Towarix
Privacy policy
This is an English translation of the Polish original. In case of any discrepancy, the Polish version prevails.
This policy explains what personal data we process in connection with the towarix.com website and the Towarix platform available at app.towarix.com (the Platform), for what purpose, on what legal basis and for how long, to whom we disclose it, and what rights you have. Capitalised terms have the meaning given to them in the Terms of service.
1. Controller
The controller is Danyil Prudnikov, conducting business under the name DANYIL PRUDNIKOV, business address: ul. Garbary 5/130, 85-229 Bydgoszcz, Poland, NIP (tax ID) 9671469007, REGON 526424313 (the Service Provider, “we”).
For any matter concerning personal data, contact us at support@towarix.com or in writing at the address above. We have not appointed a data protection officer.
2. When we are a controller and when we are a processor
As a controller we process data for our own purposes: data of people who contact us, data of Customers and their representatives needed to conclude and settle the contract, data of website visitors, and data of Users to the extent needed to authenticate them, keep the Platform secure and contact them about the Service.
As a processor we process data that the Customer enters into the Platform or imports into it from External Services, in particular data of buyers and recipients of orders (e.g. from Allegro, Fakturownia, Erli or Temu), data of the Customer's supplier contacts, and other data of Users. The Customer is the controller of that data and we process it only on the Customer's instructions, under the data processing agreement annexed to the Terms of service or a separate agreement with the Customer. If your data reached the Platform this way (for example, you are a buyer in our Customer's shop), please contact that Customer first.
3. What data we process as a controller, why, and for how long
| Data subjects and data | Purpose and legal basis | Retention |
|---|---|---|
| Platform Users: name, email address, account ID, role, sign-in data (passwords stored only as hashes, second authentication factor), linked Google account | Creating and running the account, authentication, contact about the Service — legitimate interest in providing the Service to the Customer (Art. 6(1)(f) GDPR), and where the User is also the Customer — performance of the contract (Art. 6(1)(b) GDPR) | While the account exists; up to 30 days after the account is deleted, and in backups until they rotate out (up to 30 days) |
| Platform Users: IP address, audit trail (who did what and when), technical application logs | Platform security, abuse detection and accountability for changes — legitimate interest (Art. 6(1)(f) GDPR) | Audit trail — for the term of the Customer's contract; technical logs — up to 30 days |
| Customers and their representatives: name, business name, address, tax ID, email address, phone number, order and payment data | Concluding and performing the contract (Art. 6(1)(b) GDPR); invoicing and accounting required by tax law (Art. 6(1)(c) GDPR); establishing and defending claims (Art. 6(1)(f) GDPR) | For the term of the contract and then until claims become time-barred; accounting records — 5 years from the end of the tax year in which the tax payment deadline passed |
| People who contact us: name, email address, phone number, message content | Answering enquiries and correspondence — legitimate interest (Art. 6(1)(f) GDPR), and before a contract is concluded — steps taken at the person's request (Art. 6(1)(b) GDPR) | Until the matter is closed, or, if the correspondence concerns a contract, as long as Customer data (row above) |
| Visitors to towarix.com: IP address, browser data | Delivering the website and protecting it against attacks — legitimate interest (Art. 6(1)(f) GDPR) | We keep no visitor logs of our own; Cloudflare processes this data technically (section 4) |
Customer data entered into the Platform (including data we process as a processor) is kept for the term of the contract and for 30 days after it ends, to allow a final export, and is then deleted, including from backups as they rotate, unless the law requires longer retention.
Providing data is voluntary, but without the data needed to create an account and conclude the contract we cannot provide the Service. We do not make decisions based solely on automated processing, including profiling, that produce legal effects.
