VECTYS privacy policy

Courtesy translation. In the event of any discrepancy, the French version of this privacy policy prevails.

Publisher and controller: VECTYS, a simplified joint-stock company (société par actions simplifiée) with a share capital of 2,000 euros, registered with the Paris Trade and Companies Register under number 108 300 450, whose registered office is at 21 B avenue d’Iéna, 75116 Paris (“VECTYS”, “we”).

Version 2 of 20 October 2026. It replaces the version of 13 August 2026.

Contents

1. Who is this policy for and who is responsible for your data?
2. What data do we process on our own behalf and where does it come from?
3. Why do we process this data, on what basis and for how long?
4. Who has access to this data?
5. Does this data leave the European Union?
6. How do we protect your data?
7. If your transport company is verified by a VECTYS client
8. If you use VECTYS AI on behalf of a client
9. Cookies and other trackers
10. What are your rights and how can you exercise them?
11. How does this policy change?

1. Who is this policy for and who is responsible for your data?

1.1 The people concerned

This policy is for you if you are:

• a visitor to our website www.vectys.ai or a prospect who contacts us or whom we contact,
• a user of VECTYS AI, appointed by one of our clients, or a contact person at one of our clients for the management of the contract,
• a director, partner, signatory, employee or contact person of a transport company, or a sole trader carrying out a transport activity, whose verification is requested by one of our clients.

1.2 When we are the controller

We decide how the data is used, and are therefore the controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (the “GDPR”), for our website, our commercial exchanges, the management of the contracts concluded with our clients, the management and security of user accounts, the proof of acceptance of the terms of use of our deposit space and the maintenance of a reference database consulted during verifications. Sections 2 to 6 describe this processing.

1.3 When we act on behalf of our clients

When a client asks us to verify a transport company, it is the client that decides on that verification and on what follows from it: it is the controller. We act on its behalf and on its instructions, as processor within the meaning of Article 28 of the GDPR, under a contract that complies with that article. Sections 7 and 8 describe this processing.

1.4 Data protection contact

We have not appointed a data protection officer. Our data protection contact can be reached at rgpd@vectys.ai or by post at the registered office of VECTYS, for the attention of the data protection contact.

2. What data do we process on our own behalf and where does it come from?

2.1 Data you provide to us

• Identity and business contact details: surname, first name, job title, company, business email address and phone number.
• Account data: email address, name, organisation, role, language and notification preferences, and password, which we keep only in a transformed, non-reversible form.
• Contractual relationship data: subscribed offer, billing details, history of the relationship and of our exchanges.

2.2 Data generated by your use of our services

• Connection and administration logs: user identifier, IP address, date and time, operation performed and result (success or failure).
• Proof of acceptance of the terms of use of the Deposit Space: identifier of the access link, email address to which it was sent, version of the terms accepted, date and time of acceptance and of submission.
• Browsing data on our website, under the conditions of section 9.

2.3 Data we receive from other sources

• From your organisation: when a client asks us to open an account for one of its employees, it provides us with their name, business email address and role. The invitation message informs you of this.
• For the reference database described in section 3.1: verifications concluding with a green indicator, carried out for those of our clients that have agreed that they feed it, where the documents were submitted by the transport company through our deposit space. Only the association between the company’s identifier and the domain of its email address (or the full address for a consumer email service) is taken from them.

2.4 Data we do not collect

We do not collect so-called sensitive data (health, opinions, origin, biometric data, etc.) or data relating to criminal convictions. We ask you not to send us any.

2.5 Mandatory and optional data

In our forms, essential fields are marked with an asterisk. Without this data, we cannot respond to your request, open your account or perform the contract concluded with your organisation. The other fields are optional.

3. Why do we process this data, on what basis and for how long?

3.1 Processing for which we are the controller

Where we rely on our legitimate interest, we describe it, and you can object to the processing (section 3.2).

3.2 Details on the legal bases

Where we rely on our legitimate interest, we have checked that the processing is necessary for that interest and does not disproportionately affect your rights. You can obtain details of this assessment by writing to us.

When you use VECTYS AI because a client invited you to, you are not yourself party to the contract concluded with it: it is our legitimate interest in performing that contract that is the basis for managing your account.

3.3 What we do not do

• We do not sell or rent your data.
• We do not take any decision about you based solely on automated processing. In verifications, it is our client that decides (section 7.4).
• We do not run targeted advertising and do not track your browsing on other websites.
• We do not use transport companies’ documents or the reports for our own purposes or to train artificial intelligence models. Of the data processed for our clients, we take only the association described in section 3.1, with their agreement.

4. Who has access to this data?

4.1 Our teams

Only the VECTYS staff who need it have access, under named authorisations, and they are bound by confidentiality.

