Privacy policy

Controller and contact
The Operator manages the CargoTeca platform and processes personal data under this policy. Contact for support, complaints and personal-data requests: info@cargoteca.eu.

Data used
Registration and service features involve account and profile details, contacts, role and company membership, listings, enquiries, messages and submitted files. The categories depend on account type and features used. Profile checks may include registration information and documents supplied by the user, and official-register information within the scope of the check.

Security uses session, device or browser information, IP addresses, action times and results, sign-in attempts and administrative decisions. Never send your password to support or publish it in a profile.

The driver starts GPS sharing for a particular trip and can stop it. Only authorised participants in that trip see precise coordinates. No new coordinates are collected outside enabled tracking. Enabling the feature and device permission do not replace determining a lawful processing basis.

Do not upload more third-party information than the selected feature needs. Public load descriptions are not intended for medical information, passport copies, passwords or payment secrets.

Purposes and legal bases
- Accounts and requested features: only processing necessary to perform a contract with the data subject or take steps at their request before entering into a contract.
- Abuse prevention, necessary logs, authority checks and protection of rights: the controller's legitimate interests, following assessment of necessity, proportionality and the balance of interests, only where the data subject's interests or fundamental rights and freedoms do not override those interests.
- A specific legal duty: the relevant legal obligation, identifying the applicable requirement.
- Optional features for which consent is required: separate voluntary consent that can be withdrawn for the future.

Required account information is needed for the requested service; not providing it may prevent registration, verification or a feature. Optional information should not be required for unrelated purposes.

Registration does not subscribe users to advertising. Marketing emails require separate voluntary consent, easy free unsubscribe and no access restriction for refusal. Sign-in, security and order-action notifications are not mixed with advertising.

Google sign-in and email codes
Google sign-in is optional. With openid and email scopes, Google supplies a stable sub identifier, email and verification status, plus technical information to validate the response. We do not request Gmail, Drive, contacts, calendar, photos or the extended profile scope, and do not receive your Google password. The data supports sign-in, account linking and security, not advertising, data sales or AI training; it is not sent to Groq.

First linking to an existing account requires an additional code to its email. Google confirmation alone does not create a new account: a profile and acceptance of the Terms are still required. We store the Google identifier/internal account ID link and linking time, email and its verification; the server validates the ID token but does not save ID/access/refresh tokens in the account database. Revoking access in Google (https://myaccount.google.com/connections) does not close the account, does not end CargoTeca sessions and does not erase the link. Request unlinking or closure at info@cargoteca.eu while keeping email access for another sign-in method. Google processes its stage and network information under its own policy (https://policies.google.com/privacy).

An email code is valid for 5 minutes, browser-bound, single-use and attempt-limited. Proof for completing registration lasts 15 minutes. The sign-in table stores a code hash, but the email contains the code and passes through our SMTP and the recipient's mail provider. Expiry does not physically erase every service record. Google availability depends on its configuration.

You can unlink Google in account settings after email confirmation. The link is removed from the working database; your account and current sessions remain active. Following a backup restore, completed unlinking is reapplied before Google sign-in opens.

Installed web app and push
Installing the PWA does not itself permit push. Users enable notifications separately for each device; iPhone requires a supported system and Home Screen installation. The platform can be used without push, which can be disabled in CargoTeca or the browser. Signing out stops delivery for that session, but disabling or signing out does not physically erase the record.

We store the subscription endpoint, encryption keys, user/session association, language, times and delivery statuses. A browser/device service, such as Apple, Google or Mozilla, processes delivery information and encrypted payloads; this is not Apple sign-in or advertising consent. Message, offer and order-change notifications use neutral wording and a link, not private correspondence, documents or trip addresses. Details require an access check. Notifications may appear on a locked screen: review device settings. A sent message has a 5-minute push-service lifetime, not a log or on-device retention limit. Delivery, immediacy and reading are not guaranteed.

The PWA service cache supports the interface, not a guaranteed offline account copy. Clearing site data may remove drafts and preferences. Signing out, revoking Google access and clearing local storage are different actions.

