Your data, your control.

01Overview#

This policy explains what personal data Frachta processes, why, the legal bases we rely on, and how you can exercise your rights. It applies to the Frachta platform, the website at frachta.lv and the Frachta Driver app, and is written for our business users — freight forwarders, carriers and their staff — and for the drivers who use the app.

02Data controller identity & contact#

SIA "HEIDA LTD", registration No. 40203741048, VAT No. LV40203741048, Spāres iela 3A, Rīga, LV-1002, Latvia is the data controller for personal data processed through the platform (“Frachta”, “we”).

This applies to data Frachta processes for its own purposes — accounts, security, billing, platform analytics. For data of the Customer's partners, drivers and counterparties that the Customer processes on the platform, the controller is the Customer — see section 05 and the Data Processing Agreement.

For all privacy matters write to privacy@frachta.lv.

03Categories of personal data we collect#

Depending on how you use Frachta, we may process the categories below. Some of it is entered not by you but by other Users — for example, a counterparty adding your name and phone number as a contact on a shared order:

• Account & company data — name, work email, phone number, role, company name, registration and VAT numbers.
• Operational data — loads, orders, freight tasks, consignment notes and invoice records you create, including contact details of drivers and counterparties you enter.
• Financial data — uploaded bank statements and payment-reconciliation data (see section 06), invoices and payment records.
• Verification & due-diligence data — EU VIES VAT lookups used to verify that an account belongs to a genuine business, and — when a user runs a partner check — public registry, financial and EU/UN/OFAC sanctions-list data about the checked company, which may include the names of its owners or board members.
• Usage, device & log data — IP address, browser, and actions taken on the platform (security and audit logs).
• Communications — support tickets, in-platform chat and correspondence with us.
• Driver app data — where a driver uses the Frachta driver app: the driver's name, gender, date of birth, nationality, country of residency, e-mail and driving-licence categories with their validity dates; sign-ins — the device, its IP address, the app version, the phone's operating system and, where the phone reports it, its version, and when each sign-in began, was last used and ended; runs, with the end time, reason and any note the carrier's office gives when it finishes a run for the driver; stop events and odometer readings; vehicle checks; seals, each with the cargo unit it is on (truck, trailer or semi-trailer) and that unit's registration plate, and the driver's answer at a loading stop that no seal is required; proofs of delivery, problem, damage and defect reports, and the damages the carrier records as the driver's fault, which the app shows that driver with their photographs and the amount the carrier decided to recover, never its repair cost; messages with the carrier's dispatch, and any report the driver makes about one of its messages, with the reason and the driver's note; the documents they sign; the location at a work event, photographs, crash reports and — only with the driver's consent — usage counts and anonymous diagnostics, as described below. The app also shows the driver their schedule and their pay as their carrier recorded it, day by day, and — once the carrier has uploaded its accountant's figures — the gross pay, the taxes and contributions and the net pay. The gender, female or male, is required: it is asked at registration, and once of a driver who registered before it was asked. Until a driver answers, the app cannot be used, though the driver can sign out. It is used only to word the driver's own documents — whether the app's “Maternity / Paternity leave” choice applies for maternity or for paternity leave, and, on a document in Latvian, Lithuanian or German, whether the driver's position is written in the feminine form — and for this we rely on our contract with the driver, Art. 6(1)(b). The carrier is not shown it and does not receive it, Frachta's support staff are not shown it, and it never goes into usage counts, crash reports or diagnostics; but a maternity or paternity leave application, and that wording, show it to the carrier. A carrier links a driver by inviting their Driver ID; only when the driver accepts the invitation in the app does the carrier receive the driver's e-mail address (where its own record has none) and licence categories with their validity dates. If the driver declines, the carrier is told the answer and receives neither.
• Location at a work event — when a driver records an arrival, loading or unloading, waiting for documents, a departure or a problem at a stop, an arrival at or a departure from a saved place, a seal, the answer that no seal is required or a proof of delivery, or sends a damage or defect report, the app attaches the phone's position if the driver has allowed it. The app asks for the phone's precise-location permission but requests each position at balanced accuracy — about a hundred metres, not the phone's most exact fix — and only at the moment of that action; if the driver allows only approximate location on the phone, the app records the approximate position it is given. If the phone gives no position within about 4 seconds, the app takes the last position the phone already has, provided it is no more than 2 minutes old; that position can be more exact than a hundred metres if the phone already had a more exact one, from a navigation app for example. The damage- or defect-report screen also reads the position when it opens, to show it to the driver; it is sent only with the report. The app may use location only while it is being used: there is no continuous or background tracking, the app never follows a driver between events, and an action still completes if the driver refuses or the phone cannot get a fix.
• Location verification — for every action a driver records at a stop — arrivals, loading and unloading, waiting for documents, departures, seals put on or taken off, the answer that no seal is required, proofs of delivery and problem photos — and for arrivals at and departures from saved places, Frachta records whether the truck was at that stop. Where the employer has connected a telematics account, the truck's latest position from it (the same position the employer's live map shows) is compared with the stop's location; where no usable truck position is available — no telematics, no truck position within 2 seconds, or only a truck position taken more than 15 minutes before or well after the action — the phone's position recorded with the action is compared instead. Stored with the action: the outcome (within 500 metres of the stop, further away, no position to compare, or no location for the stop), which position was used (the truck's or the phone's), the distance and when that position was taken — never the truck's position itself, nor which vehicle's position was compared. A seal records, separately, the cargo unit it is on and that unit's registration plate. The employer sees the outcome on the order; the driver is not shown it. It is a record, never a block — no action is refused because of it. Because it is a standing record of whether a worker was where the job placed them, it is set out here on its own rather than left inside “task events”.
