Data controller
The data controller is RufioExpress, […], which runs the website rufioexpress.com and the RufioExpress shipment booking service. For any question about your data, write to [email protected].
What data we collect
Booking data: name, address, phone and email of the sender and the recipient, which you provide in the booking form.
Parcel data: number of parcels, weight, dimensions, description and value of the contents, and your insurance choice.
Parcel photos: the photos of the sealed parcel, of the tape measure on its sides and of the scale that you upload from the order page. Before sending, your browser shrinks the image and removes location (GPS) data.
Payment data: payment takes place on Stripe. We neither see nor store your full card number; Stripe only sends us the payment result and a reference to the card saved with Stripe.
Communications: the messages you send us by email or WhatsApp for support.
Technical data: IP address, browser type and server logs, used for security and to limit abuse; technical cookies and, only with your consent, analytics and marketing cookies (see the cookie policy).
How we use data and on what basis
To perform the shipping contract: calculate the price, book collection and delivery with the carrier, create labels, send you confirmations, status updates and tracking by email and WhatsApp, and support you.
To apply the conditions you accept when booking: check weight and size limits with the photos, charge any penalty provided for in the Terms (section 3) to the saved card, and handle insurance claims.
To meet tax, accounting and customs obligations.
For our legitimate interest in the security of the service and in preventing fraud.
For marketing and statistics only if you have given consent, which you can withdraw at any time from "Cookie preferences" at the bottom of the site.
We do not use your data for automated decisions with legal effects on you, and we do not sell it.
Who we share data with
Carriers handling the transport (for example UPS, DHL, FedEx or their intermediaries): they receive the sender, recipient and parcel data needed for the shipment.
Stripe: payments, refunds and penalty charges.
Google: sending service emails from our company account and, when enabled, the address search in the form (Google Maps Platform), which receives the text you type in the address field.
Cloudflare and our hosting provider: secure delivery and storage of the site's data.
WhatsApp (Meta): only if you write to us or receive notifications on WhatsApp.
The insurance company, only if you make a claim.
Advertising platforms (Google, Meta, TikTok) only with your consent to marketing cookies.
Google services and Google account data
RufioExpress uses Google APIs (Gmail API) only to send service emails, such as order confirmations and notifications, from its own company account. We do not ask visitors or customers to sign in with their Google account, and we do not read, store or share data from anyone else's Google account.
RufioExpress's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Transfers outside the European Union
Some providers (Stripe, Google, Cloudflare, Meta) may process data in the United States or other countries outside the EU. In these cases the transfer relies on the EU-US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.
How long we keep data
Orders and accounting records: for as long as tax law requires (usually 10 years).
Parcel photos and insurance evidence: until any dispute, penalty or claim related to the shipment is closed.
Support messages and technical data: for as long as needed to handle the request and keep the service secure.
Security
The site uses encrypted connections (HTTPS). Uploaded photos and documents are accessible only to authorised staff; credentials for external services are stored encrypted.
Your rights
You can request access, rectification, erasure, restriction and portability of your data, object to processing and withdraw consent by writing to [email protected]. We reply within one month. You can also lodge a complaint with the data protection authority of your country.
Changes
If we change this notice, we publish the new version here with its update date.
Last updated: 2026-10-19