Privacy Policy
Last updated 5 September 2026 · LogCrew PVT LTD
Draft, pending legal review. This document was written against how the platform actually handles data, but it has not yet been reviewed by a qualified lawyer. Treat it as a statement of intent rather than a final contract.
LogCrew PVT LTD ("LogCrew", "we", "us") operates a freight marketplace where shipping and forwarding agencies publish freight inquiries, bid on one another's work, and carry the resulting job through proof of delivery, bills of lading and invoicing.
This notice explains what personal data we process, why, on what lawful basis, who we share it with, how long we keep it, and the rights you have over it. It is written to satisfy Articles 13 and 14 of the UK and EU General Data Protection Regulation, and we apply the same standard to every user regardless of where they are located.
LogCrew is a business-to-business platform. Most of the data we hold describes a company rather than an individual — but the named contact at that company is a person, and this notice covers them.
1.Who we are and how to contact us
LogCrew PVT LTD is the data controller for the personal data described in this notice. Our registered office is Office #35, 36, Mezzanine Floor, Silk Center, Pakistan.
For any question about this notice, or to exercise any of the rights described below, use the contact form on this site. Data protection requests are routed to the person responsible for them rather than to general support, and we will acknowledge your request and tell you how we intend to handle it.
We have not appointed a statutory Data Protection Officer. Our processing is not large-scale monitoring and does not involve special category data, so Article 37 does not require one. We will appoint one and publish their details here if that changes.
2.International transfers, and why this section comes early
LogCrew is established in Pakistan, which the European Commission has not designated as providing an adequate level of data protection. If you are in the UK or the European Economic Area, your personal data will be transferred outside that area when you use this service.
We rely on the UK and EU Standard Contractual Clauses as the transfer mechanism for those transfers, supported by the technical and organisational measures described under "How we protect your data". We also carry out a transfer risk assessment covering the legal regime in each destination country.
This section appears near the top rather than buried near the bottom because it is the disclosure most likely to affect your decision to use the platform.
3.What personal data we collect
We do not collect special category data as defined in Article 9, and you should not enter any into free-text fields such as an inquiry description or an invoice note.
Data you give us
- Account details: your name, work email address, phone number, and the password you set (stored only as a salted hash, never in a readable form).
- Agency profile: your company name, registered and branch addresses, the regions and services you cover, agency type, and any logo or profile imagery you upload.
- Freight inquiries and bids: origin and destination, cargo and timing details, budget where you provide one, and the content of any message you send through the platform.
- Documents: the parties, vessel, ports, cargo descriptions, weights and values you enter on a bill of lading, and the client, line items, tax and totals you enter on an invoice.
- Support and sales enquiries: whatever you choose to tell us when you contact us.
Data we generate about your use of the service
- Authentication events: sign-in times, one-time passcode issuance and verification, and the devices associated with your account, which exist so you can see and revoke unfamiliar sessions.
- Delivery records: for each inquiry sent to an agency we record whether the email was sent, delivered, opened or bounced, so that a failed send can be retried rather than silently lost.
- Server logs: IP address, browser and operating system, the pages and endpoints requested, and timestamps. These are security and diagnostic records.
Data we receive from others
- Payment data from Stripe: the outcome of a payment, the subscription status, and a token identifying the payment method. We never see or store your full card number — it is entered directly into Stripe’s systems.
- Approximate location derived from an address you enter, used to place your agency on the right region so inquiries reach you.
4.Why we process it, and on what lawful basis
We rely on a lawful basis for every processing activity. Where we rely on legitimate interests, we have carried out a balancing assessment and will share a summary of it on request.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and running your account, and providing the platform | Account details, agency profile | Performance of a contract (Art. 6(1)(b)) |
| Distributing your inquiry to agencies whose profile covers the lane | Inquiry content, agency profile, delivery records | Performance of a contract (Art. 6(1)(b)) |
| Generating bills of lading, invoices and proof of delivery | Document field data | Performance of a contract (Art. 6(1)(b)) |
| Taking subscription payments and issuing billing records | Payment outcome, subscription status | Performance of a contract (Art. 6(1)(b)); legal obligation for tax records (Art. 6(1)(c)) |
| Keeping the service secure — sign-in records, device list, rate limiting, fraud prevention | Authentication events, server logs | Legitimate interests (Art. 6(1)(f)): running a service that is not trivially abused |
| Diagnosing faults and improving the product | Server logs, aggregate usage | Legitimate interests (Art. 6(1)(f)): a service that works |
| Retaining records to meet customs, trade and accounting obligations | Documents, invoices, transport records | Legal obligation (Art. 6(1)(c)) |
| Sending marketing about LogCrew where you have asked for it | Name, email address | Consent (Art. 6(1)(a)), withdrawable at any time |
| Non-essential analytics, if and when we enable any | Usage events | Consent (Art. 6(1)(a)), collected through the cookie banner |
5.What other users of the platform can see
The most important privacy question on a marketplace is not what the operator sees. It is what other participants see. Our answers are enforced in the software, not by policy alone.
