Logisteo privacy policy

The controller for the purposes described as its own in this policy is DevConcept Venture Lab Bartosz Polak, tax identifier NIP 9591437100, REGON 260030117, correspondence address: ul. Romualda Mielczarskiego 121/416, 25-611 Kielce, Poland, referred to as the “Operator”.

For personal data, privacy and individual rights, contact biuro@devconcept.eu or write to the address above. Logisteo support is also available at hello@logisteo.cloud. We direct privacy requests to the appropriate person regardless of which contact address you use.

Processing is subject to Regulation (EU) 2016/679 (GDPR), the Polish Personal Data Protection Act and applicable Polish and EU law, including the Polish Electronic Communications Law.

This policy covers contact through the Logisteo website, registration and account management in the Carrier Portal, documents and cooperation available in that portal, GPS integrations and public vehicle availability boards. It applies to users and organisation representatives, contacts, drivers, people named in documents and visitors viewing boards without an account.

The terms of service govern use of the Carrier Portal. This policy explains personal data processing and does not replace the service contract, data processing terms or information from an employer or transport partner. Separate DevConcept products and separate services are covered by information relevant to their scope.

The Operator is the controller for its own account management, contractual relationship, service security, contact, complaints and billing for its services. Purposes and legal bases are described in section 5.

A carrier or partner organisation may separately control the data of its workforce, counterparties, orders and documents. When we process those data on its behalf, we act as a processor within its documented instructions and the data processing terms in the service terms or an applicable individual agreement. We do not use entrusted data for undisclosed purposes of our own.

An order partner or pool moderator may independently determine purposes for further use of received data. That does not automatically make it the Operator’s processor. Joint determination of purposes and means requires the parties to allocate responsibilities under the GDPR. An “administrator” role in the interface identifies account permissions, not the legal role of controller.

We receive data from you, your organisation, authorised partners, submitted documents and connected GPS sources. Company lookup uses appropriate public registers, in particular GUS/REGON. Technical data arise when the service is used.

• Account and contact: email, name or username, telephone, organisation, roles and permissions, authentication data, email confirmation and the date and version of accepted terms.
• Company: name, address, tax and other identifiers, representatives, contacts, account details and information needed for cooperation. Sole trader data may be personal data.
• Operations: drivers and their contacts, vehicles, dates, routes, location from an active integration, enquiries, offers, orders, statuses, messages and activity history.
• Documents: file content and metadata, transport, licensing, insurance and billing records, signatures, tachograph data and reading or analysis results when the relevant function is used.
• Technical data: IP address, browser and device information, sessions, error and security events and saved interface preferences.

Categories depend on the function used. Provide only necessary data. Do not include unnecessary health data, identity documents or special category data. Where a specific process requires data under GDPR Articles 9 or 10, the appropriate controller must also establish the additional condition for that processing.

• Contract with an individual: data necessary for requested steps before a contract and its performance are processed under GDPR Article 6(1)(b) where that individual is a contracting party, including a sole trader.
• Organisation representatives: business contact, authorised access and cooperation management rely on Article 6(1)(f). Our legitimate interest is working with the organisation through authorised people. A company contract does not automatically make each employee a party.
• Checking details and authority: we identify the relevant organisation and representative as necessary for the individual’s contract or the legitimate interest in correct cooperation and preventing abuse — Article 6(1)(b) or (f).
• Security: we protect access, limit misuse, maintain service operation and investigate incidents under Article 6(1)(f), taking account of proportionality, individual rights and security obligations under Article 32.
• Contact and reports: we answer enquiries, provide support and handle complaints under Article 6(1)(b) in the appropriate contractual relationship or (f), for the legitimate interest in handling and resolving the matter. Where applicable law imposes an obligation, including relevant content reporting obligations, the basis is Article 6(1)(c).
• Our own billing: data required by applicable tax and accounting rules, including relevant VAT provisions, are processed under Article 6(1)(c). This is not a blanket basis for all carrier documents.
• Claims: data needed to establish, exercise or defend specific claims are processed under Article 6(1)(f), in the interest of protecting rights and necessary evidence.
• Optional consent-based purposes: we explain the purpose and scope before offering the choice. Consent under Article 6(1)(a) is separate from any consent required for device access or a marketing channel under the Electronic Communications Law.

For data processed on an organisation’s behalf, that organisation establishes the appropriate legal basis. Its instructions and processing terms govern our handling. The service’s business purpose does not give all processes one legal basis.

Logisteo hosting uses OVH infrastructure and DevConcept Venture Lab’s own servers. Document analysis, email handling and error monitoring are performed by the Operator on the company’s servers.

Authorised personnel of the Operator and the relevant organisation access data within their duties. Infrastructure providers, in particular OVH, have access only as necessary for services delivered to the Operator and subject to appropriate data protection terms. Information on subprocessing of entrusted organisation data is provided under the applicable processing terms.

