Privacy Policy
Draft for lawyer review. Version 0.2, 2026-11-11. Square brackets are placeholders or business decisions.
This policy explains how COMPANY LEGAL NAME, LEGAL FORM, ADDRESS ("U-Packed", "we") processes personal data when you use the U-Packed website, apps and services. We are the controller under the EU General Data Protection Regulation (GDPR).
Contact for privacy questions: PRIVACY EMAIL. Data protection officer: NAME AND CONTACT, or "not appointed".
1. What we process, why, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account | Email, name, password (stored only as a hash), country, phone number, address, profile picture, account status, sign-in records (codes and sessions are stored hashed and expire) | Art. 6(1)(b) contract |
| Publish trips and make bookings | Trip route, times, available weight, notes, trunk photo. For bookings: what is sent, weight, declared value, message, pickup and delivery address, package photo, price, status history, Receiver's name and phone number | Art. 6(1)(b) contract |
| Deliver the package | Delivery code (derived on demand, not stored), Receiver details, delivery confirmation and timestamps | Art. 6(1)(b) contract |
| Payments | Amounts, payment and refund references, payout status. Card and bank details go directly to Stripe, we never see them | Art. 6(1)(b) contract, Art. 6(1)(c) legal obligations (accounting) |
| Chat | Messages between the two people of a booking | Art. 6(1)(b) contract |
| Notifications | Inbox entries, emails and push notifications about your bookings, trip alerts you ask for, device tokens for push | Art. 6(1)(b) contract. Push needs your permission on your device (Art. 6(1)(a)) |
| Trip alerts | Routes you save | Art. 6(1)(b) contract (a feature you ask for) |
| Reviews, blocking, reports | Ratings and comments, blocks you set, reports you file or that concern you | Art. 6(1)(f) legitimate interest in trust and safety |
| Safety, fraud prevention and disputes | Account and booking records, strikes for late cancellations, staff decisions and an audit log of staff actions, IP addresses in server logs and rate limits | Art. 6(1)(f) legitimate interest in protecting users and the Platform |
| Legal obligations | Records needed for tax, accounting and reporting duties, including platform reporting of seller income (EU Directive 2021/514, DAC7), and answers to authorities | Art. 6(1)(c) |
| Operating and securing the service | Server logs (IP address, time, request), error logs | Art. 6(1)(f) legitimate interest in secure operation |
| Location (Journey Loop) | If the app uses device location to notice that you landed near an airport: it is used on your device and only with your permission. The API receives the airport you choose, not your position. | Art. 6(1)(a) consent |
We do not use your data for advertising, we do not sell it, and we do not make decisions about you that have legal effect solely by automated means. Search results are ordered by simple rules (filters, departure date, price). Rate limits block repeated failed sign-ins automatically.
2. Third-party data
When you book, you give us the Receiver's name and phone number, and sometimes pickup and delivery addresses of other people. Only do this if you may, and tell the Receiver. We use these details only to deliver your package and show them to the Carrier of that booking.
3. Who receives your data
- Other users. The Carrier of your booking sees what is needed to carry the package: description, weight, declared value, addresses, Receiver details, your name and rating. Other users see your public profile: name, country, member since, rating, and reviews.
- Service providers (processors) acting on our instructions under data processing agreements:
- Hosting and database: PROVIDER, EU REGION.
- File storage for photos: PROVIDER, EU REGION. Files are private and shared through short-lived links.
- Email and SMS: Brevo (Sendinblue SAS), France.
- Push notifications: Google Ireland Limited / Google LLC (Firebase Cloud Messaging): device token, notification text.
- Route distance: Google (Maps Platform): the coordinates of a trip's start and end, without your name.
- Error monitoring: PROVIDER, if used.
- Payment service provider. Stripe Payments Europe, Ltd. (Ireland) processes payments and Carrier payouts and checks identities under financial regulation. For this, Stripe is an independent controller. See Stripe's privacy policy.
- Authorities and advisers where the law requires or to defend legal claims, for example tax authorities.
- Business transfers if we are sold, under the same protections.
4. Transfers outside the EU/EEA
Some providers (Google, Stripe, Brevo's sub-processors) may process data outside the EEA, in particular in the United States. We rely on the EU-US Data Privacy Framework where the provider is certified, otherwise on EU Standard Contractual Clauses plus additional safeguards.
A Carrier or Receiver may be located outside the EEA, for example in Bangladesh. When you book a trip to such a country the booking details are sent there because it is necessary to carry out the contract you requested (Art. 49(1)(b) GDPR). The protections of the GDPR may not apply there in the same way.
5. How long we keep data
- Account data until you delete your account. Deleting erases your personal data (name, email, phone, address, avatar, saved routes, notifications, device tokens, blocks and sign-in data) and ends all sessions.
- Booking, payment and trip records are kept after account deletion, with your identity removed ("Deleted user"), as long as needed for the other person's records, for tax and accounting law and for legal claims. Accounting records are kept for the statutory period: 6 to 10 years, depending on the country.
- Chat messages are erased 12 months after the booking ends.
- Delivery details of a booking (delivery and pickup address, the contact person's name and phone number, your message, the handover note and any dispute text) are erased 6 months after the booking ends. The booking itself, its price and its status stay for accounting.
- Server and error logs are kept for 30 days.
- Audit log of staff actions, including every time staff open a conversation, is kept for 3 years.
- Unfinished uploads are deleted after 24 hours.
- Reports and the notes on how we resolved them are erased 3 years after they are closed, to detect repeat abuse. Open reports are kept until they are closed.
6. Your rights
You have the right to: access your data and get a copy (in the app: Profile, "Export my data"); rectify wrong data (edit your profile); erase your data ("Delete my account", unless the law requires us to keep records); restrict processing; data portability (the export is machine-readable JSON); object to processing based on our legitimate interests, on grounds relating to your situation; and withdraw consent at any time without affecting earlier processing (for example turn off push notifications on your device).
To use a right you cannot use in the app, write to PRIVACY EMAIL. We answer within one month. We may ask you to confirm your identity.
You have the right to complain to a supervisory authority, in particular in the EU country where you live, work or where an infringement took place. Our lead authority is AUTHORITY, e.g. the data protection authority of the company's federal state.
7. Website cookies and device storage
The U-Packed website uses only what it needs to work: a session cookie (secure, HTTP-only, sealed) that keeps you signed in, a language cookie and your colour-mode setting stored on your device. None of these tracks you across sites, and no consent banner is needed for them. If analytics, advertising or other trackers are ever added, we will ask for your consent first.
8. Security
We use encrypted connections, store passwords and tokens only as hashes, give staff access on a need basis and record it, keep photos in private storage with short-lived links, and limit repeated sign-in attempts. No system is perfectly secure. If a breach puts your rights at risk we notify you and the authority as the law requires.
9. Age
U-Packed is for adults. We do not knowingly process data of people under 18. Tell us if you believe a minor has an account and we will delete it.
10. Changes
We will update this policy when our processing changes and tell you about important changes in the app or by email.