Express courier. Direct.
Also overnight.
x25pronto Switzerland takes goods direct to the destination. Small loads go by car. Larger loads go by van or Van XL. Direct, express and overnight trips run Monday to Sunday when a slot is free. Free times are shown in the booking calendar. This keeps the plan clear.
Data protection in practice: data processing agreements with courier services
How Swiss companies can draft ADV-style data processing agreements with couriers: required clauses, deletion timelines, access control and audit trails in clear, practical terms.
Quick answer
Swiss companies should document data processing with courier services in a written agreement: define purpose, data categories, deletion timelines, access controls and audit trails. Specify control rights, technical and organisational measures (TOM) and procedures for audits and incident reporting.
Why a DPA with courier services is needed
Couriers handle personal data of senders, recipients and shipment records. When they process data on your behalf, a data processing agreement (DPA) clarifies responsibilities. A written DPA reduces legal uncertainty and documents who does what in case of audits or incidents.
Essential content for the agreement
At minimum, state the purpose and duration of processing, categories of personal data (name, address, phone, tracking IDs), rights and duties of principal and processor, deletion rules and procedures for involving subprocessors or cross-border transfers.
Concrete clauses: deletion periods and records
Set deletion periods by data type. For example, delivery proof and tracking records may remain 6–12 months; marketing or non-essential identifiers should be deleted sooner when no legal basis exists. Specify deletion method (secure wipe or physical destruction) and how deletion is evidenced.
Access rights, roles and least-privilege
Define which staff may access which data and for what purpose. Apply a least-privilege principle. Require access logging: who viewed, changed or exported data and when. Agree on secure authentication (strong passwords, 2FA) and scheduled reviews of access rights.
Audit trails and inspection rights
Include audit and inspection provisions. Allow periodic audits or require annual compliance reports. Specify log formats (access logs, deletion proofs, incident reports) and set delivery deadlines for documentation, for example 10 working days.
Technical and organisational measures (TOM)
List TOM such as encryption in transit, secure storage, access control, secure handling of paper documents, staff training and incident handling. Name privacy contacts on both sides and define escalation paths for incidents.
Frequently asked questions
Do I need a DPA if the courier only prints address labels?
Yes. Even basic handling of personal data—printing, sorting, delivering—can constitute data processing on your behalf. Use a DPA to document the processing and protections in place.
How short can deletion periods be in a DPA?
Deletion periods must match the processing purpose and legal retention needs. Delivery proofs may require several months; data without a legal basis should be deleted promptly.
Can I conduct spot audits of the courier?
Yes. Contract for spot audits or require regular compliance reports. Specify scope, frequency and deadlines for document delivery in the agreement.
What to do if a data breach involves a courier delivery?
The courier should follow contracted incident notification rules. Set notification timelines (for example, 72 hours for reportable breaches), required content of reports and remediation steps.