decisions as explained in each individual decision.

• Right to be forgotten: In certain circumstances, you have the right to have Matkahuolto erase your personal data.

• Right to restriction of processing: In certain cases stipulated by law, you may have the right to demand that Matkahuolto limit the processing of your personal data.

• Right to withdraw consent: If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

• Right to data portability: Subject to certain statutory provisions, you may have the right to receive from Matkahuolto the personal data it processes about you in a commonly used and machine-readable format, and the right to transmit that data to another data controller without Matkahuolto’s interference.

• Right to object the processing of personal data: In certain situations, you may have the right to object to the processing of your personal data. In particular, the right to object to the processing of personal data applies to situations in which processing is based on Matkahuolto’s legitimate interest, unless there is a compelling legitimate reason for the processing that overrides the data subject’s interests, rights and freedoms, or if the processing is necessary for the establishment, exercise or defence of legal claims.

• Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, such as profiling, that produces legal effects concerning you or otherwise significantly affects you.

If you have registered as a user of Matkahuolto’s electronic services, you can check and correct your information in the electronic services provided by Matkahuolto. If you have not registered as a user of the electronic services, or if you do not want to use the electronic services to check or correct your information, you can check and correct your information by contacting Matkahuolto Customer Service Centre referred to in section 1 of this privacy statement. Any requests for the erasure or transfer of the data or any objection to direct marketing must always be submitted to the Matkahuolto Customer Service Centre.

Matkahuolto will take action in response to the data subject’s request without undue delay and, as a rule, will provide the data subject with information regarding the measures taken with regard to their rights within one month of receiving the request.

The data subject has the right to lodge a complaint concerning the processing of personal data by Matkahuolto with the data protection authority. The complaint must be filed with the competent supervisory authority – in Finland, the Data Protection Ombudsman – in accordance with the instructions provided by the authority.

10. Privacy Policy for Marketing Communications (B2B)

Background information

Oy Matkahuolto Ab, 0111393-9 (“Matkahuolto”, “We”) is the data controller responsible for processing the personal data of customers and potential customers in connection with customer relationship management, communication and marketing. As a responsible company, we want to ensure that your personal data is handled appropriately and with respect for your privacy. On this page, we describe how we process your personal data in connection with our activities related to customer relationship management, communication and marketing.

Where do we collect personal data?

We collect personal data in the following ways:

• The personal data you provide, for example, when entering into agreements, using our services, communicating with us, subscribing to newsletters and registering for events.

• Personal data that we collect or generate automatically, such as data recorded through the use of our website (e.g., analytics data, cookies), as well as information you provide through forms on our website (e.g. request for a quote, downloading materials). We may store such data in our customer management and marketing systems when you interact with us or use our services. For more information about our use of cookies, please see our

  Cookie Policy.

• Personal data collected from other sources, such as public sources (e.g. business registers) and third parties (e.g. social media platforms and our business partners).

For what purposes do we process personal data?

• We process personal data for a variety of purposes as part of our daily customer relationship management, communications and marketing activities. These purposes include, for example:

• Customer relationship management, which involves processing data on customers and their contacts in order to manage and develop customer relationships.

• Sending newsletters to our customers, potential customers and other stakeholders.

• Sending event invitations and managing events, including processing attendance data.

• Processing requests submitted through our website, such as responding to contact requests, handling requests for quotes, and providing materials you have requested (e.g. guides).

• Conducting customer satisfaction and market research to improve the quality and performance of our services.

• Improving customer insight by linking customer contact information to other data, such as actions taken on the website.

• Implementing targeted marketing and advertising, for example, to personalise content displayed on social media platforms or on our website.

For the purposes mentioned above, we may process the following personal data:

• Contact and identification information (e.g. name, email address, phone number).

• Professional information (e.g. title, organisation, industry).

• Marketing and communication interests (e.g. event registrations, downloaded content, selected areas of interest).

• Event details (e.g. attendance, feedback provided and any dietary information, which will be deleted after the event).

• Information related to website usage (e.g. IP address, cookie ID, pages visited and form submissions). For more information about our use of cookies, please see our

  Cookie Policy.

• Legal basis for the processing of personal data

We process your personal data on the following grounds:

• Our legitimate interest, for example:

• Managing and developing customer and stakeholder relationships.

• Providing useful and up-to-date information about our services, events and industry-related topics.

• Reaching out to business decision-makers and potential customers as part of sales and marketing activities.

• Ensuring the best possible customer experience through our services and communications.

• Consent, when required, for example:

• The collection of cookies and other digital identifiers in connection with the use of our website. For more information about our use of cookies, please see our Cookie Policy.

• Voluntary subscription to our newsletter via web form.

Who do we share your personal data with?

As a general rule, we do not disclose your personal data to third parties in connection with marketing, communications or customer relationship management. In some cases, however, we may share contact information, professional information and event details with our partners, for example, to organise joint events. In these situations, our partners act as independent data controllers for their own purposes.

In addition, we may use third-party platforms, such as social media platforms (e.g. LinkedIn), as marketing channels; these platforms act as independent data controllers in accordance with their own privacy policies.

We also use various service providers (e.g. IT services, marketing tools and analytics services) that act as data processors and process personal data solely in accordance with our instructions and only for the agreed purposes. These entities may not use the data for their own purposes.

We may also use and disclose information that cannot be linked to a specific individual – that is, personal data in an aggregated or anonymised form such that an individual can no longer be identified.

Where do we process personal data?

We process personal data primarily within the EU/EEA. In some cases, our service providers may process data outside the EU/EEA, in which case we ensure an adequate level of data protection, for example by using standard contractual clauses approved by the EU.

Data retention

We retain your personal data only for as long as is necessary for the purposes for which it was collected or to comply with legal obligations:

• Personal data related to customer relationship management is retained for the duration of the customer relationship and may be deleted if the contact person has been inactive for a long time and there has been no interaction.

• Data processed for marketing purposes (e.g. sending newsletters or event communications) will be retained for as long as the subscription is active – that is, until the recipient cancels it – or for a short period after the event has ended for the purpose of evaluating the event.

• Information on potential customers (prospects) is retained for marketing and sales purposes for as long as it is considered up-to-date and relevant. The data is reviewed regularly and deleted if it is no longer needed or if, for example, an email address turns out to be incorrect.

Your rights

You have the following rights:

• The right to access information.

• The right to request the correction, deletion or restriction of processing of your data.

• The right to object to the processing of personal data, including direct marketing.

• The right to transfer data from one system to another.

• The right to file a complaint with the supervisory authority.

You can exercise your rights by sending a request to us at tietosuoja@matkahuolto.fi.

Updating this Privacy Policy

We may update this policy from time to time and will notify you of any significant changes in an appropriate manner. The latest version is always posted on this page.

Contact details

If you have any questions about the processing of your personal data, please contact us:

Oy Matkahuolto Ab
Customer Service Centre
P.O. Box 100, 00101 Helsinki
tietosuoja@matkahuolto.fi

11. In conclusion

Matkahuolto reserves the right to update and revise this privacy statement. Matkahuolto will notify data subjects of any significant changes on its website or by other appropriate means.

Matkahuolto is not generally obliged to individually notify data subjects of changes, such as when the provision of such information proves impossible or would require unreasonable effort (for example, when there are no up-to-date contact details for the data subject), so the data subjects are encouraged to periodically review this statement for any changes.