Privacy Policy

Effective date: February 21, 2026 

1) Who we are (Data Controller) 

Instant Shipping (“we”, “our”, “us”) operates in Saint‑Martin (French West Indies) and determines the purposes and means of processing personal data collected through this website and our shipping services. We are therefore the data controller under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés). Our supervisory authority is the CNIL (Commission Nationale de l’Informatique et des Libertés).^1 2 

• Contact : infos@instantshipping.net  
• Postal address:  Baie De Potence Galisbay 4A, 4B, 97057 St. Martin Cedex BP 679

2) What Data We Collect 

We collect only what we need to provide and improve our shipping services and website: 

• Account & Identity Data: name, company, role, email, phone, billing/delivery addresses, login details. 
• Shipment Data: consignor/consignee details, pickup/delivery addresses, customs/tax identifiers included on the Bill of Lading, parcel contents descriptions, and tracking numbers (to perform the contract and comply with legal obligations).⁴ 
• Transaction Data: order history, invoices, payment status (payments may be processed by PCI‑compliant providers). 
• Support & Communications: messages sent to customer service (email, forms, chat), call notes. 
• Technical Data: device, browser, IP address, log files, and cookies/trackers per our Cookie section (see §7). CNIL applies strict consent rules under Article 82 of the French Data Protection Act (transposing the ePrivacy Directive).⁵ 

3) Purposes and Lawful Basis 

We process personal data only where a lawful basis under GDPR Article 6 applies: consent, contract, legal obligation, vital interests, public task, or legitimate interests (after balancing).^6 7 

When relying on legitimate interests, we document a balancing test consistent with EDPB Guidelines 1/2024.¹⁴ 

4) Where your data comes from 

• You (forms, checkout, contracts, support, newsletter subscription). 
• Operational partners strictly necessary for shipping (carriers, fulfillment partners, customs brokers). 
• Payment providers (payment status only; we do not store full card details). 
• Website (technical logs, cookie‑based telemetry under consent rules). CNIL guidance applies to cookies/other trackers.¹⁵ 

5) Sharing Your Data 

We share data only with recipients that support our services and are under appropriate contracts (GDPR Art. 28/46): 

• Carriers & logistics partners (pick‑up, transit, delivery; data printed on labels/manifests/Bills of Lading). 
• IT and cloud service providers (hosting, CRM, ticketing, email, analytics—subject to data processing agreements). 
• Payment processors (fraud checks, payments). 
• Professional advisers (auditors, legal counsel) and authorities where legally required. 
• Supervisory authorities upon request (e.g., CNIL).¹⁶ 

6) International Data Transfers 

If data is accessed or hosted outside the EEA, we use a valid transfer mechanism (GDPR Chapter V): 

• Adequacy decisions (e.g., UK, Japan, Korea, Switzerland, US for certified companies under the EU‑US Data Privacy Framework).^17 18 
• Standard Contractual Clauses (SCCs) plus Transfer Impact Assessments (TIAs) and supplementary measures when required by Schrems II and CNIL’s TIA guidance.^19 20 
• Requests from third‑country authorities are vetted per EDPB Guidelines on Article 48 (only where an applicable international agreement or other GDPR ground permits disclosure).²¹ 

7) Cookies and Similar Technologies 

We use cookies/trackers to run the site, remember preferences, measure audiences, and (with consent) personalize marketing. 

• Consent first: Except for cookies that are strictly necessary (e.g., authentication, basket, load‑balancing, language), we ask for your prior consent and provide an equal, easy “Reject All / Accept All / Customize” choice.²² 
• Scope of the cookie rule: The ePrivacy rule (transposed in France by Article 82 of the Data Protection Act) also covers non‑cookie technologies (e.g., local storage, pixels). The EDPB interprets this broadly.^23 24 
• Enforcement: CNIL has actively fined organizations for non‑compliant banners and pre‑consent drops. We design our banner, proof of consent, and granular controls accordingly.²⁵ 

You can change or withdraw your consent anytime via Cookie Settings in the site footer. 

8) Data Retention 

We keep personal data only as long as needed for the stated purposes and legal/regulatory requirements, then delete or anonymize it following CNIL’s retention lifecycle (active use → intermediate archiving → deletion/final archiving).²⁶ 

Typical periods (illustrative): 

• Customer/account records: while your account is active + up to 5 years for contract/tax evidence (adjust with your accountant and sector rules).²⁷ 
• Marketing data: until you withdraw consent or after 3 years of inactivity (CNIL prospect data practice).²⁸ 
• Web server logs/security logs: usually 6 months unless a security incident requires longer retention.²⁹ 
• Shipping/transport documents: retain per applicable transport and customs law; align with your operational/legal obligations (consult your broker and counsel).³⁰ 

We maintain a retention schedule that maps each data category to its period and deletion method (erasure or anonymization).³¹ 

9) Your Rights 

Within the EU/France framework, you have the following rights regarding your personal data: 

• Access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), and the right to withdraw consent at any time (without affecting prior lawful processing). 
• How to exercise: contact us at infos@instantshipping.net. We will respond within one month (extendable by two months for complex requests). If unresolved, you can complain to the CNIL.³² 

10) Children’s data 

Our services are intended for business and adult customers. We do not knowingly collect data from children below the local age of digital consent; if we discover such processing, we will delete the data promptly. (France has specific rules on child consent under the French Act—use safeguards if you ever target minors.)³³ 

11) Security 

We implement appropriate technical and organizational measures (access controls, encryption in transit and at rest where applicable, least privilege, logging/monitoring, vendor due diligence, secure development practices, and incident response). We also require our processors to commit to equivalent protections via Article 28 agreements.³⁴ 

12) Data breaches 

If a personal data breach occurs, we will assess the risk and notify the CNIL within 72 hours where required and affected individuals when the breach is likely to result in a high risk to their rights and freedoms, in line with GDPR and French law.³⁵ 

13) Changes to this Policy 

We may update this Privacy Policy to reflect changes in our practices, technologies, or legal requirements. Material changes will be communicated through the website and, where required, by email prior to effectiveness. Please review this page regularly.³⁶ 

Privacy & Cookies — We process personal data in accordance with the GDPR, France’s Data Protection Act, and CNIL cookie rules. Some services may involve international transfers; where they do, we rely on an adequacy decision or SCCs with a Transfer Impact Assessment. Manage your preferences anytime via Cookie Settings. See our full Privacy Policy for details.^{37 38 39 40}