Privacy

Who processes your data

The KONEKTOR platform is operated by Mywatrade s.r.o. It is the controller of your personal data under Regulation (EU) 2016/679 (GDPR). Its details and contact are in the table at the end of this page.

Send questions about your data to the contact address in the table. When we change this page materially, we tell members on the platform. We have not appointed a data protection officer (DPO) — Article 37 GDPR does not require us to.

What we process

From your application: company name, registered address, company number, sector, headcount and turnover (they set the membership fee), the contact person's first and last name, e-mail and phone, and whatever you write in the application yourself.

During membership: the customs codes you save; your capability card, if you switch it on; the contents of Deal Room rooms and of messages you exchange on the platform; votes; and a record of what you have signed.

When you sign a document: the document version, a hash of the exact wording you saw, the time, the IP address and the browser identifier. Without them the signature could not be evidenced later.

At every sign-in: the time, the country (derived from the IP address — the address itself is not stored), a rough device description such as “Computer · Windows · Chrome”, and a shortened browser fingerprint. If the network also sends the city, we store it too. We keep the last 50 sign-ins per account, for at most 90 days. The same data drives the device limit per membership: a device over the limit cannot sign in, and you can write to the founder from that screen.

From the contact form: name, e-mail, company, subject and the message — even if you never become a member. Otherwise there is nobody to answer.

When another member finds your company in the supplier directory, we record who found it and show it to you (the last 50 entries).

From the public demo “Load planner”: the e-mail, the start time, the number of calculations, consent for us to contact you (if you gave it) and a fingerprint of the IP address (we do not store the address itself) — used only to stop one address from starting too many demos a day. The goods you enter in the demo are not stored.

For logins of the company's people: name, work e-mail, function, which parts of the zone the person sees, last sign-in and devices. In the company console also tasks, messages in the company's rooms and a record of what each person did for the company, such as publishing or signing.

For warehouse and declarant accounts: details from the application and the card (name, city, the contact to be published) and the people in the account. Also what the account keeps for its clients and partners: clients and powers of attorney, consignments, watched customs codes, the pallet account and ramp visits. A ramp visit may include the driver's name and the vehicle registration number.

For requests to declarants and warehouses: the goods, place, date and the contact the member provides.

For accounts of organisations (chambers, associations) and foreign manufacturers: name, contact persons and sign-in details.

When you report content: your name, e-mail, the address of the content, the reason and your explanation; if you are signed in, also your account. We need this to assess the report and to reply. The author of the content does not receive your name or contact details.

After a failed sign-in or password-reset request: the time and a fingerprint of the IP address (we do not store the address itself) — used to block repeated attempts for a short time. For an existing account, also the number of failed attempts and the time of the last one. After several failures the site may show a short Cloudflare Turnstile check that tells people from bots.

When an e-mail from the platform cannot be sent, for example because the mail server is down, we store it and try again. We log site errors without personal data: the page address without parameters, the error text and the time. For every request the web server records the IP address, the time, the page address and the browser — this is used to detect attacks.

At registration we compare the name, company, e-mail, phone, company number and domain you enter with a list of persons and companies that the management has excluded from the platform. Only the founders and authorised staff of the platform see the list, and it is never published. We review every entry once a year and delete an entry whose reason no longer applies.

Where the data comes from

Most of the data you give us yourself — in the application, in the zone or in a message. Some we receive from others:

From a company, chamber, warehouse or declarant that set up your access on the platform or listed you as its person, client or partner: name, work e-mail, position and contact.

From a member that added your company to the partners it watches or asked for an introduction: company name, registration number and country.

From public registers and lists: business registers (for example ORSR, RPO, ARES, GLEIF), the VAT register (VIES) and the sanctions lists of the EU, the UN, the Czech Republic, the United Kingdom, the USA, Switzerland and Canada — data about the company, its directors and owners to the extent the register publishes them. We take them in the form and as of the date in which the register published them.

Why, and on what legal basis

Performance of a contract (Art. 6(1)(b) GDPR): without your company's details there is nobody to admit as a member, invoice or name in the agreement.

