Privacy Statement

• Data controller: Droppr BV
• Registered office: Watertorenstraat 8, bus 11, 9300 Aalst
• Company number: 1020.116.732
• Contact: info@droppr.be

This privacy statement explains how Droppr BV processes personal data in connection with Droppr Network.

Droppr Network is a digital network platform for professional parties in the logistics and transport sector. Through the platform, members can register, upload documents, manage compliance information, have verifications carried out, manage network relationships and support professional collaboration.

This privacy statement applies to personal data relating to, among others, platform users, contact persons, directors, employees, drivers, subcontractors and other natural persons whose data is processed via Droppr Network.

2. What personal data do we process?

Droppr Network may process the following personal data, among others:

2.1 Account and contact details

• name
• email address
• telephone number
• job title
• company or organisation
• user role
• login and account details
• communication with Droppr or other members via the platform

2.2 Professional and business-related data

• details of contact persons, directors or representatives
• company data insofar as it can be traced back to natural persons
• data on network relationships, roles and access rights
• data required for registration, verification and account management

2.3 Compliance and transport documents

Depending on the specific situation, members may upload or manage documents such as:

• transport permits
• insurance certificates
• CMR or carrier liability insurance
• RSZ or tax certificates
• identity or representation documents
• category C/CE driving licence
• Code 95
• driver card
• A1 documents
• IMI or posting documents
• work permits, single permits or residence documents where relevant
• other documents necessary for transport compliance, chain liability, legal checks or professional collaboration

2.4 Compliance statuses, flags and verification data

Droppr Network may process statuses, labels, indicators or flags such as:

• document present / missing
• valid / expired
• compliant / non-compliant
• review required
• unreadable document
• inconsistency identified
• possible risk indicator
• check date
• expiry date
• verification status

These statuses and indicators support the compliance flow and document checks within the platform.

2.5 Technical data and logs

Droppr may process technical data such as:

• IP address
• login times
• audit logs
• document uploads
• changes to documents or statuses
• access and usage data
• security logs
• error messages and support information

This data is required for security, logging, fraud prevention, support and the proper functioning of the platform.

3. What do we use this data for?

Droppr processes personal data for the following purposes:

• creating and managing accounts
• providing access to Droppr Network
• managing professional network relationships
• supporting document management and compliance processes
• checking the presence, validity and completeness of documents
• supporting transport compliance, chain liability, posting obligations and other legal or contractual verification obligations
• displaying compliance statuses, labels or indicators within permitted network relationships
• detecting missing, expired, unreadable or inconsistent documents
• supporting users in correcting or supplementing documents
• securing the platform
• preventing and investigating misuse, fraud, unauthorised access or illegal content
• providing support
• invoicing and customer management
• complying with legal obligations
• improving the operation, reliability and security of the platform

4. Do we use AI or automated document extraction?

Yes. Droppr Network may use automated document extraction via Google Cloud / Google Document AI or similar technologies.

Users upload documents to the Droppr platform. These documents may then be automatically read to identify relevant data, such as document type, name, document number, expiry date, company, driver or other compliance data.

This automated extraction supports checks on completeness, validity and possible inconsistencies. The technology is used as a tool within the compliance flow.

Automated document extraction does not automatically lead to definitive exclusion from the platform. When a document is missing, expired, unreadable or non-compliant, the user is notified and may upload a corrected or new copy.

In cases of doubt, dispute, possible errors or risk indicators, human review may take place before definitive negative consequences are attached to a status or flag.

5. Are compliance statuses or risk indicators used?

Yes. Droppr Network may use compliance statuses, labels, indicators or flags to indicate whether documents are present, valid, expired, incomplete, unreadable or possibly inconsistent.

These statuses and flags are intended to support members in document management, compliance checks and professional collaboration.

An automated status or flag does not automatically mean that a member is definitively excluded from the platform. In the first instance, the member concerned is given the opportunity to correct or supplement missing, incorrect or outdated documents.

In cases of dispute, doubt or possible incorrect assessment, a human review may be carried out.

6. On what legal bases do we process personal data?

Droppr processes personal data only where a valid legal basis exists. Depending on the specific processing, Droppr may rely on:

6.1 Performance of a contract

• account management
• access to the platform
• provision of platform services
• support
• invoicing
• management of users and network relationships

6.2 Legal obligation

• accounting and tax obligations
• legal compliance obligations
• obligations in the context of chain liability, illegal employment, posting or transport regulations, where applicable

6.3 Legitimate interest

• security of the platform
• logging and fraud prevention
• evidence purposes
• support of compliance processes
• management of professional network relationships
• monitoring for misuse or unlawful content
• improvement of the platform

For these processing activities, Droppr balances its interests against the rights and freedoms of data subjects.

