Postcrossing Privacy Policy

We are Postcrossing Lda, a company in Portugal with tax number 513308016, registered at Rua Dom João IV 399, 2, sala 12, 4000-302 Porto. We provide the services at www.postcrossing.com, forum.postcrossing.com and community.postcrossing.com (jointly, the “Website”) which allow members from around the world to exchange postcards.

Anyone can navigate through parts of our Website without having to register; however, it is necessary to register to be able to make use of certain features, in particular those that enable the sending and receiving of postcards.

By registering and using our services, you share some of your personal information with us. We are committed to protecting your privacy, and have therefore developed this Privacy Policy to explain:

We advise everyone to read it carefully in order to become familiar with our privacy practices.

Which information is collected

To bring you our services, we collect or receive your personal information in a few different ways:

Registration, account setup
To create an account on Postcrossing, we require some information from you: a username and password, email address, name and postal address, and your (approximate) location in order to place you on a world map.
Profile
You can choose to personalize your profile with optional information, such as birthday, gender, an avatar or a short text about yourself. Together with account activity, this information is part of your public profile.
Use of the service
We gather information provided by you and arising from your interactions with the Website, namely, the postcards you exchange and the content you post such as comments, images, and favorite postcards.
Automated information
When accessing our Website, our servers automatically receive and store information from your browser, such as your browser details, your IP address, requested page and referral page. This information is stored in log files for up to 30 days. We use this information only for the purpose of defending our servers against abuse, troubleshooting technical problems and understanding how our platform is used.
Analytics information
To improve the Website’s functionality and understand its usage, we rely on analytics services, which collect anonymized information about visits to the Website (for example, pages viewed, length of visits, browser and operating system).
Cookies
Like many other websites, our Website makes use of browser cookies. Postcrossing has a dedicated Cookie Policy page, which explains in detail what cookies are, how Postcrossing uses them and how you can control and/or remove them. The Cookie Policy page is an integral part of this Privacy Policy.
Customer support
When you contact us with questions or ask for help, we save your message and contact details so we can help you.
Payment information
If you make any payment to us, we are legally required to keep a record of these transactions.

How we use the collected information

When you access or use our services, we collect, use, share, and process information about you as described in this Privacy Policy and only when we have a legal basis to do so. The legal basis depends on the services you use and how you use them. These legal bases are:

  • We need the information to provide you with the services and perform the contractual obligations in our Terms of Service;
  • There is a legitimate interest, such as providing, improving and personalizing the services, and/or protecting the safety and security of the Website;
  • You’ve given us your consent to do so for a specific purpose;
  • You have made the information public; or
  • We need to comply with a legal obligation.

In more detail, we use the information we collect to:

Provide the services and personalize your experience
We use the information we receive to provide our services to you, and to maintain and operate the Website. For example, it wouldn’t be possible to allow members to exchange postcards if we didn’t have their postal address. Other information you provide allows us to authenticate you, create your profile, show you maps and statistics about your activities and personalize certain aspects of the Website such as the types of ads you see or your preferred units of measurement.
Improve our service
Some of the information you provide is used to analyze, develop and improve the Website. For example, we use third-party analytics providers, like Google Analytics, to gain insights into how our Website is used and to help us improve it.
To communicate with you about the Website
Your contact information is used to send you communications via email, such as when you request to send a postcard, when one of your sent postcards is registered, or when one of your postcards is marked as a favorite. We also use it to send you reminders, notices or updates about your account or the Website. While most of these communications can be disabled in your account settings, some cannot, as they are part of the service we provide.
Customer support
We use your information to help you when you contact us about your account or about our Website. We may also contact you about your use of the account to resolve disputes or to enforce our Community Guidelines and Terms of Service.
Keeping our service safe and secure
Postcrossing may use your information to ensure the safety and security of our Website and of our members, for example, by monitoring misuse or suspicious activity, identifying violations of our Terms of Service, and protecting the community against spam, harassment, and other security risks.

How we share the collected information

Between members

The goal of Postcrossing is to connect the world via real mail by allowing you to exchange postcards with other random members around the world. Thus, it is central to our service to share your postal address so that you can receive postcards from other members. However, we take great care to do this sharing in a controlled way. For example,

  • It is not possible for someone to request access to a specific address; instead, the Website randomly selects the destination of each postcard.
  • We also limit the number of addresses an account can request and have in place several security measures to prevent abuse.
  • The number of times your address may be shared is proportional to the number of postcards you have sent yourself. Consequently, until you send your first postcard and become eligible to receive one back, your address is not shared with anyone.

With others

We rely on some third-party companies and individuals to provide certain services on our behalf, either because they are necessary to bring you our service or because they help us improve it. These third parties may have access to some personal information, but Postcrossing ensures that entities with access to personal information are credible and offer strong protections. We never transmit more information to them than is necessary to provide the contracted service.