Visibility and recipients
Active listings and permitted profile information may be visible to other visitors. Private customers are excluded from the general participant directory. Messages, attachments, verification documents and enquiries do not become public merely because access is free. Visibility depends on purpose and participant permissions; authorised platform staff may process them for support, verification and violation handling.

Some information is disclosed to counterparties through the user's own actions. A transport participant independently determining purposes for received data may have its own controller obligations. Do not use private information for unrelated mailing campaigns.

When you write via “Contact technical support” at the top of the page, your description and the selected or captured screenshot are sent to the Operator through Telegram. A screenshot is sent only after a warning; opening the dialog does not capture the screen automatically. Exclude passwords, codes, documents and unnecessary personal data. Alternatively, email info@cargoteca.eu.

External services and transfers
External services receive the necessary minimum. Our SMTP and the recipient's mail service process the address and intended email. Photon receives address queries or reverse-search coordinates; TomTom receives route points and necessary vehicle parameters; OpenStreetMap receives map requests and browser network information; registers receive required registration or tax numbers. Groq translates eligible public descriptions and listings, not private chats, complaints or verification scans. “Add from text” runs on CargoTeca's server without external AI. Contact masking does not anonymise free text. External maps or messengers opened by links act separately.

External providers may process data outside the European Economic Area. The scope and location depend on the function and provider; EEA-only storage is not guaranteed. Available information about recipients, applicable terms and transfer safeguards can be requested at info@cargoteca.eu. Accepting the terms is not blanket consent to any international transfer.

Backups of CargoTeca data are transferred from the server to the Operator's separate storage over a protected channel (HTTPS) with certificate verification. Protecting backups does not change retention periods, access rights or deletion duties.

Free access does not require a purchase. Enabling real payments in future will require updated information on the payment provider, disclosed data and legal bases. This policy does not authorise charges.

Cookies and device storage
Necessary cookies and device storage support sign-in, security and requested preferences. Sign-in lasts up to 30 days; the temporary browser cookie for sign-in confirmation up to 15 minutes; language and theme up to 1 year; return to search up to 1 hour within the current tab. Guest drafts are checked for expiry after 7 days when the form is used; this is not guaranteed physical erasure while the browser is closed. Saving a draft does not publish it.

Users can manage site data in their browser. Clearing it may remove drafts and preferences and require signing in again. Signing out and clearing local storage are separate actions. On a shared device, perform both when necessary.

The banner offers “Necessary only” and “Allow statistics”. Optional visit statistics are off until a separate affirmative choice; registration, browsing and closing the banner do not grant permission. Closing it does not change a previously saved choice. Refusal or withdrawal does not prevent core use; registration, profile checks and role limits still apply. Advertising trackers are not enabled. “Cookie settings” lets you change or withdraw the choice. The cookie cargoteca_cookie_preferences stores the choice on this browser/device for up to 180 days from the last time the choice is saved, without a visitor identifier. Missing, expired or unreadable preferences keep optional statistics off; DNT/GPC also disable them.

The visit journal below is optional and requires the statistics choice. Withdrawal stops subsequent collection after the new choice is applied; it does not itself erase previously received records or backup copies. Security logs and requested service functions are separate.

A separate visit journal records time, an allowed public page, referring domain without the full URL, broad source category, allowed campaign tags and language. This table has no IP, account ID, persistent visitor ID, arbitrary searches, tokens or private-page paths; separate server security logs still exist.

Retention
Account data is kept while it is needed to provide the requested functions. In “Settings” (section “My data and account deletion”) you can download a copy of your data and delete your account, confirmed by an email code. After deletion, sign-in closes at once, listings are removed from the exchange, other participants see “Deleted participant”, and the data is kept locked, available only to the administrator for resolving disputes and where required by law. It is then anonymised automatically: an account without orders or payments after 6 months; data about orders, messages, disputes, reviews and verification 3 years after the end of the year of the last order; payment and invoice data 5 years after the end of the tax year. The longest applicable period applies; until it ends, the account can be restored through support. Periods at external recipients and in backups are handled separately.

