Privacy Policy

1. Controller and processor

TransferCRM is operated by Special Services, Skrzynka 7a, 32-410 Dobczyce, Poland (NIP: PL 6793148834). We are the controller of the data of our customers' accounts — the names and e-mail addresses of their owners and staff, the company's billing details, and subscription and payment data — as well as of the data of visitors to our website and of correspondence with our support.

For the data our customers enter about their passengers, clients and drivers, the customer company is the controller and we are its processor: we process that data only on its instructions, under the Data Processing Agreement. If a transport company served you as a passenger, client or driver, please address requests about your data to that company; a request that reaches us is passed on to it.

2. Data We Collect

We collect only the data necessary to provide our service:

• Account data: name, email, company name, password (hashed)
• Business data: orders, clients, drivers, vehicles, routes, and quote acceptances (name, signature, network address, device)
• Payment data: processed securely via Stripe (we do not store card numbers)
• Usage data: login times, feature usage, browser type
• Cookies: session cookies (essential), preference cookies (locale, theme)

3. Purpose of Processing

We process data to provide and improve the TransferCRM service, communicate with you about your account, ensure security, and comply with legal obligations.

4. Data Retention

How long we keep data:

• Account data — for as long as the account exists. When a subscription ends and is not renewed, the account is frozen: nothing is deleted, and it can be reactivated by subscribing again.
• Deleted accounts — when the owner deletes the company account, all of its data is erased 30 days after the request. Until then the deletion can be cancelled with the link we send by e-mail, and a reminder is sent a week before the date.
• Backups — encrypted backups roll over and are overwritten within 12 months.
• Driver positions — GPS positions recorded by the driver app are deleted after 60 days.
• Delivery logs — the record of an e-mail or SMS we sent, including the recipient's address or number, is kept for 365 days and then deleted. Deleting an order removes the messages sent about it straight away.
• Our invoices — the invoices we issue to our customers are kept for as long as tax law requires.
• Acceptance of the Terms and the DPA — the accepted text, the parties, who accepted it, when, and from which IP address and device are kept for six years after the end of the year in which the company was erased, to establish or defend legal claims (Art. 17(3)(e) GDPR).

5. Your Rights (GDPR)

Under GDPR, you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data
• Right to data portability — export your data in a standard format
• Right to object — object to certain types of processing

6. Security

We use industry-standard security measures including TLS encryption, hashed passwords, tenant data isolation, role-based access control, and regular security audits.

7. Data Storage Location

Our servers are in Frankfurt am Main, Germany (EU), operated by Hostinger International Limited, and our backups are also kept in the European Union. Where a provider processes data outside the EU/EEA, the transfer rests on an adequacy decision (such as the EU–US Data Privacy Framework) or on Standard Contractual Clauses; the list below states the safeguard for each sub-processor.

8. Who receives our customers' account data

For the data we control (section 1), we use only:

• Stripe — collects the subscription payments companies make to us. Card details go straight to Stripe and stay with Stripe; we never see or store the card number.
• Hostinger International Limited — hosts our servers in Frankfurt am Main, Germany (EU).
• Our own mail server, running on our servers — we send e-mail without any external e-mail provider.

9. Sub-processors

These providers help us process the data our customers enter about their passengers, clients and drivers. It is the same list our Data Processing Agreement refers to.

10. Google Account Data (Calendar & Gmail)

Connecting a Google account to TransferCRM is optional and always started by you. We request the narrowest scopes the connected features need:

• openid, email — to show which Google account is connected and to use it as the sending identity.
• calendar.events — to create, update and delete the calendar entries that mirror your transfer bookings. We never read or change unrelated events.
• gmail.send — to send booking confirmations and other transactional messages from your own address. This scope allows sending only: it grants no ability to read, search or delete your mail.

TransferCRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through these scopes is used solely to provide the features you switched on. It is never sold, never used for advertising or profiling, never used to train AI or machine-learning models, and never shared with third parties beyond what running the feature requires or the law demands. Google API Services User Data Policy

Data obtained through Google APIs is never sent to AI or machine-learning services and is not used to train any model.

You can disconnect the Google account at any time in Settings → Integrations, or revoke access at myaccount.google.com/permissions. Disconnecting deletes the stored access and refresh tokens immediately. Calendar entries already created stay in your calendar and remain yours to delete.

11. Cookies

We use essential cookies for authentication and session management. We do not use third-party tracking cookies. You can manage cookie preferences through your browser settings.

12. Contact

For privacy-related inquiries or to exercise your rights, contact us:

Special Services
Skrzynka 7a, 32-410 Dobczyce, Poland
Email: privacy@transfercrm.com