Privacy Policy

Velaphi Logistics B.V. ("Velaphi", "we", "us") operates the shipping rate comparison and booking platform available at velaphi.co. We are the data controller for personal data processed through the platform.

We are registered in the Netherlands and operate under the EU General Data Protection Regulation (GDPR) and, where applicable, the South African Protection of Personal Information Act (POPIA).

Contact us at: hello@velaphi.co

We collect the following categories of personal data:

• Account data: first and last name, email address, phone number, company name, company registration number, VAT number, country.
• Address data: ship-from and ship-to addresses (street, city, province, postal code, country, contact name).
• Shipment data: parcel dimensions and weight, carrier selection, tracking references, shipment status, commercial invoice details for international shipments.
• Billing and payment data: wallet balance and top-up history, Stripe customer ID, subscription plan. We do not store full card numbers — payment card data is handled entirely by Stripe.
• Organisation data: if you use organisation features, we store the organisation name, slug, country, VAT number, member email addresses, and roles.
• Usage data: pages visited, API key usage, browser type, and IP address (collected by our hosting and analytics infrastructure).
• Communications: content of messages you send us via the contact form or feedback form.

We use your personal data to:

• Create and manage your account and authenticate you.
• Calculate and display shipping rates from partner carriers.
• Book shipments with carriers on your behalf.
• Process wallet top-ups and manage your wallet balance.
• Send shipment confirmation emails and transactional notifications.
• Generate monthly shipping cost statements.
• Provide customer support and respond to feedback.
• Maintain the security, integrity, and performance of the platform.
• Comply with legal obligations (e.g. financial record-keeping).
• Send service updates and product news (you may opt out at any time).

We rely on the following legal bases:

• Contract performance (Art. 6(1)(b)): processing necessary to provide the shipping platform services you signed up for.
• Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, product improvement, and aggregated analytics.
• Legal obligation (Art. 6(1)(c)): retaining financial records for statutory periods.
• Consent (Art. 6(1)(a)): marketing emails and newsletter. You may withdraw consent at any time by contacting us.

We share data with the following processors solely to deliver our services:

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

Where personal data is transferred outside the European Economic Area (EEA), we rely on the European Commission's Standard Contractual Clauses (SCCs) to ensure an adequate level of protection.

• Account data: retained for the duration of your account plus 30 days after deletion to allow recovery, then permanently erased.
• Shipment records: retained for 7 years to comply with EU accounting and tax regulations.
• Payment records: retained for 7 years in line with financial record-keeping obligations.
• Contact and feedback messages: retained for up to 2 years, then deleted.
• Newsletter subscriptions: retained until you unsubscribe.

Under GDPR (EU users) and POPIA (South African users), you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), subject to legal retention obligations.
• Restrict processing in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent for any consent-based processing at any time.
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or the South African Information Regulator at inforegulator.org.za.

To exercise any right, contact us at hello@velaphi.co. We will respond within 30 days.

We implement industry-standard security measures including TLS encryption in transit, encrypted storage at rest, role-based access controls, and regular dependency updates. Payments are handled by Stripe and are never processed through our servers. Despite these measures, no system is completely secure; we encourage you to use a strong, unique password and notify us immediately of any suspected unauthorised access.

We use only essential session cookies required for authentication and security. We do not use third-party tracking cookies, advertising cookies, or behavioural analytics cookies. Our hosting provider (Vercel) may set minimal technical cookies for load balancing.

Velaphi is a business-to-business (B2B) platform intended solely for use by companies and their authorised employees. We do not knowingly collect personal data from individuals under the age of 18.

We may update this Privacy Policy from time to time. We will notify registered users by email at least 14 days before material changes take effect. The effective date at the top of this page reflects the most recent version.

For privacy-related queries, requests, or complaints:
Velaphi Logistics B.V.
Email: hello@velaphi.co