Privacy Policy

Privacy Policy

Last updated: 19 August 2026

1. About this Privacy Policy

Ectaro B.V. (“Ectaro”, “we”, “us” or “our”) provides e-commerce software and services through EctaroShip, including order management, marketplace and webshop integrations, shipping and label generation, tracking, inventory-related functionality, warehouse management functionality and related support services.

We take the protection of personal data seriously. This Privacy Policy explains what personal data we process, why we process it, with whom it may be shared, how long we retain it and what rights individuals have under the General Data Protection Regulation (“GDPR”) and other applicable privacy laws.

Ectaro B.V. is registered in the Netherlands with the following details:

Ectaro B.V.
Prins Mauritslaan 39
1171 LP Badhoevedorp
The Netherlands
Chamber of Commerce (KVK): 91515785
Email: [email protected]
Website: https://www.ectaroship.nl

2. Our role: controller and processor

Ectaro primarily provides its services to businesses, online merchants and other professional users.

Depending on the context, Ectaro may act either as a data controller or as a data processor.

When Ectaro acts as controller

We generally act as controller for personal data relating to:

  • Ectaro account holders and users;

  • representatives and employees of our business customers;

  • website visitors;

  • people contacting our support or sales teams;

  • billing and administrative contacts;

  • newsletter and marketing recipients; and

  • security, fraud prevention and compliance activities carried out for Ectaro’s own purposes.

In these situations, Ectaro determines the purposes and means of processing the personal data.

When Ectaro acts as processor

Our customers are primarily merchants and sellers. When a merchant connects a webshop, marketplace or other sales channel to EctaroShip, we may receive and process personal data relating to that merchant’s end customers.

This may include order, recipient, delivery and shipment information.

Where Ectaro processes this information solely to provide services on the merchant’s instructions, the merchant remains the data controller and Ectaro acts as its data processor.

If you are an end customer of one of our merchants and have questions about your personal data, you should normally contact the merchant from whom you made your purchase. We will assist our merchant customers in responding to valid data protection requests where required.

In certain limited circumstances, Ectaro may process specific information as a controller where necessary to comply with legal obligations, protect its systems, prevent fraud, establish or defend legal claims, or fulfil other legitimate business responsibilities.

3. Personal data we process

The personal data we process depends on how you interact with Ectaro and which services are used.

Account and business contact data

We may process:

  • name;

  • company name;

  • business address;

  • email address;

  • telephone number;

  • VAT and company registration information;

  • account and user identifiers;

  • login and authentication information;

  • account settings and preferences; and

  • information relating to the services used.

Order and shipment data

When merchants use EctaroShip to manage orders or shipments, we may process information such as:

  • recipient name;

  • delivery and billing address;

  • postal code, city and country;

  • email address;

  • telephone number;

  • order number;

  • shipment and parcel information;

  • carrier and shipping service;

  • tracking number and tracking status; and

  • customs and product information where required for international shipping.

This data is generally provided by the merchant directly or obtained from a webshop, marketplace or other sales channel connected by the merchant.

Integration data

When a merchant connects an external platform or marketplace to EctaroShip, we may process account identifiers, store identifiers and other information necessary to establish and operate that integration.

Billing and administrative data

We may process information necessary for invoicing, payments, accounting, financial administration and compliance with legal obligations.

Support and communication data

When you contact us, we may process:

  • your name and contact details;

  • the content of your request;

  • support tickets and correspondence;

  • technical information relevant to the issue; and

  • attachments or other information you choose to provide.

Website and technical data

When you visit our website or use our platform, certain technical information may be collected automatically, including:

  • IP address;

  • date and time of access;

  • browser and device information;

  • operating system;

  • pages or functions accessed;

  • referral information;

  • application and security logs; and

  • cookie and similar technology information.

More information about cookies and similar technologies is provided in our Cookie Policy.

