GDPR

AXEN Logistics s.r.o. Privacy Policy.

Article I

Operator

1. The data controller is AXEN Logistics s.r.o., with its registered office at Súľovská 5808/21, 040 11 Košice – Západ district, Company Registration Number: 46 027 289, registered in the Commercial Register of the Košice Municipal Court, Section: Sro, file no.: 27357/V (hereinafter referred to as the „Controller“).
2. The controller processes the personal data of natural persons in accordance with Regulation (EU) (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), Act No. 18/2018 Z. z. on the protection of personal data and amending certain acts, as amended, and other generally binding legal regulations.
3. This Privacy Policy provides information on what personal data the Controller processes, for what purposes it processes it, on what legal grounds it processes it, to whom it may disclose it, for how long it retains it, and what rights data subjects have in relation to the processing of their personal data.
4. If the data subject has any questions regarding the processing of personal data, they may contact the Controller at:

1. email address: office@axenlogistics.eu
2. telephone number: +421 918 863 503
3. the Operator’s registered office address.

5. If the Controller has appointed a data protection officer in accordance with the GDPR, the data protection officer’s contact details will be published on the Controller’s website or made available upon request by the data subject.

Article II

Categories of data subjects and the scope of personal data processed

1. The controller processes personal data only to the extent necessary to achieve the purposes set out in this Privacy Policy and in accordance with the data minimisation principle under the GDPR.
2. The controller may process personal data relating, in particular, to the following categories of data subjects:

1. clients and their contact persons,
2. carriers, sub-carriers and their contact persons,
3. drivers involved in carrying out the transport,
4. representatives of business partners and suppliers,
5. visitors to the Operator’s website,
6. persons communicating with the Operator via email, telephone, the eCargo system or other means of communication,
7. job applicants or those seeking other forms of collaboration, where the Controller is recruiting.

3. The controller may process the following categories of personal data in particular:

1. personal details, in particular first name, surname, company name, job title or position,
2. contact details, in particular the address, email address, telephone number and contact details set out in the contractual or commercial documentation,
3. data relating to the conclusion and performance of contractual relationships, in particular data contained in orders, contracts, transport documents, complaints reports or insurance documentation,
4. details of drivers and persons involved in carrying out the transport, in particular their first name, surname, telephone number, signature, the details stated in the transport documents and the identification details required for organising the transport,
5. data on vehicle movements and the transport process, in particular GPS data, location data, route data, data on loading and unloading times, and other data relating to the monitoring of transport,
6. data contained in communications between the Controller and the data subject, including email correspondence, records of telephone conversations, communications via the eCargo system or other electronic platforms,
7. information contained in photographs, video recordings, documentation relating to damage claims, insurance claims, complaints or security incidents,
8. technical and electronic data collected whilst using the Operator’s website, in particular the IP address, device details, details of the web browser used, and data collected via cookies or similar technologies.

4. As a rule, the controller does not process special categories of personal data as defined in Article 9 of the GDPR. Where the processing of such data is necessary to comply with a legal obligation, to establish, exercise or defend legal claims, or for any other reason permitted by the GDPR, the Controller shall ensure that such data is adequately protected.
5. The controller does not obtain personal data exclusively from data subjects. Personal data may also be obtained from clients, carriers, sub-carriers, business partners, insurance companies, public registers, public authorities or other lawful sources, where this is necessary to fulfil the Controller’s contractual or legal obligations.

Article III

Purposes and legal bases for the processing of personal data

1. The controller processes personal data only to the extent necessary to achieve a specific purpose of processing and only on the basis of one of the legal grounds set out in Article 6 of the GDPR or specific legislation.
2. The controller processes personal data primarily for the following purposes:

