Privacy and cookie policy

1. General provisions

This Privacy and Cookie Policy sets out the rules for processing the personal data of persons using the Cartrag Sp. z o.o. website and of persons contacting Cartrag through the communication channels available on the site.

The policy describes in particular the rules for processing data submitted via the contact form, data related to correspondence conducted through the site, cookies and similar technologies, server logs and the external tools used on the site.

Information on the processing of personal data within business relationships - in particular concerning clients, prospective clients, business partners, suppliers, carriers, port agents and logistics partners - is described in a separate GDPR information clause.

2. Data controller

The controller of personal data is:

Cartrag Sp. z o.o.
ul. Żeromskiego 32
81-369 Gdynia, Poland
VAT ID (NIP): 586-001-15-66
KRS: 0000014213

For matters concerning the processing of personal data, you can contact the controller via the contact details shown on the website or at rodo@cartrag.com.pl. Cartrag Sp. z o.o. has not appointed a Data Protection Officer.

3. Personal data processed via the website

Depending on how the site is used, the controller may process in particular:

first and last name,
email address,
telephone number,
company name,
position or role,
the content of the message or enquiry submitted,
data provided voluntarily in the contact form,
data concerning use of the website, including IP address and information stored in server logs,
data related to the use of cookies and similar technologies, in line with the preferences granted.

The company name alone, data concerning transport, direction of carriage, type of cargo, its dimensions or weight, container number or other operational information does not automatically constitute personal data. It may, however, constitute personal data where in specific circumstances it can be linked to an identified or identifiable natural person.

4. Contact form

Via the contact form, the user may submit:

first and last name,
company,
email address,
telephone,
transport-related details,
other information contained in the message body.

This data is processed for the purpose of:

handling the submitted enquiry,
contacting the person who submitted the enquiry,
preparing a response or information concerning the enquiry,
preparing an offer, where related to the submitted enquiry,
taking steps at the person's request prior to entering into a contract, where applicable.

Beneath the form there is information on the processing of personal data and a link to this Privacy and Cookie Policy.

Submitting data via the form does not require separate consent to its processing where the basis for processing is another ground provided for in Article 6 GDPR.

Where contact initiated via the site subsequently leads to a business relationship, further processing of data may take place on the terms set out in the separate GDPR information clause.

5. Correspondence

Where a user contacts Cartrag by email or through other communication channels available on the site, the controller may process the data contained in the correspondence.

The data is used in particular to:

provide a response,
handle the matter,
conduct further correspondence,
document the course of the contact,
take steps prior to entering into a contract, where appropriate.

Where correspondence leads to a business relationship, further rules of data processing are set out in the GDPR information clause.

6. Cookies and similar technologies

The website may use cookies and similar technologies to ensure the proper functioning of the site, remember settings, analyse how the site is used and - where implemented and the user has given appropriate consent - carry out analytics or marketing activities.

Cookies may be:

necessary for the proper functioning of the site,
functional,
analytical,
marketing.

The scope of technologies used depends on the current configuration of the website.

7. External tools

Depending on the current configuration of the website, tools and services of external providers may be used, in particular:

Google Analytics 4,
Google Tag Manager,
Google Ads,
Meta Pixel,
LinkedIn Insight Tag,
Google Maps,
Google reCAPTCHA,
user behaviour analysis tools,
cookie consent management tools,
other technologies necessary for the functioning of the site.

For tools that require user consent, these technologies should not be launched before the appropriate consent is obtained, except for technologies necessary for the functioning of the site or other cases permitted by applicable regulations.

8. Google Maps

Where the Google Maps service is used on the site, it may result in certain technical information related to the use of the map being transferred to Google.

The scope and manner of data processing by Google depends on the service configuration and user settings.

9. Google reCAPTCHA

Where forms or other elements of the site use Google reCAPTCHA, the service may process technical information related to the use of the site in order to protect against spam and abuse.

The scope of data processing depends on the current configuration of the service.

10. Managing cookie consents

The site may use a mechanism for managing consents relating to cookies and similar technologies.

Through the mechanism available on the site, the user may grant, refuse or - to the extent provided for by the solution used - change their consent to the use of particular categories of technologies.

11. Server logs

Using the website involves technical information being recorded in server logs.

Logs may contain in particular:

IP address,
date and time of connection,
information about the browser and operating system,
information about requests directed to the server,
information about errors and technical events.

Logs are used primarily to ensure the proper functioning of the site, infrastructure security, detection of failures and abuse, and technical diagnostics.

12. Data recipients

In connection with the functioning of the website, personal data may be transferred to entities supporting Cartrag in operating the site and IT infrastructure, in particular:

hosting and server infrastructure providers,
email service providers,
entities providing site maintenance and administration services,
entities providing IT and security services,
analytics tool providers,
marketing tool providers, where used,
providers of form handling and anti-spam tools,
the cookie consent management provider.

These entities receive data only to the extent necessary to perform the tasks entrusted to them, taking into account applicable personal data protection regulations.

Information on recipients of data related to the performance of forwarding and transport services - including carriers, port agents, logistics partners and other business partners - is not covered by this policy and is described in the GDPR information clause.

13. Legal bases for data processing

Personal data may be processed in particular on the basis of:

Article 6(1)(b) GDPR - where processing is necessary to take steps at the request of the data subject prior to entering into a contract or to perform a contract to which the data subject is a party;
Article 6(1)(f) GDPR - where processing is necessary for the purposes of the legitimate interests of the controller, e.g. handling correspondence, ensuring site security or pursuing claims;
Article 6(1)(c) GDPR - where processing is necessary to fulfil a legal obligation;
Article 6(1)(a) GDPR - in cases where consent is the basis for processing, in particular in relation to technologies requiring user consent.

Consent is not required where data processing is based on another ground provided for in Article 6(1) GDPR.

14. Data retention period

Data submitted via the contact form and data from correspondence is stored for the period necessary to handle the enquiry, conduct the related correspondence and fulfil the controller's legitimate purposes.

Where contact leads to a business relationship, the data may subsequently be processed for the period resulting from the applicable legal bases and obligations concerning that relationship. Detailed rules in this regard are set out in the GDPR information clause.

Data related to server logs and cookies is stored for the period resulting from the configuration of the infrastructure and the particular technologies.

15. Rights of data subjects

The data subject has - to the extent provided for by the GDPR - the right to:

access their data,
rectify their data,
erase their data,
restrict processing,
data portability,
object to the processing of their data,
withdraw consent, where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

The scope of individual rights may depend on the legal basis and circumstances of the specific processing.

16. Right to lodge a complaint

The data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if they consider that the processing of their personal data infringes the provisions of the GDPR.

17. Automated decision-making and profiling

Personal data processed via the website is not used to make decisions that produce legal effects concerning a person or similarly significantly affect them based solely on automated processing.

Should analytics or marketing technologies using profiling be implemented on the site in the future, their use will take place in accordance with applicable regulations and the rules concerning user consent.

18. Data security

Cartrag applies appropriate technical and organisational measures aimed at protecting personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

The scope of the security measures applied is adapted to the nature, scope and risk associated with the processing of the data.

19. Updates to this policy

This policy may be updated in particular in the event of changes to site functionality, the technologies used, the methods of data processing or applicable regulations.

The current version of the policy is published on the Cartrag website.

20. Contact

For matters concerning this policy and the processing of personal data, you can contact Cartrag Sp. z o.o.:

Cartrag Sp. z o.o.
ul. Żeromskiego 32
81-369 Gdynia, Poland
VAT ID (NIP): 586-001-15-66
KRS: 0000014213