Privacy policy

Data controller

SAVA LOGISTIC SRL, a Romanian limited liability company (CUI 27317524, VAT RO27317524, Romanian Trade Register J2010001371122), with registered office at Str. Florilor 324A, ap. 5, 407280 Florești, Cluj (Romania), operating in Spain through its permanent establishment with Spanish tax number ESW0661358B at Carrer de l'Empordà 1-7, 08211 Castellar del Vallès, Barcelona (Spain). Data-protection contact: administracion@savaexpress.com.

Purposes

• Handling quote requests submitted through the website and preparing the corresponding offer.
• Responding to enquiries and contact requests.
• Classifying and prioritising the requests received through the forms by means of automated analysis using artificial intelligence, in order to organise how they are handled.
• Measuring which requests received through the website end up as shipments, by matching each request against the subsequent commercial activity, in order to know which channels bring us customers.
• Sending the resources the user has voluntarily requested, such as the export checklist.
• Managing applications received through job postings, including the CV provided.
• Publishing, after verification, the reviews users voluntarily submit.
• Optional audience analysis, advertising measurement and identification of visiting businesses, according to your cookie choices; separate first-party cookieless statistics as explained below.
• Ensuring the security of the site and preventing its misuse.

Legal basis

• Pre-contractual measures taken at the data subject's request (Art. 6.1.b GDPR), for quote requests and enquiries.
• The data subject's consent (Art. 6.1.a GDPR), for analytics and advertising cookies, sending resources and publishing reviews. It may be withdrawn at any time.
• Pre-contractual measures and consent, for job applications.
• The controller's legitimate interest (Art. 6.1.f GDPR) in site security and fraud prevention, in classifying and prioritising the requests it receives, and in measuring which website requests end up as shipments, in order to know which channels bring it customers. The user may object to this processing at any time by writing to the address given below.

Data processed

• Quote and contact forms: name, email address, telephone and the shipment details the user chooses to provide (origin, destination, type of goods, dimensions, weight and timing).
• Request analysis: the summary and classification generated automatically from what the user writes (intent, urgency, the company inferred from the request and an estimated fleet size).
• Outcome of the request: whether it has led to shipments, taken from SAVA's own commercial activity.
• Job applications: name, telephone, email address, languages, licences, availability, message and CV.
• Reviews: name, email address and the content of the review.
• Technical data: IP address, date and time, pages visited and cookie identifiers, the latter only where the user consents.

Cookies and measurement

With your new marketing-cookie choice, the OpenAI Ads pixel measures accepted freight enquiries. It sends event and browser information, advertising identifiers and a random enquiry reference to OpenAI. Automatic advanced matching may include contact details detected in forms (such as email, phone or name), normalised and hashed in the browser. Hashing is not anonymisation. No shipment details or quotation amounts are included in our event. The pixel uses __oppref (up to 30 days) and __obref (up to 365 days); rejecting marketing removes them and prevents future events. OpenAI may process this information outside the EEA under its Conversion Terms and Ad Tools Data Processing Addendum: https://openai.com/policies/conversion-terms/ and https://openai.com/policies/ad-tools-dpa/. An earlier cookie choice does not activate this new provider.

Google Analytics uses the analytics choice; Google Ads, LinkedIn Insight Tag and Apollo business-visitor identification use marketing consent. Apollo receives technical visit data, including IP address, to identify visiting businesses for prospecting. Google Consent Mode can send limited cookieless signals when storage is denied; rejecting cookies does not mean that no network request reaches Google.

SAVA also measures page visits and engagement through its own cookieless service, using daily pseudonymous identifiers derived from technical connection data. Raw IP addresses are not stored in its event table. This separate audience measurement is based on our legitimate interest in understanding site use; you may object using the contact below.

On the job pages, visits are also counted with Plausible, a cookieless web-analytics service based in the European Union.

Choose Accept all, Reject all or preferences without losing access to forms. Reopen Manage cookies in the footer to change or withdraw your choice. Withdrawal stops future optional tracking and may reload the page; it does not erase data already lawfully processed. Your choice is stored as sava-consent in browser local storage until changed or cleared. Cookie expiry is not the retention period of data already received by a provider. See provider details and retention information below.

Google: https://policies.google.com/privacy — https://policies.google.com/technologies/cookies ; LinkedIn: https://www.linkedin.com/legal/privacy-policy — https://www.linkedin.com/legal/l/cookie-table ; Apollo: https://www.apollo.io/privacy-policy ; OpenAI: https://openai.com/policies/conversion-terms/ — https://openai.com/policies/ad-tools-dpa/ .

Recipients and processors

The website and SAVA's internal management system are hosted on a Hostinger server in Frankfurt (Germany). Data submitted through the forms is stored in SAVA's database, hosted by Supabase in its Frankfurt (Germany) region, together with files such as CVs.