• Photographs — vehicle-check, seal, proof-of-delivery, problem-report, damage and defect pictures taken with the camera in the app. A proof of delivery is a photograph of the signed delivery documents, so it shows the names and signatures on them. A photograph at a loading bay or a warehouse door can show people who are not our customers and not our users; those people appear in it only because the picture was taken where the work happened. Location and device metadata held inside the image file (EXIF) is removed before a photograph is stored. Photographs the carrier adds to a damage it records as a driver's fault are shown to that driver in the app.
• The person who signed for the goods, in older records — deliveries recorded while the person receiving a consignment signed for it on the driver's phone hold that person's name and role, the place and any remarks. That person is usually neither our customer nor our user: their name is in the record because a proof of delivery is not proof of anything without it. Deliveries are now proved by a photograph of the signed delivery documents instead.
• Your review of Frachta — if you choose to review the platform: the rating, the words you write, the name and role you ask to be credited under, and whether you agreed to publication. A review is never required, and nothing about your account changes if you ignore or decline the request.
• Device identifiers — where push notifications are switched on. In a browser, accepting its prompt creates a subscription with the browser's own push service, and we store the address it returns so that we can send to it. In the driver app, allowing notifications gives the app a push token from Expo, which we store with that sign-in. Neither is a cookie or an IP address.
• Absence, leave and a driver's own documents — where a carrier manages time off in Frachta: the type of absence (leave, holiday or sickness), the dates, whether it was approved, and a note on leave or holiday — a sickness absence takes none. The applications a driver makes in the app — annual, unpaid, maternity, paternity and child-care leave, and resignation with its grounds, reason and last working day — and explanations, with their subject, date and the driver's own words. A document signed in the app carries the driver's drawn signature, stored as the shape of the lines, not their speed or pressure. A resignation is signed outside the app with a qualified electronic signature — eParaksts where the employer is registered in Latvia, otherwise any EU qualified electronic signature; we keep the uploaded file — which, like any qualified electronic signature, contains the signer's certificate, often with a personal identification code — and record only the name from it.
• Health data (a special category). A sickness absence says something about a person's health, and the law treats it more strictly than the rest of this list. Frachta records only that an absence was of that type and when it ran — a sickness absence has no note, and Frachta does not ask for, and should not be given, a diagnosis, a medical certificate or any clinical detail. A driver's problem report marked “Injury or illness” is health data too: it carries that subject and whatever the driver writes, and the app asks for no diagnosis. So is a maternity leave application: it shows that the driver is pregnant, and holds the leave period — the dates on the doctor's certificate, not the certificate itself — and the expected date of birth. The carrier sees it like any other application; the notification and e-mail that tell the carrier's users about it say only that a leave application was submitted. An annual-leave application may state that it follows maternity leave. The employer is responsible for the lawful basis under Article 9 for keeping these records — in employment, ordinarily an obligation under employment and social-security law.
• A driver's child — a paternity or child-care leave application carries the child's date of birth, and a maternity leave application the expected date of birth — nothing else about the child — because the leave depends on it. It is kept with the application.
• Crash and performance reports from the driver app — when the app crashes, a report goes to Sentry (named under data sharing below): the error and where in the app it happened, the screen, the screens and buttons used just before it, the phone's model, operating system and app version, and the app's recent requests by method, address and result code — never their contents. For a sample of uses the app also reports how long screens and requests took, and for every use it reports whether that use ended in a crash, so that the share of uses without a crash can be measured. A report carries the driver's internal account number and nothing else about the driver — no name, e-mail address, location, photographs or message text. The app does not ask for consent to this: we rely on our legitimate interest in keeping the app working, Art. 6(1)(f).
• Usage of the driver app — only with the driver's consent — the app asks once whether it may count how it is used, and counts nothing unless the driver agrees; the answer can be changed at any time in the app, under Profile → Settings, and withdrawing it stops the counting. With consent, PostHog (named under data sharing below) receives which screens are opened, by name; each time one of seven work actions is completed — a vehicle check sent, a run started, an arrival at a stop, a proof of delivery sent, a damage report sent, a chat message sent and a document signed — with a few simple details such as how many photos were sent; when the app is opened and closed; and technical details such as the phone's model, operating system and language and the app version — linked to the driver's internal account number. It never receives the driver's location, photographs, messages or documents. For a driver who agreed, Frachta's support staff can see, as counts, how often each screen was opened and how many events the app sent each day over the last 30 days, as described below. We keep the driver's answer and when it was given for as long as the account exists, and deleting the account erases it; as proof of the consent, our audit log also keeps a record of each answer — yes or no, when it was given and the account's internal number, never the driver's name — for 24 months.
