Privacy Statement

1. Who we are

Hart voor Transport is a trade name of Zipload B.V., a courier and transport company based in Haarlem, the Netherlands. Zipload B.V. is the controller for the processing of personal data described in this privacy statement. Where this statement says "we" or "Hart voor Transport", it means Zipload B.V.

Data protection officer

We have not appointed a data protection officer (DPO). We are not required to: we are not a public authority, and large-scale regular and systematic monitoring of individuals or large-scale processing of special categories of data is not a core activity of ours (Article 37 GDPR). For any privacy question, please contact info@zipload24.com. We respond to your request within one month.

2. Which personal data we collect

Depending on how you use our services and your relationship with us, we may process the following personal data:

Contact details

• First and last name
• Email address
• Phone number
• Company name (if applicable)

Address details

• Pickup and delivery address of transports
• Billing address
• Postcode and town

Location data

• Addresses you enter in our price calculator (pickup and delivery address)
• Geolocation data for route calculation
• Live GPS location of couriers during an active job (only between pickup and delivery, see section 5a)

Technical data and origin

• IP address (in our own visitor statistics only as a pseudonymised code)
• Browser and device type
• The pages you visit, the website you came from and the time of your visit
• A random session ID, only with your consent (see section 5b)
• Origin of a request or booking: the page on which you arrived, the referring website and any campaign codes in the link (utm), and, only with your consent, the click ID of a Google ad (see section 8)
• Form drafts: what you enter in a request before you send it, only with your consent (see section 5b)

Financial data

• Payment details (bank account number, billing details)
• Invoice history

Data of couriers and freight providers

• Chamber of Commerce number and VAT number
• NIWO licence (if applicable)
• Insurance details
• Vehicle details
• Copy of identity document (stored with restricted access)

Data relating to the digital consignment note (eCMR, since June 2026)

For every job we record the consignment note digitally in accordance with the CMR Convention and the Additional Protocol concerning the electronic consignment note (eCMR Protocol). This includes:

• Contact details of the sender and recipient (name, phone, optionally email), so that after signing they receive their own copy of the consignment note by WhatsApp and/or email (Article 4 of the Protocol and Article 5 CMR)
• Signatures of the courier, sender and recipient, stored as images in our secure cloud environment (Cloudinary)
• With every signature: the IP address of the device, the browser type (user agent), a timestamp and, only if the courier grants permission in the browser, the GPS location. This data strengthens our evidence if the authenticity of a signature is disputed.
• A SHA-256 hash of every consignment note PDF we deliver, so you can check yourself that your copy is unchanged (via the X-eCMR-PDF-Hash header of your download)
• A second copy of every consignment note PDF in an independent archive (Backblaze B2, EU), so the consignment note remains available for the statutory retention period of 7 years (Article 52 of the Dutch General Taxes Act), even if our primary storage fails

The legal basis is the performance of the contract (Article 6(1)(b) GDPR): we need this data to carry out your transport order in a legally sound way. In addition, we have a legitimate interest (Article 6(1)(f) GDPR) in having evidence if a delivery is disputed. For senders and recipients who are not our customers themselves, the processing takes place within the contract between us and the person who booked (the customer).

3. What we use your data for

We process your personal data for the following purposes:

Service provision

• Organising and carrying out transport orders
• Calculating routes and prices with our price calculator
• Assigning orders to available couriers
• Keeping track of the status of your shipment

Billing and administration

• Preparing and sending quotes and invoices
• Processing payments
• Keeping our financial records

Communication

• Answering your questions by email, phone or WhatsApp
• Informing you about the progress of your transport order
• Sending relevant information about our services, only to customers about similar services or with your consent

Improving our service

• Analysing website visits to improve our website
• Measuring through which channels and campaigns requests come in
• Improving our pricing model and route calculations
• Improving ease of use

4. Legal basis for processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

Performance of a contract (Article 6(1)(b) GDPR)

When you place a transport order with us, we process your data to carry out the order. This includes calculating the price, scheduling the job, sharing your pickup and delivery address with the courier and handling the payment.

Legitimate interest (Article 6(1)(f) GDPR)

We process some data on the basis of our legitimate interest: improving our services, our own cookie-free visitor statistics (section 5b), recording the origin of a request or booking you send (page, referrer, campaign code), securing our platform and preventing fraud. We always weigh your interests, and you can object at any time (section 7).

Legal obligation (Article 6(1)(c) GDPR)

We are required by law to keep some data, for example for tax purposes. We keep financial data for 7 years, as the law requires.

Consent (Article 6(1)(a) GDPR)

For Google Analytics 4, Google Ads conversion measurement (including the click ID and Enhanced Conversions) and saving form drafts, we ask for your consent through the cookie banner. We also send newsletters and other marketing messages only with your consent, or to existing customers about similar services. You can withdraw your consent at any time via "Cookie settings" at the bottom of every page or via info@zipload24.com. Withdrawal takes effect from that moment; processing that took place earlier with your consent remains lawful.

