This Privacy Policy explains how TraxLoop (“TraxLoop”, “we”, “us” or “our”) collects, uses, discloses, retains and protects personal information when you visit www.traxloop.com (the “Website”), use the TraxLoop portal at portal.traxloop.com and its related verification pages and interfaces (the “Portal”, and together with the Website, the “Services”), or otherwise communicate with us. It also explains the rights you have and how to exercise them.
We have written this policy to meet the requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), the GDPR as retained in United Kingdom law together with the Data Protection Act 2018 (the “UK GDPR”), the Swiss Federal Act on Data Protection (the “FADP”), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), Quebec’s Act respecting the protection of personal information in the private sector as amended by Law 25 (the “Quebec Privacy Act”), the substantially similar private-sector laws of Alberta and British Columbia, the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”), the comprehensive consumer privacy laws of other U.S. states, and the other data protection laws that apply to us (together, “Data Protection Laws”). Where those laws differ, we apply the more protective standard to everyone, wherever they live, unless the law requires otherwise.
Our commitments, in short
- We do not sell personal information, and we do not “share” it for cross-context behavioral advertising.
- We do not use advertising, analytics or social media tracking technologies on the Website or the Portal.
- We do not use the content our customers place in the Portal to train artificial intelligence models.
- We collect only what we need, keep it only as long as we need it, and protect it with strong technical and organizational safeguards.
- We honor privacy requests from every individual, not only those in jurisdictions that grant a legal right to make them.
1. Who we are and what this policy covers
TraxLoop operates a collaborative platform for cross-border trade on which importers, exporters, freight forwarders, carriers, customs brokers, banks, insurers and authorities share orders, shipments, transport and trade documents, customs filings and tracking information.
This policy applies to personal information about:
- visitors to the Website;
- business contacts, such as people who write to us, ask for a demonstration, or represent current or prospective customers, partners and suppliers;
- Portal users, meaning individuals who have been invited to the Portal by an organization, and their account and activity information;
- individuals named in Customer Data (see section 2), such as contact persons, drivers and other people whose details appear in trade and transport documents; and
- people who verify documents, by scanning or entering the verification code printed on a document issued through the Portal.
This policy does not apply to websites or services of third parties, including carriers, banks or other organizations that you reach through links in the Services. Their own privacy policies govern how they handle your information.
2. Our role: controller and processor
Data Protection Laws distinguish between the organization that decides why and how personal information is processed (a “controller”, or in Canada the organization “in control” of the information) and an organization that processes it on another’s behalf (a “processor” or “service provider”).
- TraxLoop as controller. We are the controller of personal information about Website visitors, business contacts, Portal account administration, security and audit logs, and document verification scans.
- TraxLoop as processor or service provider. Information that our customers and their users enter into or upload to the Portal, such as orders, shipments, trade and transport documents, attachments and messages (“Customer Data”), is processed by us on behalf of, and under the instructions of, the customer organization that controls it. Our processing of Customer Data is governed by our agreement with that customer, including any data processing agreement. If you have questions about, or wish to exercise your rights in relation to, personal information contained in Customer Data, please contact the organization that entered it. If you contact us, we will refer your request to that organization and assist it in responding.
3. Personal information we collect
We collect only the personal information that is necessary for the purposes described in section 4.
3.1 Information you give us
- Inquiries and correspondence: your name, email address, organization, job title, telephone number and the content of your message when you contact us, for example at [email protected] or [email protected].
- Portal account information: your name, business email address, organization, role and permissions, language preference and, where you choose to set them, notification preferences. Portal accounts are created by invitation only.
- Authentication information: your password, which we store only as a salted one-way hash (bcrypt), and, where multi-factor authentication is enabled, an encrypted authenticator secret and hashed recovery codes. We never store your password in readable form.
- Customer Data: the information you or your organization enter into or upload to the Portal. Depending on how the Portal is used, this may include names, business contact details and signatures of individuals named in trade documents, the names of drivers, vehicle registration numbers and similar transport details.