1. the conclusion, fulfilment, record-keeping and management of contractual relationships with clients, carriers, sub-carriers, suppliers and business partners,
2. the organisation, arrangement, coordination and provision of domestic and international transport and freight forwarding services,
3. communication with clients, hauliers, drivers, business partners and other parties involved in the transport operation,
4. recording and managing orders, transport documents, contracts, delivery notes, CMR or eCMR consignment notes and other commercial documentation,
5. vetting of carriers, sub-carriers, drivers, business partners and other entities to protect against fraudulent behaviour, identity theft, phantom carriers or other security risks,
6. monitoring the progress of transport, ensuring the security of consignments and the protection of property, and meeting clients’ security requirements through the use of GPS data, location data and other operational data,
7. handling complaints, claims, insurance claims, recourse claims, legal disputes and the out-of-court enforcement of legal claims,
8. the protection of the rights, legally protected interests and property of the Controller, its clients or business partners,
9. compliance with obligations arising from legislation, in particular in the areas of accounting, taxation, transport, document archiving, data protection, the fight against fraud, and the implementation of sanctions or security measures,
10. the management of user accounts, electronic communications and electronic systems used in the organisation of transport, including the eCargo system or similar platforms,
11. the operation of the Controller’s website, the management of electronic services, ensuring the website functions properly, and analysing its usage,
12. marketing communications, the sending of commercial communications or information about the Controller’s services, provided there is an appropriate legal basis for doing so.

3. The legal basis for the processing of personal data may include, in particular:

1. the performance of a contract or the taking of steps prior to entering into a contract in accordance with Article 6(1)(b) of the GDPR,
2. compliance with the Controller’s legal obligation under Article 6(1)(c) of the GDPR,
3. the legitimate interests of the Controller or a third party pursuant to Article 6(1)(f) of the GDPR,
4. the data subject’s consent in accordance with Article 6(1)(a) of the GDPR, where required in a specific case.

4. The Controller’s legitimate interests may include, in particular:

1. the protection of the Controller’s property, rights and legally protected interests,
2. protection against fraudulent activity, identity theft, phantom carriers, unauthorised collection of parcels or other security risks,
3. vetting of carriers, subcontractors, drivers and business partners,
4. the assertion, substantiation or defence of legal claims,
5. ensuring the safety of transport, the protection of consignments and the smooth running of freight forwarding processes,
6. maintaining internal records, managing business relationships and improving the quality of the services provided.

5. Where the processing of personal data is based on the data subject’s consent, the data subject may withdraw their consent at any time in the manner specified in the relevant notice or by contacting the Controller. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

Article IV

Recipients of personal data and the disclosure of personal data

1. The controller may disclose or provide personal data only to the extent necessary to achieve the purpose of the processing and only to authorised recipients who are bound by a duty of confidentiality or another legal obligation to protect personal data.
2. Personal data may be disclosed or provided, in particular, to:

1. the Operator’s clients,
2. carriers, subcontractors, drivers and other persons involved in the provision of transport services,
3. business partners and service providers involved in the organisation and execution of transport,
4. insurance companies, reinsurance companies, claims adjusters, insurance brokers and other entities involved in the settlement of insurance claims,
5. lawyers, tax advisers, auditors, experts, debt collection agencies or other specialist advisers to the Controller,
6. providers of information systems, cloud services, hosting services, GPS monitoring systems, electronic communications services, the eCargo system or other technological solutions used by the Operator,
7. banks, financial institutions and payment service providers,
8. to a public authority, a court, a law enforcement agency, an administrative authority or any other authorised body, where so provided for by law or by a decision of the competent authority.

3. The controller may also disclose personal data to other entities where this is necessary for:

1. fulfilment of contractual obligations,
2. the protection of the rights and legitimate interests of the Controller, its clients or business partners,
3. handling complaints, claims, insured events or recourse claims,
4. vetting of carriers, subcontractors, drivers or business partners for the purposes of fraud prevention, protecting consignments and ensuring the safety of transport,
5. the assertion, substantiation or defence of legal claims.

4. Where the Controller uses data processors in accordance with the GDPR, it shall ensure that the processing of personal data is carried out on the basis of a written contract or other legal instrument in accordance with Article 28 of the GDPR.
5. The controller does not disclose personal data to third parties for their own marketing purposes, unless there is a specific legal basis for doing so or the data subject has given their consent.
6. Every recipient of personal data is authorised to process personal data only to the extent necessary to fulfil the purpose for which the data was made available or provided to them.

Article V

Transfer of personal data to third countries

1. As a rule, the controller processes personal data within the territory of the Member States of the European Union or the European Economic Area (EEA).
2. In justified cases, personal data may be transferred to a third country or an international organisation if such a transfer is necessary for the performance of a contract, the provision of international transport, the use of information systems or the provision of services used by the Controller.
3. Where personal data is transferred outside the European Union or the European Economic Area, the Controller shall ensure that such a transfer is carried out in accordance with the GDPR and that an adequate level of protection of personal data is ensured.
4. The transfer of personal data to a third country may be carried out, in particular:

1. to a country which the European Commission has determined ensures an adequate level of protection of personal data,
2. on the basis of standard contractual clauses approved by the European Commission,
3. on the basis of other appropriate safeguards or data protection mechanisms under the GDPR,
4. in cases expressly permitted by the GDPR, where the transfer is necessary for the performance of a contract or the exercise of legal claims.