4. How we obtain personal data

We may obtain personal data:

  • directly from you;

  • from your employer or organisation;

  • from merchants using EctaroShip;

  • from webshops, marketplaces and e-commerce platforms connected to EctaroShip;

  • from carriers and logistics providers;

  • from service providers and business partners;

  • automatically when our website or platform is used; or

  • where otherwise permitted or required by law.

5. Why we process personal data

We process personal data for purposes including:

  • creating and managing Ectaro accounts;

  • providing our platform and services;

  • importing and managing orders;

  • generating shipping labels;

  • transferring shipment information to carriers;

  • providing tracking information;

  • operating marketplace and webshop integrations;

  • providing inventory, warehouse and related functionality;

  • providing customer and technical support;

  • invoicing and financial administration;

  • maintaining and improving our services;

  • monitoring platform performance;

  • protecting the security and integrity of our systems;

  • detecting and preventing fraud, misuse and unauthorized access;

  • complying with legal and regulatory obligations;

  • establishing, exercising or defending legal claims; and

  • communicating about our products and services where permitted by law.

6. Legal bases for processing

Where Ectaro acts as controller, we process personal data only where we have a valid legal basis under the GDPR.

Depending on the circumstances, this may include:

Performance of a contract

We process data where this is necessary to provide services requested by you or to perform our contractual obligations.

Legal obligation

Certain information must be processed or retained to comply with tax, accounting, regulatory or other legal requirements.

Legitimate interests

We may process personal data where necessary for legitimate business interests, including:

  • securing our systems;

  • preventing fraud and misuse;

  • providing customer support;

  • improving our services;

  • maintaining business records; and

  • establishing or defending legal claims.

We balance these interests against the rights and interests of affected individuals.

Consent

Where required, we rely on consent, for example for certain marketing activities, cookies or similar technologies. Consent may be withdrawn at any time.

Where Ectaro acts solely as a processor on behalf of a merchant, the merchant is responsible for establishing the appropriate legal basis for processing its end customers’ personal data.

7. Marketplace and e-commerce integrations

EctaroShip allows merchants to connect third-party marketplaces, webshops and other e-commerce services.

When a merchant enables an integration, relevant data may be exchanged between Ectaro and the connected service in order to provide the functionality requested by the merchant.

Ectaro only accesses and processes data from connected services to the extent necessary for the enabled functionality, subject to applicable contractual and legal requirements.

Merchants are responsible for ensuring that their use of integrations and their processing of their customers’ personal data complies with applicable law.

8. Sharing personal data

We may share personal data where necessary with categories of recipients including:

  • shipping carriers and logistics providers;

  • marketplaces and e-commerce platforms selected or connected by the merchant;

  • hosting and cloud infrastructure providers;

  • IT, security and monitoring service providers;

  • email and communication providers;

  • customer support and ticketing providers;

  • payment, invoicing and accounting providers;

  • professional advisers such as accountants or legal advisers; and

  • public authorities where disclosure is legally required.

We require service providers processing personal data on our behalf to protect the data and process it only for agreed purposes.

We do not disclose personal data to third parties for unrelated purposes without an appropriate legal basis.

9. International data transfers

We aim to process personal data within the European Economic Area (“EEA”) where reasonably possible.

Some service providers, integrations or business partners may process data outside the EEA.

Where personal data is transferred outside the EEA, we take appropriate measures required by applicable data protection law. Depending on the destination and circumstances, these safeguards may include:

  • an adequacy decision of the European Commission;

  • European Commission Standard Contractual Clauses (“SCCs”); or

  • another legally permitted transfer mechanism.

10. Data retention

We do not retain personal data longer than necessary for the purposes for which it was collected, unless a longer retention period is required by law or necessary for the establishment, exercise or defence of legal claims.

