This Privacy Policy explains how Klever Logistics doo, Đorđa Isakova 22, 21241 Kać, Republic of Serbia, company registration number 22085417 (“KleverCargo”, “we”), processes personal data in connection with the KleverCargo Platform, the KleverCargo Drive application and the website klevercargo.com. Capitalised terms have the meaning given in the Terms of Use.
Questions and requests: privacy@klevercargo.com. Our representative in the European Union under Article 27 GDPR is KleverCargo Innovation B.V., Veemkade 328, 1019 HD Amsterdam, the Netherlands, reachable at the same address.
1. Who we are and what this Policy covers
1.1 We are a company established in the Republic of Serbia and are subject to the Serbian Law on Personal Data Protection. Because we offer our Services to companies in the European Union and elsewhere, we also apply the EU General Data Protection Regulation (GDPR) and, where relevant, the UK GDPR and the Swiss Federal Act on Data Protection to the data of persons in those territories. Where the law of your country gives you further rights, we honour them.
1.2 This Policy covers Users of the Platform and the Drive application, visitors of our website, people who contact us, and the persons whose data we process as controller. Where we process data on behalf of a Client, the Client’s own privacy notice and our DPA apply, as explained in Section 2.
2. When we are controller and when we are processor
2.1 KleverCargo as controller. We decide why and how to process the data described in Section 3: your account, the security of the Platform, billing, support, marketing and our legal records. For that processing we are the controller and you can exercise your rights directly against us.
2.2 KleverCargo as processor. Everything a Client and its Users put on the Platform to run their logistics (transport requests, bookings, gate visits, drivers, contacts, documents, chat) is processed on the Client’s instructions. The Client is the controller, we are its processor under the DPA, and the Client is responsible for informing the people concerned. If you are an employee, driver, visitor or business contact of a Client and have a question about that data, please contact the Client; if you contact us, we will forward your request to it and help it respond.
2.3 Other Clients. When two Clients conclude an Agreement, each receives the other’s contact details and processes them as an independent controller for its own business. We are not responsible for how a Client uses data it received from another Client.
3. What we process as controller, why and for how long
The table lists each processing activity for which we are controller.
We may also process any of the above to comply with a legal obligation, to respond to a binding request from a court or authority, to prevent or detect fraud and crime, and to establish, exercise or defend legal claims. That processing rests on our legal obligations and legitimate interests.
4. What we process as processor for our Clients
4.1 As processor we handle, on our Clients’ instructions, the data of their Users (name, e-mail, phone, Role), their drivers (name, phone, vehicle plates, tasks and, while a task is active and the driver has enabled it in the Drive application, the position of the device), their gate visitors (name, company, contact details, vehicle plate, arrival and departure times and, where the Client requires it, the identity document presented), their business contacts, the persons named in the documents they upload, and the messages exchanged on the Platform. The full description is in Annex I of the DPA.
4.2 Automatic reading of invoices. When a User marks an uploaded document as an invoice and the automatic reading is switched on, the document is transmitted to our sub-processor Anthropic, PBC, whose AI model returns the invoice details it finds. Documents may contain names and contact details of the persons on the invoice; they are processed solely to read the invoice, are not used to train models, and are retained by the sub-processor only as long as needed to return the result. Every User can switch the feature off at any time.
4.3 Viber and e-mail messages to contacts. Clients can send cargo offers and notifications to their own contacts through Viber Business Messages and e-mail. The Client decides whom to contact and is responsible for having the right to do so; every message offers a way to opt out, and we record opt-outs so that the contact is not messaged again.
5. Where the data comes from
We receive data from you when you register, use the Platform or contact us; from the Client that invites you or enters your details; from your device (technical and, in the Drive application, position data you enable); from public business registers, company websites and public business directories that we consult when verifying a company; and from the other Clients you conclude Agreements with.
