Privacy Policy
Version 1 · Effective date: 2026-10-16
1. Who we are CargoProof is a B2B-first transport workflow and evidence service operated by EU STARS LTD. EU STARS LTD. acts as data controller where it determines the purposes and means of processing, including its own account administration, authentication, security and fraud prevention, service administration, support/contact enquiries, operational logs and legal/compliance administration. EU STARS LTD. 22 Hristo Karaminkov Str. 5000 Veliko Tarnovo Bulgaria Company / VAT No.: BG208160628 office@eustars.eu 2. Scope and responsibilities This policy covers the CargoProof website, accounts, supported Driver/mobile workflows and guest secure access. Customer companies may act as controllers for transport/business data about their users, Drivers, guests and other participants. Where EU STARS LTD. processes those data solely on behalf of the customer and on its documented instructions, it acts as processor. Roles depend on the actual processing and applicable arrangements. Hosting records or enforcing access rules does not by itself make EU STARS LTD. the sole controller for all customer data. This distinction also applies to documents, photos, GPS, signatures and provenance records. Relevant company notices and applicable processing arrangements also apply; this policy does not replace a required data-processing agreement. 3. Information we collect and its sources We receive information from you, authorised company representatives, transport participants and the devices used in relevant workflows. We also generate technical and operational records. Depending on use, information includes names, email addresses, contact details, company relationships, transport records, uploaded content and technical access information. Website enquiries include name, company, email, optional phone number and message. Please avoid unnecessary sensitive personal information in free-text fields and uploads. 4. Account and identity information We keep account contact details, email verification and email history, login-method associations and identity-related audit events. A verified email supports sign-in, account contact and recovery. Where a password is used, it is stored as a password hash. Company memberships and Driver links are separate relationships: registering or signing in does not itself establish company authority, Driver status or transport access. 5. Transport and operational information Records may include transport identifiers, participant and company details, Driver/vehicle assignments, locations, timestamps, checkpoints, status changes, communication, incidents, claims and commercial information relevant to the service. Information can concern people who do not have a CargoProof account when an authorised participant supplies it. 6. Evidence and uploaded content Documents, photos, transport confirmations and generated records such as a Transport Passport may include personal data. File provenance can include upload or capture times, source information, file-integrity references and available embedded metadata, including location metadata. Information may be recorded, authenticated, verified within a particular workflow, self-declared or reported. Storage in CargoProof does not mean that every fact has been independently verified. 7. Location/GPS information CargoProof accepts coordinates, capture times and, where provided, accuracy, speed, heading and related device telemetry in relevant transport workflows. Location may be submitted repeatedly while a supported tracking workflow is active; the Driver web interface requests device permission before starting location updates. The service does not obtain location merely because someone registers an account. These workflows do not establish unrestricted background tracking of every user. Device settings and workflow context affect collection. An IP address is technical network provenance, not proof of physical presence. 8. Signatures and identity assertions A screen-captured signature can be stored with the associated statement, transport context, time and provenance. A typed name, reported role or signature image may be a declaration rather than independently verified identity. A screen signature is additional electronic evidence of an interaction; it is not automatically a qualified electronic signature or legal certification. 9. Guest and secure-link access A link or QR code may allow limited viewing or actions without an account. We record relevant access/action context and, where supported, technical provenance. Protect links against unintended disclosure. Links can expire or be revoked. Later association with an account does not retrospectively increase the assurance of earlier statements or actions. 10. Authentication methods Email sign-in uses a secure link or one-time code. Google and Facebook sign-in are implemented but currently disabled. If enabled and chosen, we receive the provider account identifier, email where supplied and relevant verification information to sign in or safely connect a method to the same CargoProof account. Additional email proof may be required. CargoProof does not receive provider passwords; the current integration does not persist provider access or refresh tokens. Choosing email sign-in does not connect a social account.