• Anonymous diagnostics from the driver app — only with the driver's consent — the app asks, as a separate question next to usage counts, whether it may send anonymous diagnostics, and sends nothing unless the driver agrees; the answer can be changed at any time in the app, under Profile → Settings. With consent, it sends a short report to Sentry (named under data sharing below) only when something goes wrong: at the next start after the app ended while it was open on the screen — by a crash, by the phone's system for using too much memory or for not responding, or by the phone switching off — and when its memory grows unusually fast or unusually high, at most once a minute and five times each time the app runs. Nothing is sent on a normal day, and a report that cannot be sent at that moment is dropped, not kept for later. While the answer is yes, the app keeps its last ten readings and the screens just opened in a small file on the phone, so that it can report an unexpected end at the next start; a no, or signing out, deletes it. A report holds counts and sizes read every two seconds, the last ten readings at most — requests by kind of server, method and outcome, and the size of what they sent, never their address; photos loaded, timers, secure-storage calls, screen renders and requests in progress; the app's memory figures; how long the app had been running, whether it was in front and the type of network — together with the screen open at the time and up to four before it, by the app's own screen names, the app's version and build, and the phone's model, maker and operating system with its version. It holds no name, account number, phone or installation identifier, location, time zone, language, web address, typed text, photograph, message or document. Like any request over the internet, it shows Sentry the IP address it comes from; the report carries a placeholder in its place, so that Sentry does not store that address or work out a location from it. Sentry keeps these reports in the EU, in a project of their own that holds no crash report. If a no given without a connection has not reached us when the driver signs out or the sign-in otherwise ends, the phone keeps it — with a one-way code of the account, never the account number — and sends it the next time the same driver signs in on that phone; reinstalling the app or deleting the account removes it. We rely on the driver's consent, Art. 6(1)(a). We keep the driver's answer and when it was given for as long as the account exists, and deleting the account erases it; as proof of the consent, our audit log also keeps a record of each answer — yes or no, when it was given and the account's internal number, never the driver's name — for 24 months.
• Support by Frachta staff — Frachta's authorised support staff can open a driver's account to help the driver and to keep accounts secure. They see the driver's name, e-mail address, Driver ID and app language; the account's status — including whether Frachta has blocked it, and since when — when it was created and when it was last active; the companies it is or was linked to, or that invited it, with each link's status and dates; the app version, platform and system version last seen, and whether notifications are on; the answers about usage counts and anonymous diagnostics, each with its time; recent sign-ins — when each began, was last used and ended, with the platform, system and app version, never the IP address; and counts from the records of the driver's work — the days active in the last 7 and 30 days, and the runs started and finished, stop events, photographs uploaded, documents signed, applications submitted and chat messages sent, over the last 30 days and in all — never the records themselves or the text of a message. Only for a driver who agreed to usage counts do they also see, from PostHog, how often each screen was opened and how many events the app sent each day over the last 30 days, as counts. This view does not show the driver's chats, documents, payslips, photographs, locations, gender, date of birth, nationality, licences or health data, and nothing in it can be exported; a message the driver reports is read by Frachta staff only to deal with that report. Staff allowed to act on an account can sign the driver out on every phone, block or unblock the account — a block also signs the driver out on every phone; a blocked account cannot sign in, though it can still be deleted on the deletion page, and its links and work records are not touched — and send again the confirmation e-mail of an unfinished registration. Every account opened, every search or listing of driver accounts and every action is recorded in our audit log with the staff member and, for an action, the reason they wrote; the words searched for are not recorded. We rely on our contract with the driver, Art. 6(1)(b), to support them, and on our legitimate interest in keeping the service and its accounts secure, Art. 6(1)(f).
• People who receive order updates — a User can have Frachta e-mail its client about the progress of an order. For that we process, on the User's behalf and under the Data Processing Agreement, the e-mail addresses the User enters for the order — at most five, which the User may also keep on the client's card for later orders — what was sent to them and when, whether it was sent, and whether the updates were stopped from the e-mail's link. The e-mails show the order's stops and their times, the cargo, the truck's and trailer's plates and, on delivery, the proof of delivery — never a price or the driver's name. Each recipient receives their own copy, so no recipient sees another's address. The User is the controller of this data, and questions about it go to the User first. Each e-mail links to a page where its recipients can stop the updates for that order; the User is told, and only the User can switch them on again. That page loads no analytics or advertising tag.
• How our news and offers are read — our news and offer e-mails carry a small image and a tracked link that tell us, for each recipient, whether and when the e-mail was first opened and its link first clicked; a click on an offer shown inside the platform is recorded in the same way. We use this to measure our campaigns. The record is kept with the recipient's account and also goes to PostHog, linked to the internal user and company numbers, never to a name or e-mail address. Sign-in, verification, invoice, notification and other service e-mails carry neither. You can prevent the record of an opening by not loading images in your mail program, and unsubscribing stops these e-mails altogether.
• Country for advertising on our home page — to choose which advertisement frachta.lv shows you, we look up the country your IP address is allocated to, using the regional internet registries' public allocation lists, when the page asks for an ad. The country is used only for that choice and to tell you why you see the ad. Neither your IP address nor the country is written to a database or a log; the lookup is kept only briefly in the server's memory. Advertisers receive only how many times their ad was shown and clicked each day.