- Your agency profile — company name, coverage, services and verification status — is visible to other signed-in agencies. It is a directory listing, and it is meant to be found.
- When you post an inquiry, the agencies it is sent to see its contents. Choose what you put in the description accordingly.
- Bidders cannot see one another’s bids. Only the agency that posted the inquiry sees the bids on it.
- On our public marketing pages we show recent activity in an anonymised form only. That feed is served by a separate endpoint that removes company names, personal names, contact details, budgets and exact timestamps, reduces locations to a port or city, and returns nothing at all when there is too little recent activity for a row to be non-identifying. Hiding fields in the browser would still have sent the full record to it, so the redaction happens on the server.
- We do not publish a public directory of agencies, and we do not sell or rent your data to anyone. Ever, for any price.
7.How long we keep it
Where a retention period is set by law we cannot shorten it, including at your request. Where it is set by us, we delete or irreversibly anonymise the data at the end of the period.
| Record | Retention period |
|---|---|
| Account and agency profile | For as long as the account is open, then 90 days after closure |
| Inquiries, bids and awards | Six years from the end of the job, to cover the contractual limitation period |
| Bills of lading, proof of delivery and transport records | Six years, to meet customs and international trade record-keeping obligations |
| Invoices and payment records | Seven years, or longer if local tax law requires it |
| Authentication and device records | 12 months |
| Server logs | 90 days |
| Marketing consent records | For as long as the consent stands, plus three years as proof it was given |
8.Your rights
Under the GDPR you have the following rights. They are free to exercise, and we will respond within one month — or tell you why we need longer, which we may do for a complex request.
- Access — a copy of the personal data we hold about you, and the information in this notice.
- Rectification — correction of data that is wrong or incomplete. Most of it you can correct yourself in your account settings.
- Erasure — deletion of your data where we no longer have a basis to keep it. This does not extend to records we are legally required to retain, such as invoices and transport documents.
- Restriction — a pause on processing while an accuracy or objection dispute is resolved.
- Portability — the data you gave us, in a structured, machine-readable format, or transmitted directly to another controller where technically feasible.
- Objection — to processing based on legitimate interests, including profiling. Where you object to direct marketing we will stop, with no balancing test.
- Withdrawal of consent — at any time, without affecting anything done before you withdrew it.
- Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions; the matching that routes an inquiry to your agency is a filter on the coverage you configured, and a person decides every bid and award.
How to exercise them, and how to complain
Use the contact form on this site, or the account deletion control in your account settings. We may ask you to verify your identity — not to obstruct the request, but because handing someone else’s data to whoever asks for it would be the larger failure.
If you think we have handled your data badly, please raise it with us first; we would rather fix it. You also have the right to complain to a supervisory authority in the country where you live or work, or where you believe the problem occurred. In the UK that is the Information Commissioner’s Office; in the EEA it is your national data protection authority.
9.How we protect your data
- Traffic between your browser and our servers is encrypted in transit, and data is encrypted at rest by our hosting provider.
- Passwords are stored only as salted hashes. Nobody at LogCrew can read your password.
- Sign-in is protected by a one-time passcode sent to your registered email address, and you can see and revoke the devices on your account.
- Access to production data is restricted to the staff who need it to run the service, and secrets are held in a managed secrets store rather than in code or configuration files.
- Payment card details are entered directly into Stripe and never reach our servers.
- No system is perfectly secure, and we will not claim otherwise. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and tell you directly where the risk is high.
11.Children
LogCrew is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
12.Changes to this notice
We may update this notice. The "last updated" date at the top always reflects the current version. Where a change materially affects how we use your personal data, we will tell you directly rather than relying on you to notice a new date — by email, or by an in-product notice before the change takes effect.
LogCrew PVT LTD, Office #35, 36, Mezzanine Floor, Silk Center, Pakistan. Questions about this document go through the contact form.