PacklogX

Privacy Policy

Version 1.0.0 · Effective 20 September 2026

PacklogX respects the privacy of individuals and processes personal data in accordance with applicable data protection law, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

This Privacy Policy explains how PacklogX processes personal data when individuals use the PacklogX Service, visit or interact with PacklogX, or communicate with PacklogX.

Where PacklogX processes personal data on behalf of a customer, PacklogX acts as a processor and the customer remains responsible for the processing as controller, unless applicable law provides otherwise.

1. Controller

For personal data for which PacklogX determines the purposes and means of processing, PacklogX acts as the data controller.

  • Controller and registered trade name: PacklogX
  • KVK number: 42137824
  • VAT ID: NL005526623B29
  • Website: https://packlogx.eu
  • Email: info@packlogx.eu

PacklogX is registered with the Dutch Chamber of Commerce (KVK). The registered visiting address is protected from public disclosure and is therefore not published here. PacklogX has not appointed a Data Protection Officer.

2. Personal Data We Process

Depending on how the Service is used, PacklogX may process the following categories of personal data.

Account and user data:

  • name;
  • email address;
  • company or organisation;
  • user role;
  • preferred language;
  • account and authentication information necessary to provide access to the Service.
  • portal invitations, activation status and the customer or supplier portal role assigned by the inviting organisation.

Service and security data:

  • login and authentication events;
  • audit and security logs;
  • information relating to the use and administration of the Service;
  • support communications and requests.

Customer-provided content: customers may upload or enter information into PacklogX, including packaging, product, supplier, document and compliance information. Such Customer Content may contain personal data. Where PacklogX processes such personal data solely on behalf of the customer, PacklogX acts as processor and processes that data according to the customer’s documented instructions and the applicable Data Processing Agreement.

PacklogX does not require customers to upload personal data that is not necessary for their use of the Service.

Customer Portal and Supplier Portal users receive an invitation from a PacklogX customer or its authorised representative. PacklogX processes the invitee’s name, business email address, invitation and activation status, authentication data, assigned portal role and activity necessary to provide and secure that access. The inviting customer determines who is invited and which portal access is appropriate.

3. Data Minimisation

The PacklogX Service is designed for packaging, product, supplier and compliance information.

Users and customers should only provide personal data that is necessary for the relevant purpose.

Customers and users should not upload special categories of personal data within the meaning of Article 9 GDPR unless processing such information is legally required and the relevant legal requirements are met.

PacklogX does not request sensitive personal information for ordinary use of the Service.

4. Purposes and Legal Bases

PacklogX processes personal data only where there is a valid legal basis under applicable data protection law.

  • a. Providing and administering user accounts and the PacklogX Service. Legal basis: performance of a contract under Article 6(1)(b) GDPR where applicable.
  • b. Managing subscriptions, administration, invoicing and contractual relationships. Legal basis: performance of a contract under Article 6(1)(b) GDPR and compliance with legal obligations under Article 6(1)(c) GDPR where applicable.
  • c. Maintaining the security, integrity and proper operation of the Service. Legal basis: legitimate interests under Article 6(1)(f) GDPR, where applicable, taking into account the rights and interests of individuals.
  • d. Responding to support requests and communications. Legal basis: performance of a contract under Article 6(1)(b) GDPR and/or legitimate interests under Article 6(1)(f) GDPR, depending on the circumstances.
  • e. Complying with legal obligations. Legal basis: Article 6(1)(c) GDPR.
  • f. Creating and administering invoices and recording payment status. Legal basis: performance of a contract under Article 6(1)(b) GDPR and compliance with accounting and tax obligations under Article 6(1)(c) GDPR.

PacklogX will not use personal data for a new incompatible purpose without an applicable legal basis and, where required, providing the information required by the GDPR.

5. Customer Content and Processor Role

When a PacklogX customer uploads or enters Customer Content containing personal data, PacklogX generally processes that personal data on behalf of the customer. In that situation:

  • the customer determines the purposes and means of the processing;
  • PacklogX acts as processor;
  • PacklogX processes the personal data only as permitted by the customer’s documented instructions and the applicable Data Processing Agreement;
  • the customer remains responsible for determining whether the processing is lawful and for providing appropriate information to its own data subjects;
  • PacklogX applies the processor obligations required by Article 28 GDPR.

The Data Processing Agreement governs the processing of personal data by PacklogX on behalf of the customer where PacklogX acts as processor.

At the end of the processing services, personal data processed on behalf of the customer will be returned or deleted in accordance with the applicable agreement, unless Union or Member State law requires further storage.

6. Recipients and Subprocessors

PacklogX uses the following providers where necessary to operate and support the current Service:

  • Lovable Cloud: application hosting, database, authentication and file storage infrastructure.
  • Resend: transactional email delivery, including account confirmation and portal invitations.
  • Lovable AI Gateway and Google Gemini: AI processing for the Support Assistant, import column mapping, supplier datasheet extraction and compliance suggestions when those features are used.

