Privacy policy

1. Who is responsible for your data

The data controller is HONEXPRES SRL, with its registered office in Oradea, Str. Alexandru Cazaban nr. 50, ap. 1, Bihor County, Romania, tax identification number (CUI) RO30456239, Trade Register no. J05/1140/2012 (hereinafter “Honexpres” or “we”). We process data in accordance with Regulation (EU) 2016/679 (GDPR), Law no. 190/2018 and Law no. 506/2004.

For any question about your data or to exercise your rights, write to us at contact@honexpres.ro, with the subject “Data protection”. Honexpres is not legally required to appoint a data protection officer and has not appointed one. Our other contact details are on the Contact page.

2. What data we process

• Quote requests, contact messages and “We call you” requests: your name, email, phone number, company, the company’s tax identification number and your role, the transport details (loading and delivery places and addresses, goods, dates), the documents you attach and the messages exchanged with us.
• Customers and orders: the details of customers’ contact persons, of consignees and of the people at the loading and unloading sites, needed to organise and carry out the transport, as well as the data in the transport documents and invoices.
• Carriers and partners: the details of contact persons and, for carrying out the transport, the driver and vehicle details provided by the carrier.
• Job applicants: the CV and the other data you send us by email for a position or a collaboration.
• Email, phone and WhatsApp: the email address or phone number you contact us from and the content of the messages. We do not record phone calls. When you write to us on WhatsApp, the messages also pass through the WhatsApp service, which has its own privacy policy.
• Use of the website: technical and security logs (IP address, browser type, pages accessed, errors) and, only with your consent, traffic statistics data linked to a pseudonymous identifier.
• The AI assistant (HONEXPRES COPILOT): the messages written in the conversation, the data of the request prepared with its help and, if you ask to be contacted, the contact details you leave. The conversation is anonymous and is not linked to an account. Please write only the data needed for the request.
• Filling in the request with AI (“Fill in with AI”): the text you write, the documents you attach (PDF, DOCX, XLSX, images) and the information already entered in the form, without the contact details. The result of the filling and the files uploaded but not attached to a submitted request are kept for no more than 48 hours. Please do not attach documents with personal data that is not needed for the transport.
• Tracking a request or a transport (Track & Trace): the reference and the email address you enter, used to send you a secure link or a verification code. Transport tracking is shown only where it is available.
• My HONEXPRES (the customer portal): the portal is in preparation. When it becomes available, we will process the account data (name, email, the company you represent) and we will supplement this policy before it opens.
• Automatic emails: your email address and the content of the message, when we send you the confirmation of your request, the tracking link or code, or other messages related to your request.

As a rule, we receive the data directly from you. The details of the people at the loading and unloading sites are provided to us by the customer or partner who orders the transport; if you give us another person’s data, please inform that person about this policy. When preparing a quote for a company, we may check the company’s public data, by its tax identification number, in the public registers (ANAF, VIES).

We do not ask for and do not need sensitive data (for example health data). Please do not send such data through the forms, through the AI assistant or in attached files.

3. Why we process the data and on what legal basis

• Preparing the quote for a natural person: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). For the employees or representatives of a company requesting the quote: the legitimate interest of Honexpres and of the company in responding to the request (Art. 6(1)(f) GDPR).
• Organising and carrying out the transport: the contract (point (b)) or the legitimate interest in performing the contract concluded with the company you work for (point (f)).
• Replying to messages, calls and “We call you” requests: steps taken at your request (point (b)) or the legitimate interest in replying to those who contact us (point (f)).
• Legal obligations (accounting, tax, customs, archiving): the legal obligation (point (c)).
• Website security (preventing abuse, unsolicited messages and attacks, including the anti-bot check of the forms): the legitimate interest (point (f)).
• The AI assistant: steps taken at your request (point (b)) or the legitimate interest in answering your questions (point (f)); the request prepared with its help is sent to the team only after you confirm it.
• Tracking the request or the transport: steps taken at your request or the performance of the contract (point (b)) and the legitimate interest in showing the status only to the person entitled to see it (point (f)).
• Traffic statistics: your consent (point (a) GDPR and Law no. 506/2004), which you can withdraw at any time in the cookie settings.
• Commercial messages by email: only with your consent, given separately, through a checkbox that is not ticked in advance; you can unsubscribe at any time.
• Recruitment: steps taken before entering into a contract (point (b)); keeping your CV for future positions, only with your consent (point (a)).
• Defending our rights in the event of a complaint or a dispute: the legitimate interest (point (f)).

