Privacy & Data Protection
Travomate Cargo is an EU-facing platform. It stores company data, conversations, and commercial shipping documents, so users are entitled to know what is held, for how long, and how to exercise their rights over it.
Summary, not the binding policy
This page summarises how Travomate Cargo handles personal and business data. It does not replace the full Privacy Policy, which is maintained with legal counsel and is the binding document under the GDPR. Where the two differ, the Privacy Policy governs.
What Data Is Stored
| Category | Examples |
|---|---|
| Account & profile | Name, email, profile picture (from Google Auth), company name, country, city, phone, website, description |
| Verification data | Business registration number, VAT number, and supporting documents submitted for verification |
| Listings | Cargo and capacity postings, including routes, dates, weights, volumes, and descriptions |
| Conversations | Messages exchanged between cargo owners and capacity providers |
| Documents | Commercial invoices, packing lists, bills of lading, and customs paperwork uploaded to a shipment or conversation |
| Usage data | Technical logs needed to operate and secure the service |
Commercial documents are competitively sensitive. Access to them is tightly scoped: only the parties to a shipment conversation can see the documents shared within it. See Documents and Visibility and Privacy for the exact access model.
How Long Data Is Kept
| Data | Retention |
|---|---|
| Active account data | Kept while the account is active |
| Deactivated accounts | Recoverable for up to 90 days, then eligible for deletion (see Account & Group Lifecycle) |
| Conversations & documents | Retained for the life of the account and for a limited period afterward, so both parties keep a record of an agreed shipment and any dispute can be resolved |
| Commercial & tax records | Where law requires (for example invoicing and tax records), retained for the statutory period even after account deletion |
| Deleted accounts | On permanent deletion, personal data, listings, and messages are removed and cannot be recovered, except records the platform is legally required to keep |
Specific retention periods are set out in the full Privacy Policy and are subject to legal requirements that vary by data type.
Your GDPR Rights
Users in the EU (and equivalent regimes) have the following rights over their personal data:
| Right | What it means |
|---|---|
| Access | Obtain a copy of the personal data held about you |
| Rectification | Correct data that is inaccurate or incomplete |
| Erasure | Request deletion of your data ("right to be forgotten"), subject to legal retention obligations |
| Portability | Receive your data in a portable, machine-readable format |
| Restriction & objection | Limit or object to certain processing, including marketing |
To exercise any of these rights, contact the platform through the support channel. Account deletion can also be initiated directly by the user from account settings. See Account & Group Lifecycle.
Subprocessors
Travomate Cargo relies on third parties to operate the service. Personal data may be processed by:
| Subprocessor role | Purpose |
|---|---|
| Hosting / infrastructure | Running the platform and storing data |
| Authentication (Google) | Sign-in via Google Auth |
| Payment provider | Processing payments and payouts (Phase 2, once monetisation launches) |
The full, current list of subprocessors is maintained in the binding Privacy Policy.
Data Protection Measures
Personal and business data is protected by the platform's access and security model:
- Documents are encrypted at rest
- Conversation content is visible only to the participants
- Access is governed by a whitelist-based permission model with field-level and scope-based visibility
The technical detail is covered in Security and the Users & Access section.
Legal review required
The binding Privacy Policy and the record of processing activities are maintained with legal counsel outside this documentation repository. This page summarises their intent for users and reviewers.