Privacy and Cookie Policy

This Privacy and Cookie Policy sets out the rules governing the processing of personal data by SPEEDIXA Sp. z o.o. in connection with the use of the speedixa.com website, contact forms, requests for quotations, transport, forwarding, warehousing and logistics services, cooperation with carriers and contractors, recruitment, business and marketing communications, as well as the use of cookies and similar technologies.

This Policy applies taking into account Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation — GDPR), Polish personal data protection legislation, electronic communications legislation and other laws applicable to SPEEDIXA's activities.

Last updated: 14 August 2026

Contents

1. Data Controller
2. Definitions
3. Scope of this Policy
4. Data processing principles
5. Categories of personal data
6. Sources of personal data
7. Purposes and legal bases
8. Website and contact forms
9. B2B clients and company representatives
10. Road freight
11. Temperature-controlled transport
12. ADR transport
13. Container transport
14. Air freight
15. AOG logistics
16. On Board Courier
17. Ocean freight
18. Rail freight
19. Multimodal transport
20. Warehousing and 3PL
21. Controller / Processor roles
22. Fulfilment and distribution
23. Customs services
24. GPS and Track & Trace
25. Industry-specific logistics
26. Carriers and subcontractors
27. Services for carriers
28. Transport documentation
29. Claims and insurance matters
30. Recruitment
31. Marketing
32. Cookies
33. Cookie categories
34. Consent management
35. Third-party technologies
36. Recipients of personal data
37. Transfers outside the EEA
38. Retention periods
39. Special categories of data
40. Profiling
41. Data subject rights
42. Complaint to the supervisory authority
43. Security
44. Personal data breaches
45. Changes to this Policy
46. Legal framework
47. Contact

1. Data Controller

The controller of personal data within the meaning of Article 4(7) GDPR is:

For any matters relating to this Policy, the processing of personal data or the exercise of data subject rights, you may contact SPEEDIXA using the details above.

2. Definitions

• GDPR — Regulation (EU) 2016/679.
• Controller — an entity that determines the purposes and means of processing personal data.
• Processor — an entity processing personal data on behalf of a controller.
• Personal data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on personal data, including collection, recording, organisation, storage, alteration, use, disclosure, restriction, erasure or destruction.
• User — a natural person using speedixa.com.
• Contractor — a customer, carrier, supplier, subcontractor, partner or other entity cooperating with SPEEDIXA.
• Cookies — information stored on, or accessed from, a user's terminal equipment.
• CMP — a Consent Management Platform used to manage user choices regarding cookies and similar technologies.

3. Scope of this Policy

This Policy may apply to personal data relating to:

• website visitors;
• customers and prospective customers;
• customer representatives;
• contact persons of contractors;
• carriers;
• subcarriers;
• drivers;
• freight forwarders;
• warehouse operators;
• suppliers;
• shippers;
• consignees;
• airport representatives;
• port and rail terminal representatives;
• customs representatives;
• insurance representatives;
• job candidates;
• persons submitting CVs;
• recipients of warehousing or fulfilment deliveries;
• other natural persons involved in the logistics chain.

4. Principles of Personal Data Processing

SPEEDIXA seeks to process personal data in accordance with the principles laid down in the GDPR, including:

• lawfulness;
• fairness;
• transparency;
• purpose limitation;
• data minimisation;
• accuracy;
• storage limitation;
• integrity;
• confidentiality;
• accountability;
• privacy by design;
• privacy by default.

5. Categories of Personal Data We May Process

Depending on the nature of the relationship or service, SPEEDIXA may process:

• first name and surname;
• job title;
• company name;
• business e-mail address;
• private e-mail address where voluntarily provided;
• telephone number;
• correspondence address;
• loading address;
• delivery address;
• warehouse contact details;
• shipper and consignee contact details;
• transport order information;
• shipment and booking references;
• vehicle information;
• vehicle registration number;
• driver information;
• transport document data;
• CMR information;
• AWB information;
• Bill of Lading information;
• Proof of Delivery information;
• delivery notes;
• packing lists;
• customs documents;
• insurance documents;
• recipient signatures;
• route data;
• GPS / Track & Trace information;
• delivery time windows;
• transport incident information;
• claim-related information;
• payment and settlement information;
• bank details where required;
• invoice data;
• business correspondence;
• IP address;
• User-Agent information;
• operating system;
• device type;
• date and time of connection;
• cookie identifiers;
• consent records;
• information contained in CVs;
• education information;
• employment history;
• professional skills;
• other information voluntarily provided.

