PRIVACY POLICY

trucklo.eu

1. GENERAL INFORMATION

Trucklo is a Platform enabling the search for and presentation of Manufacturers of new bodies for commercial vehicles, and the submission and routing of Enquiries to Manufacturers. One of the Platform's features is the Enquiry Routing System, which, based on the data contained in the Enquiry and Manufacturers' Production Capability Data, routes the Enquiry to Manufacturers whose offering and capabilities correspond to the given need.

This has direct consequences for data protection and is therefore stated at the very beginning of this document:

• Trucklo is not a party to the transaction between the buyer and the manufacturer and does not act as an intermediary in concluding the agreement.
• The buyer's contact details are not published on the site, are not made publicly available, and are not passed to advertising networks. They are sent solely to the manufacturers indicated by the system in the course of providing the service.
• Forwarding the enquiry to a manufacturer means that the manufacturer becomes a separate controller of that data and processes it at its own responsibility in order to prepare an offer. Details in § 7.1.

The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: GDPR), the Act of 10 May 2018 on the Protection of Personal Data, the Act of 18 July 2002 on the Provision of Electronic Services (hereinafter: ESA) and the Act of 12 July 2024 — Electronic Communications Law (hereinafter: PKE).

2. CONTROLLER OF PERSONAL DATA

The controller of personal data is:

Trucklo Sp. z o.o.

ul. Stanisława Barańczaka 1B/4, 60-537 Poznań, Poland

KRS 0001234469, NIP 7812108719, REGON 544467509, share capital: PLN 5,000

Contact channels

Data Protection Officer. The Controller has not appointed a Data Protection Officer, because, given the current scope and nature of its activity, none of the grounds for mandatory DPO appointment set out in Article 37(1) GDPR are met. In particular, Trucklo's core activity does not consist of large-scale processing of special categories of data referred to in Article 9 GDPR, or of data relating to criminal convictions and offences referred to in Article 10 GDPR, and the processing of data within Trucklo's activity does not involve regular and systematic monitoring of individuals on a large scale. All matters concerning personal data are handled at legal@trucklo.eu.

3. SCOPE OF APPLICATION — WHO THIS POLICY COVERS

This Policy covers the personal data of the following categories of individuals:

• Buyers — individuals submitting an Enquiry concerning a vehicle body, most often acting on behalf of a transport or logistics company, including contact persons and sole traders.
• Manufacturers and the individuals representing them — contact persons, individuals authorised to represent the Manufacturer, individuals responsible for sales or for handling Enquiries, and other individuals whose data the Manufacturer provided to Trucklo in connection with Participation, including individuals whose data was obtained from public sources before contact was established (§ 5).
• Visitors to the trucklo.eu site and its subdomains.
• Recipients of e-mail communications — subscribers to the newsletter, the market report and recipients of marketing communications.
• Candidates for employment and cooperation, where recruitment or a cooperation drive is being conducted.

The data of legal persons as such is not personal data. However, the data of individuals conducting sole-trader business activity and the data of contact persons at companies is personal data within the meaning of Article 4(1) GDPR and is subject to this Policy.

4. PURPOSES, LEGAL BASES, AND RETENTION PERIODS

4.1 The buyer side

Providing contact details is voluntary, but necessary to forward the Enquiry to Manufacturers and enable them to contact the Buyer. The consequence of not providing this data is the inability to use the feature of routing the Enquiry to Manufacturers.

The Buyer's use of the Platform is free of charge. Trucklo does not charge Buyers any fee for submitting an Enquiry or for routing it to Manufacturers. The Buyer's data is not sold or made available to third parties for advertising purposes.

4.2 The manufacturer side

4.3 Site visitors and communications

A note on the communication channel. The consent required under Article 398 PKE is separate from the legal basis for processing personal data under the GDPR. Trucklo does not send unsolicited commercial information by e-mail or telephone without the prior consent required by the applicable provisions for the given communication channel. The first outbound contact may be informational in nature and does not contain commercial information within the meaning of Article 398 PKE.

5. MANUFACTURER DATA OBTAINED FROM PUBLIC SOURCES — THE OBLIGATION UNDER ARTICLE 14 GDPR

At the heart of Trucklo is the list of European vehicle-body Manufacturers. Building it requires collecting data about companies before we make contact with them. This paragraph fulfils the information obligation under Article 14 GDPR towards individuals whose data was not obtained from them directly.

Sources: public business registers (KRS, CEIDG, and their equivalents in other EU member states), Manufacturers' publicly available websites, public company profiles on industry and social-media platforms, publicly available trade-fair and industry directories.

