Version 1.0 — in force from 17 September 2026
MYOBC Time-Critical Logistics B.V., Capronilaan 16, 1119 NR Schiphol-Rijk, the Netherlands — Chamber of Commerce 95451196 — VAT NL867135967B01
In short
We are a time-critical logistics company. We move consignments by On Board Courier, air charter, air freight and road freight. To do that we have to process personal data — most obviously the passport and travel document details of the couriers who fly with your consignment, and the contact details of the people who send and receive it.
This policy explains what we collect, why, on what legal basis, who we share it with, how long we keep it, and what you can ask us to do. It is written to meet the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679, the GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).
Two points are worth stating up front, because they are the ones people ask about:
- We do not sell personal data. Not to data brokers, not to advertisers, not to anyone.
- Because our service is international by nature, personal data will leave the European Economic Area. A courier flying to Singapore has their passport details seen by an airline, a ground handler and a border authority in Singapore. Section 11 explains how we handle this.
This summary is for orientation only. The sections below are the operative text.
Article 1 — Who we are and how to contact us
1.1 This policy is issued by MYOBC Time-Critical Logistics B.V. (“MYOBC“, “we“, “us“, “our“), a private limited company incorporated in the Netherlands, registered with the Dutch Chamber of Commerce under number 95451196, with its registered office and place of business at Capronilaan 16, 1119 NR Schiphol-Rijk, the Netherlands.
1.2 MYOBC is the controller of the personal data described in this policy, within the meaning of Article 4(7) GDPR. Where we act on the documented instructions of a client in respect of that client’s own data, we act as a processor and the terms of the relevant data processing agreement apply in place of this policy.
1.3 You can reach us:
| Post | MYOBC Time-Critical Logistics B.V., Capronilaan 16, 1119 NR Schiphol-Rijk, the Netherlands |
| info@myobc.eu — please use the subject line “Privacy” | |
| Telephone | +31 (0)23 751 9580 |
| Website | www.myobc.eu |
1.4 We have not appointed a Data Protection Officer. We are not required to appoint one under Article 37 GDPR: data processing is not our core activity, we do not carry out large-scale systematic monitoring, and we do not process special category data on a large scale. Privacy enquiries are handled at management level through the contact details above.
1.5 To help us deal with your request efficiently, please be clear about what you are asking for, and in what capacity you are contacting us — as a client, a courier, a consignee, an applicant or a website visitor.
Article 2 — Scope of this policy
2.1 This policy applies to all personal data we process in connection with our business, including through our website at www.myobc.eu, our quotation and booking process, our performance of transport and forwarding services, our engagement of couriers and suppliers, our recruitment activities, and our correspondence with you by email, telephone, messaging application, post or in person.
2.2 This policy is issued exclusively in the English language. MYOBC does not issue a Dutch or other language version. Any translation that may be made or circulated for convenience has no legal effect, and the English text governs in all cases. This mirrors Article 27 of our General Terms and Conditions.
2.3 This policy does not apply to websites operated by third parties, including social media platforms, which may be linked from our website. See Article 16.
2.4 Where our General Terms and Conditions and this policy both address a matter, the General Terms and Conditions govern the commercial relationship and this policy governs the processing of personal data.
Article 3 — Definitions
3.1 In this policy:
a. Client: the legal or natural person acting in the course of a profession or business who instructs MYOBC to arrange or perform the carriage of a consignment.
b. Consignment: the goods handed to MYOBC or to a courier for carriage.
c. Consignor: the person or business from whom a consignment is collected.
d. Consignee: the person or business to whom a consignment is to be delivered.
e. Courier: the natural person who accompanies a consignment on a commercial flight or otherwise carries it in person. Couriers are engaged as independent contractors and are not employees of MYOBC.
f. Personal data: any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR. Data from which identity has been irreversibly removed is not personal data and is not covered by this policy.
g. Special category data: the categories of data listed in Article 9(1) GDPR, including data revealing health, racial or ethnic origin, and religious belief.
h. You: the natural person whose personal data we process.
Article 4 — Whose personal data we process
4.1 We process personal data relating to the following categories of people:
a. individuals who contact us, and employees and representatives of client and prospective client businesses;
b. consignors and consignees, and the individuals present at collection and delivery who hand over or receive a consignment;
c. couriers engaged by us, and individuals applying to be engaged as couriers;
d. passengers on air charters we arrange. Our charter activity is at present cargo only, and this category applies only where we are in fact given passenger details;
e. employees and representatives of our suppliers, agents and subcontractors;
f. applicants for employment or engagement with us;
g. visitors to our website.
