Data, access and export

Your orders, shipments, carrier events and passports are hosted in the European Union, encrypted at rest and in transit, and nothing leaves the EU without signed Standard Contractual Clauses. Who gets into your account is your call, person by person and module by module. The contracts sit under EU law. And when you want your data out, the ledger exports line by line and your store and carrier accounts were never moved in the first place.

Hosting and encryption

The servers are in the European Union. Data is encrypted at rest and in transit, the backups are encrypted too, and on our side access to customer data is restricted and logged, so the question of who looked at a record, and when, has an answer.

The suppliers behind that sit on two lists. The processors behind this website are named in the privacy policy, with the location of each and the data it receives, and a detailed, current list is available on request. The sub-processors behind your account, hosting included, are listed in the Data Processing Agreement, and we keep that list current. We collect the data the service needs to carry out your requests, and no more.

Access rights

One account serves operations, finance and compliance, and your team runs it on a scope you set. Rights are granted per module (Orders, Carriers, Billing, the Digital Product Passport and the rest), so the packer sees the queue, finance sees the ledger, and nobody sees more than their job needs.

On top of those rights sit two-factor authentication on the login, API keys you scope and revoke one at a time (so a retired integration loses its key without touching the others) and a list of active sessions you can end yourself, for the day a laptop goes missing or a contractor leaves.

The AI Analyst works inside the same walls. It answers from your own data, cites the rows behind every figure, and proposes a next step your team approves or drops.

We hold your data the way you would want a supplier to hold it: in Europe, encrypted, visible to the people you chose.

The audit trail

Every indicator in your account opens onto the raw data behind it, so a delivery rate or an anomaly count traces back to the shipments that produced it without an export. The billing ledger records every label, every surcharge and every option as its own line. Active sessions show who is signed in now, and each API key can be revoked on its own, so you can review who holds access from the screen, without raising a request with us.

Some housekeeping stays with you. Decide who administers the account, keep API keys to one integration each, and end a session the day a person leaves.

Transfers outside the EU

Where a transfer outside the European Union is needed, it is governed by the European Commission's Standard Contractual Clauses and, where applicable, by the EU-US Data Privacy Framework, and no transfer takes place without a prior impact assessment.

Changes to the sub-processor list come with notice. Under the Data Processing Agreement we give you 30 days' notice before any change, with a right to object. If a new sub-processor is a problem for your own compliance, you object inside that window and we look for an alternative.

Carriers are a separate case. When a label is created, the recipient's name and delivery address go to the carrier, which processes them under its own responsibility, as an independent data controller with its own terms and privacy notice. It is not our sub-processor, and that is how to write it in your own register of processing. On your own carrier contracts you remain the principal, as you always were. Terms and processing agreements are governed by EU law, with no ambiguity on jurisdiction.

Data breaches

A breach is the scenario a questionnaire cares about most, and the commitment is written down. Under the Data Processing Agreement we notify you of a confirmed personal data breach within 48 hours, which leaves you time to meet your own 72-hour duty to the supervisory authority as the controller of your customers' data. Where we are the controller ourselves, the privacy policy carries the matching commitment: the authority within 72 hours, the people concerned without undue delay.

Data export

The billing ledger exports line by line, every label, surcharge and option with its amount, and it reconciles with your accounting. Because shipping on our rates is rebilled at the exact carrier price with zero markup, that export is a complete record of what you paid and why, down to the surcharge. Orders and reports export across every store you run.

Everything else is covered by the rights the privacy policy lists under the GDPR: access, rectification, erasure, restriction, portability and objection. A request to contact@horizonlogistics.eu is answered within a month at most, and erasure follows the same route. Your store and your carrier accounts stayed where they were, connected rather than moved, and the branded tracking pages run on your own domain, so leaving means disconnecting them.