6. Sources of Personal Data

Personal data may be obtained:

• directly from the data subject;
• through the website;
• through contact forms;
• through transport quotation forms;
• by e-mail;
• by telephone;
• from a transport order;
• from a contract;
• from transport documentation;
• from the data subject's employer;
• from a customer;
• from a carrier;
• from a subcontracted carrier;
• from a shipper;
• from a consignee;
• from a warehouse;
• from a freight forwarder;
• from an insurance company;
• from public authorities;
• from official public registers;
• automatically when the website is used, with regard to technical data and permitted technologies.

Where personal data has not been obtained directly from the data subject, SPEEDIXA fulfils the information obligations under Article 14 GDPR where such obligation applies and no statutory exemption is available.

7. Purposes and Legal Bases for Processing

8. Website, Contact Forms and Requests for Quotations

Through the website, users may contact SPEEDIXA, submit an enquiry or request a quotation for transport or logistics services.

The following information may be requested:

• name;
• company name;
• e-mail address;
• telephone number;
• place of departure;
• delivery destination;
• type of cargo;
• type of transport;
• additional shipment information.

Where the information is necessary to answer an enquiry or take steps prior to entering into a contract, processing may be based on Article 6(1)(b) GDPR and does not require a separate general consent checkbox.

In relation to representatives of legal entities, processing may be based on legitimate interests under Article 6(1)(f) GDPR.

9. Customers, Companies and B2B Contact Persons

SPEEDIXA conducts a substantial part of its activities on a business-to-business basis.

The GDPR does not protect legal entities as such, but it applies to identifiable representatives, employees and contact persons of those entities.

SPEEDIXA may process:

• first name and surname;
• job title;
• company name;
• business telephone number;
• business e-mail address;
• information concerning authority to represent the company;
• business correspondence.

10. Road Freight, FTL, LTL and Express Transport

In connection with road transport, FTL, LTL, partial loads and urgent shipments, SPEEDIXA may process information necessary to perform the transport order.

This may include:

• customer contact person;
• warehouse contact person;
• consignee contact person;
• driver details;
• vehicle registration number;
• trailer number;
• loading location;
• unloading location;
• loading and unloading time windows;
• delivery reference;
• shipment reference;
• CMR information;
• Proof of Delivery;
• shipment status information.

11. Refrigerated and Temperature-Controlled Transport

For goods requiring temperature-controlled transport, systems may be used to monitor temperature, time and route information.

Cargo temperature itself will normally not constitute personal data. However, temperature logger records may include vehicle identifiers, route information, timestamps or other data that can be linked to a particular driver.

Such information may be used for:

• verification of the cold chain;
• quality control;
• performance of the contract;
• handling complaints;
• insurance claims;
• establishing or defending legal claims.

12. ADR Dangerous Goods Transport

Where goods fall within ADR requirements, SPEEDIXA may process additional information required to verify compliance with applicable professional and safety requirements.

This may include:

• driver details;
• contact details;
• information about required qualifications or permits;
• information on the validity of relevant documents;
• vehicle information;
• site access information;
• information relating to a transport incident.

UN numbers, ADR classes and cargo characteristics primarily concern the cargo itself, although such information may be associated with personal data in transport documentation.

13. Container Transport and Port Logistics

In connection with container transport, personal data may be processed for collection, release and delivery of containers and access to ports or container terminals.

• driver details;
• vehicle registration number;
• container number;
• booking reference;
• terminal reference;
• terminal time slot;
• contact details;
• identity document details where reasonably required by a particular terminal.