4.2 Much of the personal data we hold does not come from you directly. It comes from a client who books a movement on behalf of others. Article 6 explains what this means for that client’s responsibilities.
Article 5 — What personal data we process
5.1 We collect and process the following categories of personal data. Not every category applies to every person; what we hold about you depends on your relationship with us.
a. Identity and contact data
First name and surname; salutation; job title; employer or business name; postal address; email address; telephone and mobile number; messaging application identifier where used for operational contact.
b. Consignment and movement data
Collection and delivery addresses and contact persons; collection and delivery times; a description of the consignment, its weight, dimensions and declared nature; reference numbers; routing and flight details; proof of collection and proof of delivery, including the name and signature of the person who received the consignment; photographs taken at collection or delivery for the purposes of evidencing condition, packing or handover.
c. Travel document and border control data
For couriers and, where applicable, for charter passengers: full name as shown in the travel document; date of birth; nationality; gender where required by a carrier or authority; travel document type, number, country of issue and expiry date; visa, ESTA, work permit and residence permit data; a copy or scan of the travel document page; frequent flyer number; and, where required by a destination state, any additional advance passenger information.
d. Financial data
Bank account details; invoicing and billing details; VAT number; payment references; payment card details where a card payment is made, which are processed by our payment provider and are not stored by us in full; credit assessment data; outstanding balance and payment history.
e. Compliance and screening data
Data generated by our client due diligence and sanctions screening, including screening results against sanctions, terrorism and politically exposed person lists; corporate ownership and control information identifying natural persons; identity verification documents; and, where a client or a destination requires it and Dutch law permits, a Certificate of Conduct (Verklaring Omtrent het Gedrag, VOG) or equivalent background check outcome for a courier.
f. Special category data
Where you or a client tells us of a medical condition affecting fitness to fly, a requirement for special assistance, a dietary requirement, or a vaccination status required by a destination state, we process data concerning health. See Article 8.
g. Communications data
The content and metadata of emails, letters, messaging application exchanges and call records; notes of telephone conversations; complaints and claims correspondence; feedback.
h. Contract and engagement data
For couriers and suppliers: engagement terms, availability, assignment history, rates, invoices, and performance notes. For applicants: CV, cover letter, references, right-to-work documentation, interview notes and assessment outcomes.
i. Marketing and preference data
Your stated preferences as to receiving communications from us; your consents and withdrawals of consent; your presence on our marketing suppression list.
j. Website and technical data
IP address; browser type and version; operating system; device type; the pages you visited, how you reached our website, how you moved through it and when you left; download errors; page response times; and data submitted through our online shipment notification form. Cookies are addressed in Article 15.
5.2 We process only the personal data that is necessary for the purposes set out in Article 7. We do not collect more than we need, and we do not use it for purposes beyond those described, unless we tell you first and have a lawful basis for doing so.
Article 6 — Where we get personal data from
6.1 We obtain personal data:
a. From you directly, when you make an enquiry, request a quotation, place a booking, submit a shipment through our website, apply to work with us, or correspond with us;
b. From a client, on behalf of others, when a client books a movement and supplies the details of a consignor, a consignee, a passenger or a contact person;
c. From couriers and suppliers, when they register with us or accept an assignment;
d. From carriers, handling agents and airport service providers, in the course of performing a movement;
e. From payment providers, banks, credit reference agencies and debt recovery agents;
f. From sanctions and compliance screening providers and publicly available official lists, including the consolidated lists maintained by the European Union, the Netherlands, the United Kingdom and the United States;
g. From recruitment agencies and online recruitment platforms, where you have applied through them;
h. From public sources, including company registers, professional networking platforms and your employer’s own published information, for the purposes of due diligence and business relationship management.
Data you give us about other people
6.2 If you provide us with personal data relating to anyone other than yourself — and in our business this is routine, because a client booking a movement will supply the details of a consignor, a consignee or a courier — you are responsible for ensuring that you have a lawful basis under the GDPR for disclosing that data to us.
