Privacy Policy

New EU regulations on the protection and processing of personal data 

Technology and the online environment benefit us all, but they also bring challenges. One of them is protecting our clients’ personal data. At CargoTrack, this has been a firm commitment to our clients from the very beginning.

Starting May 25, 2018, CargoTrack will adopt EU Regulation 2016/679. Known as the GDPR (General Data Protection Regulation), this measure will take effect in all member states of the European Union.

We assure you that CargoTrack will continue to process clients’ personal data only for well-defined purposes, such as creating personalized offers that match their needs as closely as possible and including them in market research on CargoTrack products and services.

What is personal data and how do we obtain it?

Personal data is information through which a client can be identified, directly or indirectly. CargoTrack obtains this data as follows:

Directly from the client
CargoTrack collects personal data directly from the client, usually the information provided when signing the contract or during its performance:

Last name, first name, date of birth
Postal and e-mail address
Phone number and more
Details of transactions carried out (products purchased, prices, payment methods)
Details about traffic and the area from which the client uses CargoTrack services.

CargoTrack also receives any information or content created by the client and actively provided by them (photos, videos, etc.).

In addition, to be able to offer the best products and services, CargoTrack may sometimes request information about the client’s experience while using CargoTrack products and services. This information may include comments or suggestions, as well as recommendations for improvement.

Automatically
In certain situations, CargoTrack may also collect client data by automated means. For example, personal data may be collected through cookies, web or phone beacons when the client interacts with CargoTrack services. Data collected this way may include: IP address, browser type, operating system, the identification number of the mobile device used, geographic location, referral URLs, and information about actions taken or interactions with CargoTrack.

Who is responsible for personal data in the case of group offers or offers serving multiple users?

In the case of group offers or products and services serving multiple users, the account holder is responsible for the data they provide. The account holder’s choices regarding personal data will apply to all users in the group created (unless another user has informed us of their own choice in advance). In case of discrepancies between the users’ choices and those of the account holder, the account holder will indicate which choice prevails

Why do we process personal data?

Cargo Track will process the client’s personal data only to ensure the best possible relationship with the client during the term of the contract. The processing of personal data may be based on the client’s consent, may be related to the contract or may be required by a legal obligation.
Cargo Track’s legitimate interest may form the basis for processing personal data, and the Client may object to it. Besides legitimate interest, processing may be based on the client’s consent, the need to perform the contract or a legal obligation incumbent on Cargo Track.

When Cargo Track asks the client for consent to processing, the client has three options: “Yes”, “No” or “Later”. Selecting the last option entitles Cargo Track to send further requests for consent

Only where consent has been given will Cargo Track process personal data in order to provide information about:
• Cargo Track products and services, offers, promotions or special events
• products and services of Cargo Track affiliates or Cargo Track business partners
Because it is necessary to provide products and services, Cargo Track will process personal data in order to:
• fulfill client requests/orders/questions and process payments made for Cargo Track products and services
• verify client eligibility for certain offers and products
Because it is a legitimate interest that does not harm the client’s rights, Cargo Track will process personal data in order to:
• personalize the experience at Cargo Track’s premises and in Cargo Track’s online environment, request feedback on the Client’s experience or assess the effectiveness of communication with the Client, and personalize clients’ interactions with phone sales teams or the Customer Relations department
• create and maintain Client accounts, including administering any loyalty or customer reward programs associated with the Client account
• ensure the necessary protection, identify and prevent outstanding debts, abuse, complaints and other liabilities, and comply with applicable law
• assess potential risks of fraud or late payment, including by checking dedicated databases to identify any outstanding debts resulting from non-performance of obligations under previous or ongoing electronic communications contracts
• assess the Client’s creditworthiness and commercial risk in the event a contract is concluded
• improve Cargo Track products and services by assessing the number of users who access or use Cargo Track products and services, which product and service features are of most interest to clients, what types of offers clients want and how online products and services perform from a technical standpoint
• build client profiles that Cargo Track can later use to identify cases of fraud
Cargo Track may record phone calls with Cargo Track representatives in order to identify client needs and improve the services offered by Cargo Track. The client is informed of this when requesting a call with a Cargo Track Customer Service operator and may decline the call.
Cargo Track may use the information it collects about the client, the device used or the use of products and services in other ways only in compliance with the law.

What rights do clients have regarding the processing of personal data?