04Purposes & legal bases#

For each purpose we identify a lawful basis under Article 6 GDPR:

• Provide & secure the service (accounts, exchange, TMS, documents) — performance of a contract, Art. 6(1)(b).
• Verify companies, keep records, meet tax and accounting duties — legal obligation, Art. 6(1)(c).
• Improve the platform, prevent abuse and fraud, secure the marketplace — legitimate interests, Art. 6(1)(f).
• Optional cookies and analytics — consent, Art. 6(1)(a), managed via the Cookie Policy preference centre; usage counts and anonymous diagnostics in the driver app are managed in the app, under Profile → Settings.
• News and offers by e-mail — consent, Art. 6(1)(a), given when registering or in Account → Notifications. Users who registered before we asked have given no answer either way, and we send them news and offers until they refuse, relying on our legitimate interest in telling existing customers about our own similar services, Art. 6(1)(f). Every such e-mail has an unsubscribe link, and refusing or withdrawing consent, there or in Account → Notifications, takes effect from the next e-mail. Offers shown inside the platform to signed-in users rely on the same legitimate interest.
• Choose which advertisement our home page shows — legitimate interests, Art. 6(1)(f); only the country of your IP address is used, and nothing is stored.

05Driver app data controller#

The carrier decides, not Frachta. Your employer chooses to use the app, chooses whether to connect a telematics account, and is the controller of that data. Frachta processes it on their instruction and does not use it to make decisions about you.

No automated decision is taken about you from it. A location that does not match is recorded and shown to your employer; nothing is blocked, refused or penalised by the software.

