Privacy statement

This is a translation. In case of any difference, the Dutch text prevails.

1. Who we are

XXLKoerier is a trade name of Zipload B.V., a courier and transport company based in Haarlem, the Netherlands. Zipload B.V. is the controller for the processing of personal data described in this privacy statement. Where this statement says "we" or "XXLKoerier", it means Zipload B.V.

Data protection officer

We have not appointed a data protection officer (DPO). We are not required to: we are not a public authority, and large-scale regular and systematic monitoring of individuals or large-scale processing of special categories of data is not a core activity of ours (Article 37 GDPR). For any privacy question, please contact info@zipload24.com. We respond to your request within one month.

2. Which personal data we collect

Depending on how you use our services and your relationship with us, we may process the following personal data:

Contact details

• First and last name
• Email address
• Phone number
• Company name (if applicable)

Address details

• Pickup and delivery address of transports
• Billing address
• Postcode and town

Location data

• Addresses you enter in a request (pickup and delivery address)
• Geolocation data for route calculation
• Live GPS location of couriers during an active job (only between pickup and delivery, see section 5a)

Technical data and origin

• IP address (in our own visitor statistics only as a pseudonymised code)
• Browser and device type
• The pages you visit, the website you came from and the time of your visit
• Origin of a request or booking: the page on which you arrived, the referring website and any campaign codes in the link (utm)

Financial data

• Payment details (bank account number, billing details)
• Invoice history

Data of couriers and freight providers

• Chamber of Commerce number and VAT number
• NIWO licence (if applicable)
• Insurance details
• Vehicle details
• Copy of identity document (stored with restricted access)

Data relating to the digital consignment note (eCMR, since June 2026)

For every job we record the consignment note digitally in accordance with the CMR Convention and the Additional Protocol concerning the electronic consignment note (eCMR Protocol). This includes:

• Contact details of the sender and recipient (name, phone, optionally email), so that after signing they receive their own copy of the consignment note by WhatsApp and/or email (Article 4 of the Protocol and Article 5 CMR)
• Signatures of the courier, sender and recipient, stored as images in our secure cloud environment (Cloudinary)
• With every signature: the IP address of the device, the browser type (user agent), a timestamp and, only if the courier grants permission in the browser, the GPS location. This data strengthens our evidence if the authenticity of a signature is disputed.
• A SHA-256 hash of every consignment note PDF we deliver, so you can check yourself that your copy is unchanged (via the X-eCMR-PDF-Hash header of your download)
• A second copy of every consignment note PDF in an independent archive (Backblaze B2, EU), so the consignment note remains available for the statutory retention period of 7 years (Article 52 of the Dutch General Taxes Act), even if our primary storage fails

The legal basis is the performance of the contract (Article 6(1)(b) GDPR): we need this data to carry out your transport order in a legally sound way. In addition, we have a legitimate interest (Article 6(1)(f) GDPR) in having evidence if a delivery is disputed. For senders and recipients who are not our customers themselves, the processing takes place within the contract between us and the person who booked (the customer).

3. What we use your data for

We process your personal data for the following purposes:

Service provision

• Organising and carrying out transport orders
• Calculating routes and prices
• Assigning orders to available couriers
• Keeping track of the status of your shipment

Billing and administration

• Preparing and sending quotes and invoices
• Processing payments
• Keeping our financial records

Communication

• Answering your questions by email, phone or WhatsApp
• Informing you about the progress of your transport order
• Sending relevant information about our services, only to customers about similar services or with your consent

Improving our service

• Analysing website visits to improve our website
• Measuring through which channels and campaigns requests come in
• Improving our pricing model and route calculations
• Improving ease of use

4. Legal basis for processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

Performance of a contract (Article 6(1)(b) GDPR)

When you place a transport order with us, we process your data to carry out the order. This includes calculating the price, scheduling the job, sharing your pickup and delivery address with the courier and handling the payment.

Legitimate interest (Article 6(1)(f) GDPR)

We process some data on the basis of our legitimate interest: improving our services, our own cookie-free visitor statistics (section 5b), recording the origin of a request or booking you send (page, referrer, campaign code), securing our platform and preventing fraud. We always weigh your interests, and you can object at any time (section 7).

Legal obligation (Article 6(1)(c) GDPR)

We are required by law to keep some data, for example for tax purposes. We keep financial data for 7 years, as the law requires.

Consent (Article 6(1)(a) GDPR)

For Google Analytics 4 and Google Ads conversion measurement, we ask for your consent through the cookie banner. We also send newsletters and other marketing messages only with your consent, or to existing customers about similar services. You can withdraw your consent at any time via "Cookie settings" at the bottom of every page or via info@zipload24.com. Withdrawal takes effect from that moment; processing that took place earlier with your consent remains lawful.

