Privacy policy

This Privacy Policy (the “Policy”) describes how M&R Freight Market SRL (“M&R Freight Market”, the “Company”, “we” or the “Controller”) collects, uses, stores, protects and, where applicable, transmits personal data in connection with the M&R Freight Market website and digital platform (the “Platform”).

M&R Freight Market is a B2B digital platform intended to facilitate direct contact and collaboration between carriers, producers, shippers and warehousing or logistics operators.

Controller of the personal data:

M&R Freight Market SRL

E-mail: support@mr-freightmarket.com

For questions concerning data protection or to exercise the rights provided by applicable law, you may contact us at the e-mail address indicated above.

This Policy applies together with the Terms and Conditions of Use and the Cookie and Similar Technologies Policy.

This Policy applies to natural persons whose data is processed in connection with the Platform, including:

• legal representatives and directors of registered companies;
• persons authorised to create or administer accounts;
• employees and collaborators of user companies;
• contact persons indicated in listings, messages or documents;
• persons who submit reports, requests or complaints;
• website visitors;
• other persons whose data is lawfully provided in the context of using the Platform.

Although the Platform is intended for commercial relations between companies, information that identifies or allows the identification of natural persons constitutes personal data and is protected under Regulation (EU) 2016/679 (“GDPR”).

Depending on the services used and the interaction with the Platform, we may process the following categories of data.

3.1 Identification and contact data

First name, surname, position, capacity within the company, e-mail address, telephone number, profile picture and other information provided at registration or when using the Platform.

3.2 Data on companies and their representatives

Company name, tax and commercial identifiers, registered office, places of business, field of activity, country of registration and data of the persons authorised to represent the company.

Data relating exclusively to a legal entity does not in itself constitute personal data. However, information relating to representatives, employees or collaborators is protected under applicable law.

3.3 Documents required for company verification

To verify the authenticity of information and prevent fraudulent use of the Platform, we may request, depending on the category of the company and the specific situation:

• identity documents of representatives or authorised persons;
• powers of attorney and documents concerning the right of representation;
• registration certificates and other official documents of the company;
• licences and authorisations relevant to the activity carried out;
• insurance documents;
• bank statements or supporting documents concerning the account holder;
• documents concerning the registered office, places of business or the conduct of the activity;
• other documents relevant to the requested verification.

Not all of these documents are requested from every company.

The data collected is limited, to the extent possible, to the information necessary for the purpose of the verification.

Documents submitted for verification are not displayed publicly and are not made available to other users of the Platform.

3.4 Data on activity within the Platform

We may process information generated through the use of the services, including:

• transport and availability listings;
• information on routes, loading, unloading and logistics operations;
• messages sent through the internal communication system;
• reviews and ratings given to users;
• requests, support tickets and reports;
• information on reported incidents;
• the history of relevant interactions and activities.

This information may contain personal data where it includes names, contact details or other elements that allow the identification of natural persons.

3.5 Subscription and invoicing data

We may process information concerning contracted subscriptions, the access period, invoices, the payment status for the Platform’s services and the contact persons responsible for invoicing.

We use SmartBill for issuing and managing invoices.

M&R Freight Market does not process through the Platform the payments relating to transport contracts concluded directly between users.

3.6 Technical and security data

We may process IP addresses, browser and device information, technical identifiers, authentication logs, security events and data necessary for identifying errors or preventing unauthorised access.

Authentication uses tokens managed through local storage mechanisms in the browser, with a validity of no more than seven days on the server, according to the technical configuration of the Platform.

3.7 Data from communications with us

We may process data sent by e-mail, through the support system or through other communication channels actually used by the Company.

This may include identification data, contact details, the content of requests and the documents provided for their resolution.

We process personal data only where there is an applicable legal basis, in accordance with Article 6 of the GDPR.

Since the Platform is intended for companies, the contract of use may be concluded with a legal entity.

In such situations, the performance of a contract as a legal basis does not automatically apply to all employees or representatives of the company. The processing of their data may be based on legitimate interest or another applicable legal basis.

Where we rely on legitimate interest, we ensure that the processing is necessary and proportionate to the purpose pursued, taking into account the rights and freedoms of the data subjects.