5. Sharing with third parties

We only share your personal data with third parties when this is necessary for our services, when you have given your consent or when the law requires us to. We never sell your data.

Couriers and carriers

To carry out your transport order, we share your pickup and delivery address, contact details and relevant information about the load with the courier who carries out the job. This is necessary for the performance of the contract.

Mapbox

We use Mapbox for route calculation and for converting addresses into coordinates in our price calculator. Mapbox receives the address you enter and your IP address. Mapbox is based in the United States and certified under the EU-US Data Privacy Framework; the transfer takes place on the basis of that adequacy decision. We have concluded a data processing agreement with Mapbox (Article 28 GDPR). More information: Mapbox Privacy Policy and Mapbox DPA.

Cloudinary

We use Cloudinary to store and process documents and images related to transport orders, such as photos of the load, files you send us and insurance certificates. Cloudinary is based in the United States and certified under the EU-US Data Privacy Framework. We have concluded a data processing agreement with Cloudinary (Article 28 GDPR). More information: Cloudinary Privacy Policy and Cloudinary DPA.

Moneybird

Older invoices were prepared in Moneybird and are kept there for as long as the statutory retention period runs; we prepare new invoices in our own platform. Moneybird B.V. is a Dutch company; no data is transferred to countries outside the EU. We have a data processing agreement with Moneybird (Article 28 GDPR).

WhatsApp (Meta)

We use WhatsApp to communicate with customers and couriers. If you contact us via WhatsApp, your messages and phone number are processed by Meta. Meta Platforms, Inc. is based in the United States and certified under the EU-US Data Privacy Framework. We only start a WhatsApp conversation ourselves if you ask us to, if it is necessary for an ongoing order or if you have given us your consent.

Mollie (payments)

Online payments via iDEAL or similar methods are handled by Mollie B.V. (the Netherlands). Mollie receives your name, email address, the amount and a reference to your job. We only receive the status of your payment from Mollie, not your full bank details. No data is transferred to countries outside the EU. We have a data processing agreement with Mollie (Article 28 GDPR). More information: Mollie Privacy Statement.

Railway (platform hosting)

Our customer and courier platform (app.hartvoortransport.nl) runs on Railway. Railway processes technical logs and the data needed to run the application. Railway is based in the United States; the transfer takes place on the basis of the European Commission's Standard Contractual Clauses. We have a data processing agreement with Railway (Article 28 GDPR). More information: Railway Privacy Policy and Railway DPA.

Supabase (database)

Our platform database runs at Supabase (PostgreSQL) on servers in the EU. It contains order, user and session data. Supabase Inc. is based in the United States; any transfer to the US is covered by the Standard Contractual Clauses. We have a data processing agreement with Supabase (Article 28 GDPR). More information: Supabase Privacy Policy and Supabase DPA.

Hostinger (website and email)

Our website (hartvoortransport.com) and outgoing system emails are hosted by Hostinger in data centres in the EU. Hostinger processes server logs and email metadata. We have a data processing agreement with Hostinger International Ltd. (Article 28 GDPR). More information: Hostinger Privacy Policy.

Bunny Fonts (fonts)

Our website loads fonts via Bunny Fonts, provided by BunnyWay d.o.o. (Slovenia, EU). To do so, your browser connects to Bunny's servers, which receive your IP address in order to deliver the font. Bunny sets no cookies for this and, according to its own statement, does not log IP addresses. We use Bunny Fonts instead of Google Fonts so that your IP address is not sent to Google when fonts load. More information: Bunny Fonts.

Google (Google Analytics 4 and Google Ads), only with your consent

If you click "Accept" in the cookie banner, we load Google Analytics 4 and Google Ads. Google then receives, among other things, your IP address, information about your browser and device, the pages you visit, the click ID of an ad and, with a request or booking, a hashed (made unreadable) email address and phone number (Enhanced Conversions). For users in the EU, the provider is Google Ireland Limited; data may be transferred to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework. Google is itself responsible for part of the processing. Without your consent we do not load these services and nothing is sent to Google. More information: Google Privacy Policy and how Google uses information from sites that use its services.

Other third parties

In exceptional cases we may share data with:

• Our bookkeeper or accountant, for our financial records
• Public authorities, if the law requires us to

5a. Live location of couriers (during a job)

While carrying out a transport order, our couriers share their GPS location with our platform via their smartphone. This is how it works:

When is the location active?

• Only from the moment the courier marks the job as "on the way" until delivery or cancellation.
• Outside an active job no location is shared, not even when the courier app is closed or the courier is logged out.