- Support requests: information you provide when you ask for help or report a problem.
3.2 Information collected automatically
- Security and service logs: when you use the Services, our infrastructure records technical information such as your IP address, browser user agent, the pages or resources requested, and the date and time of the request. We use it to deliver the Services, keep them secure and diagnose faults.
- Portal sessions: when you sign in, we record the IP address and user agent of the session, when it was created and when it expires or is revoked.
- Audit trail: the Portal keeps a tamper-evident record of significant actions, such as who created, changed, approved, issued, shared or revoked a document and when, together with the IP address and user agent from which the action was taken. This record is essential to the integrity of trade documents for all parties who rely on them.
- Verification scans: when someone scans or enters a document’s verification code, we record the code presented, the result, the access level served, the time and the IP address and, if the person is signed in, their account. We use this information to protect codes against abuse, including through rate limiting, and to maintain the audit trail.
- Cookies: we use only the strictly necessary cookies described in our Cookie Policy. We do not use cookies or similar technologies for advertising, analytics or cross-site tracking.
The Portal can use your device’s camera to read a document’s barcode or QR code, if you allow it. The image is processed on your device only; nothing captured by the camera is sent to us or stored.
3.3 Information from other sources
- From your organization or a trading partner: when an organization invites you to the Portal, or names you in a document, we receive your details from that organization.
- From carriers: where a customer enables carrier tracking, we receive shipment status events from the carrier concerned. These relate to shipments and containers and rarely contain personal information.
- From public sources: we may use publicly available business information, such as an organization’s registered name and address, to verify the organizations that use the Portal.
We do not purchase personal information, and we do not obtain information from data brokers.
3.4 Sensitive information
We do not ask for, and ask our customers not to upload, special categories of personal data or sensitive personal information (such as health information, biometric data, racial or ethnic origin, religious beliefs or government identification numbers) unless a trade or transport document legally requires it. Where such information is present in Customer Data, it is processed only on our customer’s instructions and for the purpose of the document concerned. We use account credentials only to authenticate you and protect your account.
4. How and why we use personal information
We use personal information only for the purposes set out below and for purposes that are compatible with them. Where the GDPR, the UK GDPR or the FADP applies, we rely on the legal bases indicated.
| Purpose | Information used | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Providing, operating and maintaining the Services, including creating and managing accounts, enforcing permissions and delivering notifications | Account, authentication, session and Customer Data | Performance of a contract (Art. 6(1)(b)); our legitimate interest in providing the Services to our customers’ users (Art. 6(1)(f)) |
| Processing Customer Data on our customers’ instructions | Customer Data | Processed on behalf of the customer, which determines its own legal basis (Art. 28) |
| Securing the Services: authentication, multi-factor authentication, fraud and abuse prevention, rate limiting and incident investigation | Logs, session data, audit trail, verification scans | Legitimate interests in protecting our users, customers and systems (Art. 6(1)(f)); legal obligation where security is required by law (Art. 6(1)(c)) |
| Maintaining the integrity and audit trail of trade documents, and allowing authorized parties to verify that a document is genuine | Audit trail, verification scans, document metadata | Legitimate interests of all parties to a shipment in relying on authentic documents (Art. 6(1)(f)); legal obligation where record-keeping is required (Art. 6(1)(c)) |
| Responding to inquiries, requests for demonstrations and support requests | Contact details and correspondence | Steps taken at your request before entering into a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Sending service and security communications, such as invitations, password resets and notices of changes to the Services | Name, email address | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Sending marketing communications about our products | Name, email address, organization | Your consent (Art. 6(1)(a)), or, where permitted, our legitimate interests in communicating with existing business contacts (Art. 6(1)(f)) |
| Complying with law, responding to lawful requests from public authorities, and establishing, exercising or defending legal claims | Any relevant information | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| Improving the Services, for example by analyzing aggregated, de-identified usage information and error reports | De-identified or aggregated data | Legitimate interests (Art. 6(1)(f)) |
Under Canadian law, we collect, use and disclose personal information with your knowledge and consent, except where the law permits otherwise. We obtain consent in a manner appropriate to the sensitivity of the information and your reasonable expectations, and, where the Quebec Privacy Act applies, we seek express consent for sensitive information and for any secondary use that is not compatible with the original purpose. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice; we will tell you the likely consequences of doing so.