M&R Freight Market may verify the information provided by companies requesting access to the Platform, in order to reduce the risks of fraud, identity impersonation, unauthorised registration or abusive use of the services.

The documents provided may be reviewed by authorised persons within the Company or by collaborators who need access in order to carry out the verification.

Identity documents, powers of attorney, bank statements and other supporting documents are not displayed publicly.

The verification carried out by M&R Freight Market is an internal eligibility and security procedure and does not constitute an official certification or a guarantee of the future commercial conduct of the verified company.

Persons who submit documents are asked not to include information that is not necessary for the purpose of the verification.

The Platform facilitates professional interaction between companies.

Depending on the available functionalities and access rights, authorised users may view certain information about companies, published listings and displayed reviews.

Contact details and other personal information may become accessible in the context of professional interactions permitted by the Platform.

Documents provided for company verification are not public.

Private messages are not displayed publicly.

Reports and incidents are handled internally and are not published in a public incident register.

Access by authorised personnel to messages, reports or documents may take place where necessary for security, the investigation of complaints, fraud prevention, compliance with legal obligations or the defence of legal claims.

Users should avoid entering unnecessary personal data in listings, messages or other fields of the Platform.

The Platform may allow users to give reviews and to report incidents related to the professional interactions carried out through it.

In this context, we may process information about the company involved, contact persons, relevant communications, supporting documents and the circumstances of the incident.

This information is used to manage reports, prevent abuse, protect the integrity of the Platform and, where applicable, provide the assistance requested by users.

Reports are handled internally, with access limited to authorised persons.

To the extent necessary and permitted by law, certain information may be disclosed to the persons involved, legal advisers, insurers or competent authorities.

M&R Freight Market does not publish reports in a public register and does not guarantee the resolution of disputes between users.

8.1 Operational communications

We may send messages necessary for the operation of the Platform, including:

• confirmations of registration and authentication;
• notifications concerning company verification;
• information about the account and subscription;
• invoicing notifications;
• security messages;
• replies to support requests;
• other communications related to the use of the services.

We use the Resend service for sending transactional e-mails.

These messages are distinct from commercial communications and may be necessary for providing the service or fulfilling legal obligations.

8.2 Commercial communications

We may send information about new functionalities, services, offers or other commercial communications only under the conditions permitted by applicable law.

Where consent is required, it will be requested before the communications are sent.

Users may withdraw their consent or unsubscribe through the mechanisms available in the respective messages or by contacting the Company.

Unsubscribing from commercial communications does not affect the sending of operational messages necessary for account administration.

The Platform uses cookies and similar technologies for functioning, remembering preferences, authentication, security and analytics.

Google Analytics is used to analyse how the Platform is used and is activated only after consent has been given for analytics cookies.

Users may accept or refuse optional cookies and may subsequently change their preferences through the “Cookie Settings” link, available in the footer of the Platform’s pages.

Google reCAPTCHA v3 is used to protect certain forms and sensitive actions against automated and abusive access.

This service may involve the transmission to Google of certain technical information, including data on the device, the browser, the IP address and the interaction with the protected form.

Detailed information on the technologies used and on consent management is available in the Cookie and Similar Technologies Policy.

Personal data may come from:

• the data subject directly;
• the company on whose behalf the data subject uses the Platform;
• other users, where the information is included in listings, messages, reports or documents;
• documents submitted for company verification;
• public registers and official sources, where consulted for legitimate purposes;
• the technical systems used for the operation and security of the Platform.

Where a company provides the data of its employees, collaborators or representatives, it must ensure that the transmission of the information is lawful and that the persons concerned are appropriately informed.

Personal data may be accessed by or disclosed to the following categories of recipients, to the extent necessary and under the conditions provided by law:

11.1 Authorised personnel and collaborators

Persons involved in the administration of the Platform, document verification, user assistance, security and incident resolution.

11.2 Other users of the Platform

Only for information accessible through the Platform’s functionalities or communicated in the course of professional interactions.

11.3 Service providers

Providers used for the operation of the Platform, including:

• SmartBill, for invoicing;
• Google, for e-mail services, Google Analytics and Google reCAPTCHA;
• Resend, for transactional e-mails;
• hosting, IT infrastructure, maintenance and security providers.

The legal role of each provider may vary depending on the service provided and the applicable contractual terms.