5. In connection with the use of email, cloud services, GPS tracking systems, communication platforms, the eCargo system or other information technologies, personal data may be processed by service providers operating outside the European Union or the European Economic Area. In such cases, the Controller takes appropriate measures to ensure the protection of personal data in accordance with the GDPR.
6. The data subject may request information from the Controller regarding a specific transfer of personal data to a third country, including information on the safeguards in place, provided that disclosure is not restricted by law or by the rights of third parties.

Article VI

Retention period for personal data

1. The data controller retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or for as long as required by the relevant legislation.
2. The retention period for personal data depends primarily on the purpose of the processing, the nature of the data being processed, the Controller’s legal obligations and the need to protect its rights and legitimate interests.
3. Personal data processed for the purposes of entering into, performing and recording contractual relationships may be retained for the duration of the contractual relationship and, following its termination, for the period necessary to protect the rights and legitimate interests of the Controller, but at least until the expiry of the relevant limitation or preclusion periods.
4. The Controller retains personal data contained in accounting, tax and related documents for the period specified by the relevant legislation.
5. Personal data relating to complaints, claims, insured events, recourse claims, court proceedings, arbitration proceedings, administrative proceedings or other disputes shall be retained by the Controller for the duration of the relevant proceedings and subsequently for the period necessary to protect and enforce legal claims.
6. Personal data processed for the purposes of vetting carriers, sub-carriers, drivers and business partners, as well as for the purposes of fraud prevention, the protection of consignments and transport security, shall be retained by the Controller for the period necessary to achieve the aforementioned purposes and to protect its legitimate interests.
7. Data relating to the course of transport, GPS data, location data, communication records, photographs, documentation of security incidents, complaints, claims or insurance claims may be retained for as long as necessary to protect the rights of the Operator, its clients or business partners, in particular for the purposes of demonstrating compliance with contractual obligations, handling complaints, insurance claims and recourse claims.
8. Personal data processed on the basis of the data subject’s consent shall be retained by the Controller for the duration of the consent or until it is withdrawn, unless a specific legal provision or other legal basis permits its further processing.
9. Once the relevant retention period has expired, the Controller shall erase the personal data, anonymise it or ensure its destruction in a manner appropriate to the nature of the data and in accordance with the requirements of the law.

Article VII

Rights of data subjects

1. In relation to the processing of their personal data, data subjects have the rights set out in the GDPR, Act No. 18/2018 Z. z. on the Protection of Personal Data and other relevant legislation.
2. In particular, the data subject has the right to:

1. to request confirmation as to whether the Controller is processing her personal data,
2. to access your personal data and obtain information about its processing,
3. to request the rectification of incorrect or incomplete personal data,
4. to request the erasure of personal data, provided that the conditions laid down in the GDPR are met,
5. to request a restriction on the processing of personal data in the cases set out in the GDPR,
6. to object to the processing of personal data carried out on the basis of the Controller’s legitimate interest,
7. to receive the personal data they have provided to the Controller in a structured, commonly used and machine-readable format, and to request that it be transferred to another controller, provided that the conditions set out in the GDPR are met,
8. to withdraw consent to the processing of personal data at any time, where the processing is based on consent; the withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

3. The rights of the data subject may be restricted to the extent permitted by the GDPR or specific legislation, in particular where processing is necessary:

1. to fulfil the Controller’s legal obligation,
2. for the purpose of asserting, proving or defending legal claims,
3. to protect the rights and legitimate interests of the Controller, its clients, business partners or third parties,
4. for the handling of complaints, claims, insured events, recourse claims or the conduct of judicial, administrative or other proceedings.

4. The data subject may exercise their rights in writing, electronically or by any other means that allows them to prove their identity.
5. The controller shall process the data subject’s request without undue delay, and at the latest within the time limit laid down in the GDPR. In justified cases, this time limit may be extended in accordance with the GDPR.
6. If the data subject considers that the processing of their personal data is in breach of the GDPR or the relevant legislation, they have the right to lodge a complaint or bring proceedings before the Office for Personal Data Protection of the Slovak Republic, or to apply to the competent court.
7. The exercise of a data subject’s rights is free of charge, unless otherwise provided for in the GDPR or relevant legislation.

