Privacy Policy

1. Introduction and Data Controller

This Privacy Policy explains how Polonia Baltic Cargo OÜ, with its registered office at Tuulemäe tn 5, 11411 Tallinn, Estonia, registry code 17637440, registered in the Estonian Commercial Register (e-Äriregister) (“we”, “us”, “the Company”), processes personal data as a data controller within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Czech Act No. 110/2019 Coll., on the processing of personal data.

This Policy applies to: visitors of our website www.poloniabalticcargo.com; our customers, suppliers, carriers and other business partners and their employees and representatives; persons who contact us by e-mail, phone or through forms; and persons whose data we process in connection with the performance of freight forwarding services (e.g. consignors, consignees, drivers).

Contact for data protection matters:
Polonia Baltic Cargo OÜ, Tuulemäe tn 5, 11411 Tallinn, Estonia
E-mail: info@poloniabalticcargo.com
We have not appointed a Data Protection Officer, as we are not required to do so under Art. 37 GDPR.

2. Categories of Personal Data We Process

a) Identification and contact data – name, surname, title, position, employer/company name, business address, e-mail address, phone number, company ID and VAT ID of sole traders.

b) Contract and transaction data – content of enquiries, quotations and orders; shipment data including consignor and consignee details, loading and unloading addresses, contact persons and phone numbers, cargo descriptions, references and order numbers; transport documents (CMR consignment notes, delivery notes, customs documents); invoicing data, bank account numbers, payment history.

c) Communication data – content of e-mail, phone, and written communications, records of meetings and negotiations.

d) Data of drivers and carrier personnel – name, phone number, vehicle registration numbers, driver’s licence or ID data where required for site access, security, or customs procedures.

e) Technical and usage data – IP address, date and time of access, browser type and version, operating system, referrer URL, pages viewed, cookie identifiers (see the Cookie Policy).

f) Credentials and compliance data – data processed in the course of sanctions screening, verification of business partners (e.g. via freight exchanges), and fraud prevention.

We do not process special categories of personal data (Art. 9 GDPR) and we do not knowingly process data of children. Our services are addressed exclusively to businesses.

3. Sources of Personal Data

We obtain personal data: directly from you (forms, e-mail, phone, contract negotiations); from your employer or the company you represent; from our customers (e.g. consignee data needed to perform a shipment); from carriers and business partners; from public sources (commercial registers, trade registers, VIES, insolvency registers, sanctions lists); and from freight exchange platforms (e.g. TIMOCOM) in accordance with their terms.

4. Purposes and Legal Bases of Processing

Purpose	Legal basis (GDPR)	Details
Handling enquiries and preparing quotations	Art. 6(1)(b)	Steps at the request of the data subject prior to entering into a contract
Conclusion and performance of freight forwarding contracts	Art. 6(1)(b)	Arranging transport, communication with carriers, consignors, consignees, tracking, claims handling
Performance where the data subject is not a contract party (e.g. consignee, driver)	Art. 6(1)(f)	Legitimate interest in performing services ordered by our customer
Invoicing, accounting, tax and archiving obligations	Art. 6(1)(c)	Act No. 563/1991 Coll. on Accounting, VAT Act No. 235/2004 Coll., Tax Code
Customs representation	Art. 6(1)(c)	Union Customs Code and related regulations
Verification of business partners, sanctions screening	Art. 6(1)(c), (f)	EU sanctions regulations; legitimate interest in fraud prevention
Establishment, exercise or defence of legal claims	Art. 6(1)(f)	Legitimate interest in protecting our rights
Direct marketing to existing customers	Art. 6(1)(f)	Legitimate interest; right to object at any time (Art. 21(2))
Newsletter to other subscribers	Art. 6(1)(a)	Consent, withdrawable at any time
Website analytics, non-essential cookies	Art. 6(1)(a)	Consent via cookie banner
Website security, logs	Art. 6(1)(f)	Legitimate interest in network and information security

Where processing is based on legitimate interest, we have carried out a balancing test; you may request further information about it.