PIN codes, container release codes and similar credentials should be treated as confidential operational information.

14. International Air Freight

When arranging air freight, personal data may be disclosed to airlines, cargo agents, handling agents, airports, terminals, customs representatives and first- or last-mile carriers.

Data may include:

• shipper contact details;
• consignee contact details;
• notify party information;
• AWB data;
• booking references;
• contact details;
• details of authorised recipients;
• customs clearance information;
• information required for aviation security.

15. AOG — Aircraft on Ground Logistics

For urgent AOG shipments of aircraft parts or components, continuous operational communication and limited exchange of personal data between parties involved in the shipment may be required.

This may include data relating to:

• airline representatives;
• MRO representatives;
• technical personnel;
• parts suppliers;
• consignees;
• airports;
• handling agents;
• freight forwarders;
• couriers;
• drivers.

Business telephone numbers, e-mail addresses, handover locations and times, booking references and operational delivery status may be processed where necessary.

16. On Board Courier / Hand Carry

Where SPEEDIXA provides an On Board Courier service, the shipment may be personally accompanied by a courier. This may require the processing of additional travel-related information relating to that courier.

Depending on the route, this may include:

• first name and surname;
• date of birth;
• nationality;
• telephone number;
• e-mail address;
• passport or travel document information, where necessary for booking and travel;
• visa information where applicable;
• flight ticket data;
• flight number;
• travel itinerary;
• booking or PNR reference;
• operational assignment status.

Such information is processed only to the extent objectively necessary for the specific service.

17. Ocean Freight — FCL and LCL

In connection with FCL and LCL ocean freight, personal data contained in shipping documentation may be processed.

• shipper information;
• consignee information;
• notify party information;
• Bill of Lading data;
• booking references;
• contact person details;
• port representative details;
• customs representative details.

18. Rail Freight

For international rail freight, including routes between China and Europe, necessary information may be disclosed to railway operators, terminals, agents, customs representatives and first- or last-mile carriers.

Where the transport operation involves a transfer of personal data outside the EEA, applicable international data transfer rules apply.

19. Multimodal and Intermodal Transport

Multimodal transport may combine road, ocean, rail and air freight.

Necessary personal data may therefore be shared with several participants in the logistics chain.

SPEEDIXA applies a need-to-know approach: each participant should receive only the information required to perform its particular part of the transport.

20. Warehousing and 3PL Services

Warehousing and 3PL activities may include:

• goods receiving;
• unloading;
• transshipment;
• put-away;
• short-term storage;
• long-term storage;
• consolidation;
• deconsolidation;
• cross-docking;
• order picking;
• repacking;
• labelling;
• inventory management;
• dispatch coordination;
• preparation of goods for onward delivery.

Personal data processed may relate to:

• customer representatives;
• suppliers;
• drivers;
• warehouse contact persons;
• carriers;
• order recipients.

21. SPEEDIXA as Controller or Processor

SPEEDIXA's legal role is determined separately for each specific processing activity.

SPEEDIXA may act as an independent controller where personal data is required for:

• organisation of transport;
• maintaining its own business records;
• compliance with legal obligations;
• accounting;
• taxation;
• security;
• handling claims;
• establishing, pursuing or defending legal claims.

Where a customer provides SPEEDIXA with personal data of its own customers solely for warehousing, fulfilment or another operation carried out under the customer's instructions, SPEEDIXA may act as a Processor within the meaning of Article 28 GDPR.

In such cases, the relevant processing is governed by appropriate contractual data processing provisions.

22. Fulfilment, Packing, Labelling and Last-Mile Delivery

When preparing orders and goods for delivery, SPEEDIXA may receive personal data relating to the final recipient.

• first name and surname;
• delivery address;
• telephone number;
• e-mail address;
• order number;
• delivery reference;
• delivery instructions.

Shipping labels should contain only the information objectively necessary to complete the relevant delivery.

23. Customs Services and Customs Clearance

When arranging customs clearance, SPEEDIXA may process personal data contained in import, export and other customs documentation.

