Privacy Policy
Last updated [EFFECTIVE DATE]
This policy explains what personal data IShip collects, why, and what you can do about it. It is written to meet the Law of Georgia on Personal Data Protection, and the GDPR where that applies to you.
1. Who is responsible
The data controller is [LEGAL ENTITY NAME], registered in Georgia under identification number [COMPANY ID NUMBER], at [REGISTERED ADDRESS].
For anything in this policy, write to [PRIVACY CONTACT EMAIL]. [DATA PROTECTION OFFICER — Georgian law requires one for certain controllers. Confirm whether you must appoint one, and name them here if so.]
2. What we collect
Data you give us
| What | Where it comes from |
|---|---|
| Your name, email address, mobile number, and job title | Registration and your profile |
| Your company's name, registration or tax identification number, address, email, and office number | Registration |
| Your password | Registration. Stored only as a cryptographic hash — we cannot read it, and neither can anyone who obtains the database |
| Tenders, bids, prices, dates, pickup and delivery addresses, and any notes you write | Your use of the marketplace |
| Saved addresses you choose to keep for reuse | The tender form |
Data we generate
- When you registered, when you confirmed your email, and when an administrator approved your account.
- When you last signed in.
- A record of administrative actions taken on your account by our staff — including if a member of staff signs in as your account for support, which is always logged.
- Server logs and error reports, which may include your IP address, the pages requested, and technical details of your browser.
We do not collect special categories of data, and we do not use your data for automated decision-making that produces legal effects for you.
3. Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Running your account and the marketplace | Performance of our contract with you |
| Showing your company and contact details to the other side of a tender you have engaged with | Performance of our contract, and our legitimate interest in a marketplace where counterparties can reach each other |
| Sending you email about bids on your tenders and their outcomes | Performance of our contract. You can turn these off in your profile or from any such email |
| Password reset and email confirmation messages | Performance of our contract. These cannot be turned off, because they are how you keep access to the account |
| Vetting registrations, and keeping the platform secure | Our legitimate interest in preventing fraud and misuse, and in protecting other users |
| Diagnosing errors and keeping the service working | Our legitimate interest in a functioning service |
| Meeting accounting, tax, and other legal obligations | Compliance with a legal obligation |
4. Who sees it
Other users
A tender you publish is visible to transporters on the platform, including its cargo details, addresses, and dates, and the name of the issuing company. Individual contact details are shown more narrowly: a bidder's details go to the tender's issuer, and the issuer's details to companies engaged with the tender. Bids are never shown to competing bidders.
Processors acting for us
- SendGrid (Twilio) — sends our email. Receives your email address and the contents of the message.
- Sentry — collects error reports so we can fix faults. May receive technical data and, incidentally, identifiers present when an error occurs.
- Cloudflare — carries traffic between your browser and our servers, and protects against attack. Processes your IP address.
- [HOSTING PROVIDER] — hosts the servers and the database.
We do not sell your data, and we do not share it with advertisers.
Others
We may disclose data where the law requires it, to establish or defend legal claims, or to a buyer if the business is sold — in which case we will tell you.
5. Transfers outside Georgia
Some of the processors above operate outside Georgia, including in the United States and the European Union. Where data leaves Georgia we rely on [TRANSFER MECHANISM — confirm with counsel: an adequacy decision of the Personal Data Protection Service, standard contractual clauses in each processor's terms, or another lawful ground. List which applies to which processor.]
6. How long we keep it
- Account and profile data — while the account is open, and for [RETENTION PERIOD] after it closes.
- Tenders, bids, and awards — retained after an account closes, because they are the record of dealings between two companies and the other side has a legitimate interest in it. [CONFIRM PERIOD]
- Records kept for accounting or tax — for the period the law requires. [STATE PERIOD]
- Server logs and error reports — [STATE PERIOD]
7. Your rights
Under Georgian law, and the GDPR where it applies, you may ask us to:
- tell you what data we hold about you, and give you a copy;
- correct data that is wrong or incomplete;
- delete data, where we have no overriding ground to keep it;
- stop or restrict a particular use;
- object to processing we carry out on the basis of legitimate interest;
- hand over the data you gave us in a portable, machine-readable form;
- withdraw consent, where we relied on it — which does not affect what was done beforehand.
Write to [PRIVACY CONTACT EMAIL]. We will respond within the period the law allows. We may need to verify who you are first.
If you are unhappy with our answer you can complain to the Personal Data Protection Service of Georgia (personaldata.ge), or, if you are in the EU or UK, to your local supervisory authority.
8. Security
Traffic is encrypted in transit. Passwords are stored only as hashes. Access to production data is limited to staff who need it, and administrative actions on an account — including signing in as one for support — are logged. No system is perfectly secure, and we will notify you and the supervisory authority of a breach where the law requires it.
9. Cookies
See the Cookie Notice, which also lets you change a choice you have already made.
10. Changes
We will post any updated policy here with a new date, and tell registered users by email where the change is material.