What we keep, and why.

OBC Portal is developed, owned and managed by Doowat bv, based in Belgium. It connects onboard couriers with brokers who need transport capacity. Doowat bv is the controller of the personal data described here.

This notice covers the public website at obcportal.com, the member portal at app.obcportal.com, the mobile apps, and anyone who opens a shared courier dashboard. It applies to couriers, brokers and visitors who send us a message or request access.

Privacy questions, requests or complaints can be sent to privacy@obcportal.com. You can also reach us at support@obcportal.com.

The public site has two forms, and each one stores exactly what you type into it:

• Request Access: your name, email, phone number, a line about your experience, and the date and time you sent it.
• Contact: your name, email, message, and the date and time you sent it.

Nothing else identifies you to us on the public site. We do not ask for your address, your date of birth or your passport number here, and the site stores no copies of any document.

The member portal is invitation-only, with no open sign-up. When you receive an account, we keep the information needed to operate it and the details you add:

• Account: your email address and a securely hashed password.
• Courier profile: your chosen display name and profile photo.
• Contact channels: your WhatsApp number, Telegram handle and up to two phone numbers, if you add them.
• Work and eligibility: base airports, home locations (addresses and airports), availability, lead time, vehicles and car availability, travel preferences and exclusions, and emergency contact details where provided.
• Document details: passports, visas, resident cards, driving licences, medical certificates and a yellow-fever declaration where provided, including extracted details such as document numbers and expiry dates.
• Missions and handovers: departure and destination airports, flight numbers and times, planned return flights, and mission and handover records. Relevant mission information is used for matching.
• Broker accounts: name, work email and broker organisation, including its email domain. Administrators and other members of that organisation can see these details; couriers see the broker's name when contacted through the platform.

If you upload a document scan, it is used only to extract and fill in the corresponding profile details. The scan is deleted immediately after extraction and is not retained or shown to brokers. Only the extracted details remain in your profile, visible to you; brokers receive relevant document and eligibility status rather than the scan itself.

With Dynamic (GPS) location enabled, the mobile app or web application uses your device's position to calculate realistic travel times. The platform records your position and a last-seen time to keep travel times and availability accurate. With Fixed location selected, it uses your saved home location instead and does not process GPS data for you.

• Background tracking in the Android app updates your position while you travel, including when the app is in the background. You can revoke the permission in your phone settings; the app then falls back to your fixed location.
• Location is used to calculate distances and travel times to airports or pickup locations, show a last-seen time, and keep availability current.
• Brokers see location-derived information, such as travel times, distances, last-seen time and an airport- or city-level location category, not raw GPS coordinates or your street address.
• Without an internet connection, your position and availability are not updated until connectivity returns. Nothing is stored on the device for later upload.
• You can switch between Dynamic and Fixed location at any time in the web dashboard or mobile app.

The public site keeps basic visit statistics — pages viewed, referring site, country of origin — so we can see what people actually read. It sets no advertising cookies, loads no social-media trackers, and does not follow you around the web.

Public form submissions let us answer messages, decide whether to issue access and keep track of conversations. The website notice relies on the consent you give when sending a message, together with our legitimate interest in replying and keeping the site usable.

In the member portal, we use data to provide the service you requested: matching availability and travel times with missions, managing document details and expiry reminders, operating invitations and contact requests, and securing accounts. The legal basis is our contract with you and, where needed, our legitimate interest in keeping the platform secure and preventing abuse.

Where consent is required, such as background location tracking on Android, it is given through your device's permission prompt and can be withdrawn at any time.

The Doowat bv team can read public form submissions. Each access request is also emailed to the address handling courier applications. Platform administrators can view courier profiles and dashboards to manage invitations, approvals and support. We do not sell personal data or share it for marketing.

Brokers receive information through the platform, not direct access to the database:

• Search results: availability, airport- or city-level location category, travel times and distances, relevant visa and document status, last-seen time and relevant mission information. Raw GPS coordinates are never exposed.
• Contact requests: a broker's request triggers a WhatsApp message to you. If you accept, your contact channels are visible to that broker for 24 hours. Declining or ignoring the request does not share your details.
• Associated couriers: if you accept an invitation to associate with a broker's organisation, that organisation can see your direct contact channels while the association remains active.
• Shared dashboards: you choose whether to create a time-limited sharing link and whether to include approximate location. You can revoke the link at any time. Viewers receive only the information shown on the shared page, served through a proxy.

Contact requests are sent through WhatsApp using our business phone number and the number in your profile. Meta (WhatsApp) processes message content under its own privacy policy. Your Accept or Decline reply updates the request in OBC Portal.

Our hosting, database and email providers process data to operate the service. Other providers include HERE for routing and traffic calculations, AeroDataBox for flight information, and Flightradar24 for airport disruption data. We send only what is needed for each service, such as an airport code or coordinates needed to calculate travel time. These providers also have their own terms.

Member service emails, including invitations, expiry warnings and contact-request notifications, are sent from noreply@app.obcportal.com and include an unsubscribe link where applicable. Public access-request notifications use the website's email service. The platform has no in-app payments and does not collect payment details.

The website's hosting and database arrangements use European Union storage. Third-party services may involve processing outside the European Economic Area. Where an international transfer requires safeguards, we rely on the standard contractual clauses issued by the European Commission.

Access requests stay while we decide on access and afterwards only while relevant to a courier we may work with. Contact messages stay until the conversation is closed. You can ask us to delete your details, unless we must retain them by law.

Member profile, location and mission data are kept while your account is active. Pending contact requests expire after 2 hours; accepted contact details stop being visible through that request after 24 hours. An active organisation association is a separate basis for contact visibility, as explained above.

When your account is deleted, your profile, document details and locations are removed. Records needed for security, disputes or legal obligations are kept only as long as necessary. Uploaded document scans are deleted after extraction, rather than retained for the life of your account.

Traffic is encrypted in transit using HTTPS. Data is held in a managed cloud database with access controls: members are restricted to authorised data, brokers to permitted information for their organisation, and sensitive data to explicitly authorised users. Administrative access is limited to platform staff.

Passwords are protected with industry-standard hashing. Document scans are processed privately for extraction, never made publicly accessible, and deleted after extraction. The retained profile details remain subject to access controls.

Both forms carry protection against automated submissions: a hidden field that only bots fill in, and a check on how fast a form was completed. Those checks exist to keep junk out. They are not used to identify anyone.

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to pause its use, ask for your data in a portable form, or object to the way we use it. Withdrawing consent does not change anything that has already happened.

In the app, you can edit or remove profile details, document details, bases and locations, and switch off Dynamic location. For other requests, including full account deletion, email privacy@obcportal.com or support@obcportal.com; we answer within thirty days. These rights apply under the GDPR in the EU/EEA and under applicable data protection law in the UK. If you think we have mishandled your data, you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données).

OBC Portal is a professional platform and is not intended for anyone under 16. We do not knowingly collect personal data from children.

When we change it, the date at the top of this page changes with it. If a change affects how we use data you already gave us, we tell you before it takes effect. Material changes affecting members are also announced in the app.