How SmartPOST protects your customer data

• Your address information is used only for the delivery campaign you agreed.
• Access is limited to a small number of authorised SmartPOST people.
• Delivery teams receive only the information needed to complete their own route.
• Client lists are never sold, reused for another client, or used for SmartPOST marketing.
• Files are securely deleted after the agreed retention period once the campaign is complete.
• We keep written data processing agreements in place, including with anyone who works on our behalf.

• You send the list to us through an agreed secure channel — not WhatsApp, personal email or a public file link.
• It is stored in a restricted area tied to that one campaign.
• Addresses are validated and turned into delivery routes.
• Each distributor sees only their own stops.
• Delivery is recorded, and undeliverable addresses are reported back to you.
• After the agreed period, the underlying file is deleted and only the non-personal campaign report remains.

For most campaigns we need the address and Eircode, plus a name only where the item is addressed to a named person. We do not ask for phone numbers, email addresses, dates of birth or anything sensitive. Where a name is not needed to deliver, our route screens simply show the address and how many items to leave.

• Company accounts with two-factor authentication — no shared logins.
• Role-based access: sales see campaign details, operations see address level, distributors see route level only.
• No bulk download of a client list from a distributor's device.
• Access is removed when someone leaves.

During the campaign we hold the full file as needed to deliver. Afterwards we keep it for a short reconciliation window — normally 30 days — to handle queries, complaints and failed-address checks. It is then deleted unless you have asked us in writing to keep it for a specific reason.

Deletion is automatic. Every file you send us is given a deletion date when it arrives — 30 days after upload unless a different date has been agreed for the campaign — and a daily process permanently removes files once that date passes. We keep only a record that the file was deleted (file name, campaign, date and reason), not the addresses.

We keep the non-personal campaign record — quantities delivered, dates, areas, completion rates and route evidence — as our own business record, without keeping the underlying list.

We keep a written breach procedure and a breach register. If a personal data breach affects a client's list, we notify that client without undue delay so they can meet their own obligations, and we help them assess and respond.

Agencies, councils and larger organisations often need to record how a supplier handles data. Email privacy@smartpost.ie and we will provide our data processing agreement and answer your assessment. See also our Privacy Notice and Data & Privacy pages.