5. Sharing with third parties

We only share your personal data with third parties when this is necessary for our services, when you have given your consent or when the law requires us to. We never sell your data.

Couriers and carriers

To carry out your transport order, we share your pickup and delivery address, contact details and relevant information about the load with the courier who carries out the job. This is necessary for the performance of the contract.

Mapbox (addresses and maps)

For address suggestions, converting addresses into coordinates and calculating the distance, our platform sends the address you enter to Mapbox. That request comes from our server; your IP address is not sent to Mapbox. If you view a map in the customer portal or on the tracking page of a job, your browser loads that map directly from Mapbox; Mapbox then does receive your IP address. Mapbox, Inc. is based in the United States and certified under the EU-US Data Privacy Framework; the transfer takes place on the basis of that adequacy decision. We have concluded a data processing agreement with Mapbox (Article 28 GDPR). More information: Mapbox Privacy Policy and Mapbox DPA.

Cloudflare (network and backups, spam checks on forms)

Our platform (app.zipload24.com) is reached through the network of Cloudflare, Inc. (United States; certified under the EU-US Data Privacy Framework). Requests from your browser to the platform, such as a request, the customer portal or the visitor statistics, therefore pass through Cloudflare. Cloudflare processes your IP address and technical data of the request in order to pass on and protect the traffic. In addition, every night we store an encrypted copy of the platform database in Cloudflare storage (R2) in the EU; Cloudflare cannot read that copy and deletes it automatically after 30 days. Legal basis: our legitimate interest in a secure and available platform.

On the request form of this website we also use Cloudflare Turnstile to keep out spam and abuse by robots. That script checks technical data of your browser and your IP address to see whether a person is filling in the form. It does not read what you type in the form and sets no cookies for advertising or tracking. Legal basis: our legitimate interest in protecting our forms.

More information: Cloudflare privacy policy.

Cloudinary

We use Cloudinary to store and process documents and images related to transport orders, such as photos of the load, files you send us and insurance certificates. Cloudinary is based in the United States and certified under the EU-US Data Privacy Framework. We have concluded a data processing agreement with Cloudinary (Article 28 GDPR). More information: Cloudinary Privacy Policy and Cloudinary DPA.

WhatsApp (Meta)

We use WhatsApp to communicate with customers and couriers. If you contact us via WhatsApp, your messages and phone number are processed by Meta. Meta Platforms, Inc. is based in the United States and certified under the EU-US Data Privacy Framework. We only start a WhatsApp conversation ourselves if you ask us to, if it is necessary for an ongoing order or if you have given us your consent.

Mollie (payments)

Online payments via iDEAL or similar methods are handled by Mollie B.V. (the Netherlands). Mollie receives your name, email address, the amount and a reference to your job. We only receive the status of your payment from Mollie, not your full bank details. No data is transferred to countries outside the EU. We have a data processing agreement with Mollie (Article 28 GDPR). More information: Mollie Privacy Statement.

Hostinger (platform and database)

Since 27 October 2026 our platform (app.zipload24.com: administration, customer and courier portal, price calculation and requests, including those made via this website) runs on its own virtual private server (VPS). We rent it from Hostinger International Ltd. (Cyprus), in a data centre in Germany (EU). The platform database (PostgreSQL), with order, user and session data, is on the same server; it also always holds an hourly copy of the past 48 hours. Every night an encrypted copy goes to a second server at Hostinger in Germany (EU) and to Cloudflare R2 in the EU (see Cloudflare); those copies are deleted after 30 days. Notifications and confirmations by email are sent through our mail server, also at Hostinger in the EU. Hostinger processes server logs and email metadata in doing so. No data is transferred to countries outside the EU for hosting the platform and the database. We have a data processing agreement with Hostinger International Ltd. (Article 28 GDPR), which forms part of Hostinger's terms. More information: Hostinger Privacy Policy and Hostinger DPA.

mijnhosting.nl (website and email)

This website (xxlkoerier.nl), the form script and the mailbox info@zipload24.com, which we use for this website, are hosted at mijnhosting.nl, the hosting environment of BOOZ Agency (Haarlem), on servers of hosting.nl in the Netherlands. The hosting company processes server logs with IP addresses and the emails in that mailbox.

Inboxvana (email)

A request made via this website also arrives as an email in the mailbox of our planning team. That mailbox is in Inboxvana, the email system in which we store and manage our email. Inboxvana keeps the emails with their attachments, your name and email address, and our replies. Inboxvana is provided by BOOZ Agency, a sole proprietorship in Haarlem, which acts as our processor for this. Inboxvana runs on its own server in a Hostinger data centre in Düsseldorf (Germany, EU). No data is transferred to countries outside the EU, except when we have an AI draft prepared (see Anthropic below). The Inboxvana data processing agreement (Article 28 GDPR), which forms part of the Inboxvana terms, applies to this. More information: Inboxvana data processing agreement (in Dutch).