6.3 In particular, you must ensure that the individual concerned has been informed of the matters set out in Article 14 GDPR, which you may do by directing them to this policy. Where the data is special category data within the meaning of Article 9 GDPR, you must obtain that individual’s explicit consent before providing it to us, and you must be able to evidence that consent on request.
6.4 We rely on your confirmation that these conditions are met. We are not in a position to verify it, and we do not accept responsibility for a failure on your part to obtain the necessary consent or to give the necessary information.
Article 7 — Purposes and legal bases
7.1 Every act of processing we carry out rests on at least one of the legal bases in Article 6(1) GDPR. Where more than one basis applies, we rely on each of them independently.
7.2 The table below sets out what we do, with what data, and on what basis.
| Purpose | Data used | Legal basis |
|---|---|---|
| Assessing an enquiry, preparing and issuing a quotation, and concluding an agreement | a, b, d, e | Performance of a contract or steps at your request prior to entering into a contract — Art. 6(1)(b). Legitimate interests where the enquirer is a business contact rather than the contracting party — Art. 6(1)(f) |
| Client due diligence, sanctions, embargo and export control screening, and the compliance condition precedent in our General Terms and Conditions | a, d, e | Compliance with a legal obligation — Art. 6(1)(c), in particular Council Regulations (EU) 269/2014 and 833/2014 and the Dutch Sanctions Act 1977. Legitimate interests in not facilitating a breach of sanctions — Art. 6(1)(f) |
| Arranging and performing carriage: booking flights, assigning and briefing a courier, collection, carriage, customs formalities and delivery | a, b, c, f | Performance of a contract — Art. 6(1)(b). Compliance with a legal obligation in respect of aviation security, customs and border control requirements — Art. 6(1)(c) |
| Providing advance passenger information and travel document data to carriers, handling agents and border authorities | c | Compliance with a legal obligation — Art. 6(1)(c). Performance of a contract — Art. 6(1)(b) |
| Keeping you informed of the status of a consignment, including by email, telephone and messaging application | a, b | Performance of a contract — Art. 6(1)(b). Legitimate interests in keeping consignors and consignees informed where they are not the contracting party — Art. 6(1)(f) |
| Invoicing, collecting payment, credit assessment and recovering sums owed to us | a, b, d | Performance of a contract — Art. 6(1)(b). Legitimate interests in recovering debts owed to us — Art. 6(1)(f) |
| Financial administration, accounting, tax returns and audit | a, b, d | Compliance with a legal obligation — Art. 6(1)(c), in particular Art. 52 of the Dutch State Taxes Act and Art. 2:10 of the Dutch Civil Code |
| Handling complaints, claims and disputes, and establishing, exercising or defending legal claims | a, b, c, g | Legitimate interests in defending our position — Art. 6(1)(f). Compliance with a legal obligation — Art. 6(1)(c) |
| Engaging and administering couriers, suppliers and subcontractors, including assignment allocation and payment | a, c, e, h | Performance of a contract — Art. 6(1)(b). Legitimate interests in maintaining a qualified courier and supplier network — Art. 6(1)(f) |
| Assessing applications for employment or engagement | a, e, h | Steps prior to entering into a contract at your request — Art. 6(1)(b). Legitimate interests in assessing suitability — Art. 6(1)(f) |
| Preventing and detecting fraud, and protecting the security of our systems, premises and data | a, d, e, g, j | Legitimate interests in protecting our business — Art. 6(1)(f). Compliance with a legal obligation — Art. 6(1)(c) |
| Managing our relationship with clients and prospective clients, including customer relationship records and contact history | a, b, g, i | Legitimate interests in developing and maintaining business relationships — Art. 6(1)(f) |
| Direct marketing to business contacts by email, telephone or post | a, i | Legitimate interests in promoting our services to business contacts — Art. 6(1)(f), subject to Art. 11.7 of the Dutch Telecommunications Act. Consent where required — Art. 6(1)(a) |
| Operating, securing, measuring and improving our website | j | Legitimate interests in operating a functioning and secure website — Art. 6(1)(f). Consent for non-essential cookies — Art. 6(1)(a) |
| Responding to requests from supervisory authorities, courts, customs, police and other competent authorities | any | Compliance with a legal obligation — Art. 6(1)(c). Legitimate interests in cooperating with authorities — Art. 6(1)(f) |
| Corporate transactions, including a sale, acquisition or reorganisation of our business | a, b, d, h | Legitimate interests in conducting corporate transactions — Art. 6(1)(f) |
What we mean by legitimate interests
7.3 Where we rely on legitimate interests under Article 6(1)(f) GDPR, we have carried out a balancing assessment: we have identified the interest, considered whether the processing is necessary to achieve it, and weighed it against your interests, rights and freedoms. We do not rely on legitimate interests where your interests override ours.