4.2 Our service providers

Service providers process this data on our behalf, on our instructions and under a contract that complies with Article 28 of the GDPR. They fall into the following categories:

The name of each service provider appears on the www.vectys.ai/sous-traitants page, which is kept up to date.

4.3 Our clients

During a verification, our clients receive the information from the reference database described in section 3.1. The administrator of the client organisation sees the accounts of the users they have appointed.

4.4 Authorities and our advisers

We disclose data to authorities that request it in the cases provided for by law, and to our advisers (lawyers, chartered accountants), who are bound by professional secrecy, for the purposes of their engagement. Where an authority’s request concerns data processed on behalf of a client and the law does not prohibit us from doing so, we inform that client before responding.

4.5 If our company changes

In the event of a sale, merger or reorganisation, your data may be transferred to the successor, to the extent necessary for the continuation of the business. We will inform you.

5. Does this data leave the European Union?

The data of VECTYS AI is processed in the European Union, with the exception of the database, hosted in the United Kingdom, a country recognised by the European Commission as providing an adequate level of protection. The hosting of the website and the protection of accounts are provided in the United States by service providers certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023). Where a customer relationship management tool is established outside the European Union, the transfer is based on an adequacy decision or on the European Commission’s standard contractual clauses. The support teams of our hosting providers may occasionally access the data from a third country, only at our request, under these clauses. The www.vectys.ai/sous-traitants page states the safeguard applicable to each service provider, and a copy can be obtained by writing to rgpd@vectys.ai.

6. How do we protect your data?

We encrypt data in transit and at rest, restrict access to data and to administration consoles to individually authorised persons, with strong authentication, segregate each client’s data and log administration operations. If a data breach likely to result in a high risk to your rights were to occur, we would inform you as soon as possible. Where it concerns data processed on behalf of a client, we inform the client within the time limits agreed with it, so that it can meet its own obligations.

7. If your transport company is verified by a VECTYS client

7.1 Who is responsible?

The controller is the VECTYS client that requested the verification, generally a freight forwarder, a charterer or a shipper (the “Client”). Its name and the address at which it can be contacted appear in the invitation message and in the deposit space. VECTYS processes the data on its behalf, as processor.

7.2 What data and where does it come from?

• Data provided by your company, or by the Client where it already holds it: name, country, register identifier, EU VAT number, address, email address and phone number. Requested documents, such as the insurance certificate, the transport licence and the company register extract, and the data they contain: surname, first name and position of the directors, partners and signatories and, where they appear, their date of birth and nationality.
• Data produced during submission: country inferred from the IP address of the person submitting the documents (the IP address is not kept by VECTYS), file metadata.
• Data from external sources, mostly publicly accessible: official registers of companies and transport operators (for France, INSEE Sirene, Infogreffe, BODACC and the national electronic register of transport companies, as well as the registers of other Member States), which provide information in particular on the identity of directors and partners and on recent changes to them, the European Commission’s VAT Information Exchange System (VIES), the Boletín Oficial del Registro Mercantil for Spain, sanctions lists published by OpenSanctions, domain name registries, line type and carrier of the phone number, and the reference database kept by VECTYS (section 3.1).
• During an additional review requested by the Client, information obtained from your company or its insurer, with the Client’s agreement and on its behalf.

No health data or data relating to criminal convictions is sought. Sanctions lists are queried on their “sanctions” collection only, excluding data relating to arrest warrants and criminal entities.

7.3 Why and on what basis?

The data is processed to verify the identity and good standing of your company, its insurance cover and the authenticity of its documents, before the Client entrusts it with a transport operation, and to produce a report intended only for the Client’s authorised users.

This processing is based on the Client’s legitimate interest in preventing identity theft, document forgery and cargo diversion (Art. 6(1)(f) GDPR). The GDPR states that “the processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned” (Recital 47). This processing is not based on your consent.

The information marked as mandatory in the deposit space is necessary for the verification. Without it, the verification cannot be carried out, and it is for the Client to draw the consequences.

7.4 How does the verification work and what role does artificial intelligence play?

The documents are read by artificial intelligence models, Google’s Gemini models run in the European Union on the Google Cloud Vertex AI service, which extract the relevant information, check consistency between the documents and write a summary. These models do not keep the data beyond generating the result, subject to their provider’s abuse-detection mechanisms, and do not use it for training.

External checks (registers, VIES, sanctions lists, analysis of the email address, the phone number and the country of connection) are carried out by conventional queries, without artificial intelligence. A technical analysis of the files (metadata, traces of editing) is carried out by VECTYS’s own tools.

The score and colour of the vigilance indicator (green, orange or red) are calculated by a deterministic formula defined by VECTYS, into which the findings of the models and of the checks enter as signals among others. No artificial intelligence model sets the indicator. The report does not characterise any fact as fraud or as an offence.