Categories of data: the company's name and registration details, address and area of operation, business contact details (e-mail, phone number), the publicly disclosed name and position of the contact person, and information on the product range and production capabilities.

Purpose and legal basis: Article 6(1)(f) GDPR — a legitimate interest in building a complete map of market supply, enabling buyers' enquiries to be matched to a manufacturer's actual capabilities, and establishing B2B business contact. This interest has been balanced against the rights of the data subjects; only business contact details are processed, in a professional context, to the extent that they were made public by the company itself or by the legislature (public registers).

Safeguards adopted in connection with this processing:

• a manufacturer profile in seeded, unconfirmed status (added without its knowledge) does not receive routed enquiries until participation is confirmed;
• at the manufacturer's request, the profile is removed from the list without delay, with no need to justify the request (implementing Article 21(1) GDPR);
• the data is not used to send unsolicited commercial information (Article 398 PKE);
• the data is not made available to third parties for marketing purposes.

Retention period: until an objection is raised, or, in the absence of any interaction, no longer than 24 months from when the data was obtained. After this period, the record is reviewed; if further processing remains justified and consistent with the data-minimisation principle, the data may be updated based on a current source, and otherwise the record is deleted.

Deadline for fulfilling the information obligation: the information is provided in accordance with Article 14(3) GDPR — generally within a reasonable period after the data is obtained, no later than one month, or, if the data is to be used to communicate with the data subject, at the latest at the time of that first contact. Where the information obligation can be fulfilled by making the information available in this Policy in accordance with Article 14(5) GDPR, Trucklo uses that method.

5.1 AI-based market-analysis tools

To monitor the market — observing competitors, detecting supply-and-demand signals, and supplementing information on Manufacturers' business profiles — the Controller uses the Perplexity AI tool (Perplexity AI, Inc., USA).

Scope. Queries submitted to the tool concern primarily companies, markets, and technologies. Trucklo does not enter Buyers' data, the content of Enquiries submitted on the Platform, or contact details obtained under a contractual relationship with a Manufacturer into the tool. The results may nonetheless incidentally include publicly available personal data, in particular the business contact details or names of individuals holding positions at companies.

Legal basis: Article 6(1)(f) GDPR — a legitimate interest in conducting market analysis and keeping the manufacturer list up to date.

Limits that we apply and that are binding on us:

• no Buyer data or the content of enquiries submitted on the site is entered into AI tools;
• no contact details obtained under a contractual relationship with a manufacturer are entered;
• results generated by the tool are not, on their own, the basis for any decision concerning an individual; they serve solely as input material verified by the team;
• information about an individual obtained by this means is verified against the original source before being recorded in the database, because generative tools may return inaccurate information. Recording unverified information would infringe the data-accuracy principle under Article 5(1)(d) GDPR.

Transfer outside the EEA: use of the tool may involve the processing of data outside the EEA, including in the United States. The transfer takes place using the mechanism provided for under the GDPR that is appropriate to the manner in which the service is used, in particular an adequacy decision, where applicable, or appropriate safeguards. Detailed rules on data transfers are described in § 8.

6. AUTOMATED MATCHING AND ROUTING OF ENQUIRIES

Trucklo matches enquiries to manufacturers in a partly automated manner. In fulfilment of Article 13(2)(f) and Article 14(2)(g) GDPR, we explain how this works.

Matching logic. A buyer's enquiry is classified by the type of body (taxonomy code), chassis, technical parameters, deadline, and region. It is then compared against manufacturers' capability data. The only hard filters are technical feasibility and the sales channel declared by the manufacturer for the given market. The remaining criteria — specialisation, available capacity, geographic proximity, and enquiry-response history — function as weightings rather than as exclusionary conditions. An enquiry is routed to between one and five manufacturers.

Significance and consequences. For the buyer, the result is receiving contact from selected manufacturers. For the manufacturer — receiving an enquiry it can quote for. The process does not result in a refusal to enter into a contract, a creditworthiness assessment, credit scoring, or any other decision producing legal effects concerning the individual or similarly significantly affecting them.

Position with respect to Article 22 GDPR. The process of matching and routing Enquiries does not constitute a decision based solely on automated processing referred to in Article 22(1) GDPR. The matching outcome does not produce legal effects concerning the Buyer or the Manufacturer, nor does it similarly significantly affect them, and it may in addition be reviewed and corrected by a human. In particular, matching does not result in a refusal to enter into a contract, a creditworthiness assessment, credit scoring, or any other decision concerning an individual referred to in Article 22(1) GDPR Independently of this, the Controller ensures that:

• the matching outcome may be reviewed by a human, and the Trucklo team may correct it;
• an interested party may contact legal@trucklo.eu for an explanation of the basis on which its Enquiry was routed to particular Manufacturers, or why a given Manufacturer did or did not receive an Enquiry.

