Reporting & Record Management Solutions Group B.V. (“RRMS”, “we”, “us”) operates the RRMS web application at portal.rrmsgroup.com. We are registered in the Netherlands (KVK 42058445, VAT/BTW NL869517387B01) with our registered office at Achterwerf 147, 1357 BS Almere, Netherlands.
For the operational personal data our customers (cargo handlers, freight forwarders, airlines and logistics providers) process in the Service, and for the user accounts they create to use it, we act as a processor on their behalf — they are the controller. We act as an independent controller for the security and audit records of the Service, for concluding and administering our contracts with customers, and for our business contacts and enquiries. This statement describes how we handle personal data in our role as controller and, in summary, as processor.
Privacy contact: admin@rrmsgroup.com
| Personal data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account data — name, username, email, role, assigned location, hashed password and authentication tokens. | Create and manage user accounts; authenticate and control access to the Service. | We process account data on our customer’s instructions as its processor (Art. 28 GDPR); the customer (your employer or principal), as controller, determines the legal basis. |
| Authentication and security data — sign-in sessions (IP address and browser), sign-in attempts, rate-limit records and the audit log of actions in the Service. | Secure the Service, prevent abuse and fraud, keep audit trails, and establish, exercise or defend legal claims, also after the customer’s contract ends. | Art. 6(1)(f) — our legitimate interests in security and in establishing or defending legal claims. We act as controller. |
| Contracting and onboarding — the company’s details; the names, roles and e-mail addresses of signatories and of billing and technical contacts; the drawn signature image; the IP address, browser and time of signing; and the signed documents, including mutual non-disclosure agreements. | Conclude and administer the contract, prove its conclusion and terms, invoice, and keep the records Dutch bookkeeping law requires. | Art. 6(1)(b) where you are yourself the contracting party; otherwise Art. 6(1)(f) — our legitimate interest in concluding and proving contracts with the business you represent; Art. 6(1)(c) for the statutory retention (art. 2:10 Dutch Civil Code, art. 52 General Tax Act). We act as controller. |
| Business contacts and enquiries — name, company, e-mail address, telephone number and the content of messages you send us. | Answer enquiries and keep in touch about our services. | Art. 6(1)(f) — our legitimate interest in answering and maintaining business contacts. We act as controller. |
| Operational cargo records — references and handling data submitted by customers, which may contain names and contact details. | Provide the Service to our customers and, where applicable, support their record-keeping obligations. | We process these on our customer’s instructions as its processor (Art. 28 GDPR); the customer, as controller, determines the legal basis (for example Art. 6(1)(c) where a legal record-keeping obligation applies). |
We do not process payment-card details, health, biometric or children’s data, and we do not knowingly process special-category data (Article 9 GDPR). Where a customer uses the transport functions, the Service holds a driver’s name, telephone number and identity-document reference on the customer’s behalf; the telephone number and identity-document reference are stored encrypted, and customers must not record a citizen service number (BSN).
Providing your account data is necessary to use the Service, and providing the contracting details is necessary to conclude a contract with us: without them we cannot give access or conclude the contract (Article 13(2)(e) GDPR).
Source of your data (Article 14 GDPR): if you use the Service as an employee or contractor of one of our customers, your account is usually created for you by your employer’s administrator — or by us on their instruction — so we receive your name, work contact details, role and work location from them rather than from you directly. This statement is how we inform you of that processing; it is available from the application and on request.
