Privacy policy

Velqora is a logistics software company operating through its business presence in the Netherlands and China and providing subscription-based digital services for customers in international markets.

Velqora provides technology intended to support logistics, transportation, shipment visibility, fleet operations, warehouse management, supply-chain coordination, operational intelligence and related business processes. The platform integrates artificial intelligence (AI) to assist customers in using data, improving operational visibility, identifying patterns and supporting informed decisions.

This policy establishes Velqora’s principles and requirements for responsible business operations, customer protection, data handling, information security, confidentiality, platform use, AI governance, employee conduct and legal compliance.

Velqora commits to:

1. Protecting the confidentiality, integrity and availability of customer information.
2. Handling personal and operational data lawfully, fairly and transparently.
3. Supporting secure and reliable logistics technology services.
4. Respecting customers’ rights and legitimate interests in their data.
5. Using AI responsibly and maintaining appropriate human oversight.
6. Preventing unauthorised access, misuse, fraud and disclosure of information.
7. Complying with applicable laws and contractual obligations in the jurisdictions in which Velqora operates.
8. Improving its policies, controls and operational practices as the business develops.

This policy is intended to operate alongside Velqora’s customer agreements, subscription terms, Privacy Policy, Data Processing Agreement, Information Security Policy and other applicable contractual documents.

This policy applies to Velqora’s business activities, digital platform, websites, applications, APIs, integrations, internal systems and related services.

It applies to relevant activities involving:

• Business-to-business (B2B) customers.
• Business-to-consumer (B2C) services and individual users.
• Shippers, carriers, freight forwarders, suppliers and logistics service providers.
• Drivers, fleet operators and authorised transport personnel.
• Warehouse operators and inventory management personnel.
• Employees, contractors, consultants and authorised representatives.
• Technology providers, hosting providers, integration partners and other service providers handling information on Velqora’s behalf.

The policy applies to information processed through subscriptions, platform accounts, customer integrations, operational systems, support activities and other authorised interactions with Velqora.

Where a customer contract or mandatory law establishes a more specific requirement, that requirement will apply to the extent legally necessary. Where provisions conflict, applicable law takes precedence.

Velqora operates in the Netherlands and China and serves customers in international markets. The location of a Velqora office or registered entity does not, by itself, determine where customer data is stored or which employees and service providers may access it. Those matters must be governed by actual system architecture, access permissions, customer commitments and applicable law.

Velqora will:

1. Identify relevant legal entities and their roles in processing personal data.
2. Maintain appropriate records of material data flows and processing activities.
3. Restrict cross-border access to authorised personnel with a legitimate business need.
4. Assess applicable international transfer requirements before transferring personal data across borders.
5. Use legally required transfer mechanisms and supplementary safeguards where appropriate.
6. Review relevant hosting, support, subprocessors and remote-access arrangements.
7. Consider local data protection, cybersecurity, data localisation and sector-specific requirements where applicable.

Transfers of personal data from the European Economic Area to a country outside that area must comply with the applicable GDPR transfer rules. Depending on the circumstances, an adequacy decision, standard contractual clauses or another valid transfer mechanism may be required.

Velqora will not represent that all international transfers are automatically lawful merely because the relevant companies belong to the same business group.

Velqora will maintain a risk-based information security programme appropriate to the sensitivity of the data, the platform’s functionality and the risks associated with logistics operations.

Velqora recognises that logistics data may reveal commercially sensitive information or information about identifiable people.

Operational data may include shipment status, vehicle and driver locations, routes, estimated arrival times, delivery events, warehouse activity, inventory records, transport documents and related sensor or tracking information.

Velqora integrates AI into its platform to help customers interpret information, identify patterns, generate insights, support planning and improve logistics workflows.

AI is intended to support customer operations. It must be used responsibly, with appropriate safeguards based on the intended purpose and risk.

Users must not use Velqora’s platform to:

• Violate applicable laws, regulations or third-party rights.
• Conduct fraud, impersonation, theft or other unlawful activity.
• Access, disclose, alter or destroy data without authorisation.
• Interfere with the security, integrity or availability of the platform.
• Introduce malware or attempt unauthorised penetration testing.
• Reverse engineer, copy or exploit protected software except to the extent permitted by mandatory law or an applicable written agreement.
• Use shipment, driver or location data for unlawful surveillance, harassment or discrimination.
• Upload data they have no legal right to provide.
• Circumvent security controls, subscription limits or access restrictions.
• Use the platform to facilitate unlawful transport, trafficking, sanctions evasion or other prohibited conduct.