The client has specific data protection rights, and Cargo Track provides an environment that makes it easy to exercise them (the right of access, rectification, objection, erasure, receipt of personal data, or to file a complaint).
Cargo Track has taken the necessary precautions to assure the client that their data protection rights are properly respected.
The client has the right to:
• access their personal data, modify or restrict it, withdraw consent or object to its processing, or request its erasure (the right to be forgotten)
• access their personal data or request that Cargo Track transfer it to another company (the right to data portability)
• disable certain types of collection or use of their data, including the use of certain cookies and similar technologies
• file a complaint with the competent supervisory authority – in Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP)
• request that Cargo Track correct any inaccuracies in their personal data. For an online account, this can usually be done from the account data editing section. In any case, the Client may submit a request to rectify their data.
These rights may be limited in certain circumstances defined by law (for example, the client may opt out of receiving marketing communications but cannot ask Cargo Track to delete the personal data required to perform the contract). Such restrictions will be reviewed individually and communicated to the client accordingly.
The right to opt out can be exercised as follows:
• by following the opt-out instructions in the relevant marketing communications
• if the client has a monitoring account, they can change their opt-in/opt-out preferences in the relevant account editing section
• by sending a written request to Cargo Track by e-mail.
The client will continue to receive administrative communications from Cargo Track, such as order confirmations or notifications about activity in their account (e.g., account confirmations and password changes), even if they opt out of marketing communications.
Cargo Track informs the client that they may object at any time to processing carried out on the basis of legitimate interest. Any objection will be reviewed and resolved in accordance with the law.

How does the GDPR apply to children?

Cargo Track does not knowingly request or collect personal data from children under the age of 16 when providing specific services (unless the explicit consent of the parent or guardian has been obtained in advance), or under the age of 14 in all other situations. Where children’s personal data is collected, it is processed carefully and only with specific safeguards.

What does automated processing of personal data involve?

Any decision based solely on automated processing will have been consented to in advance or will be necessary for concluding the Contract.
Cargo Track personalizes communication with its clients using personal data related to client history, previous choices or product and service preferences.
The client will not be subject to any decision based solely on automated data processing that produces legal effects concerning them or significantly affects them, unless the client has explicitly consented to the processing, or the processing is necessary for concluding or performing a contract with Cargo Track (as in the case of determining eligibility for certain offers) in order to prevent fraud and outstanding debts, or Cargo Track is required by law to use personal data in this way.
In all cases, the client may request an explanation of the logic behind the automated decision-making mechanism and, where applicable, may request human intervention in the decision concerning them.

Can your personal data be processed by third parties for other purposes?

If the client consents to this or there is a legitimate interest in the use of their personal data, Cargo Track may disclose this data to third parties.
As a rule, Cargo Track will not disclose the client’s personal data to a third party that intends to use it for direct marketing purposes, unless the client has consented to this.
However, Cargo Track may disclose the client’s personal data to third parties without the client’s consent in the following situations and to the following entities:
• Affiliates: personal data may be disclosed to Cargo Track affiliated companies for the purpose of conducting day-to-day business activities
• Service providers: Cargo Track may engage service providers, agents or contractors to provide services on its behalf, including the administration of the resources and services made available to the client. Cargo Track requires these third parties to comply with all applicable data protection laws and specific security requirements regarding the Client’s personal data. Cargo Track may transfer such personal data when providing electronic communications services, warranty-related services or product exchanges (where eligible).
• Other telecommunications service providers: when entering data on late payments, if applicable
• Cargo Track external consultants or partners who assist the company (e.g., external lawyers, debt collection agencies, call centers)
• Public authorities: Cargo Track may disclose client data if required to do so by law or if it believes in good faith that such disclosure is reasonably necessary for the proper conduct of legal proceedings or investigations, or to respond to any complaints or requests from authorities

What is the Subscriber Directory?

Unless the Client expressly requests otherwise, Cargo Track is legally required to include the Client’s data in the Subscriber Directory.
The subscriber information service (Subscriber Directory) allows anyone to find a subscriber’s phone or fax number(s). It may be in written or electronic form.
The client’s personal data (name/company name, home address/registered office and phone number(s)) will be included in the Subscriber Directory and may be transferred to all providers of subscriber information services and subscriber directories (printed and online phone books) from which Cargo Track has received a request to that effect.
The client:
• has 45 business days from the date the Contract is concluded to express their disagreement; otherwise, the information will be processed for this purpose
• has the right to verify, rectify and remove their personal data from the Directories and Subscriber Information Services by submitting a written request to Cargo Track

Email communications

As part of our contractual relationship, Cargo Track Solutions S.R.L. sends you the following types of messages by email:

Administrative and transactional messages, required to perform the contract and provide the services: invoices and tax documents, platform login codes (two-step authentication), notifications about road tolls, your fleet, devices and account, and replies to your requests. These messages are sent from the addresses office@cargotrack.ro, info@cargotrack.ro, no-reply@cargotrack.ro and from our employees' personal work addresses (firstname.lastname@cargotrack.ro). While you have an active account, these messages cannot be turned off, because the service cannot be provided without them; they stop when the account is closed.