Recipients may also include authorised cooperation partners, recipients of public content, legal or accounting advisers as necessary for a matter, and authorities or other recipients entitled by law. Using the portal does not automatically send all transport documents to authorities, a bank or KSeF. External map services are described separately in section 9.

Adding a driver or employee to a directory does not mean they created an account, accepted the terms or consented to every use of their data. The organisation establishes a lawful purpose, basis, scope and recipients, and gives the person the required information.

Where we act as processor, we follow the controller’s instructions and assist with individual rights, data protection and incidents. The same necessity and authorised access requirements apply to people named in documents and messages.

Authorised cooperation may give a partner access to relevant order, document, offer, vehicle or driver data. Access to one relationship does not provide access to all organisation data.

A public availability entry includes an entry code, vehicle or combination category and features, loading dimensions and capacity, equipment, a selected area with a 20 km radius, availability dates and update and expiry times. The public entry does not display registration plates, driver data, carrier contact details, exact parking location or internal organisation links. This limited dataset does not guarantee full anonymity in every context.

A pool moderator’s designated contact is published separately: contact name, telephone and email. The organisation running the pool establishes the disclosure basis and informs the person where that contact identifies them. We recommend an appropriate business contact with minimum necessary information.

A publication can be viewed without login through a link or QR code. Recipients may retain a copy. Withdrawal or expiry ends exposure through Logisteo under the service rules but does not automatically remove every recipient’s copy or internal history. Functional permission to participate in a pool does not replace a GDPR basis or information to individuals.

A GPS integration may provide location and measurement time linked to a vehicle and driver. Its controller determines the monitoring purpose, necessity, legal basis, active periods, access and retention. The individual should be informed before monitoring starts. Employment monitoring must take account of the Polish Labour Code; employee consent is not a default basis for all tracking. Monitoring must not be used for undisclosed tracking of private activity.

A public availability area is separate from live GPS location. Simply viewing the portal or a map does not automatically require device geolocation.

The board’s map uses services of the OpenStreetMap Foundation in the United Kingdom, acting as an independent controller. Your browser connects to the map service and sends at least an IP address and a request for the relevant map tile. The map infrastructure also uses servers and delivery networks in other countries. Logisteo’s purpose is displaying the requested map, based on the legitimate interest in providing that function under GDPR Article 6(1)(f).

See the OSMF privacy policy and map user information for its processing. Map services do not receive the content of documents entrusted for analysis.

Document analysis runs on DevConcept Venture Lab’s servers. It covers the submitted file, necessary context, extracted data and assessment results. Entrusted customer data are not used to train public AI models.

Reading and assessment support document handling but may contain errors. A technical error is not a finding of forgery. An assessment may affect a document or profile status or available cooperation actions. The appropriate controller defines the permitted process and its legal basis, considering the actual effects on people.

Where a process is a decision covered by GDPR Article 22, its applicable conditions and safeguards apply. The person receives the required meaningful information about the relevant logic, significance and envisaged consequences and can use the protection applicable to the case, including requesting human intervention, expressing a view and contesting a decision. Requests or explanations about an assessment may be sent to biuro@devconcept.eu and are considered by an authorised person.

Cookies and browser storage support authentication, login protection and preferences you select. Electronic Communications Law applies to both cookies and other storage or access on a device. Activities necessary for transmission or an explicitly requested service fall within the relevant statutory exception; that exception does not cover every function.

• Login and session protection: account sessions last up to 8 hours, with renewal while using the service. Signing out ends the browser session. Necessary login protection and flow data relate to that activity.
• Appearance: your selected theme is stored for up to a year, and the menu’s open state for up to 7 days. Other menu and table preferences remain in the browser until changed or removed.
• Remembered email: after choosing this option, your email remains in the browser until replaced or removed. It does not store a password or consent to marketing. Successfully signing in without remembering the email removes the stored value.

We do not use session replay. Monitoring covers necessary error and security events rather than recordings that replay your behaviour. Optional analytics or marketing technologies requiring consent can operate only after explaining purposes and recipients and obtaining the appropriate choice. Refusal does not block a basic account.

You can restrict or delete site data in browser settings. Removing session data signs you out; removing preferences restores defaults. It does not automatically delete server data. On shared devices, avoid remembering your email or remove saved site data after use.

Our own service processing uses the Operator’s infrastructure described above. An external map may connect to its provider and infrastructure outside the European Economic Area. For the United Kingdom, the applicable basis for transfers within the decision’s scope is the current European Commission adequacy decision.

Where other processing requires a transfer outside the EEA, we apply an appropriate basis under GDPR Chapter V: a current adequacy decision or appropriate safeguards, in particular standard contractual clauses and any required additional measures. Support access and further providers are included in this assessment; the server country alone does not determine all access locations.

Information about a recipient, country and safeguards and how to obtain a copy is available at biuro@devconcept.eu, protecting justified confidential information. OSMF, as an independent controller, describes its infrastructure and further processing in its policy.

We retain data for the relevant purpose. Where one fixed period does not fit the nature of a matter, the criteria below apply.

