SendingBay
ES|EN
Client area
eCommDocument and manage your multi-carrier shipments.BestmileRoute optimization for your last mile.BuenaviaHome services · Coming soon.DeCAbayIssue the DeCA for every shipment.SaaSSoftware for carrier agencies that operate and invoice.About us
Client area
ES|EN
Legal

Data Privacy and Security Policy

How we protect the data we process, what our role is, how we handle individuals' rights and how we respond to incidents.

Last updated: 23 September 2026 · Version 3.0

This policy explains how SendingBay protects the data it processes when providing its services, what its role is with respect to that data, how it handles individuals' rights and how it responds to incidents. It is common to all SendingBay products and services.

Each product line processes different data and has its own retention periods and obligations. That detail is set out in the annexes to this policy, which form part of it:

Where an annex specifically regulates a matter, the annex prevails; in all other respects this policy applies. When SendingBay adds a new product line, it will publish its annex at this same address.

1. Scope

This policy applies to all SendingBay products and services and to everyone who works on them. This policy and its annexes complement, and do not replace, the website privacy policy, the cookie policy, the terms of service with their data processing agreement, and the list of providers and sub-processors.

2. Data controller

SENDINGBAY S.L., tax ID B44799815, with registered office at Calle Mariano Cuber 17 (Wayco Cabanyal), 46011 Valencia, Spain. Registered in the Valencia Companies Register, Volume 11330, Book 8608, Folio 68, Section 8, Sheet V-209573.

3. Our role

When a customer uses a SendingBay product, the customer is the controller of the data of its own customers, buyers or recipients, and SendingBay acts as processor on its behalf, following its instructions and the data processing agreement that forms part of the terms of service. With respect to the customer's account data (users, company and billing), SendingBay is the controller, for the purpose of providing the service, giving support and invoicing. Third parties involved in providing the service —carrier networks, sales platforms or others— are independently responsible for the data they receive to perform their function; each annex describes those involved in its product line.

4. Principles

  • Minimisation. We process only the data needed to provide each service, for as long as needed, and we request from the third parties we connect to only the permissions the service requires.
  • Purpose. We do not use the personal data of our customers' customers for advertising, nor do we transfer it to third parties for commercial purposes.
  • Operational, aggregated and anonymised data. Using SendingBay products generates operational data: times, volumes, areas, time slots and incidents. From that operational data, SendingBay may derive aggregated and anonymised information that does not allow any person or any customer to be identified, and use it to operate, improve and develop its services, under the terms of the data processing agreement. The personal data of buyers and recipients is not used for that purpose: it serves only to carry out the shipment. Each annex specifies this for its product line.
  • Transparency. We publish this policy and its annexes, and we inform customers of changes that materially affect them.

5. Where data is processed

Data is processed and stored in data centres located in the European Economic Area, with infrastructure providers bound by data processing agreements. Any international transfer of personal data would be carried out with the safeguards required by European law. The list of providers, with the purpose and location of each, is at www.sendingbay.com/subencargados.

6. How we protect data

We apply technical and organisational measures proportionate to the risk: encryption of communications and of stored data, least-privilege access control with strong authentication, logging and auditing of administrative access, encrypted backups, separation of environments, confidentiality obligations and staff training, and providers holding recognised security certifications. These measures are reviewed periodically.

7. Retention and deletion

Personal data is kept only for as long as needed for the purpose for which it is processed and for any applicable legal retention periods, and is then effectively and permanently deleted; backups delete it when they complete their rotation cycle. The specific periods for each product line are in its annex. Customer account data is kept for the duration of the contractual relationship and for the legal periods that follow. On a customer's written request, we confirm deletion in writing.

8. Rights and data requests

Any person or customer may exercise the rights of access, rectification, erasure, restriction, portability and objection, or ask us what data we process, by writing to privacidad@sendingbay.com. We will ask for reasonable identification and reply within one month at most, free of charge. Where the request concerns data for which a SendingBay customer is the controller, we will forward it and help the customer respond. A complaint may also be lodged with the Spanish Data Protection Agency (www.aepd.es).

9. Security incidents

We have an incident response procedure with defined roles, timelines and channels. In the event of an incident affecting the data or credentials of a customer or of a connected third party, we contain and assess it without delay, notify those affected without undue delay and within the timelines set by applicable law and agreements, notify the Spanish Data Protection Agency within a maximum of 72 hours where the law requires it, and inform the individuals concerned where there is a high risk to them. We provide those affected with information about the incident and the measures taken.

If you detect a vulnerability or an incident affecting SendingBay, write to seguridad@sendingbay.com.

10. Providers and third parties

The providers that process data on behalf of our customers are published and kept up to date at www.sendingbay.com/subencargados.

11. Changes to this policy

We publish each version of this policy and of its annexes at this same address with its date. If a change materially affects how we process a customer's data, we inform the customer before applying it.

SENDINGBAY S.L.