Unless stated otherwise, the providers named in this section process data on SAVA's behalf, as processors, under the applicable processor agreements. Consented advertising data is also shared with Google, LinkedIn, Apollo and OpenAI under their respective terms. SAVA and OpenAI generally act as independent controllers; OpenAI acts as processor for the Restricted Processing defined in its Ad Tools DPA. OpenAI Ireland Limited receives EEA data under that agreement. Advertising providers may also use information for their own permitted measurement, delivery and service-improvement purposes.

Other providers: Google, through Google Workspace, whose email service (Gmail) carries all of the company's correspondence, plus Google Maps and Google Search; ZeroBounce, which checks that an email address exists before we write to it; Twilio, which checks telephone numbers; and Apollo, which, in addition to what is described in the cookies section, supplies business contact data for companies (see “Prospective customers”).

Unipile SAS, a French company, connects the LinkedIn account of a member of SAVA's team to SAVA's internal management system and hosts the data in France (see “Prospective customers”).

AI analysis of requests. The content of requests submitted through the forms is analysed using the API of Anthropic, an artificial-intelligence provider acting as a processor, for the sole purpose of classifying and prioritising them. The analysis returns a summary, the intent, the urgency, the company inferred from the request and an estimated fleet size, which are stored with the request. The processing is governed by Anthropic's Data Processing Addendum, incorporated into its Commercial Terms, and under those terms Anthropic does not use this data to train its models.

Anthropic only receives business documents and content: besides these requests, replies to SAVA's commercial emails (to classify them), supplier invoices and summaries of commercial activity. It receives no documents about individuals.

Documents about individuals: SAVA's own artificial intelligence. Documents about individuals — identity documents (Spanish DNI or NIE, or passport), driving licences, CAP and ADR certificates, tachograph cards, payslips, candidates' CVs, truck papers, and CMR consignment notes or loading orders bearing the driver's name — are read by SAVA's own artificial-intelligence model (Qwen2.5-VL-7B), which SAVA runs on GPU servers rented from RunPod, a US company, restricted to data centres in the EU/EEA: Czechia, France, the Netherlands, Romania, Sweden, Iceland and Norway. If reading fails, it is retried and, failing that, the data is entered by hand. These documents are never sent to Anthropic.

Internal alerts. SAVA's team receives internal work alerts via Telegram. Alerts about new job applications and new prospective customers do not carry the person's name: they only say how many there are (for example, “1 new”) and link to SAVA's internal management system, which is where they are viewed. In other alerts, people's names are partially hidden (for example, “Io* Pop****”). No alert includes identity documents, telephone numbers or email addresses; the full name is only visible in SAVA's internal management system. Telegram processes these alerts outside the European Economic Area, as explained under “International transfers”.

System maintenance. SAVA uses artificial-intelligence tools (Claude, by Anthropic) to maintain its IT systems, under a written rule that those working sessions do not handle data about individuals.

Social-media publishing. A Google Cloud server located in Iowa (United States) publishes SAVA's posts on social media. It only handles company content.

International transfers

Requests submitted through the forms are transferred to the United States, where Anthropic analyses them as described in the previous section. This transfer relies on the standard contractual clauses approved by the European Commission (Art. 46.2.c GDPR), included in Anthropic's Data Processing Addendum. It takes place regardless of cookies: it does not depend on whether the user accepts or rejects them. A copy of these safeguards may be requested at the address given below.

The database and files are stored in Frankfurt (Germany), but the contract is with Supabase Pte. Ltd., a Singapore company. Any access to the data from outside the EEA that may arise under that contract therefore relies on the standard contractual clauses approved by the European Commission (Art. 46.2.c GDPR).

Google (Google Workspace and Gmail, Google Maps and Google Search), ZeroBounce, Twilio and Apollo are US companies that participate in the EU-U.S. Data Privacy Framework. The transfer of the data they process for SAVA relies on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR).

Google, LinkedIn, Apollo and OpenAI may process advertising or technical data internationally, including in the United States. Applicable safeguards and recipient roles depend on the service and processing; see the linked privacy notices and data-processing terms, including standard contractual clauses where applicable. You can request details of the safeguards from SAVA. Rejecting optional cookies does not stop the separate processing needed to answer a submitted enquiry.

Documents about individuals read by SAVA's own artificial intelligence are processed in data centres in the EU/EEA. RunPod, which rents out those servers, is a US company that does not participate in the EU-U.S. Data Privacy Framework. For that reason, the data processing agreement SAVA has signed with RunPod incorporates the standard contractual clauses approved by the European Commission (Module Two, controller to processor; Art. 46.2.c GDPR), which cover any access to the data from outside the EEA that may arise under that contract. A copy of these safeguards may be requested at the address given below.

To connect to LinkedIn, Unipile may use network providers outside the EEA: Bright Data, in Israel, under the European Commission's adequacy decision (Art. 45 GDPR), and Webshare, in the United States, and Infatica, in Singapore, under the standard contractual clauses approved by the European Commission (Art. 46.2.c GDPR), as set out in Unipile's data processing agreement. A copy of these safeguards may be requested at the address given below.