We do not sell or rent personal data. We share it only with vetted sub-processors, each bound by a data-processing agreement, and with our customers in their role as controller. Our principal sub-processors are:
| Provider | Role | Location |
|---|---|---|
| Render Services, Inc. | Cloud hosting — application and managed database; web app delivered via a content-delivery network | EU (Frankfurt, Germany); US-headquartered provider |
| Amazon Web Services (Amazon S3) | Object storage of uploaded files, encrypted database backups and the immutable audit-log archive | EU (Stockholm, Sweden); US-headquartered provider |
| Google Workspace (Gmail) | Sending of system email such as account invitations, one-time sign-in codes and password-reset messages | Messages may be stored outside the EEA (section 4); US-parented provider |
| Sentry (Functional Software, Inc.) | Error monitoring and crash reporting — we use Sentry’s EU region | EU ingestion and storage (Frankfurt, Germany); US-headquartered provider |
| Cloudflare, Inc. | Web-application firewall and network edge in front of the Service: it terminates the encrypted (TLS) connection, so the content of requests and responses passes through its network in transit, and it keeps IP-level security logs | Global edge; US-headquartered provider |
| VirusTotal (Google) | Optional malware scanning of uploaded files using file fingerprints (hashes) only — file contents are never sent | US-parented provider |
Where your company configures its own email (SMTP) provider in the Service, that company’s outgoing messages are sent through that provider under your company’s own arrangement; it is not an RRMS sub-processor. Our current sub-processor list, with each provider’s registered address and data location, is published at portal.rrmsgroup.com/sub-processors.html and is available on request from admin@rrmsgroup.com.
Our public website, rrmsgroup.com, is a separate service hosted by Vercel Inc.; its own privacy notice at rrmsgroup.com/privacy describes the data it handles.
Your personal data is stored within the European Economic Area (EEA): in Frankfurt, Germany (application and database) and Stockholm, Sweden (files, backups and the audit archive). Two exceptions: system e-mail is sent and kept through Google Workspace, which on our edition has no EU data-region setting, so messages may be stored outside the EEA; and our network edge (Cloudflare) carries connections through its global network. Some of our service providers are headquartered in the United States and may have limited access for support and operation; where that involves a transfer outside the EEA, we rely on an appropriate Chapter V GDPR safeguard — the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914). A copy of the relevant safeguards can be requested at admin@rrmsgroup.com.
Subject to the conditions in the GDPR, you have the following rights in respect of your personal data. To exercise any of them, email admin@rrmsgroup.com; we will respond within one month. Where we act as processor for your employer or company, we will direct your request to the relevant controller.
You may also request restriction of processing (Art. 18) and, where processing is based on consent, withdraw that consent at any time.
The web application uses only strictly necessary cookies and browser storage. It sets no analytics, tracking or advertising cookies, so it asks for no cookie consent. The cookies are HTTPS-only and not readable by client-side scripts:
access_token / fw_access_token — sign you in to the handler portal or the Forwarder Portal; each expires after fifteen (15) minutes and is renewed while you stay active;refresh_token / fw_refresh_token — keep your session going; each expires after one (1) day, and every session ends at the latest eight (8) hours after sign-in;We protect personal data with measures including TLS encryption in transit, strong password hashing, multi-factor authentication, tenant data isolation, rate limiting and audit logging.
Security monitoring: to protect accounts and customer data we monitor use of the Service for security purposes. This includes logging sign-in attempts with their timestamp and IP address, temporarily locking accounts after repeated failed sign-ins, rate-limiting sensitive endpoints, verifying sign-ins with one-time codes sent by email (multi-factor authentication), limiting session lifetimes, restricting sign-in to customer-approved networks where IP allow-listing is set up for the customer (RRMS configures it on request), and recording actions performed in the Service in audit logs. Where we suspect an attempt to gain unauthorised access to an Account, or misuse of an Account, we may take protective measures without prior notice, including temporarily blocking the affected Account. The legal basis is our legitimate interest in securing the Service (Art. 6(1)(f) GDPR). This monitoring is proportionate and security-focused: we do not use it for behavioural profiling, advertising or employee performance evaluation, and it involves no automated decision-making with legal or similarly significant effects (Art. 22 GDPR).
For any privacy question or to exercise your rights, contact Reporting & Record Management Solutions Group B.V. at admin@rrmsgroup.com, Achterwerf 147, 1357 BS Almere, Netherlands. We may update this statement to reflect changes to our practices or applicable law; the “Last updated” date above reflects the current version, and material changes are notified through the application or by email.