• representative details of the importer;
• representative details of the exporter;
• contact details;
• power-of-attorney information;
• signatures;
• EORI or another identifier where it relates to a natural person;
• identity document details where a particular customs procedure lawfully requires them.

24. GPS, Telematics, Track & Trace and ETA

For the purpose of monitoring transport, SPEEDIXA may receive information concerning the location of a vehicle or shipment.

Where a vehicle can be associated with a particular driver, location information may constitute personal data.

Such data may be used for:

• monitoring transport performance;
• calculating ETA;
• providing status information to the customer;
• coordinating warehouse operations;
• preventing theft;
• security purposes;
• handling claims;
• confirming completion of transport.

Where location information is provided by an independent carrier, that carrier remains responsible for its own information obligations towards its drivers where such obligations apply.

25. Industry-Specific Logistics Solutions

SPEEDIXA may provide logistics solutions for industries including:

• automotive and spare parts;
• perishable and fresh goods;
• pharmaceuticals and healthcare;
• beverages and alcoholic products;
• retail;
• FMCG;
• construction;
• industry and manufacturing.

The category of goods being transported does not itself imply the need to process special categories of personal data.

26. Pharmaceutical and Healthcare Logistics

In connection with the transport of medicines, medical products or equipment, SPEEDIXA generally does not need information about specific patients.

Customers should not provide SPEEDIXA with information concerning diagnoses, medical treatment, prescriptions or a patient's health unless such information is objectively necessary for a lawful purpose.

Where health data exceptionally needs to be processed, it constitutes a special category of personal data under Article 9 GDPR and will only be processed where an appropriate legal basis exists.

27. Cooperation with Carriers and Subcontractors

In selecting carriers, SPEEDIXA may carry out reasonable verification of prospective transport partners.

This may involve:

• business owner information;
• representative information;
• contact details;
• licence information;
• insurance information;
• bank account details;
• driver details to the extent necessary;
• vehicle information;
• information from official or lawfully available professional sources.

Such checks may be carried out for fraud prevention, cargo security and selection of reliable subcontractors.

28. Vehicle Rental, Fuel Cards and Services for Carriers

Where SPEEDIXA provides or arranges additional services for carriers, relevant personal data may be processed.

Depending on the service, this may include:

• representative details of the lessee;
• authorised driver details;
• vehicle handover information;
• vehicle return information;
• fuel card information;
• user identifiers;
• vehicle identifiers;
• date and place of transaction;
• information relating to road traffic accidents;
• information relating to transport incidents;
• documents necessary for handling fines or claims.

29. Transport and Logistics Documentation

SPEEDIXA may create, receive, transmit and retain documents required for transport and logistics operations.

Such documents may include:

• CMR;
• AWB;
• Bill of Lading;
• Proof of Delivery;
• packing lists;
• delivery notes;
• warehouse receipts;
• shipping instructions;
• customs documents;
• insurance documents;
• powers of attorney;
• claim-related documents.

The retention period for such documentation may depend simultaneously on contractual, transport, accounting, tax and evidentiary requirements.

30. Proof of Delivery and Recipient Signatures

To confirm delivery, SPEEDIXA may receive a Proof of Delivery, CMR or other document containing the name, signature or other information of the person who accepted the shipment.

Such information may be used to demonstrate performance of the contract, settle payments, handle claims and establish or defend legal claims.

31. Cargo Damage, Claims, Insurance Matters and Debt Recovery

In the event of cargo damage, delay, partial loss or total loss, SPEEDIXA may process information necessary to establish the circumstances of the matter.

This may include:

• transport documentation;
• correspondence;
• photographs;
• GPS history;
• temperature records;
• driver information;
• vehicle information;
• insurance policy information;
• witness details;
• documents issued by competent authorities.

Personal data may also be processed for debt recovery, pursuing claims or defending against claims.

32. Recruitment, Job Applications and CVs

SPEEDIXA may process candidate data when recruiting drivers, office staff, specialists and other employees or collaborators.