Absence is not monitoring, and is not treated as it. A leave or sickness record exists because somebody has to plan the week and meet an employment obligation. It is visible to the carrier that employs the driver and to nobody else — not to other carriers a driver works for, and not to anyone trading on the exchange.

Pay from telematics. Where a carrier pays its drivers extra for night work or for days on public holidays, the times and distances of the vehicle's telematics trips during a driver's run are used to count the kilometres driven at night and the nights of work; where a carrier pays its drivers per hour, the driving hours of those trips are counted the same way, and the carrier can correct them. That is a calculation of pay the carrier owes; the driver sees its result line by line on the payslip, and nothing else is decided about the driver from it.

Per diem, posting and fuel. Where a carrier connects telematics, the platform also works out from its vehicles' trips and border crossings which driver was in which country on each day. For a trip the telematics provider did not tie to a driver, it assumes that the driver who last drove that vehicle kept it until somebody else drove it or four days passed, and it lists what it still cannot attribute rather than guessing. The carrier uses this for its drivers' per diem and for the facts of posting and cabotage it declares to the authorities. The carrier's fuel report lists every fall of 5 litres or more in a vehicle's tank, with its time and place and the driver the telematics provider identified at that moment, for the carrier to check. These are reports the carrier draws up and checks: the software takes no decision about a driver from them, and a fall in a tank is a measurement, not a finding that anybody did anything wrong.

06Data from bank-statement uploads#

Frachta lets you upload bank statements to reconcile payments against invoices. These files can contain personal and financial data of third parties (counterparty names, IBANs, amounts, dates and payment references), so this processing is described separately.

We extract only the fields needed for payment matching, store files under randomised names with access restricted to your company workspace, and never use statement contents for any other purpose. By uploading a statement you confirm you are entitled to share it. Statements are deleted with your account or earlier on request.

07Data sharing & processors#

We share data with vetted processors under data-processing agreements, and with other Users only as needed to conclude and perform a load or order — for example, your company profile, ratings and the contact details you attach to an offer are visible to counterparties. We do not sell personal data.

