Privacy Policy

1. General information

This Privacy Policy explains how we process personal data when you visit our website, contact us, submit a transport request or register as a carrier partner. Personal data is any information relating to an identified or identifiable natural person.

You may contact us using the details above if you have questions about data protection or wish to exercise your data-protection rights.

2. Hosting, server logs and encryption

Our website, its databases and the associated email services are hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany.

When you access our website, the hosting provider processes technically necessary access information. This may include the previously visited website, requested page or file, browser type and version, operating system, device type, time of access and IP address.

According to IONOS, the IP address used for web-hosting statistics is anonymised when collected. The corresponding visitor information is generally retained for eight weeks. According to IONOS, these web-hosting logs are not disclosed to third parties or transferred outside the European Union.

Processing is necessary to provide a secure, stable and reliable website and is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure operation of our online services. A data-processing agreement pursuant to Article 28 GDPR has been concluded with IONOS or forms part of the applicable IONOS contractual terms.

IONOS creates automatic backups of website files and databases. Information that has already been deleted may therefore remain in technical backups for up to 14 days. These backups are used only to secure and restore the systems.

Our website uses SSL or TLS encryption to protect information against unauthorised access while it is being transmitted.

3. Contact by email or telephone

If you contact us by email or telephone, we process the information you provide. This may include your name, contact information, company information and the content of your enquiry.

Processing takes place to handle pre-contractual enquiries or perform a contract under Article 6(1)(b) GDPR. Where a contact person represents a company, processing is also based on our legitimate interest in handling business communications under Article 6(1)(f) GDPR. Where applicable, we process information to comply with legal obligations under Article 6(1)(c) GDPR.

Emails are sent and received through the IONOS email infrastructure. For technical delivery of website emails, we use the locally installed WordPress plugin WP Mail SMTP with the IONOS SMTP server. The plugin only provides the technical connection between the website and the IONOS mail server.

4. Transport requests

You may use our transport-request form to request a non-binding quotation or the handling of a transport order. The information processed may include:

• pickup and delivery addresses;
• shipment type, number of packages, weight and dimensions;
• stackability information and requested dates or time windows;
• pickup or delivery instructions;
• company name, business address and contact-person name;
• email address, telephone number and preferred contact method;
• additional information provided voluntarily;
• technically necessary form and transmission data.

We use this information to assess your request, prepare a quotation, answer questions and prepare or perform the requested transport.

The legal basis is Article 6(1)(b) GDPR. If the person submitting the request is not the contracting party, processing is additionally based on our legitimate interest in handling business enquiries under Article 6(1)(f) GDPR.

Where necessary to prepare a quotation or perform the transport, the required information may be shared with suitable carriers, freight forwarders or other transport and logistics partners. Only information necessary for the relevant purpose will be disclosed.

The copy of the transport request stored in the form system, including the associated form data, is automatically deleted no later than 90 days after submission. If an order is placed, information required to perform and document it may first be transferred to separate business records or correspondence and retained for the applicable statutory periods. Information may also be retained for longer where necessary to establish, exercise or defend legal claims.

5. Carrier-partner registration and assessment

When you register as a carrier partner, we process the information required to assess your company and potentially establish a business relationship. This may include:

• company name, address, legal form and company website;
• VAT identification number and commercial-register number;
• contact-person name, email address and telephone number;
• preferred language;
• available vehicle types, operating areas and availability;
• licence, permit and carrier-liability-insurance information;
• uploaded licence, permit or insurance documents;
• additional information provided voluntarily and technically necessary transmission data.

We use the information to assess the company’s suitability and reliability, verify supporting documents, answer questions and prepare or manage a possible business relationship.

Processing is based on Article 6(1)(b) GDPR. Where a contact person is not personally a party to the contract, processing is based on our legitimate interest in assessing and managing business partners under Article 6(1)(f) GDPR. Where supporting documents are required by law, processing is additionally based on Article 6(1)(c) GDPR.

Please upload only documents required for the assessment. Unnecessary private information should be redacted before uploading where legally permitted.

Uploaded files are stored on our IONOS-hosted web space. Access through the download links generated by our form system is restricted to authenticated WordPress administrators.

The copy of the registration stored in the form system, including uploaded supporting documents, is automatically deleted no later than 90 days after submission. If a company is approved as a carrier partner, information and documents required for the business relationship may first be transferred to separate business records and retained for the duration of the relationship and subsequently for the applicable statutory periods.

