Privacy Policy.

CargoNova International Ltd (trading as CGN) is the data controller responsible for your personal information. We are registered in England and Wales and operate logistics and freight forwarding services across 190+ countries worldwide.

This Privacy Policy applies to all personal data we collect and process in connection with:

• Your use of the CGN website at cargonova.org and any related CGN digital platforms
• The freight, logistics, customs, and supply chain services we provide
• Your interactions with our customer service team, account managers, and sales team
• Your participation in any CGN marketing communications, events, or programmes

By using our services or website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our services.

We collect different types of personal data depending on how you interact with CGN. The categories below describe what we collect and why.

• Full name, job title, and company name
• Email address, phone number, and business address
• Login credentials for your CGN account (passwords are stored in encrypted form only)
• Billing address and payment information for invoicing purposes

• Sender and recipient names, addresses, and contact details
• Shipment contents descriptions, weight, dimensions, and declared value
• Booking reference numbers, tracking data, and delivery confirmation records
• Customs declarations, HS codes, and import or export documentation
• Payment and invoicing records for services rendered

• IP address, browser type and version, operating system, and device type
• Pages visited on cargonova.org, time spent, and navigation paths
• Referral source and search terms that led you to our website
• Cookie identifiers and tracking pixels (see Section 08 for full details)

• Records of emails, calls, and chat messages with our support or sales teams
• Feedback, complaints, and survey responses you submit to us
• Marketing communication preferences and opt-in or opt-out records

We process your personal data only where we have a lawful basis to do so. The table below sets out the purposes for which we use your data and the legal basis we rely on for each.

CGN does not sell your personal data to third parties. We share your information only where necessary to deliver our services, comply with legal obligations, or protect legitimate interests.

We share data with carefully selected third parties who help us deliver our logistics services:

• Airline and shipping carriers to book freight space and manage cargo movements
• Customs authorities and border agencies as required by law in every country of transit or destination
• Last-mile delivery partners to complete delivery at the destination address
• Warehousing and fulfilment partners where CGN manages storage on your behalf
• Payment processors to collect and process payments for services rendered
• IT infrastructure and cloud service providers who host, maintain, and secure our systems

We may disclose your information to government bodies, law enforcement agencies, customs authorities, or regulators where we are required to do so by law, court order, or regulatory directive. We will notify you of such disclosure where permitted by law.

If CGN undergoes a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.

CGN operates globally across 190+ countries. As a result, your personal data may be transferred to, stored in, or processed in countries outside your home country, including countries that may not provide the same level of data protection as your jurisdiction.

Where we transfer personal data from the European Economic Area (EEA) or United Kingdom to countries not recognised as providing adequate data protection, we rely on one or more of the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission or UK Information Commissioner's Office
• Adequacy decisions issued by the European Commission or UK government
• Binding Corporate Rules where applicable within the CGN group
• Explicit consent from the data subject in specific circumstances

For shipment-related data, certain transfers are also required by law. For example, customs authorities in countries of transit or destination are legally entitled to receive shipment and recipient information regardless of data protection safeguards.

We retain personal data only for as long as necessary for the purpose it was collected, or as required by applicable law. The table below sets out our standard retention periods for the main categories of data we hold.

When personal data is no longer required, we securely delete or anonymise it. Anonymised data (which cannot be used to identify you) may be retained indefinitely for statistical and analytical purposes.

Depending on your location and the applicable data protection law, you have the following rights in relation to the personal data we hold about you.

To exercise any of your rights, please contact our Data Protection Officer using the details in Section 12. We will respond to all requests within 30 days. In complex cases we may extend this by a further 60 days with prior notice.

CGN uses cookies and similar tracking technologies on cargonova.org. A cookie is a small text file placed on your device when you visit a website. We use cookies to make our website function correctly, to analyse how it is used, and to improve your experience.

You can manage your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of any page on cargonova.org. You can also manage cookies through your browser settings, though disabling certain cookies may affect how our website functions.

For full details about the specific cookies we use, including third-party cookies, please see our Cookie Policy.

CGN takes the security of your personal data seriously. We have implemented technical and organisational measures designed to protect your data against unauthorised access, accidental loss, destruction, or disclosure.

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. Sensitive data at rest is encrypted using AES-256 encryption.
• Access controls: Access to personal data is restricted to CGN staff who need it to perform their job. All access is logged and audited regularly.
• Penetration testing: Our systems undergo regular penetration testing and security audits by independent third parties.
• Incident response: We have a documented data breach response procedure. In the event of a breach affecting your rights, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR.
• Vendor security: All third-party service providers with access to personal data are required to maintain equivalent security standards and are subject to data processing agreements.

CGN's services are intended for businesses and adults aged 18 and over. We do not knowingly collect, process, or store personal data from children under the age of 16 (or the applicable age of digital consent in your jurisdiction).

If you are a parent or guardian and believe that your child has provided personal data to CGN without your consent, please contact us immediately at privacy@cargonova.org. We will promptly delete any such data upon verification.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable legal requirements. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Send an email notification to all registered CGN account holders
• Display a prominent notice on the CGN website homepage for at least 30 days
• Where required by law, seek fresh consent for any new processing activities

We encourage you to review this Privacy Policy periodically. Your continued use of CGN services after any changes take effect constitutes your acceptance of the updated policy.

Previous versions of this Privacy Policy are available on request by contacting our Data Protection Officer.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a concern about how we handle your personal data, please contact us using the details below.

If you are not satisfied with our response, you have the right to lodge a complaint with your national data protection supervisory authority:

• United Kingdom: Information Commissioner's Office (ICO) at ico.org.uk
• European Union: Your local Data Protection Authority at edpb.europa.eu
• South Africa: Information Regulator at inforegulator.org.za
• Kenya: Office of the Data Protection Commissioner at odpc.go.ke