Purpose

• Performance of the contract (following the route, expected arrival time).
• Customer service: you (or our business customer) can see where your shipment is via a tracking link.
• Operational control: our planning team sees the progress of open jobs.

Who sees the location?

• You as a customer: only during the active job, via your customer portal or the tracking link you receive by email or WhatsApp.
• Our planning team: only authorised staff, to solve operational problems.
• Nobody else: we do not share courier locations with third parties and do not use them for profiling or marketing.

Retention period

• A courier's last position stays in the live tracking table for at most 10 minutes and is then deleted automatically.
• A customer tracking link expires no later than 30 days after delivery; after that the link returns no data.
• For a job that is never completed, the link expires 90 days after creation.

Legal basis

The GPS location is processed on the basis of the performance of the contract with the customer (Article 6(1)(b) GDPR) and the contract between Hart voor Transport and the self-employed courier. Couriers are informed about this processing when they register.

5b. Visitor statistics and form drafts

Our website uses two tools of our own. They work differently and have a different legal basis.

Our own visitor statistics (without cookies)

We use our own script to measure how our website is used. Without your consent, this script stores nothing in your browser. We then process:

• the page you view, the website you came from and any campaign codes (utm) in the link;
• clicks on phone, WhatsApp and email links and on buttons, how far you scroll and how long you stay on a page;
• the browser and device type, derived from what your browser sends by itself;
• the approximate country and town, derived from your IP address on our own server; your IP address is not passed to any other party for this;
• a pseudonymised code of your IP address, with which we count visits; we do not store the IP address itself in these statistics.

If you click "Accept" in the cookie banner, the following are added: a random session ID in your browser's local storage (expires after 30 minutes of inactivity), so that several tabs count as one visit, your screen width and the loading speed of the page.

We use this to count visits, see which pages and buttons work, find slow pages and errors and see how many visitors are on the site at a given moment. If you send a request or booking, we link the origin from these statistics to it (the page on which you arrived, the referring website and the campaign code), so we know which channels work. We do not share this data with third parties, do not build profiles from it and do not use it for advertising.

For the measurement without consent, the legal basis is our legitimate interest (Article 6(1)(f) GDPR); nothing is stored in your browser. You can object to it at any time. For the session ID, the screen width and the loading speed, the legal basis is your consent (Article 6(1)(a) GDPR).

Form drafts (only with your consent)

If you click "Accept" in the cookie banner, we also save what you enter in a request or booking before you send it. This allows us to help you if sending fails or if you do not complete the request: we can then contact you using the phone number, WhatsApp or the email address you entered yourself. Insofar as you enter them, this concerns:

• Pickup and delivery address or route
• Choice of vehicle
• Preferred date and time
• Your name, email address and phone number
• Company name, Chamber of Commerce number and VAT number
• A message or comment you type yourself
• Extra services you selected (for example a tail lift, a pallet jack, help with loading or unloading)
• The distance and price indication shown by the calculator

We never store passwords, IBAN, credit card or CVV details and do not link this data to external marketing files. Without your consent we store nothing of what you type; we only receive your request when you send a form.

The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time via "Cookie settings" at the bottom of every page; from that moment we no longer save new drafts. We delete existing drafts immediately at your request, and otherwise automatically after 30 days.

We treat pseudonymised data, such as a session ID or an IP code, as personal data; pseudonymisation does not release us from our obligations under the GDPR.

Phone number and email address in the price calculator

The price calculator and the booking module show the price after you have entered your phone number. We then receive your phone number, and your email address if you also enter it, together with the route (including any extra addresses), the requested time, a description of what you want transported, your name if you enter it, the chosen vehicle and the price shown, so that we can call you or send you a message or an email about this trip if you do not book straight away. The email address is optional. We automatically check whether the domain of that address (the part after the @) can receive email; only that domain is used for this. This is a step you take yourself; no cookie consent is needed for it. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). If no order follows, we delete this data after 30 days. Your browser only remembers the number while the tab is open; if you click "Accept" in the cookie banner, it also remembers it on your next visit (for at most 180 days).

Retention period

• Form drafts and their change history: at most 30 days, unless you send a request (then the periods in section 6 apply).
• Phone number, email address, name, route, time, load and price from the price calculator: at most 30 days if no order follows.
• Live visitor data (who is on the site right now): 30 days.
• Page visits, clicks and loading speed: 6 months with session ID and IP code; after that we erase those identifiers and only non-identifiable counts remain.

Your rights

You can object to the visitor statistics, withdraw your consent for form drafts and request access or deletion via info@zipload24.com. We do not build complete profiles of visitors and do not sell this data.

5c. Business email communication and deliverability

In business email communication (for example with potential business customers or partners), we may process limited technical signals to keep our email reliable.