Separately from Enquiry matching, the Controller carries out advertising activities on the Google network, in the course of which — solely with consent given in the cookie banner — visitors may be assigned to remarketing audience lists (§ 10). Such activity may constitute profiling within the meaning of Article 4(4) GDPR; however, assignment to an advertising audience alone does not lead to a decision producing legal effects concerning the individual or similarly significantly affecting them. Consent may be withdrawn at any time, in particular by changing the cookie settings.

Data from enquiries submitted by buyers is never used to build advertising lists or transferred to advertising systems.

7. RECIPIENTS OF DATA

7.1 Manufacturers — separate controllers

Forwarding the enquiry to a manufacturer is not an entrustment of processing within the meaning of Article 28 GDPR. The manufacturer receives the data in order to prepare and present an offer, and from the moment of receipt becomes an independent controller of that data, responsible for its own legal basis, information obligation, and security.

The agreement concluded with the Manufacturer requires it to use the data received to handle the specific Enquiry, and does not permit it to use that data for its own marketing without a separate legal basis required by the applicable provisions.

7.2 Processors (Article 28 GDPR)

The Controller uses the following categories of suppliers, with which data-processing agreements have been concluded:

Tools used for market analysis. Tools used by the Controller for market analysis, including Perplexity AI, are not treated as processors of personal data under Article 28 GDPR where the manner in which the given tool is used does not correspond to a processing-entrustment relationship. The rules governing the use of Perplexity AI, and the scope of data that may be transferred to that tool, are set out in § 5.1.

The Controller makes the current list of processors available upon request submitted to legal@trucklo.eu.

A reservation regarding the status of Google and Meta. As regards the measurement of traffic and conversions, Google acts as a processor under the Google Ads Data Processing Terms and the Google Analytics data-processing terms; the same applies to Meta as regards the conversion pixel. However, to the extent that Google or Meta use the collected data for their own purposes — maintaining and developing their own advertising services — they act as separate controllers, over which the Controller has no influence. The rules on processing in that capacity are set out in those providers' privacy policies: policies.google.com/privacy and facebook.com/privacy/policy

7.3 Other recipients

Public authorities, to the extent and in the manner provided for by law. Legal advisers, auditors, and debt-collection firms — solely to the extent necessary. The acquirer of the business or an organised part of it, in the event of a transaction — with prior notice to the data subjects.

The Controller does not sell personal data and does not make it available to data brokers. Data concerning use of the Platform and online identifiers may reach advertising systems, in accordance with the consent given and the cookie settings (§ 10). Trucklo does not transfer Buyers' contact details, the content of their Enquiries, or Manufacturers' billing data to advertising systems for the purpose of carrying out advertising activities.

8. TRANSFER OF DATA OUTSIDE THE EEA

As a rule, data is processed within the European Economic Area. To the extent that certain IT service providers process data in third countries, the transfer takes place solely on the basis of:

• a European Commission adequacy decision (Article 45 GDPR) — in particular the Implementing Decision of 10 July 2023 on the EU–US Data Privacy Framework, where the provider is certified under that framework, or
• standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (Article 46(2)(c) GDPR), taking into account a transfer impact assessment and, where necessary, appropriate additional technical, organisational, or legal measures, applied as appropriate to the specific transfer.

The Controller does not base any transfer on the Privacy Shield framework, which was invalidated by the judgment of the CJEU of 16 July 2020 in Case C-311/18 (Schrems II). A copy of the safeguards applied may be obtained by writing to legal@trucklo.eu.

9. RIGHTS OF THE DATA SUBJECT

You are entitled to:

How to exercise these rights. A request need only be sent to legal@trucklo.eu. A response is provided without undue delay, no later than one month after receipt of the request; in complex cases, the period may be extended by two months, of which we will inform you within the first month (Article 12(3) GDPR). Exercising these rights is free of charge, subject to the cases set out in Article 12(5) GDPR.

A Manufacturer's account may also be deleted directly from the Manufacturer Panel. Deleting an account or Profile does not mean the automatic deletion of all data where its continued storage is required or permitted under applicable law, in particular in order to perform legal obligations or to pursue, establish, or defend claims. A profile added to the Manufacturer List without the Manufacturer's involvement is deleted without delay upon a request to legal@trucklo.eu, subject to data whose continued storage follows from applicable provisions.

Supervisory authority in Poland: President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, kancelaria@uodo.gov.pl. Individuals residing in another member state may, in the cases provided for in the GDPR, lodge a complaint with the supervisory authority competent for their place of residence, place of work, or the place of the alleged infringement. In France, the supervisory authority is the Commission nationale de l'informatique et des libertés (CNIL).

