Privacy policy

The controller of personal data is:

Company

BODU-TRANS d.o.o.

Address

Kettejeva ulica 10, 6210 Sežana, Slovenija

Registration no.

6430937000

VAT ID

SI39376800

E-mail

info@bodutrans.si

Website

bodutrans.si

Given the scale and nature of the processing, we are not required to appoint a data protection officer (DPO). Please address all privacy questions to the e-mail address above.

We collect personal data only when you send it to us yourself — through the enquiry form or by e-mail. The website has no user accounts, no purchases, no comments and no profiling.

The enquiry form collects exactly these fields:

• Route — country and place of loading, country and place of unloading.
• Cargo — temperature regime, type of goods, number of pallets, gross weight, requested loading date, dangerous goods marking (ADR).
• Contact — first and last name, company (optional), e-mail address, telephone (optional).
• Message — free text (optional).
• Consent — confirmation that we may process the data in order to prepare a quotation.
• Language — the language of the page from which the form was submitted.

Personal data in the strict sense is only the name and the contact details; the rest is business data about the shipment. Please do not enter special categories of personal data (health, biometric, religious belief data and similar) into the Message field — we do not need them and do not wish to receive them.

The form is protected by a hidden field (a so-called honeypot) and by the Cloudflare Turnstile service. On submission, your IP address is also processed during verification, solely in order to distinguish a human from a bot. We do not store the IP address ourselves.

• Preparing and sending a transport quotation — the legal basis is your consent (Art. 6(1)(a) GDPR), which you give by ticking the box in the form. Where these are steps taken prior to entering into a contract at your request, Art. 6(1)(b) GDPR is also a basis.
• Replying to your message and further correspondence — the legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in replying to a business enquiry we have received. Your interest does not override it here, since you established the contact yourself.
• Protecting the form against abuse — legitimate interest (Art. 6(1)(f) GDPR): without verification the form would be buried in spam.
• Fulfilling tax and accounting obligations, if the enquiry results in business — legal obligation (Art. 6(1)(c) GDPR).

We do not use the data for direct marketing, for a newsletter or for profiling. We do not carry out automated decision-making producing legal effects (Art. 22 GDPR) — a quotation is always prepared by a human.

We keep the data only for as long as is necessary for the purpose for which it was collected.

Where an enquiry results in a contract of carriage, longer periods apply: accounting records are kept in accordance with tax and accounting legislation, and transport documentation is kept for as long as claims may arise from it (see the limitation periods under the CMR Convention).

Once the period expires, we delete the data or irreversibly anonymise it. You may withdraw your consent at any time — withdrawal does not affect the lawfulness of processing carried out before it.

We do not sell personal data, we do not rent it out and we do not pass it on to third parties for their own purposes. There are no advertising networks, no data brokers, no third-party analytics.

We use the following contractual processors to operate the website. Each of them processes data exclusively on our instructions:

• Cloudflare, Inc. — website hosting and content delivery, and Turnstile (verification that the form is not being submitted by a bot). It processes technical request data, including the IP address.
• Resend — delivery of the e-mail message containing the form content to our mailbox.
• Proton AG — the business mailbox info@bodutrans.si currently runs through the ProtonMail service (servers in Switzerland). The enquiry received there also remains there.

In addition to those listed, our accounting service and, where strictly necessary, a lawyer or a state authority on a lawful basis may access the data.

Where data is transferred outside the European Economic Area (Cloudflare and Resend are US companies), the transfer takes place on the basis of the European Commission's standard contractual clauses or an adequacy decision. Switzerland has a European Commission decision on adequate protection.

As a data subject, you have the right:

• of access — to learn whether we process your data, and to obtain a copy of it (Art. 15 GDPR);
• to rectification — to have inaccurate data corrected or completed (Art. 16);
• to erasure — the "right to be forgotten", where there is no longer a basis for the processing (Art. 17);
• to restriction of processing — to have the processing temporarily halted (Art. 18);
• to portability — to receive the data you have given us on the basis of consent or a contract in a machine-readable format, or to have it transmitted to another controller (Art. 20);
• to object — to processing based on legitimate interest (Art. 21);
• to withdraw consent — at any time and without consequences (Art. 7(3));
• to lodge a complaint with the supervisory authority.

You may exercise a right by sending a message to info@bodutrans.si or by post to Kettejeva ulica 10, 6210 Sežana. We handle requests within the time limits laid down by Art. 12 GDPR. Exercising your rights is free of charge; for manifestly unfounded or excessive requests we may charge a reasonable fee.

So that we do not fulfil a request for the wrong person, we may ask you for additional identification data — but only as much as is strictly necessary.

If you believe that we process your data unlawfully, you may lodge a complaint with the supervisory authority:

Authority

Informacijski pooblaščenec Republike Slovenije (Information Commissioner of the Republic of Slovenia)

Address

Dunajska cesta 22, 1000 Ljubljana, Slovenia

E-mail

gp.ip@ip-rs.si

Telephone

+386 1 230 97 30

Web

www.ip-rs.si

We would be glad if you came to us first — most things are settled faster directly.

The website is accessible exclusively over an encrypted connection (HTTPS). We receive enquiries in the business mailbox, which only the company's representatives can access. We do not store the data from the form in any database on the website — the website has no database, no administration area and no user accounts.

This website does not use analytics or advertising cookies. The details are on the Cookies page.

We may amend this policy when the manner of processing or the legislation changes. The version published on this page is always the one in force; the date of the last change is stated at the top.

Contact