This may include:

• first name;
• surname;
• telephone number;
• e-mail address;
• education;
• professional experience;
• qualifications;
• skills;
• language skills;
• information contained in the CV;
• other information voluntarily provided.

Candidates are advised not to include information in their CV that is unrelated to the recruitment process.

The use of CVs for future recruitment processes should be based on an appropriate legal basis, such as a separate voluntary consent.

33. Operational Communication and 24/7 Logistics

Due to the international and time-sensitive nature of transport operations, operational communication may occur outside normal business hours.

Telephone, e-mail and agreed business communication channels may be used to exchange information concerning an active shipment.

Messages relating to loading, ETA, shipment documentation, incidents or active order status do not in themselves constitute marketing communications.

34. Direct Marketing and Electronic Commercial Communications

SPEEDIXA may conduct direct marketing of its own services to the extent permitted by law.

The use of specific electronic communications channels for commercial messages is carried out in accordance with the requirements of Polish electronic communications law.

Where applicable law requires prior consent, commercial communications will only be sent after such consent has been obtained.

Consent should be:

• freely given;
• specific;
• informed;
• unambiguous;
• capable of being withdrawn.

Opting out of marketing does not prevent SPEEDIXA from sending service or operational communications necessary to perform a contract.

35. Cookies and Similar Technologies

The website may use cookies, local storage, session storage, pixels, tags and similar technologies.

Such technologies may be used for:

• technical operation of the website;
• website security;
• remembering user preferences;
• session management;
• analytics;
• measuring website effectiveness;
• marketing, where the required consent has been obtained.

36. Categories of Cookies

37. Cookie Consent Management

Before non-essential cookies are used, the user should be provided with clear information about their purposes.

Users should be able to:

• accept non-essential cookies;
• reject non-essential cookies;
• select individual categories;
• change their choice later;
• withdraw consent.

Closing the banner, scrolling the page, continuing to browse the website or remaining inactive should not by themselves be treated as active consent to non-essential technologies.

38. Current List of Cookies

The actual list of cookies must reflect the website's real technical configuration.

The cookie management panel should, where applicable, identify:

• cookie name;
• provider;
• domain;
• category;
• purpose;
• retention period;
• information concerning third parties.

The Policy should not list services or cookies that are not actually used.

39. Third-Party Analytics, Advertising and Technical Services

Depending on the website's actual configuration, SPEEDIXA may use third-party IT, analytics, advertising, anti-spam, mapping, video-hosting or similar services.

Where a particular technology requires prior consent, it should not be activated until the relevant consent has been obtained.

Tag management systems, such as Google Tag Manager where used, should be configured so that non-essential analytics or advertising tags respect the user's actual consent status.

40. External Maps, Video and Embedded Content

The website may contain links or embedded content provided by third parties.

Where embedded content is capable of transmitting data to a third party before the user interacts with it, and such transmission requires consent, loading of that content should be restricted until the user has given the required consent.

41. Recipients of Personal Data

Personal data may be disclosed, only to the extent necessary, to:

• authorised SPEEDIXA personnel;
• carriers;
• subcarriers;
• freight forwarders;
• airlines;
• ocean carriers;
• rail operators;
• warehouses;
• terminals;
• port operators;
• airport operators;
• handling agents;
• customs representatives;
• insurance companies;
• banks;
• payment service providers;
• hosting providers;
• server infrastructure providers;
• e-mail service providers;
• CRM providers;
• TMS providers;
• WMS providers;
• Track & Trace providers;
• backup and cybersecurity providers;
• IT contractors;
• accounting firms;
• tax advisers;
• auditors;
• legal advisers;
• debt recovery service providers;
• public authorities;
• courts;
• other entities where disclosure is required by law or necessary for a particular service.

42. Service Providers Processing Data on Behalf of SPEEDIXA

Where a service provider processes personal data solely on behalf of SPEEDIXA, the relationship is governed by the requirements of Article 28 GDPR, where that processing model applies.

