1. Controller
VELTORIS Großgutlogistik GmbH
An den Röden 1A, 61118 Bad Vilbel, Deutschland
Represented by Managing Director Hubertus Wolf
datenschutz@veltoris-logistik.de
No data protection officer is currently appointed. If a statutory appointment requirement arises, an officer will be appointed before the relevant processing begins and this notice will be updated.
2. Hosting and technical delivery
The website is operated on a netcup GmbH root server located in Nuremberg, Germany. A data processing agreement under Article 28 GDPR is concluded with netcup before personal data is processed. When a page is requested, the web server processes in particular the IP address, time, requested resource, referrer, browser identifier and response status. IP addresses are shortened when written to the regular access log; complete addresses must no longer be present after seven days at the latest. Access logs are retained for 14 days and error and security logs generally for 90 days.
The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure, stable and abuse-resistant operation of the website.
3. Accounts, authentication and security
For registration and account use, we process name, email address, optional company, password hash, confirmation status, account settings, session and security data. Passwords are not stored in plain text. Administrators must use two-factor authentication. The legal bases are Article 6(1)(b) GDPR and, for security records, Article 6(1)(f) GDPR.
4. Shipments, tracking and delivery appointments
To prepare and perform transport contracts, we process sender and recipient data, addresses, email addresses, shipment details, dimensions, weights, packaging, status, location and appointment data, public messages, internal processing notes and, where applicable, photos, documents and proof of delivery. Public tracking requires the shipment number and recipient postcode. The displayed location is limited to city or depot level.
The legal bases are Articles 6(1)(b) and (c) GDPR and Article 6(1)(f) GDPR for fraud prevention, IT security and the establishment, exercise or defence of legal claims.
5. Enquiries and communication
For contact and shipping enquiries, we process the contact, address, transport and message data entered, together with files uploaded voluntarily. Processing is used to respond and, where applicable, prepare a contract under Article 6(1)(b) GDPR; other business communication is based on Article 6(1)(f) GDPR.
6. Applications
For applications, we process identity and contact data, desired role, potential start date, message, CV and documents submitted voluntarily. The legal basis is section 26 BDSG together with Article 6(1)(b) GDPR. Inclusion in a candidate pool only takes place with separate consent under Article 6(1)(a) GDPR.
7. Email delivery
Transactional and service emails are sent through a dedicated SMTP and mail-server configuration on netcup infrastructure. No newsletter, analytics or advertising service is used. System messages are sent from noreply@veltoris-logistik.de; replies are routed to the responsible functional mailbox depending on the matter.
8. Recipients
Recipients may, where required for the relevant matter, include netcup GmbH, appointed carriers and subcontracted carriers, transhipment warehouses and delivery partners within the EU, banks and payment providers, insurers, tax and legal advisers, auditors, authorities and courts. Data is not disclosed to advertising networks, tracking providers or data brokers.
9. International transfers
No transfers outside the European Union or European Economic Area are intended for the regular website, account, email and transport operation. Transport services are offered within the EU only.
10. Retention periods
| Data category | Standard period |
|---|---|
| Unconfirmed registration | 7 days |
| Active customer account | Until termination or a valid erasure request |
| Deleted account | Technical removal within 30 days; transaction data subject to statutory retention remains restricted |
| Shipment, tracking and delivery data | 3 years after completion of transport |
| Invoices and accounting records | 8 years |
| Commercial and business correspondence | 6 years |
| Unaccepted transport enquiry | 24 months after last contact |
| General contact enquiry | 12 months after closure |
| Application | 6 months after the process ends; candidate pool with consent 24 months |
| Abandoned upload | 30 days |
| Administrator audit record | 3 years |
| Backups | 30 daily, 12 weekly and 12 monthly encrypted restore points, used only for disaster recovery. Due deletions are re-applied after a restore. |
Verification links are valid for 24 hours and password-reset links for 60 minutes. A legal dispute, suspected misuse or statutory retention requirement may require longer purpose-limited retention.
11. Cookies and local storage
Only technically necessary session information is used. Analytics, marketing and retargeting technologies are disabled. Details are provided in the cookie information. Open cookie information.
12. Your rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn at any time with future effect. To exercise your rights, email datenschutz@veltoris-logistik.de. Proof of identity may be required to prevent unauthorised access.
13. Right to complain
Competent supervisory authority:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Wilhelmstraße 7, 65185 Wiesbaden
poststelle@datenschutz.hessen.de
datenschutz.hessen.de
14. Automated decision-making
No solely automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.