Legal obligation (Art. 6(1)(c)): invoices and accounting records must be kept under accounting and tax rules; reports of content and statements of reasons are kept under Regulation (EU) 2022/2065 on digital services. We compare members, their statutory representatives and known owners with the sanctions lists of the EU, the UN and the Czech Republic, because the rules on international sanctions prohibit making services available to persons on those lists. We compare the lists of the United Kingdom, the USA, Switzerland and Canada on the basis of legitimate interest.

Legitimate interest (Art. 6(1)(f)): the security of the platform and accounts (the sign-in record, blocking repeated attempts, refusing excluded persons and companies), protection against misuse, evidence of who signed what, knowing which parts of the zone are used, finding errors and delivering mail.

On the basis of legitimate interest we also provide the anonymous comparison with similar companies in the Dashboard. From data we already hold about companies (sector, number of employees, markets and customs codes watched, numbers of enquiries, load plans and documents, and whether the company uses certain features) we calculate medians and shares for a group of similar companies. The result is shown only for a group of at least 5 other companies, and nobody sees the figure of a single company. An organisation such as a chamber sees such totals only for its members who have given it consent, and also only for at least 5 companies. A company can opt out of other companies' comparisons at any time in the Dashboard, in the Comparison with similar companies panel.

Consent (Art. 6(1)(a)): the newsletter and e-mail alerts. You can withdraw consent at any time and the subscription ends.

Data that a company enters about its people, or a warehouse or declarant enters about its clients and partners, is processed on their behalf and on their instructions. The controller of that data is the company, warehouse or declarant; we are the processor under Art. 28 GDPR, and the processing is governed by the Data Processing Agreement. We do not look into such data and do not use it for our own purposes.

We need the data from the application and from the identification clause of the agreement to conclude the agreement — without it we cannot accept you. Invoice data is required by law. Other data (for example the capability card, a contact for publication or the newsletter) is voluntary; if you do not provide it, you simply will not have the related function.

Who can see it

Other members see only what is in the directory: company name, size band, sector and what you publish yourself. Contact details are never in the directory. Anyone who wants to reach you asks for an introduction, and you decide.

Founders and authorised staff see more — they need it to approve applications and introductions and to run the platform. Market representatives see only requests that concern their market, without the name of the company that made them.

We pass data on only when there is a reason: to the e-mail provider that delivers our messages; to public registers (for example RÚZ, ARES, GLEIF, VIES) when we verify a company — only the company or VAT number is sent.

A server administrator and server, network-protection, backup and e-mail providers help us run the platform technically (listed below). They do not evaluate the data or use it for their own purposes. We do not sell data or give it to anyone for advertising.

The company's administrator sees the data of the company's people in the company console, as described above.

A declarant sees a member's request without the member's name. The declarant sees the name and contact only when the member shows them. A warehouse sees the request with the contact, because the member chose that warehouse.

Anyone who receives a link to a load plan or a warehouse's driver page sees only what is in the link. A plan link can be protected by a PIN and can be revoked.

An organisation (chamber, association) sees, for the companies in its licence, the name, contact, since when they have been on the platform and the last sign-in. It sees a company's markets and sectors only with the company's consent. It never sees messages, requests, offers or what the company reads.

Transfers outside the European Union

Network protection may transfer data to the United States. The transfer relies on the EU–US Data Privacy Framework (a Commission adequacy decision) or on the European Commission's standard contractual clauses.

How long we keep it

Membership data: while the membership lasts, and then for as long as accounting, tax and limitation rules require — above all for agreements and invoices.

The sign-in record for at most 90 days. Contact-form messages for 6 months after they are dealt with; sooner if you ask us to delete them. Daily totals of zone use for 90 days. The e-mail from the public demo for 12 months from the start; if you consented to being contacted, until you withdraw it.

Failed sign-in attempts for 30 days. Web-server logs with the IP address for 14 days. Site errors for 30 days. An e-mail that could not be sent, until it is sent, for at most 30 days. Reports of content for 3 years. An unconfirmed newsletter subscription for 7 days. An unconfirmed application for 72 hours from submission. A declined application is deleted at once when it is declined; you receive the reason by e-mail. An entry on the exclusion list for as long as its reason applies — we review it once a year. The result of a sanctions list check and the decision on a possible match for the duration of the membership and 5 years after it ends.

