Privacy Policy

1. Introduction and our role

1.1. This Privacy Policy explains how the operator of the Pereviz.Net platform identified in Section 12 (the “Provider”, “we”, “us”) processes personal data in connection with the websites Pereviz.Net and VanMove.net and their subdomains, the courier workspace, the customer portal and related services (the “Service”). Pereviz.Net and VanMove.net are two names of the same Service provided by us; this Privacy Policy applies in the same way whichever of these websites and names you use. It applies to Users of the Service (Couriers and Customers, as defined in the Terms of Service), to visitors of our websites and to individuals whose data Users enter into the Service, such as senders and recipients of parcels.

1.2. We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), the UK GDPR and the UK Data Protection Act 2018, and the Law of Ukraine No. 2297-VI “On Personal Data Protection” of 1 June 2010, to the extent each of them applies.

1.3. We are the controller (owner of personal data) for the data of account holders, location data, billing data, support requests and technical data (Sections 2.1 and 2.3–2.6).

1.4. We are a processor (manager of personal data) for Shipment Data and other data that Couriers enter about their Customers, senders, recipients and staff (Section 2.2). For that data, the Courier who entered it is the controller and decides why and how it is processed; we process it only on the Courier's instructions under Section 7 of the Terms of Service. If a Courier has entered your data into the Service, please address your requests to that Courier first; we will help the Courier to respond.

2. Personal data we process

2.1. Account data: the email address of your Google account, which Google passes to us when you sign in with Google; your name and other profile details you enter; your company workspace, role and permissions; your language preference; and, if you connect the Telegram bot, the identifier of your Telegram chat. If you turn on notifications on a device, we also keep that device's push subscription, namely an address issued by the push service of the device's browser and its encryption keys, until you sign out on that device or turn notifications off.

2.2. Shipment Data entered by Users: names of senders and recipients, their phone numbers, email addresses, postal addresses, cities and postcodes, countries of origin and destination, geographic coordinates, selected pick-up and drop-off points, tracking numbers, parcel statuses and their history, amounts collected and payment marks, notes, photos and files, and messages exchanged about the parcel.

2.3. Location data: if you allow your browser to share the location of your device, it is used to show your position on the map and as the starting point for building a route.

2.4. Billing data: your balance, tariffs, charges and payment transactions. Payment card details are processed only by payment service providers (Section 6).

2.5. Communications: messages you send through the support form, together with the page from which you send them.

2.6. Technical data: IP address, browser and device information, date and time of requests and other technical system logs; authentication tokens, namely the access token issued by Google, which is used during sign-in to confirm your email address, and the access token of your session in the Service; and the data stored in your browser described in Section 9.

2.7. The Service is not designed to process special categories of personal data, such as data concerning health, religious beliefs or political opinions, and Users must not enter such data.

3. Purposes and legal bases

• Providing the Service, creating and managing accounts and signing you in: performance of a contract (Article 6(1)(b) GDPR).
• Processing Shipment Data on behalf of Couriers: on the Courier's instructions; the Courier is responsible for having a legal basis, usually the performance of its contract with the sender or the recipient.
• Billing, payments and accounting: performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations (Article 6(1)(c) GDPR).
• Answering support requests: performance of a contract (Article 6(1)(b) GDPR).
• Keeping the Service secure, preventing abuse and fraud, troubleshooting and optimising performance: our legitimate interests (Article 6(1)(f) GDPR).
• Complying with legal obligations and responding to legally binding requests of authorities: compliance with legal obligations (Article 6(1)(c) GDPR).

Under the Law of Ukraine “On Personal Data Protection”, the corresponding grounds are the conclusion and performance of a contract, a duty imposed on us by law, and our legitimate interests (Article 11 of that Law).

We do not use personal data for advertising, for profiling, or for automated decision-making that produces legal or similarly significant effects for you.

4. Storage limitation and data retention

4.1. Automatic deletion after 7 days. Shipment Data of each parcel is automatically, permanently and irreversibly deleted 7 days after the status of the parcel is changed to “Delivered”. The deletion covers the names, phone numbers, email addresses, postal addresses and geographic coordinates of senders and recipients, notes, photos and files, messages exchanged about the parcel, and the full status and tracking history of the parcel. The parcel's entries in the activity journal (Section 4.4) are not deleted with it but reduced to anonymous records of what was done, by which User account and when, containing no Shipment Data. The deletion is performed by the system without human intervention, and deleted data cannot be restored.

4.2. Why we do it. The mechanism puts into practice the principles of data minimisation and storage limitation (Article 5(1)(c) and (e) GDPR) and data protection by design and by default (Article 25 GDPR): once a delivery is completed, we do not keep personal data that is no longer needed. Data that no longer exists cannot be lost, stolen or misused, so the mechanism minimises both the risk and the impact of any data breach.

4.3. Technical logs. Technical system logs are rotated daily and kept for 30 days. The logs, including the full requests transmitted to carriers, may contain parts of Shipment Data.

4.4. Other data is kept as follows:

• Shipment Data of parcels that never reach the “Delivered” status, such as cancelled or declined parcels, is kept while the Courier's account remains active;
• account data and support messages are kept while the account remains active and are deleted after it is closed;
• billing and accounting records are kept for the periods required by Ukrainian tax and accounting law;
• the activity journal, which records what Users do in a Courier's workspace, by whom and when, is kept for 180 days and then deleted, anonymous records under Section 4.1 included;
• data covered by a legally binding preservation order received before its deletion is kept for as long as that order requires.