In general:

  • account data is retained while the business relationship or account remains active and afterwards where necessary for legal or administrative purposes;

  • invoices and other records forming part of our statutory financial administration are retained for the period required by applicable Dutch law;

  • support information is retained for as long as reasonably necessary to manage the request, maintain service history and protect legal interests;

  • marketing information is retained until consent is withdrawn, an objection is made, or the information is no longer required;

  • security and technical logs are retained according to our security and operational retention requirements; and

  • end-customer order and shipment data processed on behalf of merchants is retained in accordance with the applicable service requirements, contractual arrangements and merchant instructions, subject to legal obligations.

Data that is no longer required is deleted, anonymised or otherwise securely disposed of in accordance with our data management procedures.

Backup copies may remain available for a limited period as part of our standard backup and recovery processes before being automatically overwritten or securely deleted.

11. Security of personal data

Ectaro maintains technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

These measures include, where appropriate:

  • access controls based on least privilege;

  • restricted administrative access;

  • multi-factor authentication for privileged access;

  • encryption of sensitive data in transit and at rest;

  • firewall and network security controls;

  • security logging and monitoring;

  • vulnerability and patch management;

  • periodic vulnerability assessments and penetration testing;

  • secure backup procedures; and

  • incident detection and response procedures.

Access to personal data is limited to personnel and service providers who require it for authorised business purposes.

12. Your privacy rights

Subject to the conditions and limitations of the GDPR, you may have the right to:

  • request access to your personal data;

  • request correction of inaccurate or incomplete personal data;

  • request deletion of your personal data;

  • request restriction of processing;

  • object to certain processing;

  • receive certain personal data in a structured, commonly used and machine-readable format;

  • request transfer of eligible data to another organisation where applicable; and

  • withdraw consent at any time where processing is based on consent.

You also have the right to lodge a complaint with a competent data protection authority. In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens.

13. Requests to access, correct or delete data

If Ectaro acts as controller of your personal data, you may submit a privacy request by contacting:

[email protected]

Please clearly state the nature of your request and provide sufficient information for us to identify the relevant data.

We may request additional information where reasonably necessary to verify your identity and prevent unauthorized disclosure or deletion of personal data.

We aim to respond to valid privacy requests without undue delay and within the time limits required by applicable data protection law, normally within one month.

Requests relating to a merchant’s end customers

If your personal data was provided to Ectaro by an online seller or merchant in connection with an order or shipment, that merchant will normally be the controller of your personal data.

In this situation, you should submit your request directly to the merchant.

When a merchant asks Ectaro to access, correct, restrict, export or delete personal data that we process on its behalf, we will provide reasonable and timely assistance in accordance with applicable data protection law and our contractual obligations.

14. Data breaches and incidents

Ectaro maintains procedures for identifying, assessing, managing and documenting information security and personal data incidents.

Where a personal data breach occurs, we will assess the incident and notify affected controllers, individuals and/or competent supervisory authorities where required by applicable law.

15. Cookies and similar technologies

Our website uses cookies and similar technologies for essential website functionality and may use additional technologies for analytics, performance or marketing purposes.

Where required by law, non-essential cookies and similar technologies are used only after obtaining appropriate consent.

More detailed information about the cookies and technologies used on our website is available in our Cookie Policy.

16. Third-party websites and services

Our website and platform may contain links to or integrations with third-party websites and services.

Those third parties may process personal data under their own privacy policies and terms. Ectaro is not responsible for processing independently carried out by third parties outside our control.

We recommend reviewing the privacy information of any third-party service you choose to use or connect to EctaroShip.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, data processing activities, legal requirements or security practices.

The latest version will always be published on our website and will include the date of the most recent update.

Where changes materially affect how personal data is processed, we will provide additional notice where required by law.

18. Contact

If you have questions about this Privacy Policy, our processing of personal data or your privacy rights, please contact:

Ectaro B.V.
Prins Mauritslaan 39
1171 LP Badhoevedorp
The Netherlands

Email: [email protected]
Website: https://ectaroship.nl