How Hart voor Transport handles your personal data
Hart voor Transport is a courier and transport service for courier deliveries, based in Haarlem, the Netherlands. We are responsible for processing your personal data as described in this privacy statement.
| Detail | Information |
|---|---|
| Company name | Hart voor Transport |
| Address | Jan van Krimpenweg 73, 2031 CH Haarlem, the Netherlands |
| Chamber of Commerce (KvK) number | 42078890 |
| VAT number | NL869609075B01 |
| Email general | info@hartvoortransport.com |
| Email invoices | facturen@hartvoortransport.com |
| Phone | 06 1508 1713 (international: +31 6 1508 1713) |
| Website | hartvoortransport.com |
Hart voor Transport has not appointed a Data Protection Officer (DPO), because our organisation does not meet the criteria of Article 37 GDPR (we are not a public authority, large-scale systematic monitoring is not our core activity, and we do not carry out large-scale processing of special categories of personal data). For all privacy-related questions you can contact our internal privacy officer at info@hartvoortransport.com. We will respond to your request within 30 days at the latest.
Depending on how you use our services and your relationship with us, we may collect and process the following personal data:
For every job we digitally collect the consignment note in accordance with the requirements of the CMR Convention and the Additional Protocol to the CMR Convention concerning the electronic consignment note (eCMR Protocol). This includes:
X-eCMR-PDF-Hash HTTP header in your download)The basis for this processing is performance of a contract (Art. 6(1)(b) GDPR) — we need this data to carry out your transport order in a legally conclusive manner — and legitimate interest (Art. 6(1)(f) GDPR): evidentiary position in the event of a delivery dispute. For senders/consignees who are not customers of ours themselves, the processing takes place within the framework of the contract between HVT and the booking party (customer).
We process your personal data for the following purposes:
We process your personal data on the basis of the following legal grounds under the General Data Protection Regulation (GDPR):
When you place a transport order with us, we process your data in order to carry out the order. This includes calculating the price, scheduling the job, sharing your pick-up and delivery address with the courier, and handling the payment.
We process certain data on the basis of our legitimate interest, including improving our services, securing our platform and preventing fraud. In doing so, we always take your privacy interests into account.
We are legally obliged to retain some data, for example for tax administration. We retain financial data in accordance with the statutory retention period of 7 years.
In some cases we ask for your consent, for example to send newsletters or marketing messages. You can withdraw this consent at any time.
We only share your personal data with third parties where this is necessary for our service provision or where we are legally obliged to do so. We never sell your data to third parties.
In order to carry out your transport order, we share your pick-up and delivery address, contact details and relevant information about the load with the courier who carries out the order. This is necessary for the performance of the contract.
We use Mapbox for route calculation and geocoding in our price calculator. When you enter an address, it is processed via the Mapbox API to calculate the route and distance. Mapbox thereby receives the address entered and your IP address. Mapbox is based in the United States and is certified under the EU-US Data Privacy Framework (DPF); transfers take place on the basis of this adequacy decision. We have concluded a data processing agreement with Mapbox in accordance with Article 28 GDPR. More information: Mapbox Privacy Policy and Mapbox DPA.
We use Cloudinary to store and process documents and images relating to transport orders, such as photos of loads or insurance policy schedules. Cloudinary processes these files on secure servers. Cloudinary is based in the United States and is certified under the EU-US Data Privacy Framework. We have concluded a data processing agreement with Cloudinary in accordance with Article 28 GDPR. More information: Cloudinary Privacy Policy and Cloudinary DPA.
For our invoicing we use Moneybird. Your name, address details, email address and invoice details are processed in Moneybird in order to prepare and send invoices. Moneybird B.V. is a Dutch party; no transfer to third countries takes place. We have a data processing agreement with Moneybird in accordance with Article 28 GDPR.
We use WhatsApp to communicate with customers and couriers. When you contact us via WhatsApp, your messages and phone number are processed by Meta. Meta Platforms, Inc. is based in the United States and is certified under the EU-US Data Privacy Framework. We only initiate WhatsApp communication when you take the initiative yourself or when this is necessary for an ongoing order.
Online payments via iDEAL or similar methods are processed by Mollie B.V. (the Netherlands). Mollie receives your name, email address, payment amount and a reference to your job. From Mollie we only receive the status of your payment and no full bank details. Mollie is a Dutch party; no transfer to third countries takes place. We have a data processing agreement with Mollie in accordance with Article 28 GDPR. More information: Mollie Privacy Statement.
Our customer and courier platform (app.hartvoortransport.nl) runs on Railway as a hosting provider. Railway processes technical logs and data necessary to run the application. Railway, Inc. is based in the United States; transfers take place on the basis of the Standard Contractual Clauses (SCCs) as established by the European Commission. We have a data processing agreement with Railway in accordance with Article 28 GDPR. More information: Railway Privacy Policy and Railway DPA.
Our platform database runs on Supabase (PostgreSQL) on servers within the EU. It holds order, user and session data. Supabase Inc. is based in the United States, but the data is processed in the EU; for any transfer to the US the Standard Contractual Clauses (SCCs) apply. We have a data processing agreement with Supabase in accordance with Article 28 GDPR. More information: Supabase Privacy Policy and Supabase DPA.