The decision whether or not to entrust an operation to your company rests with the Client, which decides in the light of, among other things, the report and the points of vigilance it details, and arranges for any unfavourable decision to be reviewed by a person. You can submit your comments to it, send it additional documents and contest its decision with it. The Client can obtain from VECTYS a description of the general logic of the verification, the categories of sources consulted and the criteria used to calculate the indicator, which it can pass on to you.

7.5 Who has access to the data?

The report and the file data are accessible only to the Client’s authorised users and to authorised VECTYS staff. They are not disclosed to any other VECTYS client and are not used for verifications carried out for other clients, with one exception: where the Client has agreed to it, you submitted your documents through the deposit space and the verification concludes with a green indicator, the association between your company’s identifier and the domain of its email address (or the full address for a consumer email service) is taken by VECTYS, on its own behalf, into the reference database described in section 3.1, without any indication of the Client.

VECTYS uses service providers, which act on its instructions and fall into the following categories:

The name of each service provider appears on the www.vectys.ai/sous-traitants page.

The operators of the registers consulted that are not VECTYS service providers receive only the company’s identifier, name or VAT number, or the domain name of its email address. They receive no documents. Finally, the data may be disclosed to authorities that request it in the cases provided for by law.

7.6 Does the data leave the European Union?

Data hosted in the United Kingdom is hosted on the basis of the European Commission’s adequacy decision for that country. Transfers to the United States are based on the EU-US Data Privacy Framework where the service provider is certified under it, and on the European Commission’s standard contractual clauses. The support teams of the hosting providers may occasionally access the data from a third country, only at VECTYS’s request, under these clauses. The www.vectys.ai/sous-traitants page states the safeguard applicable to each service provider, and a copy can be obtained at rgpd@vectys.ai.

7.7 For how long?

Unless the Client decides on a shorter period:

• submitted documents: four (4) months from the verification, then automatic deletion,
• extracted data, verification results and report: twenty-four (24) months from the verification, then automatic deletion,
• technical logs: thirty (30) days at most; backups: seven (7) rolling days,
• requests sent to the artificial intelligence models, if their provider detects abusive use: ninety (90) days at most, in the European Union.

The Client can delete a file at any time, with immediate effect for the documents, the extracted data and the report.

7.8 Your rights

You have the right of access, rectification, erasure and restriction of processing of the data concerning you. These rights are exercised with the Client or at rgpd@vectys.ai, which forwards your request to the Client within ten (10) days. You will receive a response within one month, which may be extended by two months given the complexity or number of requests, in which case you will be informed within the first month. You can lodge a complaint with the CNIL or with the supervisory authority of the Member State of your habitual residence, your place of work or the place of the alleged infringement.

8. If you use VECTYS AI on behalf of a client

Your organisation decides on the verifications carried out, on who has access to them and on the deletion of files. The files you create, including the indication of the user who launched or deleted a verification, are processed on its behalf, and it is with your organisation that you exercise your rights over this data. Your account, your preferences and your connection logs, on the other hand, fall under the processing for which VECTYS is the controller (section 3). The administrator of your organisation can create, modify or close your account, and these decisions are their responsibility.

9. Cookies and other trackers

On our website, we use trackers that are necessary for it to work (remembering your language and your choice regarding trackers), which do not require your consent. Audience measurement is carried out only with your agreement, which you give or refuse in the banner shown on your first visit and which you can change at any time through the “Cookie preferences” link at the bottom of every page. Refusing is as easy as accepting, and your choice is kept for six (6) months.

In VECTYS AI and the deposit space, we use only strictly necessary trackers (session maintenance, security, language), which do not require consent. Our emails contain no trackers.

10. What are your rights and how can you exercise them?

For the processing for which we are the controller (sections 2 to 6), you have the following rights:

• Access: obtain confirmation that we process your data and receive a copy of it,
• Rectification: have inaccurate data corrected or incomplete data completed,
• Erasure: obtain the deletion of your data, subject to the data we must keep,
• Restriction: have the use of your data frozen, for example while its accuracy is checked,
• Objection, under the conditions of the box in section 3.2,
• Instructions after your death: set instructions on the retention, erasure and communication of your data after your death.

You exercise these rights by writing to rgpd@vectys.ai, specifying the right concerned. We respond within one month, which may be extended by two months if the request is complex, in which case we inform you within the first month. We ask for proof of identity only where there is reasonable doubt. Exercising your rights is free of charge. You can lodge a complaint with the CNIL (cnil.fr) or with the supervisory authority of the Member State of your habitual residence, your place of work or the place of the alleged infringement.

For verifications carried out on behalf of our clients, section 7.8 applies.

11. How does this policy change?

We may amend this policy to take account of changes to VECTYS AI, to our service providers or to the regulations. Each version is dated. A significant change (new purpose, new recipient, new transfer outside the European Union) is announced to users by email or in VECTYS AI before it takes effect, and our clients are informed of any change concerning the processing carried out on their behalf.