Privacy Policy

1. Introduction

CargoGauge ("we", "us", or "our") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your information in compliance with the General Data Protection Regulation (GDPR) and other applicable EU data protection laws.

2. Data Controller

Company Name: CargoGauge
CVR: 42423432
Address: Thomas Laubs Gade 23, 2100 Copenhagen, Denmark
Email: privacy@cargogauge.com
Data Protection Officer: dpo@cargogauge.com

3. What Data We Collect

3.1 Account Information

• Operators/Users: Email address, first name, last name, phone number, company affiliation
• Drivers: Name, email, phone number, driver license number and expiry date
• Subcontractors: Company name, contact details, VAT number, business registration

3.2 Location Data

• GPS Coordinates: Latitude, longitude, accuracy, altitude
• Route Information: Planned routes, actual routes taken, timestamps
• Stop Data: Arrival times, departure times, delivery confirmations
• Speed and Heading: Vehicle speed and direction during active assignments

3.3 Usage Data

• Login times and IP addresses
• Feature usage patterns
• Device information (browser type, operating system)
• System interactions and errors

3.4 Operational Data

• Assignment details and schedules
• Route templates and configurations
• Customer location information
• Proof of delivery records

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

5. How We Use Your Data

• Service Delivery: Provide real-time tracking, ETA calculations, route optimization
• Communication: Send assignment notifications, system alerts, support responses
• Analytics: Improve service quality, identify usage patterns, optimize performance
• Security: Detect and prevent fraud, unauthorized access, system abuse
• Compliance: Meet legal obligations, respond to lawful requests from authorities
• Customer Support: Respond to inquiries, troubleshoot issues, provide assistance

6. Data Storage & Location

7. Data Retention Periods

We retain your data only for as long as necessary to fulfill the purposes outlined in this policy:

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

8.1 Right of Access (Article 15)

Request a copy of all personal data we hold about you. We will provide this in a commonly used electronic format within 30 days.

8.2 Right to Rectification (Article 16)

Request correction of inaccurate or incomplete data. We will update your information within 30 days.

8.3 Right to Erasure / "Right to be Forgotten" (Article 17)

Request deletion of your personal data. We will delete your data within 30 days unless we have a legal obligation to retain it.

8.4 Right to Restriction of Processing (Article 18)

Request temporary restriction of data processing while we verify accuracy or assess legitimate grounds for processing.

8.5 Right to Data Portability (Article 20)

Receive your data in a structured, machine-readable format (JSON/CSV) and have it transferred to another service provider.

8.6 Right to Object (Article 21)

Object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we have compelling legitimate grounds.

8.7 Automated Decision-Making (Article 22)

We do not use automated decision-making or profiling that produces legal effects or significantly affects you.

9. Data Security Measures

We implement industry-standard security measures to protect your data:

9.1 Technical Measures

• Encryption in Transit: HTTPS/TLS 1.3 for all connections
• Encryption at Rest: SSL-encrypted database connections
• Authentication: JWT-based secure authentication
• Access Controls: Role-based access control (RBAC)
• Monitoring: 24/7 security monitoring and intrusion detection
• Backups: Encrypted daily backups with 30-day retention

9.2 Organizational Measures

• Regular security audits and penetration testing
• Staff training on data protection and security
• Incident response procedures
• Data minimization principles
• Privacy by design and default

10. Data Processors & Third Parties

We work with the following data processors who have access to certain data:

10.1 Hetzner Online GmbH (Infrastructure Provider)

• Location: Germany (EU)
• Purpose: Server hosting, database storage
• Data Processed: All platform data
• Safeguards: Data Processing Agreement (DPA) in place, ISO 27001 certified

10.2 HERE Technologies (Mapping & Routing)

• Location: Netherlands (EU)
• Purpose: Route calculations, traffic data, ETA predictions
• Data Processed: GPS coordinates, route waypoints (anonymized)
• Safeguards: GDPR-compliant, EU data processing only

11. International Data Transfers

We do not transfer data outside the EU/EEA. All data processing occurs within the European Union. If we ever need to transfer data internationally, we will:

• Obtain your explicit consent
• Use Standard Contractual Clauses (SCCs) approved by the EU Commission
• Ensure adequate safeguards are in place
• Notify you in advance

12. Cookies & Tracking

12.1 Essential Cookies (No Consent Required)

• Authentication Token: Keeps you logged in
• Session ID: Maintains your session state
• Security Token: Prevents CSRF attacks

12.2 Optional Cookies (Consent Required)

We do not use analytics, advertising, or tracking cookies without your explicit consent.

13. Children's Privacy

Our service is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If we discover we have collected data from a child, we will delete it immediately.

14. Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms:

• We will notify the relevant supervisory authority within 72 hours (GDPR Article 33)
• We will notify affected individuals without undue delay (GDPR Article 34)
• Notifications will include: nature of breach, likely consequences, measures taken, contact point for more information

15. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe we have violated your data protection rights:

You may also contact the supervisory authority in your EU member state.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will:

• Notify you via email of significant changes
• Update the "Last Updated" date at the top
• Maintain previous versions for your reference
• Obtain new consent if required by law

17. Contact Us