• Account and representation: for service provision or the person’s authorised access; afterwards only the minimum needed to close the relationship, comply with law or protect justified claims.
• Support and reports: until the matter is handled and closed, then only for an applicable documentation duty or necessary evidence until the relevant period ends.
• Our own billing records: for the period required for the document by applicable tax or accounting law, including the correct start date and any legally justified extension.
• Entrusted organisation data, including documents and GPS: under the purpose, controller instructions and processing terms. Ending service includes return or deletion and at least 30 days to retrieve data after the agreed switching process ends or, if no switching process takes place, after service ends. The controller may instruct earlier deletion under the terms. Data are deleted after the retrieval period unless law requires further retention.
• Publications: exposure ends on withdrawal or expiry under service rules, normally no later than 24 hours after availability ends, capped at 14 days from publication. Minimum authorisation and activity history may separately remain for accountability and relevant claims.
• Logs and security: as needed to protect the service, diagnose an issue or investigate an incident. Evidence of a specific matter is separated from routine data and retained only for a justified period.
• Statements and consent: a minimum record of content, date, version and withdrawal is kept for accountability or justified claims. Withdrawal ends use for the consent-based purpose.
• Backups: are excluded from ordinary use. Data subject to effective deletion may remain in a particular backup only until it is replaced by a newer, verified backup in the replacement cycle. A backup being used for recovery already started after a specific incident remains until that recovery is completed. A copy needed as evidence in a specific matter is retained only under that matter’s separate legal basis and necessary period. Restoration reapplies previous effective deletion and restriction instructions.

Deletion requests are considered for the relevant scope, including related files, analysis results and copies, taking account of statutory exceptions and other people’s rights.

Under the GDPR’s applicable conditions, you have rights to information and access, a copy, rectification, erasure, restriction and portability. Portability concerns appropriate data processed automatically based on consent or contract; it does not automatically provide an organisation’s complete documentation or other people’s data.

You may object to legitimate interest processing on grounds relating to your particular situation. An objection to direct marketing is unconditional. You may withdraw consent at any time as easily as it was given, without affecting the lawfulness of earlier processing.

You also have protection for decisions covered by GDPR Article 22 within that provision’s scope. Contact the appropriate controller or biuro@devconcept.eu to exercise rights. An account, acceptance of terms and disclosure of a password are not required.

For our own processing, we respond without undue delay and within one month. Complexity or the number of requests may permit a further two months, with reasons provided during the first month. Where we act as processor, we forward the request to the appropriate controller and assist with its obligations.

Identity verification is proportionate to risk. Do not send identity documents, passwords or access keys in advance. Exercising rights is generally free; statutory exceptions concern manifestly unfounded or excessive requests. Any refusal or restriction requires a lawful basis and explanation.

If you believe processing violates the GDPR, you may complain to the President of the Polish Personal Data Protection Office (UODO). The UODO website explains how to complain. Contacting us first is not a condition of making a complaint.

Required data are identified in the relevant form. Without data needed for the account, organisation identification or a particular activity, that activity cannot be completed. Additional data are voluntary. A statutory requirement relates to a specific process rather than all application fields.

Accepting terms concerns the contract. This privacy policy provides information and does not require blanket consent to every processing activity. Functional publication permission, GDPR consent and consent to marketing or device storage are separate issues.

Commercial information or direct marketing is sent through the relevant channel only when requirements of Electronic Communications Law and the GDPR are satisfied. Consent is specific, informed, voluntary and withdrawable. Continuing to browse or a preselected box is not a substitute for consent.

We apply technical and organisational measures appropriate to the data and risk, including authentication and transmission protection, permission controls, separation of organisation scopes, protected file access, limited diagnostic data and incident procedures. Authorised personnel observe confidentiality and access limits.

Protect passwords, integration keys and active sessions. Organisations keep personnel access up to date. These duties do not replace the Operator’s own data protection obligations.

Report a suspected breach to biuro@devconcept.eu. Applicable incident duties are performed. Where the GDPR’s conditions apply, the controller normally notifies the authority within 72 hours of awareness and informs people entitled to notification; a processor notifies the controller without undue delay.

Where we receive data for our own purposes from an organisation, document, integration or register, we provide the appropriate GDPR Article 14 information, including sources and categories. This is done within a reasonable period, no later than one month; if contact or disclosure to another recipient happens earlier, information is provided by that activity. Exceptions require statutory conditions; a public source or business context is not a blanket exemption.

For entrusted data, the appropriate controller provides information with our assistance under the processing terms. Logisteo is a service for authorised people working within organisations and is not directed at children. If a minor’s data appear, necessity and protection are assessed individually with respect for their rights.

The current policy is available without login and before data collection. You can save or print it. Material changes to purposes, recipients or processes are communicated appropriately before they apply.

A new purpose requires its own legal basis and compliance with further processing requirements. Updating this policy does not replace necessary consent, processing terms or the contractual change procedure. Questions about current processing can be sent to biuro@devconcept.eu.