4.5. Copies of Shipment Data stored on Users' devices for offline work are removed at the device's next synchronisation after the deletion and when the User signs out on that device. When a User chooses to sign out, changes not yet sent are discarded after a warning. A device that never reconnects to the Service keeps its copy. Data exported by Users and data transmitted at a User's request to the third parties listed in Section 5.2 are not covered by the automatic deletion.

5. Data sharing and disclosures

5.1. We do not sell, rent or trade personal data and do not share it for advertising.

5.2. We share personal data only with the following recipients and only to the extent necessary:

• hosting and infrastructure providers that store and run the Service on our behalf;
• Google (Google LLC and its affiliates): sign-in with Google; maps and route building, for which Google Maps Platform receives the addresses and coordinates of the stops and the starting point of a route; web fonts on some public pages;
• Telegram: if a User connects the Telegram bot, notifications and messages are delivered through Telegram;
• browser push services (Google, Apple, Mozilla and Microsoft): if a User has turned on notifications on a device, an encrypted notification carrying a parcel's tracking number is delivered through the push service of that device's browser;
• Nova Poshta: when a User requests a waybill or a shipment through the integration, the sender and recipient data needed for it is transmitted to Nova Poshta, which processes it as an independent controller under its own terms;
• payment service providers (for example, Payoneer or Stripe), which process payment data as independent controllers (Section 6);
• within a company workspace, the Courier's staff according to the roles assigned by its administrator, and the Customer to whom a parcel relates.

5.3. Disclosure to authorities. We disclose personal data to public authorities only on receipt of a valid and legally binding court order, warrant or other binding decision issued by a competent Ukrainian authority, or by a foreign or international law enforcement authority through procedures recognised by the law of Ukraine (such as international legal assistance), and only if the request is received before the data is deleted by the automated deletion cycle. We check the validity of each request, disclose only the data that is strictly required and, where the law allows, inform the User concerned.

5.4. Once data has been purged by the automated deletion cycle, we have no means of retrieving it and therefore cannot disclose it to anyone, including law enforcement authorities.

5.5. In a reorganisation, merger or transfer of the business, personal data may be transferred to the successor, which will continue to process it in accordance with this Privacy Policy.

5.6. International transfers. We are established in Ukraine, and our service providers may process data in other countries, including the United States. Where personal data of individuals in the European Economic Area or the United Kingdom is transferred to a country without an adequacy decision, the transfer relies on appropriate safeguards, such as the standard contractual clauses approved by the European Commission, the UK International Data Transfer Addendum or, for certified recipients, the EU-U.S. Data Privacy Framework.

6. Payment processing

6.1. Payments for the Service are processed by third-party payment service providers (for example, Payoneer or Stripe) that comply with the Payment Card Industry Data Security Standard (PCI DSS).

6.2. Payment card details are entered directly into the systems of the payment service provider and are never transmitted to or stored on our servers. We receive only the information needed to record the payment, such as the amount, currency, date, status and transaction identifier.

6.3. Payment service providers process payment data as independent controllers under their own privacy policies.

7. Security

7.1. We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (HTTPS), role-based access control within company workspaces, sign-in through Google, limiting staff access to what is necessary, and the automatic deletion described in Section 4.

7.2. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the competent supervisory authority, the affected Users and, where required, the data subjects, in accordance with Articles 33 and 34 GDPR and the law of Ukraine.

8. Your rights

8.1. Subject to the conditions of applicable law, you have the right to:

• access your personal data and receive a copy of it;
• have inaccurate or incomplete data rectified;
• have your data erased (the “right to be forgotten”), including by deleting your account;
• restrict the processing of your data;
• data portability;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, where processing is based on consent.

8.2. Under the Law of Ukraine “On Personal Data Protection”, you also have the rights set out in Article 8 of that Law.

8.3. To exercise your rights, contact us using the details in Section 12. We will respond within one month; where necessary, taking into account the complexity and number of requests, this period may be extended by two further months. We may ask you to confirm your identity.

8.4. Requests concerning Shipment Data should be addressed to the Courier who entered it, as the controller of that data; we will assist the Courier. Because Shipment Data is deleted 7 days after delivery, after that time we no longer hold it and cannot provide access to it or a copy of it.

8.5. You have the right to lodge a complaint with a supervisory authority: in the European Union, with the authority of the member state of your habitual residence, place of work or place of the alleged infringement; in the United Kingdom, with the Information Commissioner's Office; in Ukraine, with the Ukrainian Parliament Commissioner for Human Rights.

9. Cookies and data stored in your browser

9.1. We use only cookies and browser storage that are strictly necessary for the Service to work: a session cookie and a security (CSRF) cookie; a cookie that remembers your chosen language for one year; the access token of your session, kept in the browser's local storage; and, in the courier workspace, local copies of data in the browser's storage for offline work.

9.2. We do not use advertising or analytics cookies, so we do not ask for consent to cookies. Maps embedded in the Service are provided by Google and are subject to Google's privacy policy. You can delete stored data in your browser settings; you will then be signed out of the Service.

10. Children

The Service is intended for persons aged 18 and over. We do not knowingly accept children as Users of the Service.

11. Changes to this Privacy Policy

11.1. We may update this Privacy Policy. The new version is published on this page with a new effective date, and material changes are announced in the Service in advance.

11.2. This Privacy Policy is published in several languages. In the event of any discrepancy, the English version prevails.

12. Contact details

Controller: [Operator: legal form, full name, registration code and address]

Email for privacy requests: [contact e-mail]

Users of the courier workspace may also contact us through the “Support and feedback” form in the Service.