GDPR compliance

When you ship with ParcelRush, you hand us your buyers' data: their name, their address, often their phone number and email. You remain responsible for that data, and you need to be able to account for it.

This page gathers what you need for that: who processes what, where the data is hosted, how long it is kept, the data processing agreement to file, and a paragraph you can paste straight into your own privacy policy.

Article 28 of the GDPR requires a written contract between the controller (you) and the processor (ParcelRush). That contract exists and you can request it at [email protected], with no volume threshold and without going through a salesperson.

What it covers:

• We process your data only on your instructions, and only for the purposes of the service.
• Our sub-processors are listed, and any material change is notified to you with 30 days' notice.
• We assist you in answering your buyers' access, rectification, erasure and portability requests.
• At the end of the contract, your data is deleted.

The agreement is governed by Portuguese law, ParcelRush being operated by Navescale, Lda, whose registered office is in Lisbon. Transfers to a sub-processor located outside the European Union are covered by the European Commission's standard contractual clauses (decision 2021/914).

The GDPR draws three distinct roles in this chain, and they do not carry the same obligations.

• You are the controller. They are your buyers, your commercial relationship, your purposes. You are the one who informs them and answers their requests.
• ParcelRush is your processor within the meaning of Article 28. We process order data to produce the label, the customs documents and the tracking, and for nothing else.
• Carriers are not our sub-processors. DHL, UPS, FedEx, DPD, CTT and Colissimo act as independent controllers: they have their own legal obligations for transport, customs and record keeping, and they do not process the data on our behalf. Passing the address to the carrier you selected is necessary to perform your sales contract.

The distinction matters when you write your own notice: a carrier is named as a recipient of the data, not as a sub-processor of ParcelRush.

For your buyers, we process the recipient's name, delivery address, phone number and email where provided, and the order contents needed for the label and the customs declaration.

For you, we process your account data and your carrier credentials, which are encrypted.

Retention periods:

• Order data: deleted once the shipment is complete. We build no database of recipients.
• Generated labels: 6 months. A label carries the recipient's name and address, since that is what is printed on it. It stays available for as long as it takes to handle a return, a claim or a delivery dispute, then it is deleted.
• Destination country: 1 year. The country alone, for statistics. It identifies no one.
• Billing records: 10 years, as Portuguese accounting law requires. These carry your company data, not your buyers'.
• Account data: for the duration of the contract, then deleted.
• Backups: purged within 30 days.

You can ask for a label to be deleted early at any point, before the 6 months are up. Write to [email protected]: the deletion is permanent.

The whole service is hosted with Hetzner, in Germany, so inside the European Union. The database is built and run by our own team: no third-party provider hosts your shipments.

Our sub-processors are few, and each one has a reason to be there:

• Hetzner (Germany, EU): hosting of the platform and the data.
• Brevo (European Union): sending transactional emails and replies to your messages.
• Cloudflare (United States, standard contractual clauses): protecting the service and screening forms against bots.
• Stripe (United States, standard contractual clauses): payment processing. We store no card data.

The parcelrush.com website additionally uses DataFa.st for audience measurement, after consent. That tool sees nothing of your shipments: it only covers browsing on the public site.

Add this paragraph to the "Processors" or "Data recipients" section of your privacy policy. It tells your buyers that their delivery details pass through a shipping provider, which the GDPR requires you to do.

If you ship on behalf of your own clients, the chain has one more link: your client is the controller, you are their processor, and ParcelRush becomes a sub-processor.

We accept being named as such in the contract between you and your clients, and we give you what you need to file: the data processing agreement, the list of sub-processors above, the hosting location and the retention periods. That is what a client asks for when auditing its logistics provider, and it is meant to fit in an annex.

If your client requires a specific clause or its own contract template, write to us and we will look at it.

What happens in the event of a data breach?
We notify the relevant supervisory authority within 72 hours, and we tell you without undue delay if your data is affected. The full procedure is in our security policy.

What happens if a supervisory authority makes a request?
As a processor, we assist you in answering it, as well as any audit or any access, rectification, erasure or portability request coming from one of your buyers.

Are routing rules a prohibited automated decision?
No. The rules pick a carrier for a parcel, based on weight, destination and the service requested. They bear on no person, produce no legal effect and take no decision within the meaning of Article 22. You can override the carrier at any time.

Do I need a data protection impact assessment (DPIA)?
In the vast majority of cases, no. Shipping parcels involves no large-scale profiling, no special category data within the meaning of Article 9, and no systematic evaluation of individuals. If your activity does require one, we provide the technical details you need free of charge.

Can I get my data back if I leave?
Yes, for as long as your account is active: your shipping history is yours and exports in a usable format. Do it before you go, since everything is deleted at the end of the contract. Your carrier contracts are in your name, so they leave with you.

To request the data processing agreement, ask a compliance question or exercise a right: [email protected].

ParcelRush is a service operated by Navescale, Lda, VAT 518556719, Praça Duque de Saldanha 1, 2º andar, 1050-094 Lisbon, Portugal.