According to the investigative journalism website Addendum, the Austrian Post sold the names, addresses, age and gender of around three million customers to other companies for targeted marketing purposes.
It also makes assumptions about users' likely political allegiances, compiling up to 2.2 million such profiles.
That information is sold on to political parties so that they can better target potential supporters in election campaigns, Addendum reported.
The privacy campaign group, Epicenter Works, argues that such a practice runs contrary to EU data protection rules.
It was a “scandal” that the Austrian Post was collecting and selling assumptions about customers' party political allegiances without their knowledge and permission, said Wolfie Christl, a campaigner at Epicenter Works.
However, the Austrian Post sees nothing wrong in such a practice, insisting that it is allowed to use such data under Austrian law.
“The specified characteristics are collated in this way and are allowed to be used exclusively for marketing purposes. The use of such data is strictly limited to this purpose only,” it said in a statement.
Facebook, the world's largest social network, has been roiled by a series of scandals in several countries concerning data protection and privacy after user data were hijacked in the 2016 US election campaign.
The Austrian Post is listed on the Vienna Stock Exchange but is majority-owned by the state.