7.4 You have the right to object to processing based on legitimate interests. Article 13 explains how.
7.5 Where the provision of personal data is a contractual requirement — as is the case for the contact and address data needed to conclude an agreement, and for the travel document data needed to fly a courier — we cannot conclude or perform the agreement without it. We will tell you if this is the case.
Article 8 — Special category data
8.1 Our previous policy stated that MYOBC processes no special category data. That statement no longer reflects our operations and has been corrected in this version.
8.2 In the course of arranging air travel for a courier or a charter passenger we may be given data concerning health. Examples are a medical condition affecting fitness to fly, a mobility requirement or other need for special assistance, a dietary requirement that reveals a health condition or a religious belief, and a vaccination or medical certificate required for entry to a destination state.
8.3 We process this data on the basis of your explicit consent under Article 9(2)(a) GDPR. By providing it to us, or by instructing us to provide it on your behalf to a carrier, you explicitly consent to our processing it for the purpose of arranging and performing the movement concerned.
8.4 Where such data is necessary for the establishment, exercise or defence of a legal claim, we may also process it under Article 9(2)(f) GDPR.
8.5 You may withdraw your consent at any time. If you do so, or if you decline to provide the data in the first place, we may be unable to arrange the movement, because the carrier may refuse carriage or we may be unable to satisfy the entry requirements of the destination state.
8.6 Where a client provides special category data on behalf of another person, the client is responsible for obtaining that person’s explicit consent. See Article 6.
8.7 Personal data relating to criminal convictions and offences is processed only where Article 10 GDPR and Article 33 of the Dutch GDPR Implementation Act permit it. We do not screen couriers as a matter of routine. We ask a courier for a Certificate of Conduct (Verklaring Omtrent het Gedrag) or an equivalent check only where a client requires it as a condition of an assignment, or where a destination state requires it. In those cases we record the outcome of the check, not the underlying detail, and we retain it only for the assignment concerned.
Article 9 — Marketing
9.1 We may contact business representatives by email, telephone or post with information about our services, service availability, operational announcements and industry developments we consider relevant to their business.
9.2 We do so where you have enquired about or purchased our services, where you are a contact at a client or supplier business, or where we have identified from public sources that your business is likely to have a requirement for services of the kind we provide. We rely on legitimate interests, and on the exception for existing customers in Article 11.7 of the Dutch Telecommunications Act, and we send marketing to business email addresses rather than to private individuals.
9.3 Every marketing email we send contains an unsubscribe link. You can also opt out at any time by emailing info@myobc.eu with the subject line “Unsubscribe”. We will act on it without delay and without charge.
9.4 Where you opt out, we retain your contact details on a marketing suppression list for the sole purpose of ensuring that we do not contact you again. We cannot honour your objection without keeping a record of it.
9.5 Opting out of marketing does not stop operational messages about a booking you have placed or a consignment in transit. Those are part of performing the contract.
9.6 We do not share your personal data with any third party for the purpose of allowing that third party to market its own products or services to you.
Article 10 — Who we share personal data with
10.1 We share personal data only where it is necessary for the purposes set out in Article 7. The recipients fall into the following categories.
a. Carriers and airport service providers
Airlines and aircraft operators; their handling agents; airport ground handlers; security screening providers; ground transport providers at origin and destination. For an On Board Courier movement, the carrier requires the courier’s full travel document data in order to issue a ticket and permit boarding.
b. Authorities
Customs, immigration and border control authorities in the countries of departure, transit and arrival; aviation security authorities; tax authorities; police, regulators and supervisory authorities where we are legally required to respond or where we assist an investigation.
c. Couriers, agents and subcontractors
The courier assigned to a movement, who needs the collection and delivery addresses and contact details; local agents and subcontracted carriers where a road or air freight leg is performed by a third party.
d. Clients
Where you are a courier, consignor or consignee, our client receives the information necessary to evidence performance, including proof of delivery bearing the name and signature of the person who received the consignment.