Telegram, through which SAVA's team receives the internal alerts described in the previous section, processes those alerts outside the EEA. That is why the alerts are kept to the minimum: those about job applications and prospective customers do not carry the person's name, and none carries documents, telephone numbers or email addresses.

The Google Cloud server in Iowa (United States) that publishes on social media only handles company content.

Job applications: a person always decides

CVs and other candidate documents are read by SAVA's own artificial intelligence, described under “Recipients and processors”, and never by Anthropic.

The artificial intelligence only makes proposals: it organises the information and may suggest which applications best fit a position. The decision is always taken by a person in SAVA's human-resources team. No decisions are based solely on automated processing (Article 22 GDPR).

The email address a candidate gives for our reply is not checked with external services: it is used as written.

Retention

Requests submitted through the website and their analysis are retained for as long as the commercial relationship arising from them lasts and, thereafter, for the applicable commercial and tax retention periods. If no commercial relationship arises, they are retained for 24 months from the last communication with the user and then anonymised. Measuring which requests end up as shipments is done on this same data and within these same periods.

IP addresses in security logs are retained for up to 90 days to prevent abuse. The separate technical processing used for measurement is described above.

Job applications are retained for a maximum of two years from receipt, so they can be considered in later selection processes, and are deleted once that period expires.

Users may request erasure of their data at any time at the address given below.

Customers and business contacts

The sections above describe the processing of data belonging to users of this website. This section describes a different one, aimed at different people: companies that are already SAVA customers, whose data does NOT come from this website but from the commercial relationship itself.

Purpose. To send companies that are already customers communications about the same transport services they have contracted with us: groupage and full truck load between Spain and the rest of Europe.

Legal basis. Sending is based on Article 21.2 of Spanish Act 34/2002 (LSSI), which allows commercial communication without prior consent where there is a prior contractual relationship, it concerns the provider's own products or services similar to those contracted, and an opportunity to object is offered in every message. The processing of the data is based on legitimate interest (Article 6.1.f GDPR), as accepted for current customers by the Spanish DPA in its Report 0173/2018. For this purpose a current customer is one with an invoiced transaction in the last twelve months. Your consent is neither requested nor presumed.

Data processed and its origin. The identification and contact details held in your customer record — company name, email address and billing country — obtained from the commercial relationship itself (contracting, invoicing and shipment management), and not from this website. If your company exhibits at a trade fair, the company name, its country and the fair come from the public exhibitor catalogue published by the organiser. In addition to your email address, we may use the address of your public LinkedIn profile.

Retention. The address is used while the commercial relationship remains active and, for these purposes, while twelve months have not elapsed since the last invoiced transaction. If you object, your address is added to an exclusion list which is kept precisely so that we do not write to you again.

Recipients. These communications are sent through the same email provider as the rest of the company's correspondence, acting as a processor on the terms described above. This data is not disclosed to advertising platforms and is not used for audience targeting.

Prospective customers

Besides its customers, SAVA writes to companies that are not yet customers and may need road transport. This section is addressed to the contact persons at those companies, whose data does NOT come from this website.

Data processed and its origin. The contact person's name, job title and company, and their business email address and telephone number, obtained from Apollo, a provider of business contact data. Before we write, we check that the email address exists (ZeroBounce) and that the telephone number is valid (Twilio). If your company exhibits at a trade fair, the company name, its country and the fair come from the public exhibitor catalogue published by the organiser. In addition to your email address, we may use the address of your public LinkedIn profile.

Purpose and legal basis. To present SAVA's transport services to you, on the basis of SAVA's legitimate interest in making its services known to other companies (Article 6.1.f GDPR).

Contact through LinkedIn. From the LinkedIn profile of a member of SAVA's team, we may send you an invitation to connect with a short note and, if you accept it, a thank-you message. For this SAVA uses Unipile SAS (Riorges, France), which connects that LinkedIn account to SAVA's internal management system and acts as a processor; the data is hosted in France (see “International transfers”). LinkedIn processes the data on its platform as an independent controller, under its own privacy policy. If you do not accept the invitation, we withdraw it after 30 days.

How you are informed. A LinkedIn invitation has no room for a full notice, so the profile we send it from links to this policy. The first commercial email we send you states at the end, in small print, where your data comes from, what we use it for and how to unsubscribe, as required by Article 14 GDPR.

Retention. Your data is kept for two years from the last contact and is deleted once that period has passed.

If you object, your request is handled as soon as you make it: we stop writing to you and your address is added to the exclusion list, which is kept precisely so that we do not write to you again.

Your right to object to commercial communications

Whether you are a customer or a prospective customer, you may object at any time to receiving these communications, without giving reasons and at no cost, using the unsubscribe link carried by every message or by writing to administracion@savaexpress.com.

Unsubscribing is immediate and does not affect the handling of your shipments or your invoicing, which will continue as normal.

Rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw any consent given, by writing to administracion@savaexpress.com. You may also lodge a complaint with the competent supervisory authority (the AEPD in Spain, or the ANSPDCP in Romania).