Where a third party processes personal data on behalf of PacklogX in its role as processor, the applicable GDPR requirements for sub-processors must be followed, including the requirements of Article 28 GDPR.

These providers act as subprocessors where they process Customer Content personal data on PacklogX’s behalf. An up-to-date overview of applicable subprocessors and transfer safeguards can be requested via info@packlogx.eu.

Moneybird billing and accounting. For paid subscriptions, PacklogX sends the business identity, billing contact details, invoice line information, amounts, VAT information and PacklogX customer reference needed to create and administer invoices in Moneybird. Moneybird is the system of record for invoice and payment status. PacklogX receives status updates and links them to the corresponding billing record. Moneybird processes this information for invoicing, payment administration and statutory accounting purposes under the applicable arrangements; it is not presented here as a subprocessor for Customer Content processed through the PacklogX Service.

7. International Data Transfers

Personal data may only be transferred to a country outside the European Economic Area where the requirements of Chapter V GDPR are satisfied.

Where an international transfer takes place, PacklogX will rely on an applicable GDPR transfer mechanism, such as:

  • an adequacy decision under Article 45 GDPR;
  • appropriate safeguards under Article 46 GDPR; or
  • another legally applicable mechanism under Chapter V GDPR.

Information about the transfer mechanism applicable to a specific processing activity, and about how a copy of the applicable safeguards can be obtained, is available on request via info@packlogx.eu.

8. Data Retention

PacklogX retains personal data only for as long as necessary for the purposes for which it is processed, unless a longer retention period is required by law.

For Customer Content processed by PacklogX on behalf of a customer, the applicable retention and deletion arrangements are governed by the customer agreement and the Data Processing Agreement.

Customer termination. If a customer terminates its PacklogX subscription, Customer Content will remain available for up to 30 days after the end of the subscription to allow the customer to export its data. After that period, Customer Content will be deleted, unless retention is required by applicable law, or another retention period is required or permitted under the applicable agreement. This 30-day period is a contractual data-export period and is not presented as a GDPR-mandated retention period.

PacklogX service discontinuation. If PacklogX permanently discontinues the Service, the applicable notice and data-export arrangements are governed by the PacklogX Terms and Conditions. During the applicable notice period, customers will have the opportunity to export their Customer Content. Where the Terms and Conditions provide for an additional read-only period after discontinuation, that period applies before deletion.

9. Data Subject Rights

Depending on the circumstances and applicable law, individuals may have rights under the GDPR, including:

  • the right to obtain access to personal data;
  • the right to have inaccurate personal data corrected;
  • the right to request erasure of personal data;
  • the right to request restriction of processing;
  • the right to object to certain processing;
  • the right to data portability where the legal conditions for that right are met;
  • the right to withdraw consent where processing is based on consent.

These rights are subject to the conditions and limitations provided by the GDPR, and not every right applies to every processing activity.

Where PacklogX acts as processor on behalf of a customer, requests relating to Customer Content should normally be directed to the relevant customer/controller. PacklogX will provide the assistance required under the applicable Data Processing Agreement and Article 28 GDPR.

Individuals also have the right to lodge a complaint with a competent supervisory authority. For PacklogX’s own controller processing in the Netherlands, the competent supervisory authority is generally the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

10. Exercising Rights

Requests concerning personal data processed by PacklogX as controller can be sent to info@packlogx.eu.

PacklogX may request additional information where reasonably necessary to verify the identity of the person making the request.

PacklogX will handle requests in accordance with the applicable GDPR requirements and statutory time limits.

11. Security

PacklogX applies appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the risks associated with the processing (Article 32 GDPR).

Measures implemented in the current Service include:

  • encryption of data in transit (HTTPS/TLS);
  • authenticated access with role-based access control;
  • database access controls, including row-level security rules that separate data per organisation;
  • audit logging of relevant actions within the application.

12. Automated Decision-Making and AI

PacklogX may use automated processing and AI-supported functionality to assist with packaging and compliance-related tasks, such as supporting data import and answering support questions.

PacklogX does not use these features to make decisions concerning individuals that produce legal effects concerning them or similarly significantly affect them within the meaning of Article 22 GDPR.

AI-supported outputs do not change the responsibility of the relevant customer/controller for its own processing of personal data.

13. Changes to This Privacy Policy

PacklogX may update this Privacy Policy where necessary, for example due to changes in the Service, processing activities or applicable law.

The current version and effective date will be shown in the application.

Where required by applicable law, PacklogX will provide additional information or notice regarding material changes.

14. Contact

For privacy-related questions or requests concerning processing for which PacklogX is controller:

  • PacklogX
  • KVK number: 42137824
  • VAT ID: NL005526623B29
  • Email: info@packlogx.eu

PacklogX business details

The registered visiting address is protected from public disclosure and is not published here.