11.4 Advisers and authorities

Legal advisers, accountants, auditors, courts, public authorities and other entities, where disclosure is necessary and permitted by law.

M&R Freight Market does not sell users’ personal data to third parties.

The use of international technology service providers may involve the transfer or accessing of certain personal data from outside the European Economic Area.

Where such transfers take place, M&R Freight Market seeks to comply with the requirements of Chapter V of the GDPR.

Depending on the specific transfer, adequacy decisions of the European Commission, standard contractual clauses or other mechanisms and safeguards recognised by applicable law may apply.

Data subjects may request additional information on the international transfers applicable to their data and the safeguards used by contacting the Company at the e-mail address indicated in this Policy.

M&R Freight Market retains personal data only for as long as necessary for the purposes for which it was collected, for the fulfilment of legal obligations or for the protection of legitimate rights and interests, under the conditions of applicable law.

Retention periods are determined according to the nature of the data, the purpose of the processing and the applicable legal obligations.

Upon expiry of the applicable period, data is deleted or anonymised, except where continued retention is permitted or required by law.

Deleting an account does not automatically result in the immediate deletion of all associated data, where certain information must be retained for legal obligations, fraud prevention, dispute resolution or the defence of legal claims.

The Company seeks to establish and apply internal retention and deletion rules adapted to the categories of data processed.

Certain data is necessary for creating the account, verifying the company, providing the services or fulfilling legal obligations.

Without it, we may be unable to approve the registration, verify the company’s eligibility, activate the subscription or provide certain functionalities.

Other data may be provided optionally, depending on the available services and functionalities.

The request for additional documents depends on the specific need for verification and on the circumstances of each case.

M&R Freight Market seeks to protect personal data against unauthorised access, loss, alteration, disclosure or unauthorised destruction.

To this end, the Company applies technical and organisational measures appropriate to the risks associated with the processing.

Access to verification documents, private messages and information on incidents is limited to authorised persons who need this data to perform their duties.

No information system can guarantee the absolute security of information.

In the event of a personal data breach, the Company will assess the incident and will make the notifications required by applicable law, where the legal conditions are met.

Under the conditions and within the limits provided by the GDPR, data subjects have the following rights:

• The right of access to personal data and to information on its processing;
• The right to rectification of inaccurate or incomplete data;
• The right to erasure, in the situations provided by law;
• The right to restriction of processing;
• The right to data portability, where the legal conditions are met;
• The right to object to certain processing, including processing based on legitimate interest;
• The right to withdraw consent at any time, for processing based on consent;
• Rights relating to automated individual decision-making, in the situations provided by Article 22 of the GDPR;
• The right to lodge a complaint with the competent data protection authority.

The exercise of these rights may be subject to the conditions and exceptions provided by applicable law.

To exercise your rights or for any question concerning personal data, you may contact us at:

support@mr-freightmarket.com

We will respond to requests within the time limit provided by the GDPR, as a rule within one month of receiving them.

In the situations provided by law, the time limit may be extended, with the data subject being informed.

Where there are reasonable doubts concerning the identity of the requester, we may request additional information necessary to confirm identity.

Data subjects have the right to lodge a complaint with:

National Supervisory Authority for Personal Data Processing (ANSPDCP)

Website: www.dataprotection.ro

The Platform uses automated mechanisms to protect accounts and forms, including Google reCAPTCHA v3.

These mechanisms may analyse technical information and interactions in order to identify activities that present risks of abusive use.

In certain situations, the automated assessment may influence the acceptance of a technical action, such as submitting a form or authenticating.

According to the information available at the date of drafting this Policy, the use of solely automated decision-making systems that produce legal effects concerning natural persons or similarly significantly affect them, within the meaning of Article 22 of the GDPR, is not confirmed.

If such mechanisms are introduced, the Company will provide the additional information required by law.

M&R Freight Market may amend this Policy to reflect changes in the services, the Platform’s functionalities, the providers involved or applicable legal requirements.

The updated version will be published on the Platform, together with the date of the last update.

Where the changes require additional notices or the obtaining of consent, the necessary measures will be applied in accordance with the legislation.

For any question concerning this Privacy Policy or the processing of personal data, you may contact us at:

M&R Freight Market SRL

E-mail: support@mr-freightmarket.com