Privacy Policy

CargoVault is a business-to-business marketplace for cargo. This Policy explains what personal data we process, on what legal basis, for how long, with whom we share it and what rights you have. It applies to visitors of cargovault.eu and to persons acting for registered companies.

1. Controller and contact

Controller within the meaning of Art. 4(7) GDPR:
Yuliia Olshanska — operator of CargoVault (cargovault.eu)
Postal address: available on request by email or telephone below and published in the Impressum once the operating entity is registered.
Email: yuliia.olshanska@cargovault.eu
Telephone: +49 173 350 38 97

We are established in the European Union, so no representative under Art. 27 GDPR is required. We have not appointed a data protection officer, as we do not meet the thresholds of Art. 37 GDPR; data protection enquiries go to the address above.

2. Data we process

• Account: name, business email, password hash, role, two-factor settings, trusted devices.
• Company and KYC: legal name, legal form, VAT/registration number, trade register entry, address, website, directors and beneficial owners, registrant identity and authority, bank payout details, uploaded verification documents.
• Compliance screening: results of sanctions and PEP list matching against official EU, UN, UK and OFAC lists.
• Trading activity: lots, line items, bids, deposits, deals, escrow events, messages, Safe Room documents and their SHA-256 fingerprints, access logs.
• Technical: IP address, browser and device data, country, security and audit logs.
• Communications: emails, support chat transcripts, notification delivery status.

3. Purposes and legal basis

• Operating the marketplace and performing your contract — Art. 6(1)(b).
• Company verification (KYC), fraud prevention, platform and document security, trust-rating calculation — Art. 6(1)(f), our legitimate interest in a trustworthy marketplace and that of all other users.
• Sanctions and export-control screening, bookkeeping and tax records — Art. 6(1)(c).
• Transactional notifications about your bids, deals and escrow — Art. 6(1)(b).
• Optional newsletters or non-transactional emails, where offered — Art. 6(1)(a), withdrawable at any time via the unsubscribe link.

We do not sell personal data, do not profile you for advertising, and make no decision with legal effect solely by automated means: a sanctions hit or trust score only prepares a decision that an administrator takes manually.

4. Recipients and processors

Data is disclosed to the counterparty of a deal (company details and the contact person needed to perform it), and to service providers acting as processors under Art. 28 GDPR data processing agreements:

• Supabase — database, authentication, file storage. EU region (Frankfurt).
• Cloudflare — application hosting, delivery and protection against attacks.
• Resend — transactional email delivery.
• AI providers used for the support assistant — your chat message is processed to produce an answer; it is not used to train their models.

Public authorities receive data only where we are legally obliged to disclose it. We do not transfer your data for any other purpose.

5. Transfers to third countries

Personal data is stored in the European Union. Some processors are companies with a US parent that may access data for support or operational reasons, and some support-assistant requests are answered by model providers outside the EEA. Where a transfer to a third country occurs, it is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) together with additional technical measures such as encryption in transit and at rest, or on an adequacy decision where one applies. You may request a copy of the safeguards from us by email.

Your trading counterparty may be established outside the EEA. Where you enter a deal with such a company, the exchange of the data needed to perform it takes place under Art. 49(1)(b) GDPR.

6. Retention and erasure

We keep different categories for different periods, and delete or anonymise them when the period ends:

• Commercial records — lots, deals, escrow events, contract documents and their fingerprints: 20 years after completion. Cross-border trade disputes and liability claims surface long after delivery, and the integrity record only has value if it outlives the dispute period.
• Identity and KYC data — identity documents, director and beneficial owner details: 5 years after the business relationship ends, in line with anti-money-laundering rules, then erased even where the commercial record is retained.
• Account data — until you close the account, plus the periods above for data attached to concluded deals.
• Technical and security logs — up to 12 months.
• Support and email logs — up to 24 months.

Deletion is enforced in the database itself: records under a retention obligation cannot be deleted early, and identity data is erased on schedule independently of the commercial record. See our retention policy for the detailed schedule.

7. Cookies and local storage

We use only technically necessary storage: a session cookie and local storage entries that keep you signed in, remember a trusted device for two-factor authentication and store your language choice. We run no advertising, tracking or third-party analytics cookies, so no consent banner is required under § 25(2) TTDSG. If we ever introduce non-essential cookies, we will ask for your consent first.

8. Security

Access to data is restricted at row level in the database, uploads are scanned for malware and quarantined on suspicion, documents are fingerprinted with SHA-256, all traffic is encrypted, administrative actions are written to append-only audit logs, and two-factor authentication is available to every account. We notify the supervisory authority within 72 hours and affected users without undue delay if a breach is likely to result in a risk to their rights.

9. Your rights

• Access to the personal data we hold about you (Art. 15).
• Rectification of inaccurate data (Art. 16).
• Erasure, subject to the retention obligations in section 6 (Art. 17).
• Restriction of processing (Art. 18).
• Data portability in a machine-readable format (Art. 20).
• Objection to processing based on legitimate interest, including on grounds relating to your particular situation (Art. 21).
• Withdrawal of any consent you gave, with effect for the future (Art. 7(3)).

Write to yuliia.olshanska@cargovault.eu. We answer within one month and may extend by two months for complex requests, telling you why.

10. Complaints

You may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR). A list of German and European authorities is published by the Federal Commissioner for Data Protection and Freedom of Information at bfdi.bund.de. The competent authority for us is the data protection authority of the federal state in which the operating entity is registered; it will be named here and in the Impressum as soon as registration is complete.

11. Changes

We update this Policy when our processing changes and communicate material changes by email. See also our Terms of Service and fees.