• Hosting & infrastructure — Hetzner Online GmbH (Germany): servers in Helsinki, Finland (EU), in the data centre of Hetzner Finland Oy, running the platform, its database, our domain name service, and our own map and route server, which draws the maps and plans truck routes from OpenStreetMap data; the points of a route and a truck's dimensions stay on these servers and reach no third party.
• Email — our own mail server, on the same Hetzner servers, sends our transactional email (verification, sign-in links, notifications and documents) and receives the email sent to our addresses, with no other email provider in between.
• Product analytics — PostHog (EU cloud). In your browser, page-view analytics run only with your consent. Separately, the platform records which features are used — for example that an offer was posted or a message sent, never its content — linked to an internal user and company number, never to your name or email address; for this we rely on our legitimate interest in improving the platform. In the driver app, PostHog counts usage only for drivers who agree, linked to the driver's internal account number, as described above.
• Payments — Montonio Finance, UAB (Lithuania), our payment provider for everything bought on the platform: plans, team and driver seats, usage tiers, and company checks, repair-invoice scans and AI route-planner credits. With each order it receives what was bought, the company's name, VAT number and address, and the name and e-mail address of the user paying (the company's public e-mail address where there is none), so that its payment records show who paid for what. Montonio acts for payment data as an independent controller.
• Error and performance monitoring — Sentry (Functional Software, Inc.; EU data region, Germany). When something breaks on the platform, a report of the error, the address where it happened and the browser or device type goes to Sentry; it is not linked to your account. From reports sent by our servers we remove sign-in data, form contents and IP addresses; a report from your browser goes to Sentry directly and, like any web request, shows Sentry your IP address. For a small sample of page loads and requests, a record of how long they took goes to Sentry too, treated in the same way. Reports from the driver app are different: they carry the driver's internal account number, as described above; the app removes request contents, e-mail addresses and sign-in data before a report leaves the phone, and each report carries a placeholder in place of the IP address it arrives from, so that Sentry does not store that address or work out a location from it. Separately, a native component of the Sentry library built into the app — distinct from the JavaScript layer described above, and not covered by the same filtering — records, for each use of the app, only whether it ended in a crash; its own crash-catching is switched off. Before sign-in, that record carries a random identifier for the app installation instead of an account number, and is not linked to the driver; after sign-in it carries the driver's account number. With the driver's consent, the driver app also sends anonymous diagnostics, described above, to a separate Sentry project that holds no crash report; they carry no account number. We rely on our legitimate interest in keeping the platform and the app working, and for anonymous diagnostics on the driver's consent. Crash and performance reports from the driver app access information on your device; given their narrow diagnostic scope — no request content, no e-mail address, no sign-in data — we treat this as strictly necessary under Art. 5(3) of the ePrivacy Directive, so no separate consent prompt is shown for it. Sentry sets no cookies.
• If Sentry's generative-AI features (Seer) are enabled, Sentry may use error reports, call stacks, trace data, session replay and user-feedback summaries, and the content of linked code repositories, to provide automated issue analysis and suggested fixes to our team. This data is not used to train AI models without our permission, and results are visible only to us.
• Advertising measurement — Google and Meta conversion tags, only with your consent (see the Cookie Policy).
• LinkedIn conversion tracking — the LinkedIn Insight Tag, only with your consent (see the Cookie Policy). LinkedIn Ireland Unlimited Company is a joint controller with us for the collection and transmission of this data to LinkedIn; LinkedIn is solely responsible for further processing of the data once received.
• Meta Platforms Ireland Limited is a joint controller with us for the collection and transmission of Meta conversion-tag data to Meta; Meta is solely responsible for further processing of the data once received. A summary of the arrangement is available on request to privacy@frachta.lv.
• SMS delivery — verification codes, payment reminders and operational alerts, including security alerts sent to our staff that may contain the name of the company being checked, sent through our EU SMS provider (Esteria), which we instruct to keep neither the text of a message nor the number it was sent to.
• Telematics — if your company connects its telematics account (currently Mapon), we receive from it, on your instruction, not only vehicle data such as odometer readings, fuel and unit hours but also data about named drivers: driver names and tachograph card numbers, driving, work, availability and rest periods, and the position history of the vehicles they drive — each trip's start and end time and place and its distance, the vehicle's border crossings and the changes in its fuel tank, with the driver the provider identified for each trip and each change in the tank — including up to 13 months of history from before the connection. Which of these arrive depends on what your telematics contract includes.
• AI features — Anthropic (United States), the provider of the model behind the platform's optional AI features. It translates the messages of a support ticket into English for our staff, translates a staff member's reply into the language you wrote in when they choose to — they check the translation before it is sent, and you receive the translation — answers support tickets from our instructions manual — each reply it writes is marked as automated, it hands the ticket to a person whenever it cannot help, and it never handles a request about access to an account — and drafts replies for our staff to check. A message that a check on our own servers recognises as written in English is not sent to it. For these it receives only the ticket's subject and the text of its messages (and, for a reply, the staff member's text), with email addresses, phone numbers, bank account, VAT, registration and personal code numbers, links, company names and the names of people on Frachta removed first by an automatic filter and put back only on our side (it can miss a short or unusually written number); it does not receive your name, your company, your plan or other customers' messages. From recent replies our staff wrote, filtered in the same way, it also suggests points our team should remember. It helps our staff review suspicious traffic, receiving the IP addresses and the page addresses involved. In a Company Check, the repair-invoice reader and the route planner it receives what the Data Processing Agreement describes for those features. Its output is advisory: it does not make decisions about you.
• Backups — Backblaze (B2 Cloud Storage, EU Central — Amsterdam) stores our off-site backups. The data is encrypted before it leaves our servers, so Backblaze cannot read it.
• Push notifications to the driver app — Expo (650 Industries, Inc., United States) delivers them, passing each one to Apple's push service (APNs) for an iPhone or to Google's Firebase Cloud Messaging for an Android phone. For each notification Expo receives the phone's push token, a short text in the driver's language and a link to the screen it opens. The texts are general — “New message”, never the message itself; a new route, a decision, a document waiting — except that an invitation names the company that sent it.

08International transfers#

Data is hosted in the EU. It leaves the EEA only for Anthropic in the United States (the AI features; basis — Standard Contractual Clauses, not an adequacy decision), for Google, Meta and LinkedIn in the United States (only with your consent to analytics or marketing cookies), for the push service of your own browser if you allow notifications, and, for notifications to the driver app, for Expo (650 Industries, Inc.) in the United States, which passes them to Apple's or Google's push service. For the transfers to Google, Meta, LinkedIn and browser push services we rely on an adequacy decision or Standard Contractual Clauses with appropriate safeguards. For the transfer to Expo we rely on the adequacy decision for the EU-U.S. Data Privacy Framework, under which 650 Industries, Inc. is certified. You can request a copy of the safeguards at privacy@frachta.lv.