Velqora may investigate suspected misuse, preserve relevant evidence, restrict access where justified and refer matters to appropriate authorities where legally required or otherwise lawful.

Velqora personnel must protect confidential information belonging to Velqora, its customers, suppliers and business partners.

Confidential information includes non-public commercial terms, pricing, source code, system architecture, credentials, product plans, customer records, security information, operational data and business strategies.

Confidential information may be used only for authorised purposes and disclosed only to people who need it and are legally or contractually entitled to receive it.

Velqora retains the intellectual property rights it owns or licenses in its platform, software, designs, documentation, trademarks and related technology.

Customers retain their rights in their own data and materials, subject to third-party rights and the applicable contract. A subscription grants the customer only the access and usage rights expressly provided by the agreement.

Confidentiality obligations do not prevent disclosures required by law, lawful regulatory requests or the exercise of protected legal rights.

Velqora may integrate with external software, cloud infrastructure, mapping services, tracking systems, AI providers, communication tools, payment services and other third-party products. Such services may have separate terms, availability limitations, security practices and privacy policies.

Velqora will take appropriate steps to assess third parties that process personal data on its behalf and to establish required contractual safeguards.

Customers are responsible for ensuring that they have the necessary rights and authorisations to connect external systems and share data through integrations.

Velqora is not responsible for independent third-party services beyond the responsibilities imposed by applicable law or expressly accepted in a written agreement.

Velqora will use commercially reasonable efforts to maintain and support the platform in accordance with the applicable customer agreement.

Services may be affected by maintenance, upgrades, security measures, infrastructure problems, telecommunications failures, third-party outages, customer configurations or events outside Velqora’s reasonable control.

Velqora may update or modify features to improve security, performance, compliance or functionality. Material changes will be handled in accordance with the relevant agreement and applicable law.

Any guaranteed service levels, response times, recovery commitments, credits or other remedies must be expressly established in the applicable contract or service-level agreement.

Velqora will identify and assess legal obligations relevant to its business activities and the services it provides.

Depending on the circumstances, these may include:

• The EU General Data Protection Regulation (GDPR).
• Applicable Dutch privacy, commercial and consumer protection laws.
• Applicable Chinese personal information protection, cybersecurity, data security and cross-border transfer requirements.
• Applicable international data transfer requirements.
• Consumer and e-commerce rules in markets where Velqora offers services.
• Intellectual property, confidentiality, competition and contractual requirements.
• Applicable sanctions, export controls, anti-bribery and anti-corruption laws.
• Cybersecurity and sector-specific rules where the relevant legal conditions are met.
• Applicable AI regulation and data-access requirements.

The existence of an office, registration or customer in a particular country does not automatically make every law of that country applicable to every Velqora activity. Applicability must be assessed based on the relevant entity, activity, data, customer and jurisdiction.

Velqora will not claim regulatory approval, independent certification or compliance with a particular standard unless the claim is accurate and supported by evidence.

Employees, customers and authorised partners should promptly report suspected security incidents, privacy violations, fraud, unauthorised access, misuse of the platform or material breaches of this policy.

Reports should include available relevant facts, the systems or data involved, the approximate time of the event and any immediate risk.

Velqora will assess reports, take appropriate action and communicate with affected parties where required.

Reports must be handled in good faith. Retaliation against a person for making a lawful, good-faith report is prohibited.

Violations may result in corrective training, access restrictions, suspension of platform services, disciplinary action, termination of contracts or employment, or legal action, as appropriate and permitted by law.

The response will take account of the nature of the violation, the risk or harm caused, applicable legal requirements and any contractual rights.

Nothing in this policy limits rights or remedies that cannot lawfully be excluded.

Velqora management will review this policy at least annually and following material changes in the business, platform, legal environment or risk profile.

Reviews should consider:

• Changes to data collection, hosting and cross-border access.
• New AI features and integrations.
• Security incidents and lessons learned.
• Customer and regulatory requirements.
• New legal obligations.
• Changes in Velqora’s legal entities and operating markets.
• The effectiveness of existing safeguards and procedures.

Updates must be approved through Velqora’s internal governance process and communicated to affected personnel or customers where appropriate.

This policy becomes an internal company policy upon approval by authorised Velqora management.

Its provisions apply to personnel and other parties within its stated scope. Customer-facing contractual provisions become binding according to the applicable agreement, valid incorporation, acceptance and mandatory law. Publication of this policy alone does not automatically amend an existing customer contract or create a separate contractual obligation for every third party.

Approved by: Velqora Management. Authorised representative, signature and approval date to be completed upon formal approval.