Google (Google Analytics 4 and Google Ads), only with your consent

If you click "Accept" in the cookie banner, we load Google Analytics 4 and Google Ads conversion measurement. Google then receives, among other things, your IP address, information about your browser and device, the pages you visit and a cookie ID. We do not send Google your name, email address or phone number. For users in the EU, the provider is Google Ireland Limited; data may be transferred to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework. Google is itself responsible for part of the processing. Without your consent we do not load these services and nothing is sent to Google. More information: Google Privacy Policy and how Google uses information from sites that use its services.

Anthropic (AI assistance with messages and documents)

We use Claude, an AI service from Anthropic, to prepare drafts of our messages, for example a reply to your email, WhatsApp message or request, including a request made via this website, and to help check documents. Some drafts are created automatically by our system as soon as your message arrives, others only when a member of staff asks for one. A member of staff checks every draft and sends it themselves: no reply is ever sent to you automatically. Claude also reads documents, such as proofs of delivery, invoices we receive and the documents couriers upload (for example a driving licence, insurance policy or Chamber of Commerce extract). For courier documents we apply Claude's assessment (approve or reject, with a reason) directly. The courier sees the reason in the courier portal and can upload a new document or contact us; a member of staff can then change the assessment. Anthropic receives the text of the message or document, any photos or PDFs sent with it and the details of the related request, job or courier. Legal basis: our legitimate interest in answering messages and checking documents quickly and carefully.

Our contracting party is Anthropic Ireland, Limited (Ireland). Anthropic stores the data in the United States; the processing itself may also take place in other countries. Anthropic is not certified under the EU-US Data Privacy Framework. The transfer therefore takes place on the basis of the European Commission's Standard Contractual Clauses in Anthropic's data processing agreement (Article 28 GDPR), which forms part of their commercial terms. Anthropic deletes the data within 30 days. Only if their automated safety checks flag something as a breach of their usage policy do they keep it for up to 2 years. Anthropic does not use the data to train its AI models. More information: Anthropic Privacy Policy, Anthropic DPA and data retention at Anthropic.

Pushover (notifications for our planning team)

If a job waits too long for a courier or for a next step, our planning team receives a notification on their phone via Pushover, provided by Pushover, LLC (United States). Such a notification only contains the job number, the pickup time and the postcode and town of pickup and delivery (for a guest courier also their name); no customer names, streets, phone numbers or email addresses. Pushover deletes a notification from its servers as soon as it has been delivered. The transfer to the United States takes place on the basis of the standard contractual clauses of the European Commission. Legal basis: our legitimate interest in carrying out jobs on time. More information: Pushover privacy policy.

Other third parties

In exceptional cases we may share data with:

• Our bookkeeper or accountant, for our financial records
• Public authorities, if the law requires us to

5a. Live location of couriers (during a job)

While carrying out a transport order, our couriers share their GPS location with our platform via their smartphone. This is how it works:

When is the location active?

• Only from the moment the courier marks the job as "on the way" until delivery or cancellation.
• Outside an active job no location is shared, not even when the courier app is closed or the courier is logged out.

Purpose

• Performance of the contract (following the route, expected arrival time).
• Customer service: you (or our business customer) can see where your shipment is via a tracking link.
• Operational control: our planning team sees the progress of open jobs.

Who sees the location?

• You as a customer: only during the active job, via your customer portal or the tracking link you receive by email or WhatsApp.
• Our planning team: only authorised staff, to solve operational problems.
• Nobody else: we do not share courier locations with third parties and do not use them for profiling or marketing.

Retention period

• A courier's last position stays in the live tracking table for at most 10 minutes and is then deleted automatically.
• A customer tracking link expires no later than 30 days after delivery; after that the link returns no data.
• For a job that is never completed, the link expires 90 days after creation.
• We keep the positions during an active job (the route driven) for 30 days, so that our planning team can review a job; after that they are deleted automatically.

Legal basis

The GPS location is processed on the basis of the performance of the contract with the customer (Article 6(1)(b) GDPR) and the contract between Zipload B.V. and the self-employed courier. Couriers are informed about this processing when they register.

5b. Visitor statistics

Our own visitor statistics (without cookies)

We measure how this website is used with our own script. That script sets no cookies and stores nothing in your browser. For each page visited we process:

• the page you view, the website you came from and any campaign codes (utm) in the link;
• clicks on phone, WhatsApp and email links and the sending of a form;
• the type of browser and device, derived from what your browser itself sends;
• the approximate country and town, derived from your IP address on our own server; your IP address is not passed to anyone else for this;
• a pseudonymised code of your IP address, with which we count visits; we do not store the IP address itself in these statistics.

