Privacy Policy — Sigil RMPD

When Sigil processes CMR contents on behalf of a Carrier, Sigil acts as a data processor under GDPR Art. 28. The applicable Data Processing Agreement (DPA) is available at /legal/dpa.

---

3. Data We Collect and Process

As Data Controller (Carrier's account data):

- Full name and email address of account holders and users

- Company name, EDRPOU/RNOKPP/NIP/VAT number, registered address

- Billing and payment data (processed by LiqPay / PrivatBank — see §9)

- IP address, browser type, device identifiers, access timestamps

- In-app activity logs (actions taken within the Platform)

- GPS locator numbers associated with vehicles

As Data Processor (CMR document contents, on behalf of the Carrier):

- Names and addresses of senders, recipients, and parties listed in CMR documents

- Goods descriptions, quantities, weights, HS/CN codes

- Vehicle registration plates (tractor and trailer)

- Driver names, nationalities, and license details where present in CMR

- RMPD100 declaration fields submitted to PUESC/SENT

---

4. How We Collect Data

We collect personal data through the following channels:

- Account registration: you provide your name, email, company data, and billing details;

- CMR document upload: you upload CMR scans or PDFs for OCR processing;

- Platform usage: we automatically collect IP addresses, session data, and usage logs;

- PUESC integration: PUESC submission confirmations and reference numbers are recorded;

- Import of PUESC history — on your instruction: when you start it from the Platform, we retrieve documents from your own PUESC mailbox covering up to the last 12 months, using your credentials and in your name. These documents contain data about senders, recipients, delivery places, vehicles and their geolocators, taken from declarations you previously submitted. The import runs only when you start it and never automatically. See §4 of the Terms of Service;

- Communications: email correspondence and support requests.

Apart from the PUESC import described above — which retrieves your own filing history from a system you are the account holder of — we do not collect data from third parties or data brokers.

---

5. Legal Bases (GDPR Art. 6)

---

6. International Data Transfers

Some of our sub-processors are located outside the European Economic Area (EEA). We ensure appropriate safeguards for all international transfers:

All SCC transfers are conducted under the European Commission's 2021 standard contractual clauses. Transfer Impact Assessments (TIAs) are maintained for US-based processors.

---

7. Data Security

Sigil implements technical and organisational measures proportionate to the risks involved, including:

- Encryption at rest: AES-256-GCM for all stored data, including PUESC credentials and CMR documents;

- Encryption in transit: TLS 1.3 for all network communication;

- Access control: Role-based access control (ADMIN, DISPATCHER, VIEWER) with principle of least privilege;

- Credential security: PUESC API keys are encrypted and never written to logs;

- Infrastructure: Hosted on Render.com (Frankfurt) with SOC 2 Type II certification;

- Monitoring: Sentry used for real-time error monitoring and anomaly detection;

- Audit logs: All PUESC submissions and administrative actions are logged;

- Regular reviews: Security measures are reviewed at least annually.

No security measures are 100% guaranteed. In the event of a data breach, we will act in accordance with §11.

---

8. Data Retention

After the applicable retention period, data is securely deleted or anonymised.

---

9. Sub-processors

Sigil uses the following sub-processors to provide the service. Where Sigil acts as a data processor for the Carrier, these are Sigil's sub-processors under GDPR Art. 28(2).

Sigil will notify the Carrier of any intended addition or replacement of sub-processors with at least 14 days' advance notice, providing the Carrier an opportunity to object.

---

10. Automated Processing and AI

Sigil uses AI/OCR (Google Document AI) to extract data from CMR documents. This automated processing:

- Does not constitute profiling within the meaning of GDPR Art. 22;

- Does not produce legal effects for any individual automatically — all RMPD submissions require explicit human review and confirmation by the User before any data is sent to PUESC;

- Operates as an assistance tool only, with the User retaining full decision-making authority.

In accordance with the EU AI Act, our OCR system is classified as a limited-risk AI system used as an automation tool in a B2B transport compliance context. Human oversight is a mandatory product requirement, not an optional feature.

---

11. Data Breach Notification

In the event of a personal data breach:

- Sigil will notify the affected Carrier within 48 hours of becoming aware of any breach involving that Carrier's data, providing sufficient information for the Carrier to meet its own notification obligations.

- As data processor, Sigil supports the Carrier (as data controller) in fulfilling its obligations to notify the competent supervisory authority and affected individuals under GDPR Arts. 33–34 and Law No. 2297-VI Art. 21.

---

12. Your Rights

Under GDPR, you have the following rights regarding your personal data:

Role	Data category	Controller
Data Controller	Account data (name, email, company, billing)	Sigil
Data Processor	CMR document contents uploaded by the Carrier	The Carrier's company
Data Processor	Data entered into the Platform by the Carrier (drivers, fleet, counterparties, delivery places) and the same categories recovered by the PUESC history import	The Carrier's company
Purpose	Legal basis
Providing the Platform service	Art. 6(1)(b) — contract performance
Processing CMR data for RMPD submission	Art. 6(1)(b) — contract performance (as processor: Carrier's instruction)
Legal obligations (SENT records, accounting)	Art. 6(1)(c) — legal obligation
Fraud prevention and system security	Art. 6(1)(f) — legitimate interest
Sending marketing communications	Art. 6(1)(a) — consent (opt-in only)
Performance monitoring and error logging (Sentry)	Art. 6(1)(f) — legitimate interest
Recipient	Country	Transfer mechanism
Anthropic (OCR/AI)	USA	Standard Contractual Clauses (SCC) — Art. 46(2)(c)
LiqPay / PrivatBank (payments)	Ukraine	Art. 46 GDPR + Law No. 2297-VI Art. 29(4)
Sentry (error monitoring)	USA	SCC + Sentry EU data residency option
Data category	Retention period	Legal basis
CMR scans and RMPD declaration data	10 years	Art. 6(1)(c) — transport law, accounting law
Account and user data	Duration of contract + 30 days	Art. 6(1)(b)
Billing and invoice data	7 years	Art. 6(1)(c) — tax law
System and access logs	24 months	Art. 6(1)(f) — security
PUESC audit trail	10 years	Art. 6(1)(c) — SENT law
Marketing consent records	Until consent withdrawn + 3 years	Art. 6(1)(a) + legitimate interest
Reference data (counterparties, delivery places, fleet), whether entered by hand or recovered by the PUESC import	Term of the contract + 30 days	Art. 6(1)(b)
Sub-processor	Purpose	Location	DPA reference
Supabase (PostgreSQL)	Database	Frankfurt, EU	Supabase DPA
Render.com	Application hosting	Frankfurt, EU	Render DPA
Cloudflare R2	CMR file storage	Frankfurt EU bucket	Cloudflare DPA
Google Cloud (Document AI)	OCR processing	EU region	Google DPA
Anthropic	AI field mapping	USA	Anthropic DPA
LiqPay / PrivatBank	Payment processing	Ukraine	LiqPay Terms
Sentry	Error and performance monitoring	USA (EU residency option)	Sentry DPA
Right	Description
Access (Art. 15)	Obtain a copy of the personal data we hold about you
Rectification (Art. 16)	Request correction of inaccurate data
Erasure (Art. 17)	Request deletion (subject to legal retention obligations)
Restriction (Art. 18)	Request restriction of processing
Portability (Art. 20)	Receive your data in a structured, machine-readable format
Objection (Art. 21)	Object to processing based on legitimate interest
Withdraw consent	Withdraw marketing consent at any time