e. Service providers acting as processors
Providers of information technology, cloud hosting, email and office infrastructure; our customer relationship management platform; our accounting and invoicing systems; communication and messaging providers. Each processor is engaged under a written agreement complying with Article 28 GDPR, under which it may process personal data only on our documented instructions and must apply appropriate technical and organisational security measures.
f. Financial and compliance providers
Banks and payment service providers; credit reference and credit insurance agencies; debt collection agencies; sanctions and compliance screening providers; fraud prevention agencies.
g. Professional advisers
Our accountants, auditors, insurers, insurance brokers and lawyers, where necessary to obtain advice, to meet audit obligations or to handle a claim.
h. Parties to a corporate transaction
A prospective purchaser or seller in connection with the sale or acquisition of all or part of our business or assets, and their advisers, subject to appropriate confidentiality undertakings.
10.2 Before disclosing personal data to an authority, we verify that the authority is competent and that the request has a lawful basis. Where we are permitted to inform you of such a request, we will.
10.3 We do not sell personal data. We do not make personal data available to third parties for their own marketing purposes.
10.4 We may compile and publish aggregated statistics about the use of our website and our services. Such statistics are anonymised and contain no data from which you can be identified, whether alone or in combination with other data.
Article 11 — Transfers outside the European Economic Area
11.1 Our services are international. Personal data — in particular courier and passenger travel document data — is routinely transferred to countries outside the European Economic Area, including countries which the European Commission has not recognised as providing an adequate level of protection.
11.2 Such transfers occur when a courier flies to, through or from a third country; when a consignment is collected or delivered in a third country; when a carrier, handling agent or local agent outside the EEA performs part of a movement; when a border authority in a third country requires passenger data as a condition of entry; and where a service provider we use hosts or accesses data outside the EEA.
11.3 We transfer personal data outside the EEA only where one of the following applies:
a. Adequacy. The European Commission has decided under Article 45 GDPR that the destination country, or the certification framework under which the recipient operates, ensures an adequate level of protection.
b. Appropriate safeguards. We have put in place the Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) GDPR, supplemented where necessary by additional technical, contractual and organisational measures identified through a transfer impact assessment.
c. Derogations for specific situations. Where neither of the above is available, we rely on a derogation under Article 49(1) GDPR. In practice we rely on:
i. Article 49(1)(b) — the transfer is necessary for the performance of a contract between you and us, or the implementation of pre-contractual measures taken at your request;
ii. Article 49(1)(c) — the transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and another person, which is the basis on which we transfer consignor and consignee data to a foreign carrier or agent;
iii. Article 49(1)(e) — the transfer is necessary for the establishment, exercise or defence of legal claims;
iv. Article 49(1)(a) — you have explicitly consented to the transfer, having been informed of the risks.
11.4 Where a border or immigration authority in a third country requires travel document data as a condition of entry or overflight, we have no discretion in the matter and no control over how that authority subsequently uses the data. We cannot guarantee the level of protection applied by a foreign state.
11.5 If you provide us with personal data relating to another person for the purpose of a movement involving a third country, you are responsible for informing that person of the transfer and, where required, obtaining their explicit consent to it.
11.6 You may request a copy of the safeguards we apply to a particular transfer by contacting us using the details in Article 1.
Article 12 — How long we keep personal data
12.1 We keep personal data no longer than is necessary for the purposes for which it was collected, taking into account the nature and sensitivity of the data, the risk of harm from unauthorised disclosure, whether the purpose can be achieved by other means, and applicable legal retention requirements.