09Retention periods#

We keep personal data only as long as needed for the purposes above or as required by law:

• Account & company data — while the account is active, then deleted or anonymised within 12 months of closure. A driver app account is the exception: deleting it erases its personal data at once, as described below.
• Invoices & accounting records — the statutory Latvian accounting retention period (currently 5 years, 10 years for certain documents).
• Security & audit logs — up to 24 months, unless a legal hold applies (for example at the request of the police or a regulator) or the records belong to an active security investigation; they are then kept until the hold is released.
• Uploaded bank statements — until you delete them, and at the latest with account closure.
• Backups — encrypted copies, kept on a rolling schedule of up to six months. What you delete leaves the live platform at once and leaves the backups as those copies rotate out.
• Driver app data — what a driver recorded on an order (stop events with the locations and verification outcomes attached to them, seals, proofs of delivery, photographs and problem reports, and in older records the signature of the person who received the goods) is part of that order's record and is kept as long as the order is; arrivals at saved places stay with the run, and vehicle checks, damage and defect reports with the vehicle's records. The chat with a carrier's dispatch, and the driver's reports about its messages, are deleted 24 months after the driver's link to that carrier ends. When a driver deletes their account, its personal data is erased at once: name, gender, date of birth, nationality, country, e-mail address, password, licences, the device, app version, system, IP address and push token of every sign-in, the IP address and browser recorded when the terms were accepted, the answers about usage counts and anonymous diagnostics, and the notes written when reporting messages. What is left — the account's numbers, the dates of its old sign-ins, which versions of the terms were accepted, whether and when Frachta blocked the account and, as proof of consent, a record of each answer about usage counts and anonymous diagnostics — carries no name; records of Frachta staff opening or acting on the account, with the reasons they wrote, stay in our audit log, like other audit records, for up to 24 months; the old sign-in records are deleted 12 months later and the records of the answers 24 months after each answer. None of the records above goes with the account. Accounts closed before this version of the policy are erased in the same way. A carrier can place a legal hold on a driver, which stops every deletion of that driver's app records while it lasts — but not the erasure of the driver's own account, notes included.
• Reviews — kept while the review stands. Withdrawing consent removes a published quote from the site immediately; asking us to delete the review removes it entirely. We keep no copy of a deleted review beyond the backup rotation described above.
• Absence records and the documents a driver signs — absence records are kept while the driver is linked to the carrier and then for the period the carrier must keep employment records under the law that applies to it; sickness absence is deleted on the same schedule as the rest, not kept longer because it is more sensitive. The documents a driver signs are the carrier's employment file: they stay when the driver deletes their account, and are deleted 90 days after the carrier deletes the driver from its records — their files within a further 14 days — unless a legal hold applies.
• Driver app data on the phone — work recorded without signal waits on the phone until it can be sent, and is left out of the phone's backups; if the server refuses it, the driver is told and it is deleted from the phone. Photographs taken, and payslips and documents opened, in the app are deleted whenever the app starts if they are more than a day old, unless they belong to work still waiting to be sent; photographs viewed in the app are kept on the phone for up to a day and deleted when the driver signs out. The last loaded copy of the driver's runs, orders and stops, documents list, schedule and profile is kept on the phone for up to 24 hours so that the app opens with it, also offline; it is left out of the phone's backups and deleted when the driver signs out, when a sign-in ends without the driver signing out, and when the account is deleted in the app. Signing out, or deleting the account in the app, clears the driver's data from the phone, unsent work included; the app warns first if anything is unsent. Signing out keeps only a “no” to anonymous diagnostics that has not reached us yet, under a one-way code of the account, until that driver next signs in on the phone, the account is deleted or the app is reinstalled. When a sign-in ends without the driver signing out, the unsent work stays on the phone for that driver alone and is sent when they sign in again; otherwise it is deleted the next time the app is started after 7 days have passed. Another person signing in on that phone does not see it, and it is never sent under their account. An account deleted on the web leaves unsent work on the phone until that same clean-up.
• Verification and due-diligence data — results are kept with the account of the company that ran the check, and deleted on the same schedule as account data, but no later than 24 months from when the check was run if the account remains active longer.
• Error and crash reports, and anonymous diagnostics, in Sentry — kept for no longer than 90 days after Sentry receives them, then deleted automatically.
• Product analytics in PostHog — kept for up to 7 years on our plan; this is PostHog's own retention and cannot be shortened on their side. Deleting your account removes the identifiers it is linked to, as described above.
• Telematics history — the trips, border crossings, daily odometer and fuel-counter readings and fuel-tank changes copied from a carrier's telematics account, including up to 13 months from before it was connected, are kept for as long as the carrier's account exists and are deleted with it; tank-level and temperature readings are deleted two years after they were taken.

