Privacy Policy

1. Data Controller

The data controller is DAICISION s.r.o., registered in the Commercial Register of the District Court Bratislava III, Section: Sro, File No. 188504/B, operating the platform at cargly.co.

• Registered office: Lermontovova 911/3, 811 05 Bratislava, Slovak Republic
• Company ID (IČO): 56990596
• Email: privacy@cargly.co

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable national data protection legislation of the Slovak Republic (Act No. 18/2018 Coll.).

2. Data Protection Officer

For questions regarding data protection, you may contact us at privacy@cargly.co. If a Data Protection Officer is appointed in the future, their contact details will be published here.

3. Data We Collect

We collect and process the following categories of personal data:

• Account data: name, email address, phone number, password (hashed), profile image
• Business data: company name, registration number (IČO), tax ID (DIČ), VAT number (IČ DPH), company address
• Shipment data: pickup/delivery addresses, geocoordinates, shipment descriptions, images
• Location data: GPS coordinates of carriers during active transports (when opted in)
• Financial data: payment information processed by Stripe, transaction records, invoice data
• Communication data: messages exchanged between users, notification records
• Usage data: session information, authentication tokens

4. Legal Basis for Processing

We process your personal data based on the following legal grounds (GDPR Art. 6):

• Contract performance (Art. 6(1)(b)): account management, matching shippers with carriers, processing payments, facilitating bookings, in-app messaging
• Consent (Art. 6(1)(a)): GPS location tracking during active transports (carrier opt-in), optional marketing communications
• Legal obligation (Art. 6(1)(c)): invoice retention (10 years), tax reporting (DAC7), fraud prevention
• Legitimate interest (Art. 6(1)(f)): platform security, service improvement, dispute resolution

5. GPS Location Data

Carrier GPS location is collected only during active transports and only when the carrier has explicitly opted in via the platform settings. Location data is shared exclusively with the shipper of the specific shipment being transported.

GPS data is retained for 30 days after delivery for dispute resolution purposes, then automatically deleted. A Data Protection Impact Assessment (DPIA) has been conducted for this processing activity in accordance with GDPR Art. 35.

You may withdraw consent for GPS tracking at any time through your account settings. If GPS is disabled during an active transport, the shipper will be notified.

6. Automated Decision-Making

The platform uses an automated matching algorithm to suggest suitable carrier routes for shipments based on geographic proximity, date overlap, and weight capacity. This matching is used to suggest potential connections only — all booking decisions are made by users themselves. No automated decisions with legal or similarly significant effects are made without human involvement.

7. Data Sharing & Sub-processors

We share data with the following third-party processors to operate the platform:

We do not sell personal data to third parties.

8. International Data Transfers

Some of our sub-processors are based in the United States. These transfers are protected by the EU-US Data Privacy Framework (DPF) adequacy decision. Where the DPF does not apply, we use EU Standard Contractual Clauses (SCCs) as a transfer safeguard.

9. Your Rights

Under GDPR, you have the following rights:

• Access (Art. 15): Request a copy of your personal data
• Rectification (Art. 16): Correct inaccurate data
• Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Restriction (Art. 18): Restrict processing of your data
• Portability (Art. 20): Receive your data in a machine-readable format
• Objection (Art. 21): Object to processing based on legitimate interest
• Withdraw consent: Withdraw consent at any time (e.g., GPS tracking)

To exercise these rights, contact us at privacy@cargly.co. We will respond within 30 days.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The lead supervisory authority for Cargly is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava 27, Slovakia. dataprotection.gov.sk

You may also contact the supervisory authority in the EU Member State of your habitual residence.

11. Data Retention

• Account data: Retained for the duration of your account, deleted within 30 days of account deletion
• Transaction & invoice data: Retained for 10 years as required by Slovak tax law (Act No. 431/2002 Coll.)
• GPS tracking data: Retained for 30 days post-delivery, then automatically deleted
• Messages: Retained for the duration of your account
• Server logs: Retained for 90 days

12. Cookies

We use essential cookies for authentication and session management. No third-party advertising or analytics cookies are used. For details, see our Cookie Policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification. Continued use of the platform after changes constitutes acceptance.