[{"data":1,"prerenderedAt":55},["ShallowReactive",2],{"nav-latest-post-en":3,"page-compliance-en":8},{"stem":4,"title":5,"category":6,"cover":7},"en\u002Fblog\u002Fddp-vs-dap-who-pays-import-duties","DDP or DAP: who pays the import duties on your parcels","Customs","\u002Fassets\u002Fblog\u002Fddp-dap-qui-paie-droits-douane.jpg",{"id":9,"blocks":10,"extension":46,"meta":47,"seo":48,"slug":52,"stem":53,"__hash__":54},"pages_en\u002Fen\u002Fpages\u002Fcompliance.yml",[11],{"type":12,"title":13,"lastUpdated":14,"copyLabel":15,"copiedLabel":16,"sections":17},"legal-content","GDPR compliance","Last updated: 10 August 2026","Copy","Copied",[18,21,24,27,30,33,37,40,43],{"heading":19,"body":20},"Who this page is for","When you ship with ParcelRush, you hand us your buyers' data: their name, their address, often their phone number and email. You remain responsible for that data, and you need to be able to account for it.\n\nThis page gathers what you need for that: who processes what, where the data is hosted, how long it is kept, the data processing agreement to file, and a paragraph you can paste straight into your own privacy policy.\n",{"heading":22,"body":23},"1. The data processing agreement (DPA)","Article 28 of the GDPR requires a written contract between the controller (you) and the processor (ParcelRush). That contract exists and you can request it at hello@parcelrush.com, with no volume threshold and without going through a salesperson.\n\nWhat it covers:\n\n• We process your data only on your instructions, and only for the purposes of the service.\n• Our sub-processors are listed, and any material change is notified to you with 30 days' notice.\n• We assist you in answering your buyers' access, rectification, erasure and portability requests.\n• At the end of the contract, your data is deleted.\n\nThe agreement is governed by Portuguese law, ParcelRush being operated by Navescale, Lda, whose registered office is in Lisbon. Transfers to a sub-processor located outside the European Union are covered by the European Commission's standard contractual clauses (decision 2021\u002F914).\n",{"heading":25,"body":26},"2. Who is responsible for what","The GDPR draws three distinct roles in this chain, and they do not carry the same obligations.\n\n• \u003Cstrong>You are the controller.\u003C\u002Fstrong> They are your buyers, your commercial relationship, your purposes. You are the one who informs them and answers their requests.\n• \u003Cstrong>ParcelRush is your processor\u003C\u002Fstrong> within the meaning of Article 28. We process order data to produce the label, the customs documents and the tracking, and for nothing else.\n• \u003Cstrong>Carriers are not our sub-processors.\u003C\u002Fstrong> DHL, UPS, FedEx, DPD, CTT and Colissimo act as independent controllers: they have their own legal obligations for transport, customs and record keeping, and they do not process the data on our behalf. Passing the address to the carrier you selected is necessary to perform your sales contract.\n\nThe distinction matters when you write your own notice: a carrier is named as a recipient of the data, not as a sub-processor of ParcelRush.\n",{"heading":28,"body":29},"3. What we process, and for how long","For your buyers, we process the recipient's name, delivery address, phone number and email where provided, and the order contents needed for the label and the customs declaration.\n\nFor you, we process your account data and your carrier credentials, which are encrypted.\n\nRetention periods:\n\n• \u003Cstrong>Order data: deleted\u003C\u002Fstrong> once the shipment is complete. We build no database of recipients.\n• \u003Cstrong>Generated labels: 6 months.\u003C\u002Fstrong> A label carries the recipient's name and address, since that is what is printed on it. It stays available for as long as it takes to handle a return, a claim or a delivery dispute, then it is deleted.\n• \u003Cstrong>Destination country: 1 year.\u003C\u002Fstrong> The country alone, for statistics. It identifies no one.\n• \u003Cstrong>Billing records: 10 years\u003C\u002Fstrong>, as Portuguese accounting law requires. These carry your company data, not your buyers'.\n• \u003Cstrong>Account data:\u003C\u002Fstrong> for the duration of the contract, then deleted.\n• \u003Cstrong>Backups:\u003C\u002Fstrong> purged within 30 days.\n\nYou can ask for a label to be deleted early at any point, before the 6 months are up. Write to hello@parcelrush.com: the deletion is permanent.\n",{"heading":31,"body":32},"4. Where the data sits, and who touches it","\u003Cstrong>The whole service is hosted with Hetzner, in Germany, so inside the European Union.\u003C\u002Fstrong> The database is built and run by our own team: no third-party provider hosts your shipments.