If we intend to use personal information for a new purpose that is not compatible with the purpose for which it was collected, we will inform you and, where required, obtain your consent before doing so.
5. What we never do
- We do not sell personal information, rent it, or exchange it for anything of value.
- We do not share personal information for cross-context behavioral advertising or targeted advertising, and we do not display advertising in the Services.
- We do not use third-party analytics, advertising pixels, social media plug-ins, session recording or fingerprinting technologies.
- We do not build profiles of individuals to make predictions about their personal preferences, behavior or characteristics.
- We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
- We do not use Customer Data to train artificial intelligence or machine learning models, and we do not allow our service providers to do so.
- We do not knowingly collect personal information from children.
6. Cookies and similar technologies
The Website does not set cookies. The Portal uses only the cookies that are strictly necessary to keep you signed in securely, to remember a language you have chosen and to hold open a driver access link after its PIN has been entered. Our hosting provider may set a strictly necessary security cookie to protect the Services against automated attacks. Because these technologies are strictly necessary, they do not require consent under the EU ePrivacy Directive, the UK Privacy and Electronic Communications Regulations or the Quebec Privacy Act. Full details, including each cookie’s name, purpose and duration, are in our Cookie Policy.
Because we do not track you across websites, the Services do not change their behavior in response to a “Do Not Track” browser signal; there is no tracking to switch off. We treat a Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of your personal information, although we do not sell or share it in any event.
7. How we disclose personal information
We disclose personal information only as described below, and only to the extent necessary for the purpose concerned.
7.1 Other parties on the shared record
The Portal is a collaborative platform. Information in a shipment or document, including your name as the person who prepared, approved or issued it, is visible to the organizations and users that the controlling customer has made parties to that record or granted access to, according to their role. The Portal applies party-scoped visibility and least-privilege permissions so that each organization sees only what its role entitles it to see.
7.2 Document verification
Documents issued through the Portal carry a verification code. What is shown when a code is checked depends on who checks it:
- Anyone with the code sees only a minimal record: whether the document is genuine and current, its type, number and revision, the issuing organization’s name and country, and the time of the check. No parties, quantities, values or containers are shown.
- Authorized users of organizations with access to the shipment, signed in with multi-factor authentication, see the key facts of the document so that they can compare them with the paper or electronic copy in front of them.
- Customs and law-enforcement authorities that we have vetted, whose users must use multi-factor authentication, see the same key facts when inspecting a document within the countries for which they are authorized. Such checks are recorded in the audit trail.
7.3 Service providers (sub-processors)
We use carefully selected service providers that process personal information on our behalf, under written contracts that require them to use it only to provide services to us, to keep it confidential and secure, to assist us in meeting our obligations and to delete or return it when the services end. Our principal service providers are:
| Provider | Service | Location of processing |
|---|---|---|
| Cloudflare, Inc. | Website and Portal hosting, content delivery, network security, database connectivity, file storage, document rendering and transactional email | Global network; data may be processed in the United States and other countries where Cloudflare operates |
| Anthropic, PBC | Optional machine translation of document text, used only when a Portal user requests a translation. Only the text to be translated and the languages concerned are sent | United States |
| Our database hosting provider | Managed hosting of the Portal database | Disclosed on request |
We will provide a current list of our service providers, including the database hosting provider, on request at [email protected]. Customers with a data processing agreement will be notified of new sub-processors in accordance with that agreement.
7.4 Carriers and other third parties at your instruction
Where a customer enables carrier tracking or an integration, we send the information needed for that purpose, such as a tracking, booking or container number, to the carrier or provider concerned. Those organizations handle the information under their own privacy policies.