6.4 Consent

In certain cases, Droppr may request consent, for example for certain marketing communications or non-essential cookies. Where processing is based on consent, that consent may be withdrawn at any time.

7. Who is responsible for uploaded data?

Each customer, carrier, subcontractor or other member is in principle itself responsible for the data and documents it uploads to Droppr Network concerning its own organisation, employees, drivers, subcontractors or partners.

Members must ensure that the data they upload is accurate, up to date, complete and lawfully obtained. They must also have the necessary information obligations, consents or legal bases when uploading personal data relating to other natural persons.

Droppr is responsible for the platform, security, technical processing, document structure, status logic, logging and the manner in which compliance statuses, notifications or flags are processed and displayed within the platform.

Depending on the specific use case, Droppr may act as data controller, processor or separate data controller for certain platform functionalities.

8. With whom do we share personal data?

Personal data may be shared with:

• the member uploading the data
• authorised users within the same organisation
• other members within permitted network relationships
• Droppr staff or support personnel who require access
• hosting and cloud providers
• Google Cloud / Google Document AI for document extraction
• IT, security and software providers
• accounting, legal or professional advisers
• public authorities or regulators where legally required

Droppr does not share personal data without restriction. Access is limited on the basis of roles, rights and necessity.

Where possible, the full document is not displayed, but only a status, expiry date, check date or other limited metadata.

9. Is data processed outside the European Economic Area?

Droppr seeks to process personal data within the European Economic Area as far as possible.

Where personal data is nevertheless processed by providers outside the European Economic Area or where access from outside the EEA is possible, Droppr implements appropriate safeguards, such as contractual arrangements, processor agreements, standard contractual clauses or additional security measures where necessary.

10. How long do we retain personal data?

Droppr retains personal data and documents no longer than necessary for the purposes for which they are processed.

Retention periods are determined on the basis of account management, active collaboration, compliance checks, legal obligations, chain liability, transport regulations, tax and accounting obligations, evidence purposes, security and incident follow-up.

For compliance and chain liability documents, a retention period of up to 5 years after the end of the collaboration or last relevant assignment may be applied, where necessary to demonstrate due diligence or verification obligations.

For invoicing and accounting data, the statutory accounting retention periods apply. For contracts, a longer evidential period may apply depending on contractual liability.

For sensitive or highly personal documents, such as identity documents, residence or work permits, medical fitness, driving licences, Code 95 or driver cards, Droppr applies data minimisation. Where possible, only status information or metadata is retained, such as document type, check date, expiry date and verification status.

Full documents are retained only where necessary for legal, contractual, operational or compliance-related purposes.

11. How do we secure personal data?

Droppr takes appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure. These measures may include, among others:

• role-based access rights
• limitation of admin rights
• logging and audit trails
• secure cloud environment
• access control
• encryption where appropriate
• back-ups
• monitoring of security incidents
• procedures for data breaches
• agreements with processors and sub-processors
• periodic review of access and security

12. What are the rights of data subjects?

Data subjects have, within the conditions of the AVG/GDPR, among others the following rights:

• right to information
• right of access
• right to rectification
• right to erasure
• right to restriction of processing
• right to data portability
• right to object
• right to withdraw consent where processing is based on consent
• right not to be subject to solely automated decision-making with legal or similarly significant effects, where applicable

Droppr may ask the requester to confirm their identity where necessary to prevent misuse or unauthorised access to data.

13. Correction of documents and dispute of statuses

Where a document is missing, expired, unreadable or non-compliant, the user is given the opportunity to correct, supplement or upload a new copy of the document.

Where a member disagrees with a compliance status, flag, verification or significant reduction of a status or score, the member may submit a reasoned objection via the platform or via info@droppr.be.

Droppr will carefully assess disputes and may request additional information or documents.

14. Cookies and tracking

Where Droppr Network uses cookies or similar technologies, this is done in accordance with Droppr's cookie policy.

Essential cookies may be used to enable the platform to function technically.

Non-essential cookies, such as analytics or marketing cookies, are placed only where a valid legal basis exists.

15. Complaints

Where a data subject has questions or complaints about the processing of personal data, they may contact Droppr via privacy@droppr.be or info@droppr.be.

Data subjects also have the right to lodge a complaint with the competent supervisory authority, including the Belgian Data Protection Authority.

16. Changes to this privacy statement

Droppr may amend this privacy statement where the platform, processing activities, legislation or suppliers used change.

The most recent version is made available via the Droppr Network platform or website.