Commercial messages (offers, service news, newsletters) are sent only with your prior consent. You can withdraw your consent at any time, with no effect on the services you have contracted, using the unsubscribe link in each such message, from your account settings or by email to office@cargotrack.ro OR info@cargotrack.ro. Requests are applied within 24 hours at most.

We do not sell, rent or share your email address with third parties for marketing purposes.

Processors and data transfers

To provide our services we use the following categories of providers, which process data on our behalf under contract, with confidentiality and security obligations:
• hosting and infrastructure: hosting providers with data centres in the European Union;
• hosting of the customer relationship management system: Hosterion S.R.L. (Romania);
• sending email notifications: Mailgun Technologies, Inc. (data processed in the European Union region);
• telematics platform: Ruptela UAB (Lithuania);
• office and communication services: Microsoft Ireland Operations Ltd.;
• payment services: the electronic payment providers indicated at the time of payment.

Data is stored and processed in the European Union. Where a provider is based outside the European Economic Area, the transfer is made on the basis of the standard contractual clauses approved by the European Commission or an adequacy decision, and the data generally remains stored on servers in the European Union.

Retention periods

• Billing data and tax documents: 10 years, in accordance with accounting legislation.
• Account data and correspondence with you: for the duration of the contract and 3 years after it ends, to defend against any possible claims.
• Technical logs of the email system: 30 days.
• Data of job applicants: 3 years.
• Consent for commercial communications: until it is withdrawn.

How do we protect your personal data?

Cargo Track applies appropriate safeguards to ensure the security of the client’s personal data and has specific retention periods in place, so that personal data is kept only as long as necessary to fulfill the stated purpose.
• Data security
To guarantee the security of personal data, Cargo Track has implemented a range of security measures in line with industry standards. These do not cover the personal data the client chooses to share in public online or offline spaces.

• Data retention
Cargo Track will keep personal data for as long as necessary for the stated purpose, taking into account the need to answer questions or resolve issues, provide new or improved services and comply with applicable legal requirements. Therefore, Cargo Track may retain personal data for a reasonable period after the client’s last interaction with Cargo Track, in accordance with applicable law.
When the client’s personal data is no longer needed for the purpose for which it was collected or agreed, and there is no legal obligation to retain it, Cargo Track will securely destroy or delete it.

• Processing of personal data
We process your personal data exclusively within the legal provisions on personal data protection. These include EU Regulation 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as other applicable laws (e.g., Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector).

Our employees and authorized agents are required to comply with data protection provisions in accordance with the law.

All requests regarding your data, data protection within CARGO TRACK SOLUTIONS S.R.L., or any questions/complaints can be sent to the following email address: office@cargotrack.ro

For people who have applied for one of the jobs posted on the company’s LinkedIn page www.linkedin.com/company/cargo-track or in the careers section https://cargotrack.ro/cariere/, the form data is stored in the secure CARGOTRACK database for a period of 3 years. For faster deletion of your data from CARGOTRACK records, you can send a request by e-mail to office@cargotrack.ro

How can I learn more about this regulation?

For any question regarding personal data or to exercise their legal rights, the client may contact the Cargo Track data protection officer using the dedicated address: office@cargotrack.ro. Forms for submitting concerns or questions are also available to the client on www.cargotrack.ro.

All available options will be presented and all messages will receive a response in accordance with the law. However, the client should bear in mind that, for technical reasons, implementing their requests or choices may take a few days if no campaigns are running. If campaigns are running, Cargo Track may only be able to implement the client’s choice for future campaigns. During the time needed to implement the choice, Cargo Track will continue to process the Client’s personal data based on the previously expressed choices.

How do these regulations apply to legal entities?

For clients that are legal entities, in order to process its users’ personal data as described above, Cargo Track will obtain the express consent of the account holder for the types of personal data processing or categories of personal data for which the law requires such a condition. To this end, the legal-entity client undertakes, before transferring the personal data of users and the contact person to Cargo Track, to obtain their consent for the processing carried out by Cargo Track in performing the contract and for the data processing mentioned in the preceding articles. By transferring the personal data of users and the contact person to Cargo Track, the legal-entity client certifies that the consent of the users and the contact person has been obtained for the processing of their personal data by Cargo Track in accordance with the above provisions, and assumes full responsibility in this regard. Also, as with group offers, the client will select the users’ choices in communications with Cargo Track.

Last updated: 21 October 2026