Privacy policy

RZ OÜ is an Estonian private limited company (OÜ), registry code 14255749, not registered for VAT. The contract is with that company.

RZ OÜ is the controller for the account, billing, and security logs. The privacy contact is info@nocargo.eu once the operator sets that address. The shipper is the controller for carrier and customer contact details they type in. nocargo is the processor for that data. The shipper's own customers are not nocargo account holders. Their data is processed under the data processing agreement.

Categories: account data, billing data, shipment contents the customer types, messages, files, inbound mail, support chats, and security logs.

Purposes and bases: contract for the service; legitimate interest for security and for product email that is not marketing; consent for non-essential cookies and for marketing mail.

Retention: orders for the life of the account plus 24 months, then delete or anonymise; invoices for the period Estonian accounting law requires; unmatched inbound mail for 14 days; AI chat bodies for 30 days, while token counts stay; backups follow the backup rotation.

Recipients are the sub-processors on the sub-processor list. We do not sell personal data.

International transfers: Stripe under its DPA, with card data staying at Stripe. Mailgun is configured for the EU region (api.eu.mailgun.net). The AI provider, when the feature is on, uses the region of the account's API key, with SCCs where the provider is outside the EEA. Sentry, if enabled, has send_default_pii off and uses an EU region when the plan has one.

Rights: access, rectification, erasure, restriction, portability, and objection. Email the privacy contact. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).