5. Recipients of Personal Data

Personal data may be disclosed, strictly to the extent necessary, to the following categories of recipients:

• Carriers and logistics subcontractors engaged to perform transport, warehousing, handling or customs services;
• Customers (e.g. carrier and driver data shared with the customer whose goods are transported);
• Freight exchanges and verification platforms (e.g. TIMOCOM GmbH) in connection with offers, orders and business partner verification;
• Customs authorities, tax authorities and other public bodies where required by law;
• Banks, payment institutions and insurers (including our liability insurer in claims handling);
• Providers of accounting, legal, audit, debt collection, IT, hosting, e-mail and analytics services;
• Courts, arbitration bodies and law enforcement in disputes or investigations.

Processors act on our documented instructions under data processing agreements pursuant to Art. 28 GDPR.

6. Transfers to Third Countries

Personal data are processed primarily within the European Economic Area. If performance of a shipment requires transfer outside the EEA (e.g. carrier, customs agent or consignee in a third country), we transfer only the data necessary and rely on: an adequacy decision of the European Commission (Art. 45 GDPR), Standard Contractual Clauses (Art. 46(2)(c) GDPR), or the derogation for transfers necessary for the performance of a contract (Art. 49(1)(b)–(c) GDPR). Some of our IT providers may process data in third countries; in such cases transfers are covered by Standard Contractual Clauses or, for US providers, the EU–US Data Privacy Framework where certified. You may request a copy of the relevant safeguards at info@poloniabalticcargo.com.

7. Retention Periods

Category	Period
Enquiries not resulting in a contract	12 months from last communication
Contract and shipment documentation, transport documents	Duration of the contract + limitation periods, generally up to 4 years; 10 years where needed for defence of legal claims
Invoices and accounting records	5 years (Accounting Act)
VAT records	10 years (VAT Act)
Customs documentation	Periods required by customs regulations (generally 10 years)
Marketing consents and newsletter data	Until withdrawal of consent, max. review every 3 years
Website logs	6–12 months
Cookies	See Cookie Policy

After expiry of the retention period, data are erased or anonymised.

8. Your Rights

Under Articles 15–22 GDPR you have the right to:

• Access – obtain confirmation whether we process your data and a copy of the data;
• Rectification – have inaccurate data corrected and incomplete data completed;
• Erasure (“right to be forgotten”) – where the data are no longer needed, consent is withdrawn, or processing is unlawful, unless retention is required by law;
• Restriction of processing – in the cases set out in Art. 18 GDPR;
• Data portability – receive data you provided to us in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means;
• Object – to processing based on legitimate interest; where you object to direct marketing, we will stop such processing without exception;
• Withdraw consent – at any time, without affecting the lawfulness of processing before withdrawal;
• Not to be subject to automated decision-making producing legal or similarly significant effects – we do not carry out such processing.

How to exercise your rights: send a request to info@poloniabalticcargo.com or by post to our registered office. We will respond without undue delay, at the latest within one month (extendable by two months for complex requests, of which we will inform you). We may ask you to verify your identity. Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive.

Complaint: you have the right to lodge a complaint with the supervisory authority: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee, or with the supervisory authority of your habitual residence.

9. Obligation to Provide Data

Provision of data is voluntary; however, without identification and contact data we cannot conclude or perform a contract with you. Data required by law (e.g. invoicing data) must be processed regardless of your wishes.

10. Security

We apply appropriate technical and organisational measures (Art. 32 GDPR), including: TLS/SSL encryption of the website and e-mail in transit, access controls and authorisation levels, password policies, backups, contractual confidentiality obligations of staff and processors, and regular review of measures. In the event of a personal data breach likely to result in a high risk to your rights, we will notify you and the supervisory authority as required by Articles 33–34 GDPR.

11. Changes to This Policy

We may update this Policy to reflect legal or operational changes. The current version, with the date of last update, is always published at www.poloniabalticcargo.com/privacy-policy. Material changes will be notified to registered business partners by e-mail.