Privacy Policy (GDPR)

1. Data controller

The controller of your personal data is Transport Kris, with its registered address at Altmannsdorferstraße 104/2/256, 1120 Vienna, Austria .

This Privacy Policy applies to the Transport Kris website, user portals and the TK Kurier mobile application.

For matters relating to personal data protection, you may contact us at: info@transportkris.com .

2. Categories of personal data processed

Depending on how our services are used, we may process the following categories of personal data:

• Identification data: first name, surname, company name, tax or VAT/UID number, customer, partner or driver identifier, FTK number and order or transport number.
• Contact data: email address, telephone number, billing address, pickup or delivery address and country.
• Account data: username, assigned role, account status, settings, login-related data and information required to authenticate the user.
• Order and transport data: order history, pickup and delivery locations, processing status, dates and times, transport instructions, shipment details and other information required to perform the service.
• Location data: current GPS location, route history, geographical coordinates, timestamps, speed and other data required to monitor the transport.
• Photographs and multimedia data: photographs taken during pickup and delivery, photographs of the shipment, packaging, documents, data loggers, damage and other elements required during order performance.
• Documents: waybills, pickup and delivery confirmations, signatures, forms, invoices, complaints, attachments and PDF documents.
• Transaction and settlement data: order history, invoices, payments, settlement statuses and downloaded documents.
• Customer and partner database data: registration data, cooperation history, contact history, assigned orders and internal business notes.
• Communication data: messages, enquiries, complaints and attachments submitted through forms, user portals, the application or email.
• Technical data: IP address, device type and version, Android version, browser information, session identifiers, timestamps, security logs and information about application operation.
• Diagnostic data: information about errors, crashes, performance and system stability where necessary to ensure proper operation of the application.
• Notification data: information required to send notifications about new orders, status changes and system messages.
• Cookie data: essential cookie identifiers and, where consent has been granted, analytical or marketing identifiers.

3. Purposes and legal bases for processing

• Performance of a contract or order – Article 6(1)(b) GDPR, particularly for accepting, organising, performing, monitoring and settling transport services.
• User account management – Article 6(1)(b) GDPR, for registration, login, account management and providing relevant functions to customers, partners, dispatchers and drivers.
• Monitoring transport performance – Article 6(1)(b) GDPR and Article 6(1)(f) GDPR, to confirm the route, perform the order, ensure transport security and provide the customer with information about its execution.
• Documenting pickup and delivery – Article 6(1)(b) GDPR and Article 6(1)(f) GDPR, using photographs, documents, signatures, timestamps and location data.
• Invoicing and settlements – Article 6(1)(b) and Article 6(1)(c) GDPR.
• Compliance with legal obligations – Article 6(1)(c) GDPR, particularly regarding accounting, taxation and mandatory document retention.
• Ensuring security – Article 6(1)(f) GDPR, particularly for protecting accounts, detecting abuse, recording events and preventing unauthorised access.
• Handling complaints and pursuing claims – Article 6(1)(f) GDPR.
• Contact and ongoing customer support – Article 6(1)(b) or Article 6(1)(f) GDPR.
• Marketing or analysis – Article 6(1)(a) GDPR, only where the required consent has been granted.

4. GPS location and route monitoring

The TK Kurier application may access the precise location of the device while an active order is being performed. Location data may also be processed when the application is running in the background or when the device screen is turned off, where this is necessary to maintain continuous transport monitoring.

Location data is used in particular for:

• displaying the current position of the driver and transport,
• recording the route travelled,
• confirming arrival at the pickup or delivery location,
• ensuring transport security,
• detecting irregularities during order performance,
• supporting geofencing and route-related warnings,
• documenting the proper performance of the service.

Location tracking is connected with the performance of an order and may be stopped after the transport has been completed, in accordance with the application functions and the organisation of the service.

5. TK Kurier application permissions

Depending on the operating system version and the functions used, the application may request the following permissions:

• Precise location: required to monitor the transport being performed.
• Background location: required to maintain continuous tracking during an active order, including when the screen is turned off or the application is running in the background.
• Camera: required to take photographs of shipments, documents, data loggers, pickups, deliveries or damage.
• Access to photographs or files: required to select, save, upload or download documents and materials connected with an order.
• Notifications: required to provide information about new orders, status changes, important deadlines and system messages.
• Network access: required to synchronise data with the Transport Kris platform.
• Biometric authentication: where enabled by the user, biometric authentication may be used to securely unlock access to the application. Biometric data is handled by the device operating system and is not stored by Transport Kris.

The user can manage application permissions in the device settings. Disabling certain permissions may restrict or prevent the use of functions required to perform transport services.

6. Photographs, documents and proof of performance

During order performance, the application may allow or require the creation and transmission of photographs, documents, signatures and other evidence.

These materials may include:

• photographs of the shipment during pickup and delivery,
• photographs of data loggers and measuring devices,
• photographs of possible damage,
• waybills and transport documents,
• signatures and receipt confirmations,
• PDF files and attachments connected with the order,
• documents connected with complaints or verification.