Which signals

• The delivery status of emails we send (for example whether an email was delivered or rejected by the receiving server, a so-called bounce).
• The reason for a bounce, insofar as the receiving server provides it (for example "mailbox does not exist").
• Whether a recipient has replied or has indicated that they no longer want to receive messages.
• A simple check of business email addresses in advance (for example whether the domain can receive email), so we do not send messages to non-existent addresses.

Purpose

• Reliable business communication and error handling.
• Preventing someone from receiving several messages after an earlier message could not be delivered.
• Protecting the reputation of our email address, so our messages keep reaching other recipients.
• Respecting an opt-out: anyone who indicates that they no longer want messages is recorded and receives no further messages in that context.

Legal basis

This processing is based on our legitimate interest (Article 6(1)(f) GDPR): reliable business communication, error handling, protecting our reputation as a sender and respecting opt-outs. It concerns limited technical signals, not sensitive data.

Your rights

You can object, request access or request deletion at any time via info@zipload24.com. We record an opt-out permanently, so you receive no further messages from that context.

6. Retention periods

We do not keep your personal data longer than necessary for the purposes for which we process it. We use the following periods:

When the retention period ends, we delete or anonymise your data.

7. Your rights

Under the GDPR you have the following rights:

• Right of access: you may know which personal data we process about you and request an overview.
• Right to rectification: if your data is incorrect or incomplete, we will correct it at your request.
• Right to erasure: you can ask us to delete your data. We will do so unless the law requires us to keep it.
• Right to restriction: you can ask us to (temporarily) restrict the processing.
• Right to object: you can object to processing based on our legitimate interest, such as our visitor statistics.
• Right to data portability: you can receive your data in a common, machine-readable format and have it transferred to another party.
• Right to withdraw consent: via "Cookie settings" at the bottom of every page or by email.

You can exercise your rights via info@zipload24.com. We respond to your request within one month.

Lodging a complaint

If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl, phone +31 88 - 1805 250. If you live or work in another EU country, you can also contact the supervisory authority of that country.

8. Cookies and similar technologies

Strictly necessary (no consent required)

Some storage is necessary for the website to work: remembering your cookie choice, your session in the customer portal and temporary data in your browser that makes a form or the price calculator work while you use it. No consent is required for this (Article 11.7a(3) of the Dutch Telecommunications Act).

Our own visitor statistics (no consent required)

Without consent, our own statistics store nothing in your browser and set no cookies (see section 5b).

Only with your consent

• Google Analytics 4 (statistics): cookies _ga and _ga_*, to measure visits to and use of the website.
• Google Ads conversion measurement (account AW-389699407): cookie _gcl_au and, if you arrive via an ad, the click ID (gclid). We keep it in your browser for at most 30 days and send it along with a request, so that a request or booking can be linked to the ad click. With a request or booking we also send a hashed email address and phone number (Enhanced Conversions).
• Form drafts: see section 5b.
• Extended own statistics: a random session ID in your browser's local storage (30 minutes), screen width and loading speed (see section 5b).
• Remembering your phone number: the phone number from the price calculator in your browser's local storage (at most 180 days), so you do not have to enter it again on your next visit.

We use Google Consent Mode v2 in its basic form: as long as you have not given consent, we do not load Google's scripts and nothing is sent to Google.

Changing your choice

You can change your choice or withdraw your consent at any time via "Cookie settings" at the bottom of every page or with the button below. After withdrawal we delete Google's cookies, the click ID, the session ID and the remembered phone number from your browser and no longer save form drafts.

Change cookie settings

9. Security

We take the protection of your data seriously and take appropriate technical and organisational measures against misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification:

• Encrypted connection: all communication between your browser and our website runs over HTTPS.
• Hashed passwords: account passwords are stored with modern hashing and cannot be read, not even by us.
• Restricted access: only authorised staff have access to personal data, and only insofar as their work requires it.
• Secure storage: documents and files are stored with reputable cloud providers with appropriate security.
• Regular backups: to prevent data loss.

No method of transmission over the internet or of electronic storage is completely secure. If you suspect that your data is not properly secured or you see signs of misuse, please contact us immediately.

Data breaches

If a data breach occurs despite our measures, we act in accordance with the GDPR:

• We keep an internal register of data breaches (Article 33(5) GDPR).
• We report a breach that poses a risk to the people concerned to the Dutch Data Protection Authority within 72 hours.
• If the breach is likely to result in a high risk to your rights and freedoms, we inform you directly.

Do you suspect a data breach at our company? Report it via info@zipload24.com; we investigate your report within 24 hours.

10. Changes to this privacy statement

We may amend this privacy statement. We publish changes on this page, with the date of the last change at the top. In the event of significant changes to the way we process your data, we will actively inform you by email or with a notice on our website.

11. Contact

Do you have questions about this privacy statement or about the processing of your personal data? Please contact us: