PRIVACY
POLICY.

The data controller responsible for the processing of personal data described in this policy is:

CANXANSA OÜ
Registry Code: 17286174
VAT: EE102968134
Registered office: Tallinn, Estonia
Email: info@canxansa.com

CANXANSA OÜ is established in the European Union and processes personal data in accordance with the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") and the Estonian Personal Data Protection Act.

We collect personal data only to the extent necessary to provide our freight forwarding services and to operate our website. The categories of data we process include:

• Contact data — name, company, email, phone number, country (provided through the quote form, by email or by phone).
• Shipment data — origin, destination, mode of transport, cargo description, weight, dimensions, incoterms, and any details required for customs, carrier booking and invoicing.
• Commercial data — quotation history, booking references, invoices, payment status, communication history.
• Technical data — IP address (truncated), browser type, device type, referring URL, pages visited, time on site, approximate location at country level. Collected via Google Analytics 4 only with your consent.
• Tracking data — when you use the shipment tracking tool, we process the tracking number you enter and return the associated shipment status.

We do not knowingly collect any special categories of personal data (health, religion, biometric data, etc.) and we do not target our services at children under 16.

We process personal data only for specific, explicit purposes and on a valid legal basis under Article 6 GDPR:

• To respond to quote requests and operate shipments — legal basis: performance of a contract or steps prior to entering a contract (Art. 6(1)(b)).
• To issue invoices and maintain accounting records — legal basis: legal obligation (Art. 6(1)(c)), Estonian accounting and tax law.
• To comply with customs, sanctions and dangerous-goods regulations — legal basis: legal obligation (Art. 6(1)(c)).
• To send commercial follow-ups to existing customers — legal basis: legitimate interest (Art. 6(1)(f)); you may object at any time.
• To analyse website traffic via Google Analytics — legal basis: your consent (Art. 6(1)(a)), captured via our cookie banner.
• To respond to messages sent through the contact or signals subscription form — legal basis: legitimate interest (Art. 6(1)(f)) or, for marketing subscriptions, consent (Art. 6(1)(a)).

This website uses two categories of cookies and similar technologies:

• Strictly necessary — required to remember your cookie choice and to keep basic site features working. These are stored without consent because the site cannot function without them.
• Analytics — Google Analytics 4 (property G-X19NTBBWNQ), used to count visitors, measure traffic sources and improve content. IP addresses are anonymised. These cookies are set only after you click "Accept" in the cookie banner.

You can change or withdraw your consent at any time by clicking "Cookie settings" in the page footer, or by clearing the canxansa_consent entry in your browser storage.

We share personal data only with parties who need it to deliver our services or to comply with the law. Recipients fall into the following categories:

• Carriers and sub-contracted forwarders — airlines, shipping lines, road hauliers and partner forwarders who physically execute the shipment. Only the data strictly required for booking and delivery is shared.
• Customs brokers and authorities — when required for import or export clearance in any country involved in the shipment.
• Payment and accounting service providers — banks and our accounting firm processing invoices and receipts.
• IT service providers — Formspree (form submissions), Google (Analytics, Fonts), GitHub Pages (website hosting). These act as our processors under written terms.
• Public authorities — when we are legally obliged to disclose data in response to a lawful request.

We do not sell personal data and we do not share it with anyone for their own marketing purposes.

Because our freight services connect Europe with Turkey, the Middle East, Central Asia and the Far East, some personal data is necessarily transferred to recipients outside the European Economic Area (EEA) — for example a carrier in Turkey, a customs broker in the UAE, or a destination agent in China.

Where the destination country has not received an EU adequacy decision, transfers are made on one of the following safeguards under Article 46 GDPR:

• Standard Contractual Clauses (SCCs) signed with the recipient.
• The derogation of Article 49(1)(b) — transfer necessary for the performance of the contract you have requested.

Google Analytics data is processed by Google LLC; transfers to the United States are covered by the EU–US Data Privacy Framework.

We keep personal data only as long as needed for the purpose for which it was collected:

• Quote requests that did not result in a booking — up to 24 months from the last contact, then deleted.
• Shipment and accounting records — 7 years, in line with Estonian accounting law.
• Customer support correspondence — up to 3 years after the last interaction.
• Analytics data in Google Analytics 4 — retention period set to 14 months at event level.
• Marketing consent records — until consent is withdrawn, plus a short legal-evidence period.

After the relevant period, data is either deleted or irreversibly anonymised.

Under the GDPR you have the following rights in relation to your personal data:

• Access (Art. 15) — request a copy of the personal data we hold about you.
• Rectification (Art. 16) — ask us to correct inaccurate or incomplete data.
• Erasure (Art. 17) — ask us to delete data when it is no longer needed, subject to our legal retention duties.
• Restriction (Art. 18) — ask us to limit processing while a dispute is resolved.
• Portability (Art. 20) — receive your data in a structured, commonly used format.
• Objection (Art. 21) — object to processing based on legitimate interest, including direct marketing.
• Withdraw consent (Art. 7) — withdraw analytics or marketing consent at any time, without affecting prior lawful processing.

To exercise any of these rights, write to info@canxansa.com. We respond within one month. We may ask you to verify your identity before disclosing personal data.

We apply appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration or disclosure. These include:

• TLS/HTTPS encryption for all traffic to and from our website.
• Access to shipment and customer records restricted to authorised CANXANSA personnel.
• Strong passwords and two-factor authentication on operational accounts.
• Written confidentiality and processing terms with all sub-contractors and IT providers.
• Regular review of access rights and prompt revocation when no longer required.

No method of transmission or storage is fully secure; we cannot guarantee absolute security but we treat any incident according to a documented response procedure and notify supervisory authorities and affected individuals where required by GDPR.

For any question about this privacy policy or about how we process your personal data, please contact:

CANXANSA OÜ
Tallinn, Estonia
Email: info@canxansa.com

You also have the right to lodge a complaint with the Estonian supervisory authority, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia — www.aki.ee — or with the supervisory authority in the EU country where you live or work.

This policy may be updated from time to time. The "Effective" date at the top of this page shows the latest version. Material changes will be highlighted on the website.