This data goes to our platform (app.zipload24.com), where the statistics of our other websites are also processed. If you send a request via this website, the platform may record the page, referring website or campaign through which you arrived, so that we know which channels work. We do not share this data with third parties, do not build profiles from it and do not use it for advertising.

Legal basis: our legitimate interest in measuring and improving the use of our website (Article 6(1)(f) GDPR). You can always object to this. We treat pseudonymised data, such as an IP code, as personal data; pseudonymisation does not release us from our obligations under the GDPR.

Retention period

• Page visits and clicks: 6 months with the IP code; after that we erase it and only non-identifiable counts remain.

Your rights

You can object to the visitor statistics and request access or deletion via info@zipload24.com. We do not build complete profiles of visitors and do not sell this data.

6. Retention periods

We do not keep your personal data longer than necessary for the purposes for which we process it. We use the following periods:

When the retention period ends, we delete or anonymise your data.

7. Your rights

Under the GDPR you have the following rights:

• Right of access: you may know which personal data we process about you and request an overview.
• Right to rectification: if your data is incorrect or incomplete, we will correct it at your request.
• Right to erasure: you can ask us to delete your data. We will do so unless the law requires us to keep it.
• Right to restriction: you can ask us to (temporarily) restrict the processing.
• Right to object: you can object to processing based on our legitimate interest, such as our visitor statistics.
• Right to data portability: you can receive your data in a common, machine-readable format and have it transferred to another party.
• Right to withdraw consent: via "Cookie settings" at the bottom of every page or by email.

You can exercise your rights via info@zipload24.com. We respond to your request within one month.

Lodging a complaint

If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl, phone +31 88 - 1805 250. If you live or work in another EU country, you can also contact the supervisory authority of that country.

8. Cookies and similar technologies

Strictly necessary (no consent required)

Some storage is needed for the website to work: remembering your cookie choice and temporary data in your browser that makes a form work while you use it. If you send a request, your browser temporarily keeps the fields you filled in in the session storage of that tab, so that you do not have to fill them in again if sending fails; that data stays on your device and disappears when you close the tab. No consent is required for this (Article 11.7a(3) of the Dutch Telecommunications Act). On the page with the request form, Cloudflare Turnstile loads (see section 5); it may temporarily store data in your browser for the spam check.

Our own visitor statistics (no consent required)

Our own statistics set no cookies and store nothing in your browser (see section 5b).

Only with your consent

On your first visit you see a cookie banner with "Accept" and "Decline". If you make no choice or click "Decline", nothing from Google loads. If you click "Accept", we load:

• Google Analytics 4 (measurement ID G-LFCWC1CKRR): cookies _ga and _ga_* (at most 2 years), to measure visits to and use of the website.
• Google Ads conversion measurement (AW-389699407): cookie _gcl_au (90 days), to see which ads lead to a request, phone call or WhatsApp message.

We do not load any other advertising or social media pixels. We use Google Consent Mode v2 in its basic form: as long as you have not given consent, we do not load Google's scripts and nothing is sent to Google.

Changing your choice

You can change your choice or withdraw your consent at any time via "Cookie settings" at the bottom of every page or with the button below. Google's cookies are then deleted. Your browser remembers your choice in local storage.

Change cookie settings

9. Security

We take the protection of your data seriously and take appropriate technical and organisational measures against misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification:

• Encrypted connection: all communication between your browser and our website runs over HTTPS.
• Hashed passwords: account passwords are stored with modern hashing and cannot be read, not even by us.
• Restricted access: only authorised staff have access to personal data, and only insofar as their work requires it.
• Secure storage: documents and files are stored with reputable cloud providers with appropriate security.
• Regular backups: to prevent data loss.

No method of transmission over the internet or of electronic storage is completely secure. If you suspect that your data is not properly secured or you see signs of misuse, please contact us immediately.

Data breaches

If a data breach occurs despite our measures, we act in accordance with the GDPR:

• We keep an internal register of data breaches (Article 33(5) GDPR).
• We report a breach that poses a risk to the people concerned to the Dutch Data Protection Authority within 72 hours.
• If the breach is likely to result in a high risk to your rights and freedoms, we inform you directly.

Do you suspect a data breach at our company? Report it via info@zipload24.com; we investigate your report within 24 hours.

10. Changes to this privacy statement

We may amend this privacy statement. We publish changes on this page, with the date of the last change at the top. In the event of significant changes to the way we process your data, we will actively inform you by email or with a notice on our website.

11. Contact

Do you have questions about this privacy statement or about the processing of your personal data? Please contact us: