Privacy Policy

1. Who Are We?

Box16 is a service of Box16 B.V., located at Le Mairekade 77, 1013 CB Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 42104995. We develop and operate software (SaaS) for automatically processing, anonymising and neutralising transport and freight documents, including CMR consignment notes, with the aim of protecting carrier identification in the logistics chain.

Contact: info@box16.nl

2. What Personal Data Do We Process?

Account data:

• Email address and name (when creating an account)
• Role within your organisation

Document data:

• CMR documents you upload (may contain personal data of third parties, such as carrier data)
• Processed (neutralised) versions of these documents

Technical data:

• IP address and session information
• Usage statistics (number of processed documents, detection tier)
• Audit log of actions in the application

3. Why Do We Process Your Data?

Purpose	Legal basis
Providing the CMR neutralisation service	Performance of contract
Account management and authentication	Performance of contract
Billing and usage tracking	Performance of contract + legal obligation
Security and fraud prevention	Legitimate interest
Error detection and service improvement	Legitimate interest

4. How Long Do We Retain Your Data?

• Uploaded documents: Automatically deleted after your configured retention period (default 30 days, adjustable in Settings).
• Account data: Retained for as long as your account is active + 12 months after cancellation.
• Audit logs: Retained for 24 months (for compliance and dispute resolution).
• Usage statistics: Retained for 24 months (anonymised after 6 months).

5. Where Is Your Data Stored?

All your data is stored within the European Economic Area (EEA):

• Database: Railway (Netherlands, EU-west region)
• Document storage: Cloudflare R2 (EU region)
• Frontend: Vercel (Frankfurt, EU)

6. Your Rights

Under the GDPR you have the right to:

• Access your personal data
• Rectification of incorrect data
• Erasure ("right to be forgotten")
• Restriction of processing
• Data portability
• Object to processing based on legitimate interest

Send a request to: info@box16.nl

You can also file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

7. Changes

We may update this privacy policy. For material changes we will notify you via email or in the application.