For a specific dispute or security incident, retain only necessary evidence with a documented reason and a defined review/end point, not the entire history indefinitely.

Last server GPS point: No journey history: logical 15-minute window from recording; cleanup at the next minute cycle, earlier on accepted STOP, completion or cancellation. Physical cleanup may normally lag about a minute.

Sessions: Validity: web up to 30 days, Driver 7 days, support 30 minutes.

Access links and codes: Validity: password-reset link 30 minutes, email-address verification link 24 hours, Driver code 10 minutes, handover link 48 hours, delegation link 7 days.

Rate-limit counters: Up to 24 hours after the protection window ends; specific incidents handled separately.

Guest draft: Usable 7 days from last save; an expired draft is removed on the next editor opening. A closed browser may retain the physical file longer.

Local backups: Snapshots covered by automation have age-based 56-calendar-day rotation with protection of a usable recovery point. Databases every 12 hours, full copies every 72 hours. A cleanup failure can extend retention; this is not a promise that every copy is erased exactly at the boundary.

Copies on separate storage: the last 8 weekly copies are kept.

Rights and requests
Where the law provides, users may request access, rectification, erasure, restriction and portability, and object to legitimate-interest processing. Consent can be withdrawn for the future without affecting the lawfulness of earlier processing based on it.

Requests may be sent to info@cargoteca.eu; this is not the only valid channel. We respond without undue delay and no later than 1 month after receipt. Where necessary because of complexity or the number of requests, this may be extended by up to 2 further months, explaining why within the first month. Proportionate identity or authority checks may be needed, not passwords, full card numbers or unnecessary documents. Statutory erasure exceptions remain.

A complaint may be lodged with a competent supervisory authority; contacting the controller does not remove that right.

Automated decisions and changes
AI assists translation and suggestions.

Users receive updated information about material changes to purposes, recipients or processing conditions. Where fresh consent is required, changing the text alone does not provide it.