10Push notifications#

If you allow them, we can send notifications about things that need you: a new offer matching your search, a message, a document awaiting signature, an invoice falling due. You are never asked for this at sign-up, nothing is sent unless you accept the browser or device prompt, and refusing changes nothing else about the platform.

In the browser. Accepting creates a subscription held by your own browser's push service — Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge — and we store the address it gives us so we can send to it. The message itself is encrypted before it leaves us and can only be read by your browser: the push service carries it without being able to see it. If a subscription stops working we delete it.

You can withdraw permission at any time in your browser or device settings, without telling us. We are not notified when you do; we simply stop being able to reach you, and the dead subscription is removed the next time we try.

In the driver app. If the driver allows notifications, the app receives a push token from Expo (650 Industries, Inc., United States), which we store with that sign-in. We send each notification to Expo, which passes it to Apple's push service on an iPhone or to Google's Firebase Cloud Messaging on an Android phone. A notification carries a short general text in the driver's language — for example a new route, a new message, a decision or a document waiting — and the link to the screen it opens; it never contains the text of a chat message, and an invitation names the company that sent it. A driver who mutes a company's chat gets no notifications of its messages; the messages themselves still arrive in the app. Notifications can be switched off in the phone's settings at any time; the token is removed when the driver deletes the account, and when Apple or Google reports that it no longer works.

11When we ask you for a review#

We ask a company's owner for a review, and only after the platform has actually done something for them: a delivery completed through the freight exchange, or two days after a paid module is taken. The request appears in the app, and the same ask goes once by e-mail to the owner's address — once, and never repeated. We rely on our legitimate interest in learning whether the product works, balanced against how little this asks of you — a card you can close, which stops for good once you have closed it three times.

The same request goes to everyone it reaches, with the same links, whatever we expect them to say. We do not ask only the customers we think are happy, and we do not hide, delay or filter a review because of its score. Closing the card puts it away for six months; the third time you close it, it does not come back. Writing a review stops it at once.

To stop review requests entirely at any time, write to privacy@frachta.lv.

12Your data-subject rights#

Under the GDPR you have the right to:

• Access — obtain a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure — have data deleted (the “right to be forgotten”).
• Restriction — limit how we process your data.
• Portability — receive your data in a portable format.
• Objection — object to processing based on legitimate interests or direct marketing.
• Withdraw consent — at any time, without affecting prior processing.

13How to exercise your rights#

Email privacy@frachta.lv with your request. We respond within one month, as required by the GDPR, and may ask you to verify your identity. If a request is manifestly unfounded or excessive we may refuse or charge a reasonable fee, explaining why. See also the GDPR page.

14Automated decision-making#

Frachta does not make automated decisions that produce legal or similarly significant effects on you. Company verification and abuse prevention involve automated checks, but a human reviews any decision to refuse or block an account.

15Complaints to a supervisory authority#

You may lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija) or the supervisory authority in your EU country of residence. We would appreciate the chance to resolve any concern directly first — write to privacy@frachta.lv.

16Changes to this policy#

We may update this policy at any time. For a material change — one that affects pricing, liability, your rights or obligations, or what data is processed and by whom — we give at least one month's notice in-app or by email before it takes effect. A non-material change — a clarification, a correction, or a change in formatting that does not alter what this policy requires — may be made at any time and is noted in the changelog on this page. The “last updated” date and version above change with each revision.

17Contact#

Questions about this Privacy Policy? Write to privacy@frachta.lv. The controller is SIA "HEIDA LTD". Related documents: Terms & Conditions, Cookie Policy, GDPR and the Data Processing Agreement.

This Privacy Policy is published in English and in translation. If a translation differs from the English text, the English text prevails.