6. Driver, vehicle and live-tracking information

Once a carrier partner has been assigned, we may additionally process the assigned driver’s name and telephone number, the vehicle registration or licence-plate number, current transport status, estimated time of arrival and a time-limited GPS or live-tracking link to plan, coordinate and perform the relevant transport.

We generally receive this information from the assigned carrier partner and not always directly from the driver. We use it exclusively to coordinate pickup and delivery, ensure contact during the transport, provide the customer with status information, manage delays or disruptions and document proper performance.

Where the driver is personally a party to the contract, processing is based on Article 6(1)(b) GDPR. Where the driver is employed by or otherwise works for a carrier partner, processing is based on our legitimate interest in the safe, transparent and efficient performance of the transport order under Article 6(1)(f) GDPR.

Where necessary for the specific transport, the driver’s name and telephone number, vehicle registration number, transport status, estimated arrival time and a time-limited tracking link may be disclosed to the customer, shipper, consignee and the relevant pickup or delivery location.

GPS or live-location information is used exclusively during an active transport order. We do not use it for permanent driver performance, behaviour or movement monitoring and do not create permanent movement profiles.

The tracking link is generally provided by the carrier partner or a tracking provider used by that partner. Steblix does not currently operate its own GPS tracking system. The carrier partner is responsible for the lawful operation of its system and for informing its drivers. Steblix is responsible for its own use and disclosure of the location information received.

Active use and disclosure ends when the transport is completed. The link should then be disabled without undue delay and should generally no longer be accessible seven days after delivery. We do not normally retain location histories. Individual information may be retained for longer only to handle a damage claim or complaint, establish or defend legal claims, or comply with statutory retention obligations.

7. Form storage and transmission

Our forms are provided through form software installed locally on our WordPress website. Submitted information is stored in the WordPress database hosted by IONOS and transmitted to our business email address through the IONOS mail server.

Documents submitted through the carrier-partner form may also be stored on the website’s hosting space. These files are not automatically added to the public WordPress media library. Stored submissions and protected download links are intended to be accessible only to authorised administrators.

Submissions stored in the form system and their associated uploaded files are automatically and permanently deleted from the live website system no later than 90 days after submission. Technical IONOS backups may continue to contain deleted information for up to 14 additional days.

8. Google Analytics

With your consent, we use Google Analytics 4 to compile statistics about the use of our website. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics may process page views, session information, approximate location information, and browser and device information. After you give consent, Google Analytics sets the first-party cookies _ga and _ga_*. They contain a randomly generated identifier and are used to distinguish users or sessions. We do not send the contents of our forms or the names and contact details entered in them to Google Analytics.

Our consent-management system activates Google Analytics only after you consent to the Statistics category. Processing is based on your consent under Article 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG. You may withdraw your consent at any time through the cookie settings with future effect. Further statistical collection is then prevented and the Analytics cookies are deleted.

Google Analytics 4 uses the IP address during collection to derive approximate location information and, according to Google, discards it before it is logged in any data centre or server. We use Google Analytics exclusively for audience and website-usage statistics, not for personalised advertising.

User-level and event-level data retention in our Google Analytics account is set to two months. Standard reports based on aggregated data may be unaffected by this setting. Google or its subprocessors may process information outside the European Economic Area. Such transfers take place only where the requirements of Articles 44 et seq. GDPR are satisfied, including an adequacy decision, valid certification under the EU–US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.

9. Wordfence Security

We use Wordfence Security to protect our website against attacks, malware, unauthorised login attempts and other misuse. The provider is Defiant, Inc., 1700 Westlake Ave N, Suite 200, Seattle, WA 98109, United States.

For security purposes, Wordfence may process IP and proxy IP addresses, requested URLs, time and type of request, browser or user-agent information, HTTP headers and security-relevant parts of a request, user ID, username and roles for authenticated users, and filenames where a suspicious file is detected.

Processing is necessary to detect and prevent attacks and protect the integrity and availability of our website. It is based on Article 6(1)(f) GDPR. Local Wordfence Live Traffic information is retained only for the configured security period and no longer than 30 days.

Where information is transmitted to Defiant in the United States, the transfer is governed by Defiant’s Data Processing Addendum and the EU Standard Contractual Clauses incorporated into it.

10. Cookies and consent management

Our website uses technically necessary cookies and similar storage technologies. Services requiring consent are loaded only after prior consent.