Loading…

Calculate routeDistance, costs and tolls

Find a carrierCarriers and forwarders

AdvertisingPromote your offer to the market

Controller and contact The Operator manages the CargoTeca platform and processes personal data under this policy. Contact for support, complaints and personal-data requests: info@cargoteca.eu. Data used Registration and service features involve account and profile details, contacts, role and company membership, listings, enquiries, messages and submitted files. The categories depend on account type and features used. Profile checks may include registration information and documents supplied by the user, and official-register information within the scope of the check. Security uses session, device or browser information, IP addresses, action times and results, sign-in attempts and administrative decisions. Never send your password to support or publish it in a profile. The driver starts GPS sharing for a particular trip and can stop it. Only authorised participants in that trip see precise coordinates. No new coordinates are collected outside enabled tracking. Enabling the feature and device permission do not replace determining a lawful processing basis. Do not upload more third-party information than the selected feature needs. Public load descriptions are not intended for medical information, passport copies, passwords or payment secrets. Purposes and legal bases - Accounts and requested features: only processing necessary to perform a contract with the data subject or take steps at their request before entering into a contract. - Abuse prevention, necessary logs, authority checks and protection of rights: the controller's legitimate interests, following assessment of necessity, proportionality and the balance of interests, only where the data subject's interests or fundamental rights and freedoms do not override those interests. - A specific legal duty: the relevant legal obligation, identifying the applicable requirement. - Optional features for which consent is required: separate voluntary consent that can be withdrawn for the future. Required account information is needed for the requested service; not providing it may prevent registration, verification or a feature. Optional information should not be required for unrelated purposes. Registration does not subscribe users to advertising. Marketing emails require separate voluntary consent, easy free unsubscribe and no access restriction for refusal. Sign-in, security and order-action notifications are not mixed with advertising. Google sign-in and email codes Google sign-in is optional. With openid and email scopes, Google supplies a stable sub identifier, email and verification status, plus technical information to validate the response. We do not request Gmail, Drive, contacts, calendar, photos or the extended profile scope, and do not receive your Google password. The data supports sign-in, account linking and security, not advertising, data sales or AI training; it is not sent to Groq. First linking to an existing account requires an additional code to its email. Google confirmation alone does not create a new account: a profile and acceptance of the Terms are still required. We store the Google identifier/internal account ID link and linking time, email and its verification; the server validates the ID token but does not save ID/access/refresh tokens in the account database. Revoking access in Google (https://myaccount.google.com/connections) does not close the account, does not end CargoTeca sessions and does not erase the link. Request unlinking or closure at info@cargoteca.eu while keeping email access for another sign-in method. Google processes its stage and network information under its own policy (https://policies.google.com/privacy). An email code is valid for 5 minutes, browser-bound, single-use and attempt-limited. Proof for completing registration lasts 15 minutes. The sign-in table stores a code hash, but the email contains the code and passes through our SMTP and the recipient's mail provider. Expiry does not physically erase every service record. Google availability depends on its configuration. You can unlink Google in account settings after email confirmation. The link is removed from the working database; your account and current sessions remain active. Following a backup restore, completed unlinking is reapplied before Google sign-in opens. Installed web app and push Installing the PWA does not itself permit push. Users enable notifications separately for each device; iPhone requires a supported system and Home Screen installation. The platform can be used without push, which can be disabled in CargoTeca or the browser. Signing out stops delivery for that session, but disabling or signing out does not physically erase the record. We store the subscription endpoint, encryption keys, user/session association, language, times and delivery statuses. A browser/device service, such as Apple, Google or Mozilla, processes delivery information and encrypted payloads; this is not Apple sign-in or advertising consent. Message, offer and order-change notifications use neutral wording and a link, not private correspondence, documents or trip addresses. Details require an access check. Notifications may appear on a locked screen: review device settings. A sent message has a 5-minute push-service lifetime, not a log or on-device retention limit. Delivery, immediacy and reading are not guaranteed. The PWA service cache supports the interface, not a guaranteed offline account copy. Clearing site data may remove drafts and preferences. Signing out, revoking Google access and clearing local storage are different actions. Visibility and recipients Active listings and permitted profile information may be visible to other visitors. Private customers are excluded from the general participant directory. Messages, attachments, verification documents and enquiries do not become public merely because access is free. Visibility depends on purpose and participant permissions; authorised platform staff may process them for support, verification and violation handling. Some information is disclosed to counterparties through the user's own actions. A transport participant independently determining purposes for received data may have its own controller obligations. Do not use private information for unrelated mailing campaigns. When you write via “Contact technical support” at the top of the page, your description and the selected or captured screenshot are sent to the Operator through Telegram. A screenshot is sent only after a warning; opening the dialog does not capture the screen automatically. Exclude passwords, codes, documents and unnecessary personal data. Alternatively, email info@cargoteca.eu. External