EU GDPR

Cargo One GmbH, based in Berlin, Germany, processes personal data under the EU General Data Protection Regulation (GDPR).

Our role: We act as processor for the personal data our customers put on the platform, and as controller for our own business data.

What we have in place:

• Data processing terms under Article 28 GDPR form part of our customer agreements and incorporate the EU Standard Contractual Clauses
• Records of processing activities under Article 30 GDPR
• Data protection impact assessments for higher-risk processing, including our AI features
• The platform is hosted in the EU; transfers outside the EEA rely on the Standard Contractual Clauses or another approved transfer mechanism
• Data subject requests: a request that reaches us directly is passed to the customer, and we help them respond within the statutory deadline
• Personal data breaches are notified to affected customers without undue delay
• Security and data protection awareness training for staff
• An information security management system certified to ISO/IEC 27001:2022 (see the ISO/IEC 27001 entry for its scope)

Supervisory authority: Berlin Commissioner for Data Protection and Freedom of Information.