We do not use a consent checkbox for the quote request: we reply because you asked us to. The data marked as required in the forms is the data without which we cannot prepare the quote or cannot contact you.

4. Who we disclose the data to

• The partners who carry out the transport (carriers, shipping lines, airlines, rail operators, agents, warehouses, customs brokers): only the data needed for the transport, for example the addresses and contact persons at loading and unloading. These partners are, as a rule, independent controllers.
• Authorities (the customs authority, ANAF, other authorities and courts), when the law requires it.
• Our advisers (accounting, lawyers, auditors), bound by confidentiality obligations, when this is necessary.
• The providers of digital services listed below.

HONEXPRES remains the controller of the personal data it processes for its own services. The providers below receive the data only to the extent needed for the service they provide and act in the roles set by their contracts or terms: as a rule as our processors, and Google, for some services, in its own name, under Google’s terms.

• Cyber_Folks – infrastructure and hosting provider and provider of the e-mail services of HONEXPRES, with which HONEXPRES has a direct contract. It processes the e-mail messages sent and received through the HONEXPRES addresses, including the automatic e-mails sent by the website (e-mail addresses, content of the messages and attachments), for the operation of e-mail and for communication with you.
• Astimp IT Solution SRL – contractual provider of the hosting infrastructure for the website and the applications, with which HONEXPRES has a direct contract. The website, the applications, the programming interface (API), the content management system and the databases run on the infrastructure it provides, and the files uploaded by users are kept in the hosting infrastructure contracted by HONEXPRES. The data described in section 2 is therefore stored and technically processed on this infrastructure, only for the operation of our services.
• Anthropic and OpenAI – providers of artificial intelligence (AI) models. The data sent and the provider that receives it depend on the function used: your messages to the AI assistant, after the automatic masking of recognised personal data, go to Anthropic and/or OpenAI (one can replace the other); with “Fill in with AI”, when the function is switched on and only if you ask for the filling, the text you write and the content of the documents you attach go only to Anthropic, to extract the information of the transport; the preparation of articles and the translations use only Anthropic and receive no visitor data; if a voice option with an external provider is switched on, the sound of the spoken messages is processed by OpenAI. Not all data or documents reach both providers. According to these providers’ commercial terms, the data sent through their programming interface is not used to train their models; they may keep it for a limited period (as a rule up to 30 days) for security and abuse prevention. Details: the artificial intelligence transparency note.
• Cloudflare – the Turnstile anti-bot check of the forms (the IP address, the browser type and other technical signals sent by the browser, to tell a person from an automated program) and, to the extent they are switched on for the website, the services of delivery and protection of traffic and of access control for our team.
• Google – (a) maps and addresses (Google Maps Platform): the text you type in the address fields and the addresses of the route are sent by our server to Google for address suggestions and the calculation of the route, without your IP address and without your contact details; when you press “Check the address with Google”, the address you wrote is sent to Google for validation (Address Validation); the embedded Google map is loaded in your browser, so Google receives your IP address and the requests of the map, only after you press “Show Google map”; (b) Google reviews: our server reads the public reviews, and the profile pictures of the authors are loaded from Google in your browser only if you have accepted cookies; (c) YouTube: the player is loaded only when you press the play button of a video; (d) Google Analytics 4: traffic statistics, only with your consent. Details in the cookie policy.
• Sentry (Functional Software, Inc.) – only if it is switched on on the server: technical monitoring of server errors. It is not loaded in your browser. It receives the type of the error, a message cleaned of e-mail addresses, numbers and identifiers, the technical route and the incident code, without the content of forms or messages, without cookies and without your IP address.

We do not sell personal data and we do not use it to create marketing profiles from several sources.

5. Transfers outside the European Economic Area

To provide digital services, certain personal data may be processed by providers located outside the European Economic Area or may be accessed from such jurisdictions. Where applicable, transfers are made on the basis of an adequacy decision of the European Commission, including the EU–US Data Privacy Framework for certified recipients, or on the basis of the standard contractual clauses approved by the European Commission, accompanied, where appropriate, by additional safeguards.