services and transfers External services receive the necessary minimum. Our SMTP and the recipient's mail service process the address and intended email. Photon receives address queries or reverse-search coordinates; TomTom receives route points and necessary vehicle parameters; OpenStreetMap receives map requests and browser network information; registers receive required registration or tax numbers. Groq translates eligible public descriptions and listings, not private chats, complaints or verification scans. “Add from text” runs on CargoTeca's server without external AI. Contact masking does not anonymise free text. External maps or messengers opened by links act separately. External providers may process data outside the European Economic Area. The scope and location depend on the function and provider; EEA-only storage is not guaranteed. Available information about recipients, applicable terms and transfer safeguards can be requested at info@cargoteca.eu. Accepting the terms is not blanket consent to any international transfer. Backups of CargoTeca data are transferred from the server to the Operator's separate storage over a protected channel (HTTPS) with certificate verification. Protecting backups does not change retention periods, access rights or deletion duties. Free access does not require a purchase. Enabling real payments in future will require updated information on the payment provider, disclosed data and legal bases. This policy does not authorise charges. Cookies and device storage Necessary cookies and device storage support sign-in, security and requested preferences. Sign-in lasts up to 30 days; the temporary browser cookie for sign-in confirmation up to 15 minutes; language and theme up to 1 year; return to search up to 1 hour within the current tab. Guest drafts are checked for expiry after 7 days when the form is used; this is not guaranteed physical erasure while the browser is closed. Saving a draft does not publish it. Users can manage site data in their browser. Clearing it may remove drafts and preferences and require signing in again. Signing out and clearing local storage are separate actions. On a shared device, perform both when necessary. The banner offers “Necessary only” and “Allow statistics”. Optional visit statistics are off until a separate affirmative choice; registration, browsing and closing the banner do not grant permission. Closing it does not change a previously saved choice. Refusal or withdrawal does not prevent core use; registration, profile checks and role limits still apply. Advertising trackers are not enabled. “Cookie settings” lets you change or withdraw the choice. The cookie cargoteca_cookie_preferences stores the choice on this browser/device for up to 180 days from the last time the choice is saved, without a visitor identifier. Missing, expired or unreadable preferences keep optional statistics off; DNT/GPC also disable them. The visit journal below is optional and requires the statistics choice. Withdrawal stops subsequent collection after the new choice is applied; it does not itself erase previously received records or backup copies. Security logs and requested service functions are separate. A separate visit journal records time, an allowed public page, referring domain without the full URL, broad source category, allowed campaign tags and language. This table has no IP, account ID, persistent visitor ID, arbitrary searches, tokens or private-page paths; separate server security logs still exist. Retention Account data is kept while it is needed to provide the requested functions. In “Settings” (section “My data and account deletion”) you can download a copy of your data and delete your account, confirmed by an email code. After deletion, sign-in closes at once, listings are removed from the exchange, other participants see “Deleted participant”, and the data is kept locked, available only to the administrator for resolving disputes and where required by law. It is then anonymised automatically: an account without orders or payments after 6 months; data about orders, messages, disputes, reviews and verification 3 years after the end of the year of the last order; payment and invoice data 5 years after the end of the tax year. The longest applicable period applies; until it ends, the account can be restored through support. Periods at external recipients and in backups are handled separately. For a specific dispute or security incident, retain only necessary evidence with a documented reason and a defined review/end point, not the entire history indefinitely. Last server GPS point: No journey history: logical 15-minute window from recording; cleanup at the next minute cycle, earlier on accepted STOP, completion or cancellation. Physical cleanup may normally lag about a minute. Sessions: Validity: web up to 30 days, Driver 7 days, support 30 minutes. Access links and codes: Validity: password-reset link 30 minutes, email-address verification link 24 hours, Driver code 10 minutes, handover link 48 hours, delegation link 7 days. Rate-limit counters: Up to 24 hours after the protection window ends; specific incidents handled separately. Guest draft: Usable 7 days from last save; an expired draft is removed on the next editor opening. A closed browser may retain the physical file longer. Local backups: Snapshots covered by automation have age-based 56-calendar-day rotation with protection of a usable recovery point. Databases every 12 hours, full copies every 72 hours. A cleanup failure can extend retention; this is not a promise that every copy is erased exactly at the boundary. Copies on separate storage: the last 8 weekly copies are kept. Rights and requests Where the law provides, users may request access, rectification, erasure, restriction and portability, and object to legitimate-interest processing. Consent can be withdrawn for the future without affecting the lawfulness of earlier processing based on it. Requests may be sent to info@cargoteca.eu; this is not the only valid channel. We respond without undue delay and no later than 1 month after receipt. Where necessary because of complexity or the number of requests, this may be extended by up to 2 further months, explaining why within the first month. Proportionate identity or authority checks may be needed, not passwords, full card numbers or unnecessary documents. Statutory erasure exceptions remain. A complaint may be lodged with a competent supervisory authority; contacting the controller does not remove that right. Automated decisions and changes AI assists translation and suggestions. Users receive updated information about material changes to purposes, recipients or processing conditions. Where fresh consent is required, changing the text alone does not provide it.