6. How we protect your data
6.1 We run an information security management system certified against ISO/IEC 27001:2022 (certificate SCK/05/KLD/25/38/4080). Measures include encryption of all traffic in transit (TLS 1.2 or higher) and of data at rest, role-based access control per company and per feature, passwords stored only as salted hashes, session cookies that are HttpOnly and Secure, rate-limited and logged log-ins, separated production and development environments, daily encrypted backups, vulnerability management and scheduled independent penetration tests, confidentiality undertakings and training for all personnel, and a documented incident response procedure. The measures are described in detail in Annex II of the DPA.
6.2 No system is perfectly secure. If a personal data breach is likely to result in a high risk to you, we will inform you and the competent authority as the law requires. Please never send passwords or sensitive data by e-mail, and report anything suspicious to security@klevercargo.com.
7. Who receives your data
7.1 Service providers (sub-processors). We use the following providers, each bound by a data processing agreement and permitted to process data only for the stated purpose:
7.2 Other recipients. Our accountants, auditors, lawyers and insurers under confidentiality; courts, arbitral tribunals and public authorities where the law requires; the other Client when you conclude an Agreement; and a buyer or successor in the event of a merger, acquisition or sale of our business, who must respect this Policy. We never sell personal data and do not share it with advertisers.
8. International transfers
8.1 The Platform and its database are hosted in the European Union (Frankfurt, Germany). Our team operates the Platform from the Republic of Serbia, a country that has ratified Council of Europe Convention 108+ and whose data protection law follows the GDPR. Some providers listed in Section 7 process data in the United States.
8.2 Where data of persons in the EEA, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses (with the UK Addendum and Swiss adaptations where applicable), together with a transfer impact assessment. As processor for our Clients we enter into the Standard Contractual Clauses through the DPA. A copy of the relevant safeguards is available on request at privacy@klevercargo.com.
9. How long we keep data
We keep personal data for the periods stated in Section 3 and, as processor, for the duration set out in the DPA and the Terms of Use. When a period ends we delete the data or anonymise it so that it can no longer be linked to you. Statutory retention obligations (in particular accounting and tax law) and the need to establish or defend legal claims may require us to keep specific records longer, in which case access to them is restricted.
10. Your rights and how to exercise them
10.1 Subject to the conditions of the applicable law you have the right to: access your personal data and receive a copy; have inaccurate data corrected; have data erased; restrict processing; object to processing based on legitimate interest, including direct marketing at any time; receive the data you provided in a portable format; withdraw consent at any time without affecting earlier processing; and not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
10.2 You can update your profile, change your password, manage notifications and delete your account directly on the Platform, and a company administrator can export all of the company’s data from the profile. For anything else write to privacy@klevercargo.com. We may ask you to verify your identity. We answer within 30 days; for complex requests we may extend by two further months and will tell you why. Requests are free unless manifestly unfounded or excessive.
10.3 If your request concerns data we process for a Client, we will forward it to the Client and tell you so, because only the Client can decide on it.
10.4 You may lodge a complaint with a supervisory authority. For Serbia: the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia, poverenik.rs . In the EEA: the authority of the Member State where you live or work, or our EU representative named above. In the United Kingdom: the Information Commissioner’s Office. In Switzerland: the Federal Data Protection and Information Commissioner. We would appreciate the chance to address your concern first.
11. Automated decisions and AI features
We take no decisions about you based solely on automated processing that have legal or similarly significant effects. Company verification is carried out by our staff on the basis of public information and does not produce automated decisions. Values read from documents by the AI-assisted invoice reading are suggestions that a person checks before they are used. Ratings are given by other Clients, not by us.
12. Children
The Platform is a business tool for adults. We do not knowingly process data of persons under 18 and Clients may not register such persons as Users. If you believe we hold such data, contact us and we will delete it.
13. Website and cookies
The Platform and the website use only strictly necessary cookies and browser storage (session, language, theme and similar settings). We use no analytics, advertising or tracking cookies. Details are in the Cookie Policy. Contact and demo request forms on klevercargo.com are processed as described in Section 3.
14. Changes to this Policy
We may update this Policy to reflect changes in our Services or in the law. Each version carries a version number and effective date. Material changes are announced on the Platform or by e-mail before they take effect. The applicable law and forum for disputes are stated in the Terms of Use.