Specifically, the data sent to the AI model providers (Anthropic, OpenAI), to Cloudflare, to Google and, if it is switched on, to Sentry may reach places outside the European Economic Area, in particular the United States. For Anthropic, the data processing agreement, which is part of the provider’s commercial terms, includes the standard contractual clauses approved by the European Commission. Cloudflare, Google (Google LLC) and Sentry (Functional Software, Inc.) appear on the list of participants in the EU–US Data Privacy Framework, and their data protection terms provide for standard contractual clauses for the cases in which the certification does not apply. For the other providers, one of the solutions in the first paragraph applies, as the case may be. Describing these solutions does not mean that every transfer is compliant merely because they exist; you can ask for information about the safeguards applied to a particular transfer.

When the transport has its origin or destination in a country outside the European Union, the data needed for the transport reaches, by the nature of the service, the partners in that country (Art. 49(1)(b) and (c) GDPR). You can ask for details about the safeguards applied at the address above.

6. How long we keep the data

• Quote requests that do not become orders: 24 months from the last interaction, after which they are deleted or anonymised.
• Documents attached to requests that do not become orders: 12 months from the last interaction.
• Orders, contracts, invoices and transport documents: 10 years from the end of the financial year in which they were drawn up, in accordance with accounting and tax legislation; customs documents, for the period required by customs legislation.
• Contact messages, “We call you” requests and correspondence not related to an order: 12 months from the last message.
• CVs and applicants’ data: 6 months from the end of the selection; longer only with your consent, for no more than 12 months, with the possibility of renewing it.
• Conversations with the AI assistant: 30 days, if they do not become a quote request; the request sent is kept like any quote request. The technical logs of the assistant, with personal data masked, are kept for 12 months.
• The result of the “Fill in with AI” function and the files uploaded but not attached to a submitted request: no more than 48 hours.
• Technical and security logs of the website: no more than 12 months.
• Traffic statistics data: no more than 14 months from collection, in pseudonymous form; the statistics identifier in the browser expires after 12 months.
• Proof of your cookie choice: for the period of validity of the choice and a further 3 years.
• Consent to commercial messages: until you withdraw it; the proof of the consent and of its withdrawal is kept for a further 3 years.

If a complaint or a dispute arises, we keep the necessary data until it is finally resolved.

7. Your rights

You have the right of access to the data, the right to rectification, to erasure, to restriction of processing, to data portability, to object (including to processing based on legitimate interest and, at any time, to commercial messages) and the right to withdraw your consent, without affecting the processing carried out before the withdrawal.

To exercise your rights, write to us at contact@honexpres.ro. We may ask you for additional information to make sure that the request comes from you. We reply within no more than one month of receiving the request; this period may be extended by no more than two months, under the conditions of the GDPR, in which case we let you know. Exercising your rights is free of charge.

If you have consented to statistics, you can change your choice at any time in the cookie settings, described in the cookie policy.

If you believe that we process your data in breach of the law, you can lodge a complaint with the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, the Romanian National Supervisory Authority for Personal Data Processing), www.dataprotection.ro. Please write to us first, so that we can resolve the situation.

8. Automated decisions

We do not take decisions with legal effects or similar effects on you solely by automated means and we do not create profiles. The automated tools on the website (the AI assistant, the completion of the request from your description, the load calculator) help you prepare the request; the quote and any confirmation come from a person.

9. Security

We use appropriate technical and organisational measures: encrypted connections, role-based access, antivirus scanning of uploaded files, backups and access logs. Conversations with the AI assistant are stored encrypted, and in the logs personal data is masked. No system is completely free of risk; if an incident occurs that may affect your rights, we notify you in accordance with the law.

10. Children

The Honexpres website and services are intended for companies and adults. We do not knowingly collect data of persons under 16 years of age. If you find out that a minor has sent us data, write to us and we will delete it.

11. Cookies

Which cookies and similar technologies we use and how you give or withdraw your consent is explained in the cookie policy.

12. Changes to the policy

We update this policy when the processing or the law changes. The version published on this page is the one in force. If a change affects you significantly, we announce it visibly on the website and, if a new cookie choice is needed, we ask you for it again.

13. Contact

HONEXPRES SRL, Str. Alexandru Cazaban nr. 50, ap. 1, Oradea, Bihor County, Romania. Email: contact@honexpres.ro. Opening hours: Monday–Friday, 09:00–16:00. All contact channels are on the Contact page.