12.2 Our retention periods are:
| Data | Retention period | Reason |
|---|---|---|
| Invoices, accounting records, and the client, consignment and payment data appearing in them | 7 years from the end of the financial year concerned | Art. 52(4) Dutch State Taxes Act; Art. 2:10 Dutch Civil Code |
| Contracts, quotations and the agreement file | 7 years from the end of the agreement | Fiscal retention; evidential purposes |
| Consignment and movement records, including proof of delivery | 7 years from completion | Fiscal retention; defence of claims |
| Courier and passenger travel document data, including document copies | Deleted within 12 months of completion of the movement, unless retained for a claim, an audit or a legal obligation | No longer necessary once the movement is complete |
| Sanctions and client due diligence screening records | 5 years from the end of the business relationship | Evidencing compliance with sanctions obligations |
| Claims, complaints and dispute files | Until final resolution, plus the applicable limitation period | Establishment, exercise and defence of legal claims |
| Enquiries that do not result in an agreement | 24 months from the last contact | Relationship management; recurring enquiry patterns |
| Correspondence and contact history | 7 years, or shorter where no longer relevant | Relationship management; evidential purposes |
| Applicant data where the application is unsuccessful | 4 weeks after the end of the procedure, or 12 months with the applicant’s consent | Dutch Data Protection Authority guidance |
| Courier and supplier engagement files | 7 years after the last assignment | Fiscal retention; qualification records |
| Marketing preference and suppression list data | Retained for as long as necessary to honour your objection | We cannot honour an opt-out without a record of it |
| Website analytics data | No longer than 26 months | Analytics purpose is exhausted |
12.3 Where a retention period expires but the data remains necessary for a legal obligation, an ongoing claim or an investigation, we retain it for as long as that necessity lasts, and no longer.
12.4 We may anonymise personal data instead of deleting it. Once anonymised, the data can no longer be associated with you and we may retain and use it without further notice, for example for statistical and operational analysis.
12.5 At the end of a retention period, personal data is securely deleted or destroyed.
Article 13 — Your rights
13.1 You have the following rights in respect of your personal data. Some of them apply only in particular circumstances, which are indicated below.
a. Access — Article 15 GDPR. You may ask us to confirm whether we process personal data about you and, if so, to provide a copy of it together with information about the purposes, recipients, retention periods and the source of the data.
b. Rectification — Article 16 GDPR. If the data we hold about you is inaccurate or incomplete, you may ask us to correct or complete it.
c. Erasure — Article 17 GDPR. You may ask us to delete your personal data, for example where it is no longer necessary for the purpose it was collected for, where you withdraw a consent we relied on, or where you successfully object to processing. This right is not absolute: we may refuse where we need the data to comply with a legal obligation, or for the establishment, exercise or defence of legal claims.
d. Restriction — Article 18 GDPR. You may ask us to suspend our processing of your personal data, for example while we verify its accuracy or consider an objection you have raised.
e. Portability — Article 20 GDPR. Where we process your personal data by automated means on the basis of your consent or of a contract with you, you may ask us to provide it in a structured, commonly used, machine-readable format, or to transmit it directly to another controller where technically feasible.
f. Objection — Article 21 GDPR. You may object at any time, on grounds relating to your particular situation, to processing we carry out on the basis of legitimate interests. We will then stop, unless we can demonstrate compelling legitimate grounds which override your interests, or unless we need the data for legal claims. You may object to direct marketing at any time, without giving a reason, and we will stop immediately.
g. Withdrawal of consent — Article 7(3) GDPR. Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew it.
h. Complaint — Article 77 GDPR. See Article 18 of this policy.
13.2 How to exercise a right. Contact us using the details in Article 1. There is no charge.
13.3 Verification. We may ask you for information to confirm your identity before we act. This is a security measure: it prevents personal data being disclosed to someone who has no right to receive it. We may also ask you to clarify the scope of your request where it is not clear what you are asking for.
13.4 Timing. We respond within one month of receiving your request. Where a request is complex, or where you have made a number of requests, we may extend that period by up to two further months. If we do, we will tell you within the first month and explain why. Where we decide not to act on a request, we will tell you why, and inform you of your right to complain to the Dutch Data Protection Authority and to seek a judicial remedy.
13.5 Notification. Where we rectify, erase or restrict your personal data, we will notify each recipient to whom we disclosed it, unless this proves impossible or involves disproportionate effort. We will also tell you that we have done so.
13.6 Third-party data. Where you are a consignor, consignee or passenger whose data was supplied to us by a client, you may exercise these rights against us directly. We may need to contact the client in order to respond fully.
Article 14 — Automated decision-making and profiling
14.1 We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR.
14.2 We use automated screening tools for sanctions, embargo and client due diligence purposes. These tools generate potential matches. A potential match is always reviewed by a person before any decision is taken, and the decision whether to proceed with a booking is taken by a person, not by the system. You may ask us to explain a decision that followed a screening match.
14.3 We do not build marketing profiles, and we do not categorise you or predict your behaviour for advertising purposes.
Article 15 — Cookies
15.1 Our website uses cookies. A cookie is a small text file placed on your device by your browser when you visit a website.
