TruckLo Privacy Policy
This Privacy Policy explains how personal data is processed when you use the TruckLo platform (“Platform”). It is an informational GDPR notice and a product-legal draft for the Controller’s counsel review. It is not individual legal advice.
1. General information and definitions
- Platform - the TruckLo website for discovering commercial vehicle producers and B2B lead matching. Sales contracts and payments are not concluded on the Platform.
- User - any person using the Platform.
- Producer - a B2B entity with or applying for a profile and panel.
- Buyer - a B2B entity (or person acting for it) submitting a lead.
- Lead - an enquiry with contact details and need parameters that may be assigned to a Producer.
- Profile - the Producer’s public listing on the Platform.
2. Data controller
The controller is:
Trucklo Sp. z o.o.
registered office in Poznań, ul. Stanisława Barańczaka 1B lok. 4, 60-537 Poznań, Poland
entered in the Register of Entrepreneurs of the National Court Register (KRS) kept by the District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register, under KRS number 0001234469
Tax ID (NIP): 7812108719 · REGON: 544467509
GDPR e-mail: contact@trucklo.eu
DPO: not appointed.
You may also use the Contact form with subject “GDPR / RODO”. We respond without undue delay and within 30 days (extendable under the GDPR).
3. Categories of data subjects
- Buyers and contact persons submitting leads or forms,
- Producers (waitlist, onboarding, panel accounts, public profiles),
- Newsletter subscribers,
- Website visitors (technical / cookie data - see Cookie Policy),
- Platform staff administrators - as needed to operate the system.
4. Purposes and legal bases
| Process | Purpose | Legal basis (proposal) | Retention (proposal) |
|---|---|---|---|
| Producer waitlist | invite queue, onboarding communication | consent / pre-contractual steps (Art. 6(1)(a)/(b) GDPR) | until programme ends + max 24 months or erasure |
| Onboarding / profile | B2B listing, catalogue, matching | contract / pre-contractual (b) | until account deletion + legal duties |
| Producer panel account | authentication, lead access | contract (b) | until account deletion |
| Quiz / lead | matching and handling B2B enquiry | contract / legitimate B2B interest (b)/(f) | 24 months after lead closed; event logs 12 months |
| Contact reveal / stats | anti-scraping, measurements | legitimate interest (f) | IP|UA hash: 1 day; events per stats policy |
| Contact forms | reply to enquiry | (f) / (b) | 12–24 months (mailbox policy) |
| Newsletter | Platform and industry updates | consent (a) | until unsubscribe |
| Analytics / ads cookies | analytics, marketing | consent (ePrivacy + GDPR) | see Cookie Policy |
| Geocoding | profile / filter location | (f) | no durable query logging (if not logged) |
Providing data is voluntary but often required to deliver the service (e.g. a lead without contact details cannot be handled).
5. Recipients and processors
Data may be entrusted to processors or disclosed to recipients as needed, including:
- hosting and SMTP (Instantio infrastructure / 360 Software House),
- SMSAPI - SMS lead notifications,
- Google (Tag Manager, Analytics, Maps) - where enabled and after required consents,
- Microsoft Clarity - UX analytics (after consent),
- Meta - marketing pixel (if enabled, after consent),
- OpenStreetMap Nominatim - geocoding queries,
- Producer assigned to a lead - receives buyer contact details and enquiry content as a data recipient for handling that enquiry (joint-controller qualification to be confirmed with counsel).
6. Transfers outside the EEA
Some providers (e.g. Google, Meta, Microsoft) may process data outside the EEA. Appropriate transfer safeguards (e.g. SCCs / provider settings) are used where available. See the Cookie Policy for marketing tools.
7. Retention
We apply the periods in section 4 unless a longer period is required by law, claims, or Platform security. Afterwards data are deleted or anonymised.
8. Your rights
Under the GDPR you may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (without affecting prior lawfulness). You may lodge a complaint with the Polish SA (UODO) or your local authority.
Exercise rights via the GDPR e-mail or contact form (subject “GDPR / RODO”).
9. Profiling and lead matching
The Platform uses automated or semi-automated lead matching based on quiz parameters and admin rules. Final assignment may be made by Platform Admin. This does not produce legal effects solely by automated means under Art. 22 GDPR; it organises B2B contact. You may object to processing based on Art. 6(1)(f).
10. Security
We apply measures appropriate to risk, including HTTPS, hashed panel passwords, restricted panel access, form rate limiting, and click-gated contact reveal to limit automated harvesting.
11. Children’s data
The service is for B2B use by adults (18+). We do not knowingly collect children’s data.
12. Changes
This Policy may be updated. The current version and effective date appear on this page. Material changes may also be communicated separately.