Privacy Policy

1. Who is responsible for the data

The data operator is the company that manages the GoCargo platform (the identification data are above). For the data you enter about clients, drivers, or partners of your company, your company is the operator, and GoCargo processes them on its behalf, in accordance with the Data Processing Agreement (DPA).

2. What data we process

We only process the data necessary for the platform's operation:

• account data: name, email, phone, role in the company, password (only encrypted irreversibly), security settings;
• Company data: name, CUI, address, data from public registers (ANAF, VIES), verification documents;
• platform activity: announcements, offers, orders, uploaded documents (CMR, invoices, photos), evaluations, disputes;
• messages and calls: message content, sent files, voice notes; audio-video calls are not recorded;
• payments: amounts, payment status, IBAN for collections; card data is processed directly by Stripe;
• technical data: IP address, browser type, visited pages, security logs (logins, devices);
• truck position, only when the carrier sends it for order tracking.

3. Why we process them (purpose and basis)

• Provision of the platform and execution of the contract with your company (art. 6 para. 1 lit. b GDPR);
• payments, invoicing, and fiscal obligations (art. 6 para. 1 lit. c);
• security, fraud and abuse prevention, company trust score (legitimate interest, art. 6 para. 1 lit. f);
• Site usage statistics, without advertising profiling (legitimate interest); can be disabled in “Cookie Settings” → Statistics;
• GoCargo advertising measurement and remarketing (GoCargo ads displayed on other websites and social networks, depending on the pages visited on our site) — only with your consent for marketing cookies (art. 6 para. 1 lit. a); consent can be withdrawn at any time from “Cookie Settings”;
• Notification emails and SMS messages, which you can disable in settings; security messages and order notifications cannot be disabled.

4. GoCargoAI

The GoCargoAI functions (reading received orders via email, filling out ads from text, translating messages) send the respective text to an AI model provider, only to generate the result. We do not send passwords or payment data, and the provider is not allowed to use the texts for training their own models. You make the decisions about orders; GoCargoAI only suggests.

5. Who we share data with

Other companies see a company's data only as necessary: the public profile, listings, and contact details after opening contact or completing an order.

We use providers (subprocessors) for hosting, payments, SMS, AI, maps, and — only with marketing consent — advertising; the full list, with the country where data is processed, is on the Subprocessors page. Transfers outside the EU are only made with adequate guarantees (standard contractual clauses or the EU-US framework).

We transmit data to authorities only when legally required.

6. How long we keep them

• account data: how long the account exists; after closure, it is anonymized within 30 days;
• orders, invoices, and payments: 10 years, according to accounting law (anonymized where possible);
• messages: how long the company account exists;
• Visit statistics: up to 13 months in detailed form (without IP address), then only daily totals;
• Security logs: 12 months;
• Backup copies: 14 days, encrypted.

7. Your rights

You have the right to access, rectify, delete, restrict, data portability, and oppose, as well as the right to withdraw your consent at any time. From Account → Settings → My Data, you can download your personal data and request account deletion. For any other requests, please contact us at the personal data contact address; we will respond within a maximum of one month.

If you believe your rights are still violated, you can contact the National Authority for the Supervision of Personal Data Processing (ANSPDCP, www.dataprotection.ro) or the authority in your country.

8. Data security

We use encrypted connections (HTTPS), irreversible encrypted passwords, two-factor authentication, protected cookie sessions (inaccessible to scripts), encryption of integration secrets, encrypted backups in a second location, and continuous monitoring of errors and availability. The GoCargo team’s access to data is role-based and logged.