Privacy
Privacy Statement Noventra B.V. and OrangeChain
1. Who we are and who this statement applies to
Noventra B.V. (“Noventra”, “we”) is a 4PL/5PL supply chain orchestrator that coordinates transport between shippers (“Customers”) and transport companies (“Carriers”) through our platform OrangeChain. In doing so, we process personal data. In this statement we explain which data that is, why we use it and what rights you have.
| Name | Noventra B.V. |
| Registered office | Veenendaal, the Netherlands |
| Chamber of Commerce number | 42114354 |
| Privacy coordinator | Mathijs van Wijnen |
This statement applies to:
- users of OrangeChain (employees of Customers and Carriers);
- contact persons at Customers, Carriers and their customers or suppliers (“Clients”);
- drivers of Carriers, whose data we receive from the Carrier for transport orders coordinated through OrangeChain;
- visitors to our website who use the contact form;
- business contacts who are in touch with us in any other way.
Our role in each relationship
- With the Customer, we are joint controllers (Article 26 GDPR) for the personal data processed through OrangeChain for that Customer’s transport orders. The Customer informs its own employees and contact persons at Clients and is your first point of contact. Noventra secures OrangeChain and reports data breaches. You can exercise your rights with either of us.
- Alongside the Carrier, we are an independent controller. Each party is responsible for its own processing of, for example, driver data.
- Where we process data solely on behalf of a Customer or Carrier, we act as a processor. For that purpose we conclude a data processing agreement.
2. What data we process, for what purpose and on what legal basis
We only process the data needed to coordinate transport and report on it. We do not process special categories of personal data.
| Who | Data | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|---|
| Users of OrangeChain | Name, business e-mail address, telephone number, job title, login details, login and usage logs | Access to the platform, security, support | Performance of the contract with the user’s organisation; legitimate interest (security and prevention of misuse) |
| Contact persons at Customers, Carriers and Clients | Name, business contact details, job title, loading and unloading address | Executing and coordinating transport orders, escalations | Legitimate interest (conducting the business relationship) |
| Drivers | Name, telephone number and licence plate, provided by the Carrier; transport status (such as arrival at the loading or unloading location); signature on the proof of delivery (POD) | Executing and tracking the transport order, proof of delivery | Legitimate interest (execution and status monitoring of the transport); legal obligation (retention of transport documents) |
| Business contacts | Name, contact details, correspondence | Contact, quotations, invoicing | Performance of the contract; legal obligation (accounting records) |
| Visitors who fill in the contact form | Name, company, e-mail address, telephone number (if you provide it), subject and message; a hashed version of your IP address | Responding to your question or request; preventing abuse and spam | Legitimate interest (responding to your question and keeping the website secure) |
We do not use personal data for other purposes, do not sell it and do not share it for marketing. We may use transport data in anonymised or aggregated form for sector and market averages (for example for CO₂ reporting). That data can no longer be traced back to individuals or to individual Customers or Carriers.
3. Retention periods and recipients
How long we keep data
| Data | Retention period |
|---|---|
| Driver data (and vehicle location data, if processed in the future) | Deleted or irreversibly anonymised no later than 1 week after completion of the transport order, unless needed for a pending claim, complaint or dispute |
| Proofs of delivery (POD) and consignment notes | For as long as a statutory retention obligation applies, usually 7 years |
| Order and transport data including contact persons | Term of the contract with the Customer plus 5 years, unless agreed otherwise with the Customer |
| OrangeChain user accounts | Deleted no later than one month after termination of the contract |
| Accounting records and invoices | 7 years (statutory tax retention obligation) |
| Messages sent through the contact form | As long as needed to handle your question and no longer than 12 months afterwards. If a business relationship follows, the periods above apply |
| Hashed IP addresses (protection against abuse of the contact form) | No longer than 24 hours |
Who we share data with
- Customers and Carriers involved in a transport order, insofar as necessary for that order.
- Suppliers that process data on our behalf (sub-processors). We have a data processing agreement with all our sub-processors.
- Public authorities, such as customs or the police, where the law requires us to do so.
- Google, as a processor for the spam protection of the contact form and, if you consent, for the website statistics of Google Analytics (see below).
Noventra does not share data of Customers or Carriers with companies affiliated with Noventra that are themselves active as a carrier or logistics service provider, unless it concerns an order assigned to that company as a Carrier.
Our website, the contact form and reCAPTCHA
Our website does not use tracking or advertising cookies. Only if you consent in the cookie banner do we use Google Analytics to measure how our website is used, for example which pages are visited and for how long. Google Analytics places cookies for this, and Google receives, among other things, your IP address and information about your browser and device. We use these statistics only to improve our website. If you do not consent, Google Analytics is not loaded. You can change your choice or withdraw your consent at any time via the link below.
Your browser also remembers the choice you made in the cookie banner and which video quality suits your connection; those settings stay on your own device and are not sent to us.
A message sent through the contact form reaches us by e-mail and is stored in our business mailbox. To limit abuse, we briefly keep track of how many messages are sent from an IP address; for that we only store a hashed version of that IP address.
The contact form is protected by Google reCAPTCHA v3, so that automated programs (bots) cannot misuse it. reCAPTCHA is only loaded once you start using the form. Google then receives, among other things, your IP address, information about your browser and device and how you use the page, and uses it to assess whether the form is being filled in by a person. We only receive that assessment. Google acts as our processor, under the Google Cloud data processing terms, and uses the data only to provide and secure reCAPTCHA, not for advertising.
Google may process this data in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework; the transfer takes place on the basis of the European Commission’s adequacy decision on that framework.
4. Security, data breaches and use of AI
Security
Noventra operates an information security management system (ISMS) set up in accordance with the ISO/IEC 27001:2022 standard. The main measures are:
- Need-to-know access: personal accounts with multi-factor authentication (MFA); users only see data relating to their own transport orders.
- Encryption: data is encrypted in transit and at rest.
- Segregated access: data of Customers and Carriers is shielded from affiliated companies.
- Suppliers: hosting with an ISO/IEC 27001-certified provider.
- Logging and back-ups: administrative actions are logged, and back-ups are made and tested regularly.
- Staff: confidentiality, security awareness and immediate revocation of access upon departure.
- Risk assessment: we assess risks at least once a year and whenever significant changes occur.
Data breaches
If a data breach occurs, we immediately assess its consequences. We inform affected Customers within 24 hours of discovery and, where required, notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours. If the breach is likely to pose a high risk to you, we will also inform you directly.
Use of AI
Where transport data is missing, OrangeChain may complete it using artificial intelligence (AI), for example for emission calculations. Completed data is labelled as such. We do not take decisions about individuals based solely on automated processing that have legal or similarly significant effects for them (Article 22 GDPR). This takes place entirely within our own database and under our own control; the data is never shared with external parties in the process.
5. Your rights and contact
You have the following rights:
- access to the data we process about you;
- rectification of inaccurate data;
- erasure of data, where there is no longer a reason to keep it;
- restriction of processing;
- objection to processing based on legitimate interest;
- data portability of data you provided yourself, where applicable.
Send your request to our e-mail address. We will respond within one month. To prevent misuse, we may ask you to verify your identity. If your request concerns data we process jointly with a Customer, we will coordinate the handling with that Customer. You only need to submit your request to one of us.
If you are not satisfied with how we handle your data, please contact us. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
This statement is also available as a pdf and in Dutch. Questions about your data? E-mail our e-mail address.