Privacy & Cookie Policy

1.Data We Process as Controller

When you register, contact us, or use WooCargo as an account holder, we process the following personal data as a controller:

• Account data — name, email, phone, organisation, role and authentication details (including two-factor authentication, if you turn it on), to create and secure your account (legal basis: performance of contract, Art. 6(1)(b) GDPR).
• Billing data — the details needed to charge you for the service and to keep the related records (Art. 6(1)(b) and, for tax records, Art. 6(1)(c)).
• Usage and device data — server logs and IP addresses used to operate and secure the service (legitimate interest, Art. 6(1)(f)). We do not use analytics or advertising trackers.
• Marketing data — where you opt in, to send product updates (consent, Art. 6(1)(a)).

2.Data We Process as Processor

Carriers and logistics companies (“Operators”) use WooCargo to run their work. The personal data they enter is Customer Data: we process it only on the Operator’s documented instructions and solely to provide the service, as their processor under our Data Processing Agreement. The Operator is the controller. Customer Data may include:

• Senders and consignees — names, addresses, phone numbers, email addresses, tax numbers where a delivery note requires them, and the signatures and photos taken at delivery.
• The Operator’s staff and drivers — names, contact details and roles; for drivers, also the device’s location while a route is in progress (recorded by the driver app, including in the background) and the proof-of-delivery photos and signatures they capture.
• The Operator’s clients and partner carriers — contact persons and their details.
• Messages of the in-app conversations — the text, the photos, who wrote them and when; between the Operator’s staff, its clients and its drivers.
• Texts pasted for AI reading, such as a client’s email, which are kept with the orders created from them.

If you are a consignee, a driver or a client’s employee and have a question about your data, please contact the Operator you deal with; we will assist them as required.

3.Cookies and Similar Technologies

We only use cookies that the service needs or that remember a choice you made. We do not use analytics, advertising or third-party cookies, so we do not ask for cookie consent.

• Sign-in (cf_access) — keeps you signed in. Strictly necessary.
• Language (NEXT_LOCALE) — remembers the language you chose, for one year.
• Layout (sidebar_state) — remembers whether the side menu is open.

The service also keeps in your browser’s local storage what it needs to keep you signed in (sign-in tokens, your workspaces and profile) and some display preferences, such as the theme and the width of the details panel.

4.Third Parties and International Transfers

We share personal data with the service providers (sub-processors) needed to operate WooCargo — currently: Oracle Cloud Infrastructure, Mailjet (Sinch), OpenRouter, Amazon Web Services (Bedrock), Google Cloud (Vertex AI), OpenStreetMap Foundation (Nominatim), VIES (European Commission). The full registry, including each provider’s role and location, is maintained in Schedule 1 of our Data Processing Agreement. Where data is transferred outside the European Economic Area, the transfer is protected by an adequacy decision or by appropriate safeguards such as the EU Standard Contractual Clauses together with supplementary measures.

Maps in the service load map images from the OpenStreetMap Foundation’s servers, which receive your IP address and the area shown. The driver app downloads its updates from Expo (United States). On the Operator’s instructions, data is also disclosed to the Greek tax authority (ΑΑΔΕ) for delivery notes and to the partner carriers the Operator hands shipments to.

5.How Long We Keep Data

• Operational and security logs — up to 12 months after account termination.
• Marketing data — up to 24 months after the relationship ends.
• Drivers’ locations — deleted 90 days after they are recorded.
• Messages and photos of the conversations — deleted 3 months after they are sent.
• Other Customer Data, including texts pasted for AI reading — kept while the Operator’s account is active and deleted within 30 days of account termination.
• Records required by law — up to 7 years where required by applicable law.

6.Your Rights

Where we are the controller, you have the right to access, rectify, erase, restrict or port your personal data, and to object to processing or withdraw consent at any time. Where WooCargo is the processor, please direct such requests to the controller (the Operator or the organisation that holds the account); we will assist them as required. You also have the right to lodge a complaint with a supervisory authority: ours is the Office of the Commissioner for Personal Data Protection in Cyprus, and you may also turn to the authority of the country where you live or work — in Greece, for example, the Hellenic Data Protection Authority.

Contacting us

For any privacy question or to exercise your rights, contact us at privacy@woocargo.com. Controller: Woocargo Ltd, Reg. No. HE 403674, VAT CY10403674R, 4A Andrea Assioti, Akropoli, 2007 Nicosia, Cyprus. Tel. +357 22397742.

7.Updates to This Policy

We may update this policy from time to time. Material changes will be notified through the service or by email, and the “last updated” date above will reflect the latest version.