Some of the service providers we use include:

Analytics
To understand how our Website is used and to improve it, we use a third-party analytics service called Google Analytics provided by Google. This service collects anonymized information about the use of the Website (for example, time of visits, pages viewed and type of operating system used) through the use of cookies. The data collected by Google Analytics about your use of our Website is kept for a period of 26 months. You can find Google’s Privacy Policy on its website.
Advertising
To be able to support the service we provide to you, we display advertising banners on our Website using third-party advertising networks and platforms such as Google Ad Manager and Google AdSense — you can learn how Google manages data in its ads products on Google’s Business Data Responsibility site and on this page explaining how Google uses information from sites and apps that use its services. Where required, if the ads we show you collect, share and/or use your information for ad personalization, we will request your consent prior to showing them to you, and you can withdraw your consent at any time.

Legal obligations

Postcrossing may also share information with third parties regarding investigations, judicial inquiries and legal or administrative procedures, when required to do so by law.

How we store and secure information

Security

We take the security of personal information very seriously, and do our best to safeguard it. Keeping in mind industry best practices and the technical knowledge available, we use technical and organizational measures to protect your personal information, both during transmission and after it is received, against destruction, accidental or unlawful loss, accidental alteration, disclosure or unauthorized access, within a level of security appropriate to the nature of the information being protected. However, Postcrossing cannot guarantee the total security of the information in its users’ accounts against all possible situations of unauthorized access, hardware or software failures and other factors that may compromise the security of the information.

Accounts

Your account access is protected by a password chosen by you. You should make careful use of the Website in order to prevent unauthorized access to your account and your personal information, namely, by carefully choosing and protecting your password and limiting access to the devices through which you access the Website.

Hosting

To provide you with access to our Website, we use the hosting provider Amazon AWS, and its data centers in the E.U. Amazon AWS follows industry best practices, adheres to globally known compliance programs in both security and data privacy, and maintains several recognized certifications assessed by independent auditors.

Additionally, we use several technical measures to secure the information stored and ensure strictly controlled access to it. Some of the safeguards we use are firewalls, intrusion detection systems, data encryption and access controls.

Backups

In order to ensure continued availability of the Website in case of any technical or physical incidents, we make regular backups of the information so we can restore your access to it in a timely manner. These backups are encrypted and kept for a limited period of time.

Storage period

When your account is terminated (either by you or by us), if you don't have any postcards traveling from your account, all your personal information is immediately deleted.

If you still have postcards traveling to other members, we may keep some of your account information (name, username, email, address, profile text and IP address) until these postcards arrive or are deleted by our system. We do this so that we can help the recipients of your postcards register them, if they need our help. This means some information can be kept for up to one year, but you can contact us at any time to request that it is deleted sooner.

We may also keep some information to comply with legal obligations (for example, applicable tax/revenue laws), to resolve disputes or to enforce our Terms of Service.

How you can access and control your information

Most of the information Postcrossing collects about you is easily accessible to you simply by logging in to the Website.

Through your account settings, you can update your information, withdraw any consent that you had previously given (for instance, about which emails you’d like to receive from us or which types of ads you’re shown) or terminate your account to erase your personal information. Please ensure you’ve read the details about how long we store your information in the “storage period” section above.

If you require additional access to other information about your account, or would like to exercise your right to data portability, you’ll need to contact us so that we can first verify your identity.

Under certain circumstances, you may have the right to restrict the processing of your information. Please contact us so that we can analyze your request.

Lastly, if you’ve lost access to your account or are having trouble exercising any of your rights, please contact us.

How we transfer information we collect internationally

When we transfer any personal information to a third-party service provider in a country which is not a member state of the E.U., we will comply with the applicable legislation; in particular, we will make sure there is an adequate level of protection for personal information and we will not transfer personal information to services in jurisdictions that do not provide adequate safety and security guarantees.

Other important privacy information

Links to other websites or services

The Website may contain links to third-party websites, including in advertising banners. These third-party websites and the way they process collected information are the sole responsibility of their owners, and therefore Postcrossing is not responsible for their privacy policies and/or practices.

Updates to our Privacy Policy

We may update this Privacy Policy from time to time, and we will post the changes on this page. If the changes are significant, we will provide appropriate notice of those changes.

Contact

If you have any questions or concerns about how your information is handled, or if you believe we are not following this Privacy Policy, please contact us through our contact form or use our address:

Postcrossing Lda
Rua Dom João IV 399, 2, sala 12
4000-302 Porto
PORTUGAL

If we do not satisfactorily deal with a complaint you have, you may also contact the Portuguese Data Protection Authority.

Effective from: May 25, 2018