Use, protection and your rights
11. How information is used We use relevant information to provide accounts and authorised transport workflows, deliver and associate evidence, support secure sharing, answer enquiries, maintain service integrity, investigate misuse and resolve disputes. Information needed to process an action is identified by its form or workflow; omitting it may prevent that action. We do not treat account creation as marketing permission. 12. Legal bases The appropriate basis depends on the purpose, whose data is processed and whether EU STARS LTD. acts as controller or processor. Processing necessary to provide a service contracted with you, requested functionality or steps you request before a contract may rely on performance of that contract. For business representatives who are not personally party to the customer contract, relevant relationship administration may instead rely on legitimate interests. Legitimate interests may support proportionate security, fraud/abuse prevention, operational and evidence/provenance integrity, protecting legal/business interests and appropriate service improvement, subject to necessity and balancing against affected people’s rights. Establishing, exercising or defending legal claims may also involve legitimate interests. We rely on legal obligation only where applicable law requires the processing. Consent is used only where it is genuinely the basis for a specific purpose, such as optional marketing where consent is required. Account creation and core transport processing are not generally treated as consent-based. Device permission alone is not a basis for every subsequent use of location. A customer acting as controller must establish the basis for its own processing. 13. Service and security communications We send authentication, account-security and necessary service communications to operate the service. These are transactional and distinct from marketing. Account creation and the contact form do not create marketing consent or a newsletter subscription. Optional marketing, if introduced, will require a separately appropriate lawful basis and any consent or other permission required by applicable communications rules. 14. Cookies and session technologies CargoProof uses essential session and security cookies to maintain your session, protect forms and support secure access. Browser cookies and server-side session records are involved. Where persistent sign-in is requested, an authentication cookie may remember your sign-in. CargoProof does not itself set analytics or advertising cookies. Blocking necessary cookies may prevent sign-in or other secure functions. External resources described below receive technical requests under their own practices. 15. Service providers and external resources CargoProof may use providers necessary for hosting, storage, communications, authentication and infrastructure, subject to appropriate contractual and data-protection arrangements where required. Service email is delivered through SMTP infrastructure. Some operational map views load OpenStreetMap tiles and Leaflet resources from unpkg; supported address workflows send address queries to Nominatim/OpenStreetMap for geocoding. Some legacy guest-auth pages load Bunny Fonts. These requests can disclose technical connection information such as IP address; geocoding also discloses the submitted address to the lookup service. Optional external map/share links take you to the chosen service and may include the information you choose to share. Google and Facebook sign-in are currently disabled; if enabled and chosen, the relevant provider processes login-related information. Information about applicable provider arrangements can be requested at office@eustars.eu. 16. Sharing Relevant data is made available according to company memberships, transport participation, assigned roles and scoped access. Authorised participants may download documents or share information outside CargoProof and have responsibilities for that use. The operator may disclose information to service providers, authorised advisers or competent authorities where necessary and lawful. Access controls do not make every operational record private to its author. When acting as processor, EU STARS LTD. handles disclosures in accordance with lawful instructions and applicable law. 17. International transfers Service providers or their authorised personnel may process information in different jurisdictions. If personal data is transferred outside the European Economic Area, appropriate safeguards or another lawful transfer mechanism will be used where required by applicable law. Depending on the circumstances, this may involve an applicable adequacy decision or contractual safeguards. Contact office@eustars.eu for information about relevant processing locations and transfer safeguards, including how to obtain a copy or further details where applicable. 18. Retention CargoProof retains personal information only for as long as reasonably necessary for providing the service, contractual purposes, transport/evidence integrity, security, applicable legal/compliance obligations and the establishment, exercise or defence of claims. Retention varies by data category and context. Historical-access or plan controls concern online availability, not necessarily physical deletion. Replaced or withdrawn evidence may retain an original and change history to preserve context. Closing an account or ending access does not necessarily immediately delete transport evidence, audit/provenance history, security or claim-related records. Where backups are maintained, residual copies may remain temporarily, subject to protection and normal lifecycle controls; immediate removal from every backup is not promised. For processing on a customer’s behalf, retention must also reflect lawful instructions and applicable processing terms, subject to legal obligations. 19. Security The application uses authenticated or scoped access, server-side authorisation, protected authentication credentials and provenance records to help protect information. No system guarantees absolute security, uninterrupted availability or that a recipient will never misuse shared content. Keep your mailbox, devices, credentials and access links secure, and report suspected misuse through the approved contact. 20. Your GDPR rights Subject to the applicable conditions and exceptions, you may request access, correction, erasure, restriction, objection to processing and portability. Where processing relies on consent, you may withdraw it without affecting prior lawful processing. You may complain to the competent supervisory authority, including in your habitual residence, workplace or the place of the alleged infringement. In Bulgaria, this is the Commission for Personal Data Protection (CPDP): https://cpdp.bg/. We may need proportionate identity verification. Requests are handled within applicable legal time limits; rights do not require erasing every record in every circumstance. 21. Account deletion, restriction and requests Send requests for account closure, access to your data, erasure or restriction to office@eustars.eu. Profile editing is available; self-service account deletion may require a password, so users of passwordless accounts may need assistance. Account closure, ending membership and withdrawing a link are distinct from deleting all transport/evidence records. We assess requests against other people’s rights, lawful retention needs and our obligations, and explain applicable limits. A request concerning processing on a customer’s behalf may need to be handled with that customer as controller; EU STARS LTD.’s obligations depend on its role and applicable law. 22. Children CargoProof is intended primarily for business and professional transport activity and is not directed at children. Do not use the service to collect children’s information unnecessarily. If you believe that a child’s information has been submitted inappropriately, contact office@eustars.eu so the matter can be assessed. 23. Changes We may update this policy. The version and effective date are shown above. Material changes will be communicated through an appropriate service channel where required. An updated policy does not itself authorise incompatible new uses or replace any required consent. 24. Contact For privacy questions and rights requests, contact: EU STARS LTD. 22 Hristo Karaminkov Str. 5000 Veliko Tarnovo Bulgaria Company / VAT No.: BG208160628 office@eustars.eu