Article VIII

Cookies and technologies used on the website

1. The Controller’s website may use cookies, similar technologies and other technical tools to ensure the website functions correctly, enhance security, analyse visitor traffic, improve the user experience and provide selected electronic service features.
2. Cookies are small text files that are stored on a user’s device when they visit a website and enable the user’s device to be recognised or certain information about their use of the website to be recorded.
3. In particular, the operator may use:

1. essential cookies required for the website to function properly,
2. analytical and statistical cookies used to analyse website traffic and usage,
3. functional cookies that enable user settings to be remembered,
4. marketing or advertising cookies, if these are used on the website.

4. Cookies that are not essential for the operation of the website are used only on the basis of the relevant legal grounds and, where required by law, only after the user has given their consent.
5. Users can manage their cookie settings via the cookie banner displayed when they visit the website or via their web browser settings. However, restricting the use of cookies may affect the functionality of certain parts of the website.
6. Detailed information on the cookies used, their purposes, retention periods and management options is set out in a separate document entitled „Policy on the Use of Cookies and Similar Technologies by AXEN Logistics s.r.o.“ published on the Controller’s website.

Article IX

Processing of personal data for the purposes of security, fraud prevention and vetting business partners

1. The controller also processes personal data for the purposes of protecting its rights and legitimate interests, protecting customers, safeguarding consignments, preventing fraudulent behaviour, preventing damage and ensuring the security of transport.
2. For the purposes set out above, the Controller may process the personal data of clients, carriers, sub-carriers, drivers, contact persons and other individuals involved in the organisation or provision of transport services.
3. To the extent necessary to achieve the aforementioned purposes, the controller may, in particular:

1. vetting of carriers, subcontractors, drivers and business partners prior to entering into a business relationship or during the course of such a relationship,
2. verification of identification, registration, contact and operational details,
3. verification of licences to carry out transport activities and related authorisations,
4. verifying the validity of insurance cover and insurance-related details,
5. verifying information available in public registers, lists or databases,
6. verifying facts relating to suspected fraudulent behaviour, identity theft, unauthorised collection of a consignment, unauthorised use of a vehicle or other security risks,
7. the recording and assessment of security incidents, damage claims, insurance claims, customer complaints and recourse claims,
8. monitoring the progress of the consignment using GPS data, location data or other data relating to the vehicle’s movements, where necessary to ensure the safe delivery of the consignment, protect the consignment or fulfil contractual obligations.

4. The legal basis for the processing of personal data under this Article is the Controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR, consisting in particular of:

1. the protection of the Operator’s assets, those of its clients and business partners,
2. the protection of consignments and the prevention of damage,
3. protection against fraudulent behaviour, bogus carriers, unauthorised recipients or other forms of abuse,
4. verifying the reliability of business partners,
5. the assertion, substantiation or defence of legal claims,
6. compliance with insurers’ requirements, insurance terms and conditions, and safety standards applied in the transport and logistics sector.

5. The controller shall take appropriate technical, organisational and security measures to protect the personal data being processed against unauthorised access, loss, misuse, destruction or unauthorised disclosure.
6. The processing of personal data under this Article shall be carried out only to the extent necessary for the purpose pursued and for the period necessary to protect the rights and legitimate interests of the Controller, its clients and business partners.

Article X

Final Provisions

1. The Data Controller is entitled to amend or supplement this Privacy Policy as appropriate, in particular in the following cases:
   (a) changes to legislation,
   (b) changes to the way in which personal data is processed,
   (c) changes to the services provided,
   (d) changes to technical or organisational measures,
   (e) changes relating to the use of the Operator’s website or electronic systems.
2. The current version of the Privacy Policy is published on the Controller’s website.
3. If the Controller uses cookies or similar technologies on its website, details of their use may be set out in a separate document entitled „Rules on the Use of Cookies and Similar Technologies by AXEN Logistics s.r.o.“, which is published on the Controller’s website.
4. This Privacy Policy applies, as appropriate, to personal data processed in connection with the provision of the Controller’s freight forwarding, logistics and related services, unless otherwise provided for in a separate document or by law.
5. This Privacy Policy shall come into force and take effect on 24 June 2026.