These materials are used to perform the contract, confirm proper transport performance, handle complaints, ensure security and protect against claims and misuse.

7. User accounts and login security

Access to certain platform and application functions requires the creation of a user account and login.

To protect the account, we may process session data, device information, login time, IP address, the authentication method used and security-related events.

Passwords are stored in a protected form and are not made available to other users. Users are responsible for protecting their login details and must not disclose them to unauthorised persons.

8. Customer, partner and driver databases

We maintain protected databases containing information required to manage customers, partners, drivers, orders and transports.

• Access to data is limited to persons with the appropriate permissions.
• Each user receives access only to data connected with their account, role or assigned order.
• User and order identifiers are used to restrict access and prevent the display of data belonging to other customers or partners.
• Data is stored on protected server infrastructure.
• For security and audit purposes, we may record the date, time, user, file name and type of action performed.

9. Recipients of personal data

Data may be disclosed only to entities necessary for the operation of Transport Kris services, including:

• hosting, server infrastructure and domain providers,
• email service providers,
• technical and IT service providers,
• accounting and invoicing systems,
• banks and payment service providers, where applicable,
• partners performing orders assigned to them,
• legal advisers, accountants and other service providers bound by confidentiality obligations,
• public authorities where disclosure is required by applicable law.

Processors acting on our behalf are required to apply appropriate security measures and use personal data only in accordance with our instructions and applicable law.

10. Transfers of personal data outside the EEA

We aim to process personal data within the European Economic Area. If the use of a technical service results in the transfer of data outside the EEA, we will rely on an appropriate legal basis and safeguards, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

11. Data retention periods

We retain personal data for as long as necessary for the purpose for which it was collected and for the period required by applicable law.

• User accounts: for the period during which the account remains active and for the period required to settle the cooperation and protect against claims.
• Order and transport history: for the duration of the cooperation and for the period required for settlement, audit, complaint handling and protection against claims.
• Location data and route history: for the period required to confirm transport performance, settle the service, ensure security and handle possible claims.
• Photographs, signatures and transport documentation: for the period required to perform and document the service, handle complaints and comply with legal obligations.
• Accounting and tax documents: for the period required by law, generally up to 10 years.
• Contracts and correspondence: until the expiry of the applicable limitation periods.
• Technical and security logs: for the period required to protect the system, analyse events and prevent misuse.
• Data processed on the basis of consent: until consent is withdrawn, unless another legal basis permits continued processing.

12. Your rights

Subject to the conditions set out in the GDPR, you have the right to:

• access your personal data,
• receive a copy of your data,
• correct inaccurate data,
• request deletion of your data,
• request restriction of processing,
• data portability,
• object to processing,
• withdraw consent at any time where processing is based on consent.

Certain data may not be deleted immediately where continued retention is required by law or is necessary for the establishment, exercise or defence of legal claims.

To exercise your rights, contact us at: info@transportkris.com .

You also have the right to lodge a complaint with the competent data protection supervisory authority.

13. Account and data deletion

A user may request deletion of their account and personal data by contacting us at: info@transportkris.com .

Where the relevant function is available in the user portal or the application, the deletion request may also be submitted directly through the user's account.

After receiving the request, the account will be deleted or anonymised, except for data that must continue to be retained due to legal, accounting, tax or security obligations or for the protection against claims.

14. Cookies

Our website uses cookies that are technically necessary for website operation, login, session maintenance, security and remembering user settings.

Analytical or marketing cookies are used only where permitted by law and where the user has provided the required consent.

Cookie preferences can be managed through the cookie banner and the user's browser settings.

15. Notifications

The application may send notifications regarding new orders, status changes, pickup and delivery information, required actions, document deadlines and important security messages.

Users can manage notifications in their device settings. Disabling notifications may result in important information not being noticed in time.

16. Data security

We apply appropriate technical and organisational measures designed to protect personal data against loss, unauthorised access, disclosure, alteration or destruction.

These measures may include in particular:

• encryption of data transmission using HTTPS/TLS,
• role-based access controls,
• individual user and order identifiers,
• session and login protection,
• logging of security events,
• restriction of access to authorised persons,
• backups and data recovery procedures,
• protection of files and documents from public access.

No method of data transmission or storage can guarantee complete security. However, we take measures appropriate to the type of data and the level of risk.

17. Profiling and automated decision-making

We do not use profiling or solely automated decision-making that produces legal effects concerning the user or similarly significantly affects them.

18. Use of the application by authorised persons

The TK Kurier application is intended primarily for drivers, partners, employees and other persons authorised to handle transports within the Transport Kris system.

Users should use only their own account and a device they are authorised to use. Activities may be performed only within the scope of the user's assigned duties and permissions.

19. Changes to this Privacy Policy

This Privacy Policy may be updated periodically to reflect changes in applicable law, application functions, security measures or the way our services are provided.

The current version of the Privacy Policy is available at: https://transportkris.com/rodo-en/ .