Privacy Policy
1. Who processes your data
The controller of personal data (within the meaning of the GDPR) is an individual entrepreneur registered in Ukraine who operates the platform https://trasahub.com.
Full registration details (legal name, address, tax ID) will be published here before payments start being accepted; until then they can be requested at the contact email address.
Referred to below as "we", "the platform".
2. How to contact us
Questions about data, requests for access, rectification or erasure: support@trasahub.com.
We reply within 30 days. If a request is complex, we may extend the period by a further two months — we will tell you about that within the first 30 days.
3. What data we collect
When you register: email, password in hashed form, side of the market (carrier or shipper), the time and the version of the policy you agreed to.
When you fill in your profile: first and last name, contact phone number, city you are based in, interface language.
When you fill in company details: name, company code (EDRPOU or VAT number), type of company, team composition and invitations to managers.
When you submit a company for verification: the documents you uploaded. These files are kept in closed storage, are accessible to an administrator only, every access is recorded in a log, and after the decision the files are deleted — what remains is a record of which types of documents were checked, by whom and when.
When you publish a listing: points of departure and destination and their coordinates, cargo details, price, currency, payment terms, free-form comment. The listing is publicly visible; your phone number in it is not (see section 5).
When someone reveals your contact details: we record which company, which listing and when. You see this log in your own "Contact reveals" section.
When you pay for a subscription: the payment provider tells us the fact and the status of the payment and the transaction identifier. Your card details do not reach us and are not stored by us — they remain with the provider.
Technical data: IP address, browser type, request time in server logs, cookies (a separate document — "Cookies").
Your phone number and email do not go into analytics and are not written to the application logs.
4. Why we do this and on what legal basis
| What for | Legal basis |
|---|---|
| To let you work on the platform: account, company, listings, search, subscription | performance of a contract — Art. 6(1)(b) GDPR |
| To protect contact details from being harvested for free: the gate, quotas, the reveal log | performance of a contract and our legitimate interests — Art. 6(1)(b) and 6(1)(f) |
| To check a company following its request for verification | performance of a contract at your request |
| To detect circumvention of the rules: phone numbers in free text, duplicates, abuse | legitimate interests — Art. 6(1)(f) |
| To notify you about the service and about your listings | performance of a contract |
| Traffic analytics | your consent — Art. 6(1)(a), withdrawable at any time |
| Accounting and taxes | legal obligation — Art. 6(1)(c) |
Our legitimate interests in the rows above are to keep a workable paid model and to prevent the contact database from being turned into a free directory. You may object to processing on this basis: write to us, and we will weigh your arguments against ours.
We do not take automated decisions producing legal effects concerning you. Automatic archiving of a listing that has not been confirmed for seven days is the removal of an outdated record, not a decision about you; the listing can be restored.
5. Who else sees your data
Other users. Publicly visible: company name, its type and side of the market, the verification badge, your listings, the city you are based in. Your phone number, the messenger marks on it and your name are shown only to companies with active access — and every such reveal is recorded. Your email address is never shown to other users. As for the person who revealed your contact details, your log shows you the company, but not the company's contact details.
Processors acting on our instructions:
| Who | What for | Where |
|---|---|---|
| Supabase | database, authentication, file storage | EU, Frankfurt |
| Vercel | hosting and execution of server code | EU, Frankfurt |
| Stripe (planned, payment is not yet automated) | subscription payment in euro | EU / USA under SCCs |
| WayForPay (planned, payment is not yet automated) | subscription payment in hryvnia | Ukraine |
| Resend | emails about registration and subscription | USA under SCCs |
A data processing agreement is signed with each of them (Article 28 GDPR).
Geocoding service. To place a city on the map, we send the name of the settlement to OpenStreetMap Nominatim — without your name, phone number or any identifier.
We do not sell data and we do not pass it on for anyone else's advertising. We disclose it to public authorities only upon a lawful request.
6. Transfers of data outside the EU
Data is stored in the European Union. However, our company is registered in Ukraine and our administrators work from there — meaning that data is accessed from a country outside the EEA. For this we rely on the standard contractual clauses of the European Commission (Article 46 GDPR).
7. How long we keep data
| What | How long |
|---|---|
| Account and profile | for as long as the account exists |
| Listings | while active; after archiving — 12 months, then deleted |
| Verification documents | until the administrator's decision, then deleted |
| Contact reveal log | 3 years; survives deletion of the account in anonymised form |
| Payment and accounting records | the period set by tax law |
| Server logs | 30 days |
About the contact reveal log specifically: when you delete your account, the references to people in that log are nulled, while the fact and the time of the event remain. This is a trace of access to personal data — destroying it would mean losing the ability to investigate abuse. You cannot be identified in it after deletion.
8. Your rights
- To find out what data of yours we process, and to obtain a copy
- To rectify inaccurate data — most fields are editable in your profile
- To erase your account and data (the "right to erasure") — with the exception of the anonymised log in section 7 and of records we are required by law to keep
- To port your data in a machine-readable format
- To restrict processing or to object to it
- To withdraw consent to analytics — the cookie banner is always available, and withdrawal does not affect the lawfulness of processing before it
- To lodge a complaint with a supervisory authority: in Ukraine — with the Ukrainian Parliament Commissioner for Human Rights, in the EU — with the data protection authority of your country
You can delete your account and export your data yourself in your profile. These rights are free of charge; we may charge a fee only for manifestly excessive repetitive requests.
9. Security
Access to the database is restricted at row level: everyone sees only what they are entitled to. Passwords are stored hashed. Secret keys never reach the code that runs in your browser. Administrators' access to other people's data is written to a separate log, and the quotas on revealing contact details apply to administrators exactly as they do to everyone else — there is no privileged channel for exporting the database.
We will notify the supervisory authority within 72 hours of a breach that threatens your rights, and you without undue delay.
10. Children
The service is intended for business entities. We do not knowingly collect data of persons under 18 years of age.
11. Cookies
A separate document — "Cookies" (page /cookies).
12. Changes
We will notify you of material changes by email and in the interface no later
than 15 days before they take effect. Every version has a date; the version you
agreed to is kept together with the time of your consent. Previous versions
remain available in the "Archive of previous versions" section
(/legal/archive).
Language. This is a translation of the Ukrainian original. In case of any discrepancy between the English and the Ukrainian version, the Ukrainian version prevails.