15.2 We use:
| Cookie type | Placed by | Purpose | Consent required |
|---|---|---|---|
| Functional | MYOBC | Necessary for the website to work, including allowing you to submit a shipment through the online form and remembering your cookie choices | No — strictly necessary |
| Analytical | MYOBC, using Google Analytics | Understanding how the website is used, so that we can improve it. Configured to limit the data collected and so that visitors are not identified by name or email address | Yes |
15.3 Strictly necessary cookies are placed without consent, as permitted by Article 11.7a(3) of the Dutch Telecommunications Act. Analytical cookies are placed only where you have given consent through our cookie banner.
15.4 You can withdraw your cookie consent at any time through the cookie settings on our website. You can also block or delete cookies through your browser settings; your browser’s help function explains how. If you block or delete functional cookies, parts of the website may stop working, and you may be unable to submit a shipment through the online form.
15.5 Where we use advertising or conversion measurement services provided by third-party platforms, we do so only where you have given the relevant consent through our cookie banner.
Article 16 — Third-party websites
16.1 Our website may contain links to websites operated by third parties, including social media platforms. This policy does not apply to those websites.
16.2 We have no control over how those websites collect, store or use personal data, and we accept no responsibility or liability for their doing so. We recommend that you read the privacy policy of any such website before providing data to it.
Article 17 — Security and personal data breaches
17.1 We apply appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, and against accidental loss, destruction or damage, as required by Article 32 GDPR. Those measures include:
a. access control, with individual accounts, strong authentication and access granted only to those who need it for their role;
b. encryption of data in transit, including a TLS connection on our website, and encryption of data at rest in our databases;
c. secured network connections and protected remote access;
d. physical protection of our premises, equipment and information technology infrastructure;
e. logging and monitoring of access to systems containing personal data;
f. backups, and procedures for restoring availability after an incident;
g. written confidentiality obligations imposed on our employees and on the couriers, contractors and other personnel we engage, which survive the end of the engagement;
h. written processing agreements with every processor we engage, and an assessment of that processor’s security measures before engagement.
17.2 We cannot guarantee the security of personal data transmitted to us over the internet. Transmission over an open network is at your own risk. Once we receive it, we apply the measures described above.
17.3 We maintain a procedure for handling suspected personal data breaches.
17.4 Where a breach is likely to result in a risk to the rights and freedoms of natural persons, we notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) without undue delay and, where feasible, within 72 hours of becoming aware of it.
17.5 Where a breach is likely to result in a high risk to your rights and freedoms, we notify you without undue delay, unless one of the exceptions in Article 34(3) GDPR applies.
17.6 We maintain an internal register of all personal data breaches, whether or not they are notifiable.
Article 18 — Complaints
18.1 If you are not satisfied with how we process your personal data or how we have handled your request, please contact us first using the details in Article 1. We would rather resolve it directly.
18.2 You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.
18.3 The competent authority for MYOBC is:
Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ Den Haag
the Netherlands
Telephone: +31 (0)88 180 5250
www.autoriteitpersoonsgegevens.nl
18.4 You also have the right to an effective judicial remedy under Articles 78 and 79 GDPR.
Article 19 — Children
19.1 Our website and our services are directed at businesses and are not intended for children. We do not knowingly collect personal data relating to persons under the age of 16 without the consent of a parent or guardian, and we have no practical means of verifying a website visitor’s age.
19.2 If you are a parent or guardian and believe we hold personal data about a person under 16 without the necessary consent, contact us using the details in Article 1. We will stop the processing and delete the data.
Article 20 — Changes to this policy
20.1 We may amend this policy, for example where the law changes or where our services change. The current version is always published on our website at www.myobc.eu.
20.2 Where an amendment is material, we will take reasonable steps to bring it to the attention of the people affected, by email or by a notice on our website.
20.3 Each version carries a version number and a date. This is version 1.0, in force from 17 September 2026. It replaces the MYOBC privacy policy previously published in Dutch, which is withdrawn with effect from the same date.
MYOBC Time-Critical Logistics B.V.
Capronilaan 16, 1119 NR Schiphol-Rijk, the Netherlands
Chamber of Commerce 95451196 · VAT NL867135967B01
info@myobc.eu · +31 (0)23 751 9580 · www.myobc.eu