Some recipients may act as independent controllers, for example banks, insurance companies, certain carriers or public authorities.

43. Transfers of Personal Data Outside the European Economic Area

SPEEDIXA's international activities may involve transport and logistics operations outside the European Economic Area.

Certain international IT service providers may also process information in third countries.

Where Chapter V GDPR applies, SPEEDIXA uses an appropriate transfer mechanism, depending on the circumstances, including:

• an adequacy decision adopted by the European Commission;
• Standard Contractual Clauses;
• other safeguards under Article 46 GDPR;
• derogations under Article 49 GDPR, only where the conditions for their application are met.

Additional technical or organisational safeguards may be applied where appropriate.

44. Retention of Personal Data

Personal data is retained no longer than necessary for the relevant purpose, legal obligation or protection of legal claims.

45. Data Minimisation in the Logistics Chain

SPEEDIXA seeks to provide each participant in the logistics chain only with the information required to perform their task.

For example:

• a driver receives information necessary for loading and delivery;
• a warehouse receives information necessary to identify and process the shipment;
• a last-mile carrier receives the necessary recipient information;
• a customs representative receives data required for customs procedures;
• an insurer receives information necessary to handle a specific insurance claim.

46. Special Categories of Personal Data

SPEEDIXA does not request special categories of personal data under Article 9 GDPR through ordinary website forms unless such information is objectively necessary.

Users are requested not to provide through ordinary contact forms:

• health information;
• genetic data;
• biometric data;
• religious beliefs;
• political opinions;
• trade union membership;
• other special categories of personal data.

Where processing of such information becomes necessary, it will only take place on an appropriate legal basis.

47. Data Relating to Offences and Administrative Proceedings

Transport incidents, fines, road traffic accidents or official proceedings may involve documents containing information subject to a specific legal regime.

Such information is processed only where an appropriate legal basis and necessity exist.

48. Personal Data of Children

The SPEEDIXA website is primarily intended for professional B2B contacts, customers, carriers, business partners and job candidates.

SPEEDIXA does not intentionally seek to collect children's personal data through ordinary contact forms.

49. Profiling and Automated Decision-Making

SPEEDIXA does not generally make decisions concerning ordinary website users based solely on automated processing that produce legal effects or similarly significantly affect them within the meaning of Article 22 GDPR, unless otherwise expressly stated.

Where permitted analytics or advertising technologies are used, limited marketing profiling may take place.

50. Data Subject Rights

Where provided for by the GDPR, data subjects may have the right:

• to access their personal data;
• to obtain a copy;
• to rectification;
• to completion of incomplete data;
• to erasure;
• to restriction of processing;
• to data portability;
• to object to processing;
• to withdraw consent;
• to protection against certain automated decision-making;
• to lodge a complaint with a supervisory authority.

51. Right of Access

A data subject may obtain confirmation as to whether SPEEDIXA processes their personal data and may obtain the information required under Article 15 GDPR.

52. Right to Rectification

A data subject may request correction of inaccurate personal data and completion of incomplete information.

53. Right to Erasure

A data subject may request erasure in the circumstances provided for in Article 17 GDPR.

The right to erasure is not absolute, for example where continued retention is required to comply with a legal obligation or to establish, pursue or defend legal claims.

54. Right to Restriction of Processing

In the circumstances provided for by the GDPR, a data subject may request restriction of the processing of their personal data.

55. Right to Data Portability

Where the requirements of Article 20 GDPR are met, a data subject may receive personal data provided by them in a structured, commonly used and machine-readable format.

56. Right to Object

Where processing is based on Article 6(1)(f) GDPR, a data subject may have the right to object to such processing on grounds relating to their particular situation.

57. Right to Object to Direct Marketing

A data subject has the right to object at any time to the processing of personal data for direct marketing purposes.

Following a valid objection, the relevant personal data will no longer be processed for direct marketing.

58. Withdrawal of Consent

Where processing is based on consent, consent may be withdrawn at any time.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

59. Handling Data Subject Requests

SPEEDIXA handles data subject requests without undue delay and within the time limits provided for by the GDPR.