7.5 Legal requirements
We disclose personal information to courts, regulators, law-enforcement or other public authorities only where we are legally required to do so, for example by a valid court order, subpoena or warrant, or where disclosure is otherwise permitted by Data Protection Laws and necessary to protect the rights, property or safety of any person. We review every request for legal validity and scope, disclose no more than is required and, unless the law prohibits it, notify the customer or individual concerned so that they can seek a remedy.
7.6 Business transfers
If TraxLoop is involved in a merger, acquisition, financing, reorganization or sale of all or part of its business, personal information may be disclosed to the parties to the transaction, under strict confidentiality obligations and only as necessary to evaluate and complete it. Any successor will be bound by this policy for the information it receives, and we will notify affected individuals as required by law.
8. International transfers
TraxLoop is based in Canada, and our service providers may process personal information in other countries, including the United States. Data protection laws in those countries may differ from those of the country in which you live.
- From the EEA, the UK and Switzerland: the European Commission, the UK government and the Swiss authorities have recognized Canada as providing an adequate level of protection for personal information subject to PIPEDA. For transfers to countries that are not recognized as adequate, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, the Swiss-approved clauses or, where the recipient is certified, the EU–U.S. Data Privacy Framework and its UK and Swiss extensions, together with supplementary measures where appropriate. You may request a copy of the relevant safeguards at [email protected].
- From Quebec: before communicating personal information outside Quebec, we carry out a privacy impact assessment that takes into account the sensitivity of the information, the purpose for which it will be used, the protection measures that will apply and the legal framework of the destination, and we put in place a written agreement providing adequate protection.
- From elsewhere in Canada: when personal information is processed outside Canada, it may be accessible to courts, law-enforcement and national security authorities of that jurisdiction. We use contractual and other means to ensure a comparable level of protection.
9. How long we keep personal information
We keep personal information only for as long as it is needed for the purposes for which it was collected, or as required or permitted by law. When it is no longer needed, we securely delete or anonymize it. The table below sets out our principal retention periods.
| Information | Retention period |
|---|---|
| Inquiries and correspondence that do not lead to a business relationship | Up to 3 years after our last contact |
| Portal account information | For as long as the account is active; deleted or anonymized within 90 days after the account is closed, except as stated below |
| Session cookies | Up to 12 hours (see the Cookie Policy) |
| Session records (IP address, user agent) | Up to 12 months after the session ends, for security investigations |
| Audit trail of actions on trade and transport documents | 7 years after the event, so that every party can rely on the history of the documents and meet customs, tax and commercial record-keeping obligations |
| Verification scans | IP address removed after 90 days; the remainder of the record kept for 7 years as part of the audit trail |
| Customer Data | As instructed by the customer and set out in our agreement with it; deleted or returned at the end of the agreement, except where we are legally required to retain it |
| Backups | Overwritten on a rolling cycle; deleted data is removed from backups when the cycle completes |
| Marketing preferences and opt-outs | For as long as needed to respect your choice |
Where information must be kept for longer to comply with a legal obligation, to resolve a dispute, or because it is subject to a legal hold, we keep it only for that purpose and for no longer than necessary. Where an individual has used personal information to make a decision about you, we keep that information for long enough for you to request access to it.
10. How we protect personal information
We protect personal information with technical, physical and organizational measures appropriate to its sensitivity and to the risks involved, including:
- encryption of all traffic to and from the Services using TLS, and encryption of stored data by our infrastructure providers;
- passwords stored only as salted bcrypt hashes; session tokens stored only as hashes; authenticator secrets encrypted;
- multi-factor authentication, which is mandatory for privileged roles and for users of inspection authorities;
- invitation-only accounts, role-based access control, party-scoped visibility, segregation of duties and the principle of least privilege;
- secure cookie settings (
HttpOnly,SecureandSameSite), short session lifetimes and revocation of all sessions after a password change; - integrity protection of issued documents through SHA-256 hashing and digitally signed verification records, and an immutable audit trail;
- rate limiting and monitoring to detect and respond to abuse; and
- confidentiality obligations, training and need-to-know access for our personnel and service providers.