Backups are made continuously and old ones are deleted. A deleted account may therefore remain briefly in the latest backups; it disappears from live data at once.

Logins of the company's people, tasks, messages and the company record are kept until the administrator removes them, at the latest until the company account is deleted. Data kept by a warehouse or declarant is kept until they delete it; when the account is deleted, we delete it together with the account.

Cookies and data in your browser

All cookies we use are strictly necessary: konektor-session — sign-in of the member and the company's people, 24 hours; kdev — device marker, created only at sign-in, protects the account and the agreed number of devices, 12 months from the last sign-in; konektor-prac — sign-in of a warehouse or declarant account, 24 hours; konektor-org — sign-in of an organisation, 7 days; konektor-vyrobca — sign-in of a foreign manufacturer, 7 days; kn_… — a PIN-protected load plan link, created after the correct PIN, 12 hours; kon_ukazka — the public load planner demo after you enter an e-mail, keeps the number of calculations, 90 days.

Strictly necessary cookies do not need consent (in Slovakia § 109(8) of Act No. 452/2021 Coll., in the Czech Republic § 89(3) of Act No. 127/2005 Coll.). The cookie bar is therefore information only. We use no tracking or advertising cookies.

When the site shows a Cloudflare check (for example during an attack or after several failed sign-in attempts), Cloudflare may set a security cookie such as cf_clearance or __cf_bm. It only serves to tell people from bots, is strictly necessary and does not track you.

Your browser also keeps a few settings in local storage (these are not cookies): your language (for at most 12 months), whether you have seen the cookie bar, whether you were offered the guided tour, the light or dark look of the load planner, the customs-map view and unfinished work such as a shipment. The dock record (photos, names and signatures) is kept in IndexedDB storage. All of it stays on your device, is not sent to us and is cleared with the site data.

Invoices that a company uploads to the Finance from your accounting panel of the Dashboard are read and totalled by the browser itself and stored only on your device (in IndexedDB storage). Neither the file nor the invoices nor any totals from them are sent to our server. You delete them with the button in the same panel or together with the site data. The last five questions from the Questions in your own words panel are also remembered only by the browser. Our server processes the question itself to give the answer and does not store it.

How we count visits

For every page shown, the browser sends: the page address, the language, whether it is the first page of the visit, the domain you came from, and a rough type of device, system and browser. The country comes from a network header; the IP address is not stored.

We also record words typed into the site's search boxes — not linked to you. It shows us what people look for and do not find.

No cookie and no identifier is used for this. That is why we cannot tell a new visitor from a returning one. Platform staff and the client zone are not counted.

What you open in the zone

In the client zone we record against your account which sections you opened, how often and when you last did. We need to know whether the tools are used, and which member to contact when they have not looked at what they pay for in a long time.

We do not store what you read in a section. We know you opened the sanctions monitor — not which measure. Only the founders see the record; you can see your own in the zone.

Your rights

You have the right of access, rectification, erasure, restriction of processing, portability and objection. You may withdraw consent at any time. Write to the contact address in the table; we reply within one month. You can also ask for your account to be deleted directly in the zone: Settings → Account & security → Request account deletion.

We make no automated decisions that have legal effects for you (Art. 22 GDPR). The only thing the platform does on its own is to refuse a registration that matches an entry for a person or company excluded from the platform; every entry was decided by a person, who will review it again on request.

If you think we handle your data wrongly, you may complain to the supervisory authority of the state where you live, work or where the infringement took place (Art. 77 GDPR). In Slovakia this is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava. In the Czech Republic it is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7. We would like to hear from you first, though — we can put it right faster.

Other processors

These providers help us run the platform; they are our processors under Art. 28 GDPR. Server administrator — a technician who runs the server under a contract with us and is bound by confidentiality. Provider of the rented server (a data centre in the European Union) — the server the platform runs on. Cloudflare, Inc. (USA) — network protection, the secure connection between the site and the server, and the Turnstile check; transfers to the USA under the EU–US Data Privacy Framework. Backup storage outside the server (in the European Union) — backups are encrypted before upload with a password the storage provider does not have. E-mail service provider — delivery of e-mails from the platform.

When this list changes, we will announce it on the platform at least 30 days in advance. A client whose data we process under the data processing agreement may object to the change.