We use the locally installed Complianz software to manage your cookie choices. Your selection is stored in technically necessary cmplz_* cookies so the website can remember and demonstrate your decision. Polylang may set the technically necessary pll_language cookie to remember the selected website language.

Strictly necessary storage is based on Section 25(2)(2) TDDDG. Where personal data is processed, the legal basis is Article 6(1)(f) GDPR. Services requiring consent are used on the basis of Section 25(1) TDDDG and Article 6(1)(a) GDPR.

You can change your choices at any time through the cookie settings. Detailed information about cookies, their purposes and retention periods is available in our Cookie Policy.

Google Analytics is activated only after you consent to the Statistics category. We do not currently use advertising trackers or social-media tracking pixels.

11. Contact through WhatsApp

Our website contains ordinary links to WhatsApp. No WhatsApp script is loaded merely by visiting our website. Only when you click a WhatsApp link do you leave our website and establish a connection with WhatsApp. WhatsApp may then process technical information such as your IP address, device and browser information and other usage data.

If you send us a WhatsApp message, we process your telephone number, WhatsApp name and, where applicable, profile image, the content and time of your messages, and files or other information you provide.

For users in the European Economic Area, the service is generally provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Using WhatsApp is voluntary. The legal basis for handling a specific request is Article 6(1)(b) GDPR or, for business communications, Article 6(1)(f) GDPR. WhatsApp may transfer information to affiliated companies or processors outside the European Economic Area and states that it uses safeguards including the EU–US Data Privacy Framework or Standard Contractual Clauses.

You may always contact us by email or telephone instead.

12. Recipients and international transfers

We disclose personal data only where necessary for the relevant purpose, required by law or based on your consent.

Possible recipients include IONOS as our hosting and email provider, Google as the provider of Google Analytics, Defiant as the provider of Wordfence, selected carriers, freight forwarders and transport partners, customers, shippers, consignees and pickup or delivery locations, technical providers, tax or legal advisers, insurers and legally competent authorities or courts.

Transport, driver, vehicle and location information is disclosed only to the extent necessary to prepare a quotation or perform the specific transport.

Some providers or their subprocessors may process information outside the European Economic Area. Such transfers take place only where the requirements of Articles 44 et seq. GDPR are satisfied, including an adequacy decision, valid certification under the EU–US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.

13. Retention periods

We retain personal data only for as long as necessary for the relevant purpose. The following principles apply:

• unsuccessful or discontinued transport requests: generally three months after the request is closed;
• rejected or discontinued carrier-partner registrations, including uploaded documents: generally three months after completion of the assessment;
• driver contact information, vehicle registration and active tracking information: for the transport duration; tracking access generally ends no later than seven days after delivery;
• active business relationships: for their duration;
• business correspondence: generally six years where statutory retention is required;
• invoices and accounting vouchers: generally eight years;
• books, annual financial statements and certain tax records: generally ten years;
• IONOS web-hosting visitor information: generally eight weeks;
• user-level and event-level Google Analytics data: two months; aggregated standard reports may be unaffected;
• local Wordfence Live Traffic information: no longer than 30 days;
• technical IONOS backups: up to 14 days after regular deletion.

Statutory periods generally begin at the end of the calendar year in which the relevant document was created or transaction occurred. Information may also be retained where necessary to establish, exercise or defend legal claims. It will then be deleted or anonymised when the relevant period expires.

14. Your data-protection rights

Subject to the applicable legal requirements, you have the following rights:

• access under Article 15 GDPR;
• rectification under Article 16 GDPR;
• erasure under Article 17 GDPR;
• restriction of processing under Article 18 GDPR;
• data portability under Article 20 GDPR;
• objection under Article 21 GDPR;
• withdrawal of consent at any time with future effect;
• a complaint to a data-protection supervisory authority.

To exercise your rights, contact info@steblix.com.

Objection to processing based on legitimate interests

Where we process information on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.

15. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority. The authority responsible for our registered location is:

You may also contact the authority responsible for your usual place of residence or employment.

16. Providing information and automated decisions

Providing personal data is generally voluntary. However, certain information is required so that we can process a transport request, prepare a quotation, perform an order or assess a company as a carrier partner. Without this information, we may be unable to process the relevant request.

We do not use solely automated decision-making that produces legal effects concerning you or similarly significantly affects you.

17. Updates to this Privacy Policy

We may update this Privacy Policy when our website, the services we use, our business processes or applicable legal requirements change. The current version is always available on this website.