No method of transmission or storage is completely secure. If you believe your account or information has been compromised, please contact us immediately at [email protected].
11. Security incidents and breach notification
We maintain an incident response procedure. If a breach of security safeguards or confidentiality incident affects personal information for which we are responsible, we will:
- take prompt measures to contain it and reduce the risk of harm;
- notify the competent supervisory authority without undue delay and, where the GDPR or UK GDPR applies and notification is required, within 72 hours of becoming aware of it;
- report to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible where the breach creates a real risk of significant harm, and notify the Commission d’accès à l’information du Québec and the persons concerned where an incident presents a risk of serious injury;
- notify affected individuals and authorities as required by U.S. state breach notification laws; and
- keep a record of every incident, as required by law.
Where we act as a processor, we will notify the customer concerned without undue delay so that it can meet its own obligations.
12. Your rights
Subject to the conditions and exceptions set out in Data Protection Laws, you have the following rights. We extend them to every individual, regardless of where you live, to the extent that we are reasonably able to do so.
- Access: to know whether we hold personal information about you and to obtain a copy of it, together with information about how it is used and to whom it has been disclosed.
- Correction: to have inaccurate or incomplete information corrected.
- Deletion: to have your information deleted where it is no longer needed, where you withdraw consent, or where it has been processed unlawfully.
- Portability: to receive information you have provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another organization where technically feasible.
- Restriction and objection: to ask us to restrict processing of your information, and to object at any time to processing based on our legitimate interests or for direct marketing purposes.
- Withdrawal of consent: to withdraw your consent at any time, without affecting the lawfulness of processing carried out before you withdrew it.
- Information about automated decisions: to be informed of, and to submit observations about, any decision based exclusively on automated processing. We do not make such decisions.
- De-indexation (Quebec): to request that we cease disseminating your information or de-index any hyperlink attached to your name, where the conditions of the Quebec Privacy Act are met.
- Opt-out of sale, sharing, targeted advertising and profiling (U.S. states): although we do not engage in any of these activities, you may submit such a request at any time.
- Non-discrimination: we will not deny you services, charge you a different price or provide a different quality of service because you exercised your rights.
12.1 How to exercise your rights
Email [email protected] with your request. If you are a Portal user, you may also update much of your account information directly in the Portal. We do not charge a fee for responding to a request unless the law permits it and the request is manifestly unfounded or excessive.
- Verification: to protect your information, we will verify your identity before responding, normally by confirming control of the email address associated with your information. We will not ask for more information than is necessary for that purpose.
- Authorized agents: you may use an authorized agent to submit a request on your behalf. We may ask the agent for proof of your written authorization and ask you to verify your identity directly with us, except where the agent holds a valid power of attorney.
- Response times: we will acknowledge your request promptly and respond within one month under the GDPR, the UK GDPR and the FADP (extendable by up to two further months for complex requests), within 30 days under PIPEDA and the Quebec Privacy Act (extendable where the law permits), and within 45 days under the CCPA and other U.S. state laws (extendable once by a further 45 days). If we need to extend the period, we will tell you why.
- Requests about Customer Data: if your request concerns information that one of our customers controls, we will refer it to that customer and assist it in responding.
- Refusals and appeals: if we decline your request, in whole or in part, we will explain why and tell you how to appeal or complain. If you live in a U.S. state that provides a right to appeal, you may appeal our decision by replying to our response with the subject line “Privacy request appeal”. We will respond to your appeal within the period required by law and, if we deny it, tell you how to contact your state Attorney General.
