Privacy notice

1. Who we are

UAB Kelvara ("Kelvara", "we", "us") is a company registered in Lithuania, company code 305812447, with its registered office at Verslo al. 12, LT-44210 Kaunas, Lithuania. For the purposes of the GDPR we act as a data controller for the personal data we collect about website visitors, prospective customers and job applicants, and as a data processor for personal data our customers process through the Kelvara platform.

You can contact our data protection team at privacy@dpd-lt.com.

2. The distinction between controller and processor

This distinction matters, so we state it plainly:

• When you visit this website, contact our sales team, or apply for a job, Kelvara decides why and how your data is used. We are the controller, and this notice governs that use.
• When a logistics operator uses Kelvara to plan and track deliveries, the recipient and consignment data flowing through the platform belongs to that operator. They are the controller; we process it on their instructions under a data processing agreement. If you are a delivery recipient with a question about your parcel data, contact the retailer or carrier who arranged the delivery.

3. Personal data we collect as a controller

Category	Examples	Source
Contact data	Name, work email, phone, company, job title	You, via forms and email
Enquiry data	The content of your message, sector, parcel volume	You
Recruitment data	CV, cover note, correspondence, interview notes	You and, where relevant, referees
Technical data	IP address, browser type, pages viewed, referring URL	Collected automatically
Account data	Login identifier, role, audit-log activity	Customer administrators and you

4. Why we use your data and our lawful basis

Under Article 6 of the GDPR we rely on the following bases:

Purpose	Lawful basis
Responding to a sales or general enquiry	Steps taken at your request prior to entering a contract; our legitimate interest in growing our business
Providing the platform to a customer	Performance of our contract with that customer
Assessing a job application	Steps prior to entering an employment contract; our legitimate interest in recruiting
Securing and improving our website	Our legitimate interest in a safe, functional service
Sending occasional product updates to existing contacts	Consent, or legitimate interest where a soft opt-in applies; you can object at any time
Meeting legal, tax and accounting obligations	Compliance with a legal obligation

5. How long we keep it

We keep personal data only as long as necessary for the purpose it was collected for:

• Sales enquiries: up to 24 months after our last contact, then deleted or anonymised.
• Unsuccessful job applications: 12 months, so we can consider you for other roles, unless you ask us to delete sooner.
• Customer account data: for the life of the contract and up to 90 days after termination, after which it is deleted or returned.
• Data processed on a customer's behalf: according to the retention policy that customer configures, including proof-of-delivery media.
• Accounting records: as required by Lithuanian law, typically 10 years.

6. Who we share it with

We do not sell personal data. We share it only with:

• Sub-processors who help us run the service — cloud hosting, email delivery, error monitoring and analytics. Each is bound by a written contract and listed in our sub-processor register, available to customers on request.
• Professional advisers such as auditors and lawyers, where necessary and under confidentiality.
• Authorities, where we are legally required to disclose.

7. Where your data is processed

Kelvara hosts personal data within the European Economic Area (data centres in Frankfurt, Germany and Stockholm, Sweden). We do not routinely transfer personal data outside the EEA. Where a sub-processor requires a limited transfer, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses together with supplementary safeguards.

8. Your rights

Where we are the controller, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to our processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting prior processing.

To exercise any of these, email privacy@dpd-lt.com. We respond within one month. If you believe we have handled your data improperly, you may lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija) at vdai.lrv.lt, though we would appreciate the chance to resolve it first.

9. Cookies

This website uses a minimal set of cookies. We do not use advertising or cross-site tracking cookies.

Cookie	Purpose	Duration
Strictly necessary	Security and load balancing; the site will not function without them	Session
Preference	Remembers choices such as language and cookie consent	6 months
Analytics (aggregate)	Privacy-friendly, cookieless page-view counting; no cross-site profiling	n/a

You can control cookies through your browser settings. Blocking strictly necessary cookies may break parts of the site.

10. How we protect your data

We encrypt personal data in transit (TLS) and at rest, restrict access on a least-privilege basis, log administrative actions, and review our security controls regularly. Proof-of-delivery media is stored in EU regions and expires under the retention policy of the responsible customer. No system is perfectly secure, but we take our obligations seriously and maintain a documented incident-response process.

11. Changes to this notice

We may update this notice as our services or the law change. We will post the revised version here with a new "last updated" date, and for material changes we will make reasonable efforts to notify affected individuals directly.

12. Contact

Questions about this notice or your personal data: privacy@dpd-lt.com, or by post to Data Protection, UAB Kelvara, Verslo al. 12, LT-44210 Kaunas, Lithuania.