10. COOKIES AND SIMILAR TECHNOLOGIES

The legal basis for the use of cookies and similar technologies is Article 399 PKE. For technologies requiring consent, the user's prior consent applies in accordance with Article 399(1) PKE. Where the use of a given technology involves the processing of personal data, the basis for that processing is the relevant basis under Article 6 GDPR, in particular consent under Article 6(1)(a) GDPR.

Google Search Console does not use cookies and does not require information to be stored on a visitor's device in connection with the use of the Platform. The tool provides the Controller with data on the Platform's visibility in search results, in particular the number of impressions, clicks, and rankings for search queries. This data is used by the Controller in the form available in the tool and is not used to identify specific visitors to the Platform.

All third-party tags are injected by Google Tag Manager. The container itself does not record any analytics or advertising data; it fires individual tags only after the corresponding consent has been read. Tools other than Google tools — Microsoft Clarity and the Meta pixel — do not use Consent Mode and are therefore not loaded at all before consent.

Consent Mode. Google scripts are embedded in consent mode (Consent Mode v2) with a default setting of denied for the analytics_storage, ad_storage, ad_user_data, and ad_personalization parameters. Until the relevant consent is given, analytics and advertising tools are not run to the extent requiring that consent, and the consent settings are passed to the relevant Google services in accordance with their current configuration.

The principles we apply:

• the cookie banner does not use manipulative design patterns — the refuse button is just as visible and just as accessible as the accept button;
• continuing to use the site, or merely scrolling the page, does not constitute consent;
• consent may be withdrawn at any time via the “Cookie Settings” link in the site footer, with an effect as simple as giving it (Article 7(3), fourth sentence, GDPR);
• until consent is given, we do not run any analytics or marketing scripts.

A detailed list of the cookies used, together with their validity period, is available in the cookie settings panel.

11. CONTENT PUBLISHED BY MANUFACTURERS

Manufacturer profiles contain content supplied by the manufacturers themselves (descriptions, photographs of completed work, technical data). The manufacturer is responsible for holding the rights to the materials provided.

Reports concerning illegal content or content infringing the rights of third parties are accepted at compliance@trucklo.eu. We consider reports promptly, and we inform the reporting party and the manufacturer concerned of the decision taken, in accordance with Article 16 of Regulation (EU) 2022/2065 (the Digital Services Act) and Article 14 ESA.

The Controller does not acquire rights to a Manufacturer's materials beyond what is necessary to present the Profile on the site and to promote the site itself. The Controller does not use a Manufacturer's materials to train AI models, nor does it transfer them to third parties for that purpose.

12. SECURITY OF PROCESSING

In accordance with Article 32 GDPR, the Controller has implemented technical and organisational measures appropriate to the risk, in particular:

• TLS encryption of transmissions on all pages of the site and in all forms;
• role-based access control and the principle of least-privilege access to operational systems (CMS, CRM, spreadsheets, automation tools);
• mandatory two-factor authentication for administrative accounts and accounts with access to enquiry data;
• tokenised, single-use links in onboarding forms, preventing access to the form by unauthorised persons;
• data-processing agreements with all suppliers and confidentiality obligations for individuals authorised to process data (Article 29 GDPR);
• regular backups and restoration tests;
• maintaining a record of processing activities (Article 30 GDPR).

Data breaches. Personal-data breaches are recorded and assessed for the risk they pose to the rights or freedoms of individuals. Where a breach may give rise to such a risk, the Controller notifies the President of the Personal Data Protection Office without undue delay, wherever possible no later than 72 hours after becoming aware of the breach (Article 33 GDPR). Where a breach may give rise to a high risk to the rights or freedoms of individuals, the Controller also notifies the data subjects, in accordance with Article 34 GDPR. Suspected incidents should be reported to compliance@trucklo.eu.

The Controller notes that the transmission of data over the internet is never entirely free of risk, and cannot guarantee the complete security of data sent by e-mail. Where information requiring a heightened level of protection is to be transmitted, the Controller may indicate or provide an appropriate communication channel.

13. CHANGES TO THE POLICY

The Controller may amend this Policy, in particular in connection with a change in the law, a change in the manner in which data is processed, the deployment of new features, or a change of IT service provider, where such a change affects the manner in which personal data is processed.

We inform you of material changes to the Policy with reasonable advance notice, of no less than 14 days, through a notice on the site and, in the case of registered Manufacturers, by e-mail. Changes take effect on the date indicated in the notice. Archived versions of the Policy, together with their effective dates, are made available on request submitted to legal@trucklo.eu.