13. Additional information for residents of U.S. states
This section supplements the rest of this policy and applies to residents of California and the other U.S. states with comprehensive consumer privacy laws. In the preceding 12 months we have collected the following categories of personal information, as defined in the CCPA:
| Category | Examples | Sources | Business purposes | Disclosed to |
|---|---|---|---|---|
| Identifiers | Name, business email address, account identifier, IP address | You; your organization; your device | Providing and securing the Services; communicating with you | Service providers; other parties on a shared record, as directed by the customer |
| Customer records | Business contact details, signatures | You; your organization; trading partners | Providing the Services | Service providers; parties on a shared record |
| Commercial information | Orders, shipments and trade documents in which you are named | Your organization; trading partners | Providing the Services on the customer’s instructions | Service providers; parties on a shared record; carriers at the customer’s instruction |
| Internet or network activity | Session records, audit trail, verification scans, security logs | Your device | Security, integrity of documents, debugging | Service providers |
| Professional or employment-related information | Job title, organization, role in the Portal | You; your organization | Providing the Services; managing permissions | Service providers; parties on a shared record |
| Sensitive personal information | Account log-in credentials | You | Authentication and account security only | Not disclosed |
We do not sell or share personal information, and we have not done so in the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. We use sensitive personal information only for purposes permitted by the CCPA and do not use it to infer characteristics about you. We do not offer financial incentives in exchange for personal information. Our retention periods are set out in section 9.
Under California Civil Code section 1798.83 (“Shine the Light”), California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures.
14. Children
The Services are designed for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 16 years of age, or under the age of digital consent in their jurisdiction if higher. If you believe a child has provided us with personal information, please contact us at [email protected] and we will delete it.
15. Marketing communications
We send commercial electronic messages only with your consent, or where the law permits us to rely on an existing business relationship, in compliance with Canada’s Anti-Spam Legislation (CASL), the EU ePrivacy rules as implemented in each Member State, the UK Privacy and Electronic Communications Regulations and the U.S. CAN-SPAM Act. Every message identifies TraxLoop, includes our contact information and contains a simple means of unsubscribing, which we honor promptly and in any event within 10 business days. Unsubscribing from marketing messages does not affect service and security messages that are necessary for your use of the Portal.
16. Privacy Officer and contact information
We have designated a Privacy Officer who is responsible for our compliance with this policy and with Data Protection Laws. The Privacy Officer also acts as the person in charge of the protection of personal information under the Quebec Privacy Act. You may contact the Privacy Officer with any question, request or complaint:
- Email: [email protected]
- Subject line: “Privacy” followed by the nature of your request
We will investigate every complaint and, if it is justified, take appropriate measures, including amending our policies and practices where necessary. Where the GDPR or UK GDPR requires us to appoint a representative in the European Union or the United Kingdom, the representative’s contact details are available from [email protected] and will be listed in this section.
17. Complaints to a supervisory authority
We encourage you to contact us first so that we can try to resolve your concern. You also have the right to lodge a complaint with a data protection supervisory authority, in particular:
- European Union / EEA: the supervisory authority in the Member State where you live or work, or where an alleged infringement took place (a list is maintained by the European Data Protection Board at edpb.europa.eu);
- United Kingdom: the Information Commissioner’s Office (ico.org.uk);
- Switzerland: the Federal Data Protection and Information Commissioner (edoeb.admin.ch);
- Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca), or, in Quebec, the Commission d’accès à l’information du Québec (cai.gouv.qc.ca), in Alberta, the Office of the Information and Privacy Commissioner of Alberta, and in British Columbia, the Office of the Information and Privacy Commissioner for British Columbia;
- United States: the California Privacy Protection Agency (cppa.ca.gov) or your state Attorney General.
18. Changes to this policy
We review this policy regularly and update it to reflect changes in the Services, our practices or the law. The date at the top of this page shows when it was last updated. If we make a material change, we will notify Portal users by email or through the Portal before the change takes effect and, where required, ask for your consent. Previous versions are available on request.
19. Language
This policy is available in English and French. Both versions are equally authoritative. Translations into other languages, where provided, are for convenience only.