\n\nOur sub-processors are few, and each one has a reason to be there:\n\n• \u003Cstrong>Hetzner\u003C\u002Fstrong> (Germany, EU): hosting of the platform and the data.\n• \u003Cstrong>Brevo\u003C\u002Fstrong> (European Union): sending transactional emails and replies to your messages.\n• \u003Cstrong>Cloudflare\u003C\u002Fstrong> (United States, standard contractual clauses): protecting the service and screening forms against bots.\n• \u003Cstrong>Stripe\u003C\u002Fstrong> (United States, standard contractual clauses): payment processing. We store no card data.\n\nThe parcelrush.com website additionally uses DataFa.st for audience measurement, after consent. That tool sees nothing of your shipments: it only covers browsing on the public site.\n",{"heading":34,"body":35,"paste":36},"5. The paragraph to add to your privacy policy","Add this paragraph to the \"Processors\" or \"Data recipients\" section of your privacy policy. It tells your buyers that their delivery details pass through a shipping provider, which the GDPR requires you to do.\n","To prepare and track your shipments, we use ParcelRush (Navescale, Lda, Praça Duque de Saldanha 1, 2º andar, 1050-094 Lisbon, Portugal), a processor within the meaning of Article 28 of the GDPR. The data needed for delivery (name, address, phone number, email address and order contents) is passed to it in order to produce the shipping label, the customs documents where applicable, and the parcel tracking. That data is hosted in the European Union. The order data is deleted once the shipment is complete; the generated label, which carries the delivery name and address, is kept for 6 months and then deleted. It is also passed to the carrier we selected for your order, which acts as an independent controller. You may exercise your rights of access, rectification, erasure, restriction, portability and objection by contacting us.",{"heading":38,"body":39},"6. Warehouses and 3PL providers","If you ship on behalf of your own clients, the chain has one more link: your client is the controller, you are their processor, and ParcelRush becomes a sub-processor.\n\nWe accept being named as such in the contract between you and your clients, and we give you what you need to file: the data processing agreement, the list of sub-processors above, the hosting location and the retention periods. That is what a client asks for when auditing its logistics provider, and it is meant to fit in an annex.\n\nIf your client requires a specific clause or its own contract template, write to us and we will look at it.\n",{"heading":41,"body":42},"7. Frequently asked questions","\u003Cstrong>What happens in the event of a data breach?\u003C\u002Fstrong>\nWe notify the relevant supervisory authority within 72 hours, and we tell you without undue delay if your data is affected. The full procedure is in our \u003Ca href=\"\u002Fen\u002Fsecurity\">security policy\u003C\u002Fa>.\n\n\u003Cstrong>What happens if a supervisory authority makes a request?\u003C\u002Fstrong>\nAs a processor, we assist you in answering it, as well as any audit or any access, rectification, erasure or portability request coming from one of your buyers.\n\n\u003Cstrong>Are routing rules a prohibited automated decision?\u003C\u002Fstrong>\nNo. The rules pick a carrier for a parcel, based on weight, destination and the service requested. They bear on no person, produce no legal effect and take no decision within the meaning of Article 22. You can override the carrier at any time.\n\n\u003Cstrong>Do I need a data protection impact assessment (DPIA)?\u003C\u002Fstrong>\nIn the vast majority of cases, no. Shipping parcels involves no large-scale profiling, no special category data within the meaning of Article 9, and no systematic evaluation of individuals. If your activity does require one, we provide the technical details you need free of charge.\n\n\u003Cstrong>Can I get my data back if I leave?\u003C\u002Fstrong>\nYes, for as long as your account is active: your shipping history is yours and exports in a usable format. Do it before you go, since everything is deleted at the end of the contract. Your carrier contracts are in your name, so they leave with you.\n",{"heading":44,"body":45},"8. Getting in touch","To request the data processing agreement, ask a compliance question or exercise a right: hello@parcelrush.com.\n\nParcelRush is a service operated by Navescale, Lda, VAT 518556719, Praça Duque de Saldanha 1, 2º andar, 1050-094 Lisbon, Portugal.\n","yml",{},{"title":49,"description":50,"ogImage":51},"GDPR compliance: DPA, sub-processors and hosting | ParcelRush","The Article 28 data processing agreement, the list of sub-processors, retention periods, and a paragraph you can paste into your own privacy policy.","https:\u002F\u002Fparcelrush.com\u002Fassets\u002Fog-parcelrush.jpg","compliance","en\u002Fpages\u002Fcompliance","UpCSR9BBZI5wwvhehXF4pDcdbOr5Gw8ndeV4pWapqxY",1786349450421]