Where permitted by the GDPR, the response period may be extended taking into account the complexity and number of requests.

60. Verification of the Requester's Identity

Where SPEEDIXA has reasonable doubts concerning the identity of the person making a request, additional information may be requested to confirm that person's identity.

Any such verification should be proportionate to the risk of unauthorised disclosure.

61. Right to Lodge a Complaint with a Supervisory Authority

A data subject has the right to lodge a complaint with the competent data protection authority.

In Poland, the competent supervisory authority is:

Prezes Urzędu Ochrony Danych Osobowych — UODO

Official information is available at: uodo.gov.pl

62. Security of Personal Data

SPEEDIXA applies technical and organisational measures appropriate to the nature and risks of the processing.

Depending on the system, such measures may include:

• access control;
• least-privilege access;
• individual user accounts;
• password protection;
• multi-factor authentication;
• TLS/HTTPS;
• backup procedures;
• software updates;
• anti-malware protection;
• network security;
• logging;
• monitoring;
• server infrastructure protection;
• incident response procedures;
• supplier management;
• confidentiality obligations;
• staff training.

63. Prevention of Transport Fraud and Cybersecurity Threats

SPEEDIXA may take reasonable measures to prevent:

• carrier impersonation;
• unauthorised changes to bank account details;
• business email compromise;
• phishing;
• cargo theft;
• unauthorised changes to delivery addresses;
• unauthorised access to shipment data;
• document forgery;
• other forms of fraud or abuse.

64. Personal Data Breaches

Where a personal data breach occurs, SPEEDIXA assesses its nature, scope and risk to the rights and freedoms of natural persons.

Where the conditions laid down in the GDPR are met, the breach is reported to the competent supervisory authority.

Where the breach is likely to result in a high risk to the rights and freedoms of a data subject, the affected data subject is informed where required by law.

65. Commercially Confidential Information

During logistics operations, SPEEDIXA may receive information that does not constitute personal data but is commercially sensitive.

Examples may include:

• value of goods;
• transport routes;
• shipment volumes;
• supplier names;
• buyer names;
• delivery terms;
• supply chain information;
• pricing;
• internal reference numbers;
• commercial documentation.

Even where the GDPR does not apply to such information, it may be protected by contractual and organisational confidentiality measures.

66. Links to External Websites

The website may contain links to third-party websites.

After following an external link, the processing of personal data is governed by the relevant third-party service provider.

67. Changes to this Privacy Policy

This Policy may be updated in connection with:

• changes in applicable law;
• changes in SPEEDIXA's services;
• changes to the website;
• implementation of new systems;
• changes in service providers;
• changes in cookies;
• changes in processing activities;
• new guidance from supervisory authorities.

The current version is published on the website together with its date of update.

Updating this Policy does not replace the need to obtain new consent where applicable law requires a new consent for a particular processing activity.

68. Main Legal Framework

Depending on the processing activity, the following legal acts may apply in particular:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 — GDPR;
• the Polish Act of 10 May 2018 on the Protection of Personal Data (Ustawa o ochronie danych osobowych);
• the Polish Act of 12 July 2024 — Electronic Communications Law (Prawo komunikacji elektronicznej);
• applicable Polish provisions governing electronically supplied services;
• the Polish Labour Code (Kodeks pracy) in relation to recruitment and employment matters;
• the Polish Accounting Act (Ustawa o rachunkowości);
• the Polish Tax Ordinance (Ordynacja podatkowa);
• the Polish Civil Code (Kodeks cywilny);
• applicable transport, customs, insurance and other sector-specific legislation.

Official GDPR text: EUR-Lex

69. Contact Regarding Personal Data

To exercise your rights, object to processing, withdraw consent or request information concerning personal data processing, please contact:

70. Document Version

SPEEDIXA Sp. z o.o. Privacy and Cookie Policy

Version: 1.0

Date: 14 August 2026

© SPEEDIXA Sp. z o.o. All rights reserved.