1. Data controller
Truxelo (SAS) acts as data controller for personal data collected via the website, the application and customer support. Full identification details are in the legal notice.
2. Data collected
Account data (name, email, role, company), operational data entered in the TMS (transport orders, e-CMR, proofs), invoicing data, technical logs and support interactions. No sensitive data is collected.
3. Purposes and legal bases
Provision of the SaaS service (contract performance), customer support and product improvement (legitimate interest), legal and accounting obligations (legal obligation), commercial communications (consent — opt-in only).
4. Retention periods
Active accounts: for the duration of the contract. After termination: 30 days reversibility window, then deletion or anonymisation. Invoicing data: 10 years (legal obligation). Web analytics: 13 months maximum.
5. Recipients and sub-processors
Data is accessed by authorised Truxelo employees and a limited list of sub-processors (hosting in France, transactional email, analytics, support tools). The full list is published in the French policy and kept up to date.
6. International transfers
Truxelo hosts personal data in France (European Union). When a sub-processor operates outside the EU, transfers are framed by the European Commission's Standard Contractual Clauses.
7. Your rights
You have the right to access, rectify, erase, restrict, port your data and object to processing. To exercise these rights, contact dpo@truxelo.com. You may also lodge a complaint with the CNIL (French data protection authority).
8. Security
Encryption in transit (TLS 1.3) and at rest, least-privilege access, audit logs, regular backups, hosting in France. More details on the data security page.
This page summarises the privacy policy. For the exhaustive list of processing activities, sub-processors and retention tables, refer to the French version or the PDF.