4. Who receives the data
We use the following providers, who process data on our behalf (sub-processors) under agreements that ensure its protection:
| Entity | Service | Location / transfer basis |
|---|---|---|
| Hetzner Online GmbH, Germany | Platform servers, database, document editor | EU (Germany) |
| Cloudflare, Inc., USA | DNS, traffic protection and acceleration, hosting of towarix.com, storage of files (photos, attachments) and backups | EU / USA — EU-U.S. Data Privacy Framework, standard contractual clauses |
| Clerk, Inc., USA | User authentication and account management | USA — EU-U.S. Data Privacy Framework, standard contractual clauses |
We notify Customers at least 14 days in advance of any intended addition or replacement of a sub-processor of Customer data, as set out in the data processing agreement.
Data we process as a controller may also be received by: Google (the email service behind support@towarix.com — correspondence), our invoicing system provider (Fakturownia), providers of accounting and legal services to us, and public authorities where the law requires it.
Data the Customer instructs the Platform to send to External Services (e.g. Allegro, Temu, Erli, Ceneo, Fakturownia) goes to those services on the Customer's instruction, under the Customer's own agreements with their providers. Those providers are not our sub-processors.
5. Transfers outside the European Economic Area
Some providers (Cloudflare, Clerk, Google) are based in or use infrastructure in the United States. Transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (for certified entities) or on the Commission's standard contractual clauses. You can obtain a copy of the safeguards by writing to the address in section 1.
6. Data received from Google
The Platform uses Google APIs in two cases.
Sign in with Google
When a User signs in with a Google account, through our authentication provider (Clerk)
we receive only the basic data needed to sign in: the Google account ID, the email address
and whether it is verified, and the name and profile picture if present in the profile
(scopes openid, email, profile). We use them only to
create the account, recognise the User on later sign-ins and show their name in the
Platform.
Copy of data on Google Drive (optional feature)
If the Customer turns this feature on and connects a Google account, the Platform requests
the https://www.googleapis.com/auth/drive.file scope. It lets the app use only
files it created itself or that the User explicitly shared with it. Under this feature the
Platform:
- creates one folder for the copies on the Customer's Drive;
- once a week saves into it an archive with an export of the Customer's Towarix data;
- moves only its own older archives in that folder to the trash;
- does not read, search or modify any other file on the Drive.
We store the access and refresh tokens encrypted and use them only for the actions above. When the Google account is disconnected in the Platform or the contract ends, we revoke the tokens with Google and delete them. Access can also be revoked at any time in the Google account settings.
Limited Use
We use data received from Google only to provide or improve the user-facing features described above. We do not sell it, do not transfer it to others (except to the providers in section 4 as needed to run these features, at the User's direction, for security, or to comply with the law), do not use it for advertising or to train generalised artificial intelligence models, and do not allow humans to read it unless the User consents, it is necessary for security, or the law requires it.
Towarix's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. Cookies
The towarix.com website uses no cookies and no analytics or advertising tools.
The app.towarix.com Platform uses only cookies strictly necessary for it to work: keeping the signed-in User's session (including cookies of the authentication provider Clerk on app.towarix.com and clerk.towarix.com), protecting forms against CSRF attacks, and remembering the selected organisation. They are necessary to provide the service the User requested, so they do not require consent (Art. 399(3) of the Polish Electronic Communications Law). We use no analytics or advertising cookies.
8. Your rights
Where we are the controller of your data, you have the right to:
- access your data and receive a copy;
- rectify your data;
- erase your data;
- restrict processing;
- port data processed under a contract;
- object to processing based on legitimate interest (Art. 6(1)(f) GDPR);
- lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, Poland).
To exercise your rights, write to support@towarix.com. We reply without undue delay and within one month at the latest. If the request concerns data we process on behalf of a Customer, we pass it to the Customer and help them respond.
9. Security
We apply technical and organisational measures appropriate to the risk, in particular encrypted connections (TLS), encryption of External Service credentials and of shipment recipient data, role-based access control, two-factor authentication, logical isolation of each organisation's data, an audit trail, daily backups and ongoing security updates.
10. Changes to this policy
The current version of this policy is always available at towarix.com/privacy with its effective date. We notify Customers of material changes by email before they take effect.