This Policy explains what data we collect in connection with the CargoTrust website, mobile application and related services, the purposes for which we process it and your rights. Updated: November 2026. CargoTrust, Sarajevo. Contact: contact@cargotrust.co. This policy covers both the company registry and the freight board.
This policy applies to data processing when you visit the landing page, register an organisation, use the mobile application or receive system email (verification, activity notifications). It does not cover third-party websites that links may lead to.
Registration and account: contact person first and last name, email, hashed password, system role, organisation data (name, JIB or similar identifier, address, city, country) and company ID confirmation status. Technical data: IP address, device type and OS, access timestamps, error logs, session identifiers. Content: review texts, categories, proof of collaboration (files in object storage), discussion comments, suspicious content reports. Push notifications: a token linked to the device when you enable notifications. Remember me is an option on the phone: if you turn it on, your email and password stay only in the protected storage of that device, not on our servers, and they are deleted when you turn the option off. The company that received a review can see the confirmed email and phone of the person who wrote it, the ones from registration, and no one else can see that contact.
When you use the freight board we process the listing text (load or free truck), the phone number you set as contact, the pickup or availability place and watch radius, and the notification when a load falls inside that circle. The message or form used to create a listing is used to assemble the content. Other users see the number on the listing so they can call you or write on WhatsApp or Viber. Numbers from outside sources are kept in an internal directory for contact, with a note of whether someone was contacted and what they replied; we do not publish those numbers as a company registry. A watch is a place and kilometres you save, not continuous tracking of the phone’s movement. Push suggestions for loads next to a free truck are sent only if you turn that option on.
CargoTrust, Sarajevo, keeps a registry of logistics and transport companies from Bosnia and Herzegovina, Croatia, Serbia, and Montenegro, including companies that do not have an account with us. Data about those companies comes from public sources and the tax administrations of those countries, and from users when they add a company that is not in the registry yet. What is public is the name, identification number, address, city, country, legal status, and publicly published financial figures, when the source has them. Email and phone are not public on the website. They may be used so that a user, after an approved positive review, can send a one-time invitation to a company that is not registered. A company is not deleted from the registry. If you are not a user and you want a wrong fact corrected, or an email and phone removed, write to contact@cargotrust.co. We can correct the name, identification number, registered office, and other facts that come from a public source or a tax administration when they are wrong. We do not remove those facts only because the company has not opened an account. Reviews about the company stay.
Contract performance: account management, authentication, profile display, enabling review entry and discussions. Legitimate interest: abuse protection, security, product improvement analytics, proving transactions in case of disputes. Consent: marketing messages only if you give express consent. Legal obligation: response to orders from competent authorities.
We share data only with providers that help the service run, and only on our instructions. Those are: the database, document storage, email delivery, SMS to confirm a phone number, and push notifications to the phone. If an admin turns on artificial intelligence review checks, the review text and evidence images may be sent to the provider of that check. While that option is off, they are not sent. We do not sell data.
We only need to remember your choice about this notice, in the browser, so we do not ask every time. Fonts, icons and the embedded video are not required. They load from Google and YouTube only if you accept, and then your IP address is sent to those services. If you decline, the page uses system fonts and the video stays hidden. You can change the choice from the Cookies link.
We keep data for as long as the purpose requires, or while a legal duty lasts. Erasing an account in the app closes that person's login: email, phone, password, session, and push token are removed. If Remember me is on, that copy of the password is deleted from the phone. First and last name stay on reviews, comments, and inquiries, because a review must show who wrote it and which company gave it. The company stays in the registry. Reviews it received stay. The text of reviews its user wrote stays, and the evidence files attached to those reviews are deleted. If that person is the only user of an active company, or of a company still under review, the company no longer has an active account and returns to the registry without a confirmed company ID. A suspended company stays suspended. If the company still has other users, its status does not change. Parts of records may remain in backups until rotation. Logs are kept for a limited time for security.
You have the right of access, rectification, erasure of the login where the legal basis allows it, restriction, portability, and objection. You erase the account in the app, on the profile, by confirming your password. The same applies while registration is under review or while the company's access is suspended. The name on a published review, and the company itself, are not part of that erasure. You may withdraw consent where processing is based on it. You may complain to the competent supervisory authority. To use these rights, contact contact@cargotrust.co.
We use HTTPS, access control, password hashing and measures at application and database level. No system is completely secure; please use strong passwords and keep your device safe.
The service is intended for business users. It may only be used by adults (18 or older) acting on behalf of a company. We do not collect dates of birth; each person confirms this when registering or accepting an invitation. If we learn that an account is used by a minor, we close it and delete their personal data.
We may update the policy; we publish the new version here. Significant changes may be announced by email or in-app notification.
CargoTrust, Sarajevo. For privacy questions and data requests: contact@cargotrust.co.