Privacy Policy and Personal Data Notice

1.Data controller

Within the StowCargo service, your personal data is processed by the company that provides the StowCargo service (“StowCargo” or “the provider”), acting as data controller under Turkish Personal Data Protection Law No. 6698 (“KVKK”). This notice fulfils the information obligation under Article 10 of the KVKK.

The data controller’s registered name and address will be provided on request through the contact address below.

For StowCargo installations on a company’s own server (on-prem), data is stored on that company’s server and that company is the data controller. In team and business accounts, the customer company is the controller for third-party details entered in packing lists (for example consignee names); StowCargo processes that information on the customer’s instructions and only to provide the service.

• Data controller: the company that provides the StowCargo service
• E-mail: [email protected]
• Website: stowcargo.com

2.What we process

We only process what the service needs to work. We do not advertise, build profiles or sell data.

• Account details: name, e-mail address, company name, an optional company logo and your role in the team (admin, member, viewer or customer). Your password is never stored in plain text; only a scrypt hash is kept. Where single sign-on (OIDC) is used, we receive your name and e-mail address from the identity provider.
• Plans you save: the packing list (item names, dimensions, weights, quantities, order and document numbers, any consignee names you type), the chosen vehicle, the computed layout and the plan’s versions.
• Warehouse loading progress: progress reported from the warehouse link opened on a phone, optional vehicle photos and a name the loader may choose to enter. The warehouse link does not require an account.
• Security and activity log: for sign-ins and changes, the IP address, device and browser details (user agent), time and the action taken.
• ERP API: packing lists your company sends with its API keys, and request logs (IP address, time and the request body up to 1 MB). These are kept in a separate database.
• Subscription and billing details: the chosen plan, number of users, period end date and the details you provide for invoicing.
• Correspondence: whatever you send us by e-mail.

3.What stays on your device

The layout calculation runs in your browser. PDFs, images and photos you import are read on your device (including text recognition) and are not uploaded. Workspace content you have not saved stays only in your browser’s local storage.

Your documents and photos are never sent to any third party.

4.Purposes and legal bases

Personal data is collected electronically and automatically while you use the service, and is processed on the following legal bases under Article 5(2) of the KVKK:

• Entering into and performing our contract (Art. 5(2)(c)): opening your account, managing your session, saving and archiving plans, managing teams and roles, running warehouse tracking and the ERP API, activating your subscription, and sending invitation, password reset and subscription e-mails.
• Legal obligations (Art. 5(2)(ç)): keeping invoicing and accounting records, retaining access logs as required by Law No. 5651 and its regulations, and responding to lawful requests from authorities.
• Establishing, exercising or defending legal claims (Art. 5(2)(e)): keeping a tamper-evident activity log of who did what and when, as evidence in case of disputes.
• Legitimate interests (Art. 5(2)(f)): keeping the service secure, preventing abuse and unauthorised access, enforcing rate limits, and finding and fixing errors, in a way that does not override your fundamental rights.

5.Who we share data with

The StowCargo site runs on our own servers. We use no third-party analytics, advertising or tracking services, and our pages carry no tracking pixels. Your data only reaches others in these cases:

• Your team: users in the same team can see the team’s plans and activity log as far as their role allows. People you share a warehouse link with can see that plan’s loading details.
• Connections you set up: your ERP or the webhook addresses you configure receive plan data as you set it up.
• Authorities: only where the law requires it and upon a lawful request.

6.Transfers abroad

Your personal data is not transferred abroad. Should a transfer become necessary, this notice will be updated first and the transfer will follow Article 9 of the KVKK.

7.How long we keep data

We keep data for as long as the purpose requires and the law prescribes. When that period ends, data is deleted, destroyed or anonymised.

8.Security measures

Under Article 12 of the KVKK we take technical and organisational measures to protect your data, including:

• Passwords are stored only as scrypt hashes; session cookies are HttpOnly and cannot be read by scripts in the browser.
• Role-based access: each user can only do what their role allows.
• A tamper-evident activity log: sign-ins and changes are written to a log that cannot be edited afterwards.
• Site data and ERP keys and request logs are kept in two separate databases.
• Rate limits on sign-in and API requests; signed webhooks with destination checks.
• Only authorised people can enter the admin panel, with a password, for at most 8 hours per session.

9.Your rights

You can contact the data controller to exercise your rights to:

• learn whether your personal data is processed and request information about it;
• learn the purpose of processing and whether data is used accordingly;
• know the third parties in Turkey or abroad to whom data is transferred;
• ask for incomplete or inaccurate data to be corrected;
• ask for deletion or destruction under the conditions of Article 7 of the KVKK;
• ask for corrections or deletions to be notified to third parties who received the data;
• object to an outcome against you that results solely from automated analysis;
• claim compensation for damage caused by unlawful processing.

10.How to apply

You can apply in writing, by registered e-mail (KEP), with a secure electronic or mobile signature, or from the e-mail address registered on your StowCargo account, to [email protected], in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Please include your full name, your Turkish ID number if you are a Turkish citizen, a postal or e-mail address for our reply, and what you are asking for.

We will conclude your request within 30 days at the latest, free of charge; if it involves an additional cost, the fee set by the Turkish Personal Data Protection Board may be charged. If your request is rejected, you find the answer insufficient or we do not reply in time, you may complain to the Personal Data Protection Board under Article 14 of the KVKK.

11.Users in the European Union

If you use the service from the European Union or the European Economic Area, your rights under the General Data Protection Regulation (GDPR), including access, rectification, erasure, restriction, portability and objection, are unaffected. Use the same contact address for requests; you may also lodge a complaint with the data protection authority in your country.

12.E-mails and cookies

We only send service e-mails (invitations, password resets, subscription notices), from our own mail server. We send no marketing e-mails or newsletters, so we never ask for consent to commercial electronic messages under Law No. 6563.

The site uses strictly necessary cookies only. See the Cookie Policy for details.

13.Changes to this notice

We may update this notice as the service or the law changes. The current version is always on this page with its date at the top. We will tell account holders about significant changes by e-mail or in the app.