Privacy Policy

01Who we are & scope

This Privacy Policy explains how SalesFactory OÜ - operator of the Jetsend service at jetsend.eu, the customer dashboard, and the Jetsend Returns Portal - collects, uses, shares and protects your personal data. We act as the data controller for the processing described below, in line with the EU General Data Protection Regulation (GDPR) and applicable national data-protection law.

Who this policy covers

• Registered Jetsend customers (senders and recipients of parcels).
• Visitors to jetsend.eu and our locale subpaths.
• Business contacts (partners, journalists, job applicants).

A separate Cookie Policy covers how we use cookies and similar local-storage technologies - read both for the full picture.

02Data we collect

We process four broad categories of personal data. Most of it comes directly from you when you sign up, book a shipment or contact support. Some is generated automatically by your browser or by the carrier handling your parcel.

2.1. Account data

2.2. Shipment data

2.3. Payment data

We never see your full card number. Card details are entered directly into Stripe's PCI-DSS Level 1 environment; we only receive a payment token and the last four digits.

2.4. Technical data

03How we use your data

We process personal data only when one of the six lawful bases of Article 6 GDPR applies. The table below maps each processing purpose to its lawful basis.

Provide the shipping serviceArt. 6(1)(b) - performance of a contract

Quote, book, label, track and deliver your parcels; manage your account; respond to support requests.

Comply with legal obligationsArt. 6(1)(c) - legal obligation

Invoicing, VAT/MOSS reporting, customs declarations, anti-money-laundering checks, retention of accounting records.

Prevent fraud and abuseArt. 6(1)(f) - legitimate interests

Verify identity, block prohibited content, detect payment fraud, throttle abusive requests. Balanced against your rights and freedoms.

Improve the productArt. 6(1)(a) - consent (analytics cookies)

Aggregated, IP-truncated product analytics via PostHog (EU). Disabled by default; opt-in via the cookie banner.

Marketing communicationsArt. 6(1)(a) - consent

Newsletter, feature announcements, promotional offers. Opt-in only; unsubscribe link in every email.

Defend legal claimsArt. 6(1)(f) - legitimate interests

Establish, exercise or defend legal claims in disputes, chargebacks, customs investigations, and carrier liability cases.

04Who receives your data

To run the service we rely on a small, audited set of sub-processors. Each one is bound by a written data-processing agreement, processes data only on our instructions, and is listed below. Carriers (DHL, GLS, UPS, InPost and others) act as independent controllers once the parcel is handed over.

Packlink (Auctane S.L.U.)

Spain / EU

Carrier aggregation, label issuance, tracking and customs paperwork.

Cloudflare, Inc.

EU edge

CDN, bot protection and DDoS mitigation. EU Standard Contractual Clauses.

Neon (Databricks Inc.)

EU (Frankfurt)

Managed PostgreSQL database hosting for the dashboard.

Stripe Payments Europe

Ireland

Card and SEPA payments. Stripe is an independent PCI-DSS Level 1 controller for fraud-prevention data.

Resend (Resend Inc.)

EU / US

Transactional email delivery (sign-in, receipts, shipping updates). SCCs in place.

PostHog Inc.

EU (Frankfurt)

Product analytics. IP truncated. Loaded only with analytics consent.

Vercel Inc.

EU edge

Hosting of the marketing site and dashboard front-end. Logs are short-lived.

Photon / OpenDataSoft

France

Address autocomplete and geocoding. Only the typed query is sent.

Google LLC

Ireland (EU)

OAuth sign-in for users who choose Google. Conversion tracking only with marketing consent.

4.1. Public authorities

We disclose personal data to tax authorities, customs offices, courts or law-enforcement bodies only when compelled by a valid legal instrument (Article 6(1)(c) GDPR) and only the minimum data necessary.

4.2. Business transfers

If Jetsend is acquired or merges with another company, your data may transfer to the acquirer under the same protections. We will notify you in advance via the dashboard and by email.

05International transfers

Your data is stored in the European Union by default - primarily in Frankfurt (Neon, PostHog) and on Cloudflare's EU edge. Limited transfers outside the EEA happen only when a sub-processor's parent company is established abroad (e.g. Stripe US, Resend US).

In every such case the transfer is protected by one or more of the following safeguards:

• The European Commission's adequacy decisions for the United Kingdom and Switzerland.
• The EU Standard Contractual Clauses (2021/914) plus supplementary technical measures.
• The EU-US Data Privacy Framework where the recipient is certified.

A copy of the SCCs and our Transfer Impact Assessment summary is available on request from dpo@jetsend.eu.

06How long we keep it

Retention is driven by legal duty (mainly tax and customs law) and by what is reasonably necessary to defend legal claims. Once the period below expires, data is irreversibly deleted or anonymised.

07Your rights

Under the GDPR you have the following rights over your personal data. You can exercise any of them by emailing privacy@jetsend.eu; we reply within one month (extendable by two further months for complex requests).

Access (Art. 15)

Receive a copy of the personal data we hold about you.

Rectification (Art. 16)

Correct inaccurate or incomplete data - most fields are editable in your profile.

Erasure (Art. 17)

Have your data deleted, subject to overriding legal retention duties.

Restriction (Art. 18)

Pause processing while a dispute is investigated.

Portability (Art. 20)

Export your data in a machine-readable format (JSON or CSV).

Objection (Art. 21)

Object to processing based on legitimate interests, including profiling.

Withdraw consent (Art. 7)

Withdraw analytics or marketing consent at any time without affecting prior processing.

Complain (Art. 77)

Lodge a complaint with your local supervisory authority.

The first copy of your data is free. We may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, as permitted by Article 12(5) GDPR.

08Security & breach handling

We apply technical and organisational measures appropriate to the risk, including:

• TLS 1.3 in transit; AES-256 at rest on the database and backups.
• Hardware-backed 2FA on every admin account; single sign-on via Google Workspace.
• Least-privilege access reviewed quarterly; production access logged.
• Penetration tests by an independent third party every 12 months.
• PCI-DSS Level 1 compliance for the payment pipeline (handled by Stripe).
• Vulnerability disclosure program at security@jetsend.eu.

If a personal-data breach is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours and, when the risk is high, we notify you directly without undue delay (Articles 33 - 34 GDPR).