Our public website (hartvoortransport.com) and outgoing system emails are hosted by Hostinger in data centres within the EU. Hostinger processes server logs and email metadata. We have a data processing agreement with Hostinger International Ltd. in accordance with Article 28 GDPR. More information: Hostinger Privacy Policy.
In exceptional cases we may share data with:
While carrying out a transport order, our couriers share their GPS location with our platform via their smartphone. Below we explain exactly how this works.
Processing of GPS location takes place on the basis of performance of the contract (Article 6(1)(b) GDPR) towards the customer and on the basis of the contract between Hart voor Transport and the self-employed courier. Couriers are informed about this processing upon registration.
To make our request flow work properly, we may process limited technical visitor data and temporarily entered form data during your visit to the website. Below we explain what this involves.
Form data entered along the way — only when you enter it yourself and only insofar as it is relevant to the request — may include, among other things:
We do not store passwords, IBAN, credit card or CVV data via this visit data, and we do not link this data to external marketing databases.
This processing takes place on the basis of our legitimate interest (Article 6(1)(f) GDPR): making the request flow function correctly, security, fraud prevention and customer service for incomplete requests. In a proportionality assessment we have taken into account the limited sensitivity of this data, the short retention period and your right to object.
We treat pseudonymised data (such as a session ID linked to an IP address and browsing behaviour) as personal data; pseudonymisation does not release us from our GDPR obligations.
You can object to this processing at any time, request access to your data or request its deletion. Send an email to info@hartvoortransport.com. We do not build full profiles of visitors and do not use this data for marketing or advertising purposes.
In business email communication (for example with potential business customers or business partners) we may process limited technical signals to keep our email communication dependable.
This processing takes place on the basis of our legitimate interest (Article 6(1)(f) GDPR): dependable business communication, error handling, reputation protection and respecting opt-outs. This concerns limited technical signals, not sensitive personal data.
You can object at any time, request access or request deletion via info@hartvoortransport.com. We record an opt-out permanently so that you no longer receive any follow-up messages from this context.
We do not retain your personal data for longer than is necessary for the purposes for which it is processed. We apply the following retention periods:
| Type of data | Retention period |
|---|---|
| Financial data and invoices | 7 years (legal obligation) |
| Contact details of customers | 2 years after the last contact or order |
| Contact details of couriers | 2 years after the end of the cooperation |
| Transport order data | 3 years after completion of the order |
| Documents (insurance policy schedules, identity documents) | 2 years after the end of the cooperation |
| Website visit data (IP address, logs) | 6 months |
| Communication via email/WhatsApp | 2 years after the last contact |
| Live GPS location of courier (during a job) | a maximum of 10 minutes in the live tracking table |
| Tracking link after delivery | 30 days after delivery, invalid thereafter |
| Tracking link for an uncompleted job (fallback) | 90 days after creation of the job |
| Session and visit pings (visitor tracking) | 30 days |
| Form drafts (request entered along the way) | 30 days, unless transferred to an order |
| Form draft history (audit log of changes) | 30 days |
Once the retention period has expired, your data is deleted or anonymised.
Under the GDPR you have the following rights in relation to your personal data:
To exercise your rights, you can contact us at info@hartvoortransport.com. We respond to your request within 30 days.
Do you disagree with the way we handle your data? Then you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP). You can get in touch via autoriteitpersoonsgegevens.nl or by calling +31 88 1805 250.
Our website uses functional cookies and session storage that are necessary for the site to function correctly. Examples: remembering session data in the customer portal, storing your cookie choice, and a technical session ID that allows our request flow to work across multiple steps and form drafts to be restored after a browser refresh (see section 5b). Under the Dutch Telecommunications Act, no consent is required for these functional cookies and session storage.
When you accept our cookie banner, we place analytical cookies from Google Analytics 4 to measure visitor behaviour on our own website and improve the site. For this we use Google Consent Mode v2: as long as you have not given consent, no analytical cookies are placed and no identifiable data is sent to Google.
You can withdraw your choice at any time by clearing the cookies in your browser or by clicking "Decline" in the banner that reappears. Google Analytics is a service of Google LLC (United States) which processes personal data under a data processing agreement and appropriate safeguards (EU-US Data Privacy Framework). More information: Google Privacy Policy.
We do not place advertising cookies on this website and we do not use techniques that track your browsing behaviour on other websites.
We take the protection of your data seriously and apply appropriate technical and organisational measures to prevent misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification. We have taken the following measures:
Despite these measures, no method of transmission over the internet or electronic storage can be guaranteed to be 100% secure. If you suspect that your data is not properly secured or there are indications of misuse, please contact us immediately.
If, despite our measures, a data breach occurs, we act in accordance with the General Data Protection Regulation:
Do you suspect a data breach at our end? Report it via info@hartvoortransport.com — we investigate your report within 24 hours.
We reserve the right to amend this privacy statement. Changes are published on this page, stating the date of the last update. We recommend that you consult this page regularly so that you are aware of any changes.
In the event of significant changes that affect the way we process your data, we will actively inform you by email or via a notice on our website.
Do you have questions about this privacy statement or about the processing of your personal data? Then please contact us:
| Hart voor Transport |
| Jan van Krimpenweg 73, 2031 CH Haarlem, the Netherlands |
| Email: info@hartvoortransport.com |
| Phone: 06 1508 1713 |
| KvK: 42078890 |