GDPR information clause

Pursuant to Article 13 and Article 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR"), Cartrag Sp. z o.o. provides information on the rules for processing the personal data of persons whose data is processed in connection with its business activities.

1. Data controller

The controller of personal data is:

Cartrag Sp. z o.o.
ul. Żeromskiego 32
81-369 Gdynia, Poland
VAT ID (NIP): 586-001-15-66
KRS: 0000014213

The controller has not appointed a Data Protection Officer.

2. Who this clause applies to

This clause applies to persons whose personal data is processed by Cartrag in connection with its business activities, in particular:

• clients and prospective clients,
• persons representing clients and prospective clients,
• employees and associates of business partners,
• suppliers and service providers,
• carriers and subcontractors performing transport,
• port agents,
• forwarders and logistics operators,
• foreign agents and logistics partners,
• contact persons involved in the execution of transport and forwarding orders,
• other persons whose data is necessary for conducting business relationships or carrying out Cartrag's tasks.

This clause applies to data processing within business and operational relationships. The rules for processing the data of persons using the website and contacting us through it are set out in a separate Privacy and Cookie Policy.

3. Scope of processed data

Depending on the type of relationship, Cartrag may process in particular:

• first and last name,
• business email address,
• telephone number,
• position or role held,
• name and details of the company with which the person is associated,
• data contained in correspondence,
• data contained in documentation related to the execution of orders,
• data concerning orders, where in specific circumstances it allows the identification of a natural person,
• other data necessary for the specified purpose of processing.

Information concerning the company, transport or cargo - such as the company name, transport direction, type of cargo, its dimensions and weight, container number or order number - does not automatically constitute personal data. It may, however, constitute personal data where in specific circumstances it can be linked to an identified or identifiable natural person.

In the case of entrepreneurs conducting business activity, data concerning that activity may in certain situations constitute personal data. The assessment is made taking into account the specific scope and manner of data use.

4. Source of data

Personal data may be obtained:

• directly from the data subject,
• from their employer or the entity they represent,
• from a business partner or other business contact,
• from a carrier, agent, logistics operator or other entity involved in order execution,
• from documents and correspondence related to service provision,
• from publicly available sources, where justified by the business activity conducted.

5. Purposes and legal bases of processing

Personal data is processed depending on the type of relationship and purpose, in particular for:

a) Handling enquiries and business contacts

Data may be processed for the purpose of handling an enquiry, conducting correspondence, preparing a response or an offer and taking steps prior to entering into a contract.

The legal basis may be Article 6(1)(b) GDPR - where actions are taken at the request of the data subject prior to entering into a contract - or Article 6(1)(f) GDPR, where the contact concerns a person representing a company or another person participating in the business relationship.

b) Conclusion and performance of a contract

Data is processed for the purpose of concluding and performing contracts and carrying out related activities.

The legal basis may be:

• Article 6(1)(b) GDPR - where the data subject is a party to the contract,
• Article 6(1)(f) GDPR - where the data concerns a person representing a business partner or a contact person involved in contract performance.

c) Organisation and performance of forwarding and transport services

Data may be processed for the purpose of organising and performing transport and forwarding services, handling orders and communicating with carriers, agents, logistics operators, terminals and other entities involved in the performance of the service.

The legal basis may be Article 6(1)(b) or Article 6(1)(f) GDPR, depending on the nature of the specific relationship.

d) Fulfilment of legal obligations

Data may be processed for the purpose of fulfilling obligations arising from legal provisions.

The legal basis is Article 6(1)(c) GDPR.

e) Establishing and defending against claims

Data may be processed for the purpose of establishing, pursuing or defending against claims.

The legal basis is Article 6(1)(f) GDPR.

f) Ensuring security and organisation of operations

Data may be processed for the purpose of ensuring information security, protecting property, organising work, preventing abuse and protecting the legitimate interests of Cartrag.

The legal basis is Article 6(1)(f) GDPR.

Consent is not the basis for data processing where another legal ground specified in Article 6(1) GDPR applies to the given purpose.

6. Data recipients

In connection with its business activities, personal data may be transferred to entities involved in the fulfilment of the specified purposes, in particular:

• carriers and subcontractors performing transport,
• port agents,
• forwarders and logistics operators,
• logistics partners,
• foreign agents and partners involved in transport execution,
• terminals and other entities involved in shipment handling,
• IT and information system service providers,
• email and ICT infrastructure providers,
• entities providing accounting and administrative services,
• insurers,
• legal, tax and other professional advisers,
• postal operators and courier companies,
• public authorities and other entities authorised under legal provisions.

In the course of its activities Cartrag uses in particular systems and services such as Microsoft 365, InsERT nexo PRO and insurance services provided by Allianz, to the extent appropriate for the processes performed.

7. Data transfers outside the European Economic Area

In connection with the performance of international forwarding and transport services, the data of contact persons may be transferred or made available to entities located outside the European Economic Area, in particular partners, agents, carriers or other entities involved in transport in regions such as China and India.

Where data is transferred outside the EEA, Cartrag applies the appropriate mechanisms provided for in Chapter V of the GDPR, where required in the specific case.

The scope of transferred data is limited to what is necessary to fulfil the specified purpose.

8. Data retention period

Personal data is stored for the period necessary to fulfil the purpose for which it was obtained, and thereafter for the period required by legal provisions or necessary to secure any claims.

In the case of forwarding-related documentation, data is stored for the period resulting from applicable regulations and documentation obligations, with forwarding documentation stored for 5 years to the extent indicated by Cartrag.

Data related to concluded contracts may be stored for the period necessary for their performance and for the period required by legal provisions or justified by the possibility of pursuing or defending against claims.

Data of contact persons representing business partners may be stored for as long as justified by the existing business relationship, and thereafter for the period necessary to fulfil legal obligations and protect the legitimate interests of the controller.

9. Rights of data subjects

The data subject has - to the extent provided for by the GDPR - the right to:

• access their data,
• rectify their data,
• erase their data,
• restrict processing,
• data portability, where the conditions provided for in the GDPR are met,
• object to the processing of their data, where the basis for processing is Article 6(1)(e) or (f) GDPR,
• withdraw consent, where processing is based on it.

The exercise of individual rights may be limited where this follows from legal provisions or the nature of the specific processing.

10. Right to lodge a complaint

The data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if they consider that the processing of their personal data infringes the provisions of the GDPR.

11. Automated decision-making and profiling

Cartrag does not use personal data to make decisions about individuals that produce legal effects or similarly significantly affect them based solely on automated processing.

Data is not subject to profiling that would lead to such decisions being made.

12. Data security

Cartrag applies appropriate technical and organisational measures aimed at protecting personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Security measures are adapted to the nature, scope and risk associated with the processing of the data.

13. Updates to this clause

This clause may be updated in the event of changes to the way data is processed, the organisation of Cartrag's activities or applicable legal provisions.

The current version of the clause is made available in a manner that allows its content to be reviewed.

14. Contact

For matters concerning the processing of personal data, please contact:

Cartrag Sp. z o.o.
ul. Żeromskiego 32
81-369 Gdynia, Poland
VAT ID (NIP): 586-001-15-66
KRS: 0000014213