Privacy Policy

1. Data controller

Your personal data is processed by LogiFindex as data controller. Our company name, address and registration details are in the "Operator details" section at the end of this page. For any request about personal data: info@logifindex.com

2. Personal data we process

• Identity and contact: first and last name, title/position, e-mail, phone, optional WhatsApp number.
• Business details: company name, tax office and number, address, line of business, service regions (these may be personal data for sole traders).
• Account and security: username, password (stored only in irreversibly hashed form), session tokens, login times, IP address, browser and device information.
• Verification documents: documents you upload, such as tax certificates, licences, activity certificates or insurance policies, and the information on them.
• Transaction data: listings, quotes, prices, routes, cargo details, deals, status updates, ratings and planning notes.
• Messages and documents: in-Platform messages, shared files (e.g. CMR, invoice, packing list, proof of origin, policy) and third-party information they contain.
• Location data: device location and time when a driver or carrier starts live-tracking sharing; driver name, phone and vehicle plate (if entered).
• Request and subscription data: information you give in the quote wizard, contact form, guest quotes and daily digest subscription, consent records and an irreversible hash of your IP address to prevent abuse.
• Payment and billing: invoice details, payment status and amounts. Card details are processed by the payment institution and are not stored on LogiFindex servers.

We do not ask for special categories of personal data (health, biometric data, religion, political opinions, etc.). If documents you upload contain such data, please redact it before sharing.

3. How we collect data

• Directly from you: registration, profile, listings, quotes, messages, document uploads, forms and e-mail correspondence.
• From your business partners: information shared by the counterparty in a deal (e.g. driver details entered by the carrier, consignee details shared by the shipper) and from the user who invited you.
• Automatically: server logs, IP address, device information and local storage generated when you use the Platform.
• From public sources: trade registries, professional association directories and company websites, limited to business contact information.

4. Purposes and legal bases

We process your personal data for the following purposes and on the following legal bases under Article 5 KVKK and Article 6 GDPR:

• Opening your account and providing the Platform (listings, quotes, matching, CRM, documents, tracking, planning): conclusion and performance of a contract (KVKK 5/2-c; GDPR 6(1)(b)).
• Member verification, fraud and abuse prevention, Platform security: legitimate interests (KVKK 5/2-f; GDPR 6(1)(f)) and legal obligations.
• Invoicing, accounting, tax and commercial record-keeping; requests from authorities; records required by Law No. 5651: legal obligation (KVKK 5/2-ç; GDPR 6(1)(c)).
• Establishing, exercising and defending legal claims: KVKK 5/2-e; GDPR 6(1)(f).
• Service notifications (quote, message, document, signature and reminder e-mails): performance of a contract.
• Product development, statistics and the anonymised freight index (LFX): legitimate interests; data is aggregated and anonymised wherever possible.
• Live-tracking location data: performance of a contract and legitimate interests; sharing is deliberately started by the driver and can be stopped. Consent is obtained where required.
• Daily digest and marketing e-mails: consent, including consent to commercial electronic messages under Law No. 6563 (GDPR 6(1)(a)). You may withdraw consent at any time.
• International transfers: safeguards under Article 9 KVKK and Chapter V GDPR (see below).

5. Sharing with other users

• When you publish a listing or submit a quote, business details such as cargo, route, dates and price are shown to the relevant users.
• Before a deal is concluded your identity and contact details are not shown to the counterparty; bidders are listed anonymously.
• Once a deal is concluded, the company name, role and contact details needed to perform the job are shared with the parties. The insurer and customs broker on the same job can see the shared job information and job documents but not each other's messages. An insurance quote stays between the shipper and the insurer.
• A live-tracking link is visible to anyone who has the link; share it only with people you trust.
• Ratings may be shown on the rated business's profile.

6. Service providers and other recipients

We do not sell your data. To operate the Platform we share it only as necessary, under contractual confidentiality obligations, with:

• Server, database and file hosting providers (European Union) — application servers, database and uploaded files.
• Website hosting and content delivery providers (USA and global delivery network) — serving web pages; technical access logs (IP address, browser data).
• E-mail service providers — sending transactional and notification e-mails and support correspondence.
• Font, map, address search and routing providers — your IP address when pages and maps load; place names entered for address search and routing.
• Web analytics provider (USA and EU; only if you give cookie consent) — aggregate measurement of site use; cookie ID, pages visited, device and approximate location.
• EU VAT number validation system (VIES, European Commission) — EU companies only: country code and VAT number, for company verification.
• Payment institutions — collecting payments for Paid Services and preventing fraud.
• Professional advisers: lawyers, accountants and auditors.
• Competent public authorities and courts: where legally required or upon a valid request.
• Corporate transactions: an acquirer in a merger, acquisition or sale of assets, in line with this policy.

7. International transfers

Some of the providers above are located outside Türkiye (in the European Union and the United States). Transfers abroad are made under Article 9 KVKK on the basis of standard contracts announced by the Board or other appropriate safeguards provided by law, or, in exceptional cases where these are not available, on the basis of your explicit consent. For individuals in the EEA, transfers outside the EEA rely on the European Commission's Standard Contractual Clauses or adequacy decisions (e.g. the EU-US Data Privacy Framework).

8. Live tracking and location data

• Location data is collected only after a driver or carrier opens the tracking link sent to them and starts sharing, and only while sharing is on. The driver can stop sharing at any time.
• Collected locations are shown on the tracking page of the relevant shipment and to the parties to the job; they are not used for other purposes or sold.
• The carrier is responsible for informing its drivers about location sharing and having an appropriate legal basis.

9. Company verification

We verify companies to show that businesses on the Platform are real and tax-registered and to prevent fake accounts and fraud. A verified company shows a “Verified company” badge on its profile, quotes and job screen.

• Data processed: the company's country, tax or VAT number and name; for EU companies, the registered name and address returned by the verification system; for companies in Türkiye, the uploaded tax certificate (PDF or image), tax office and the approval code on the certificate; check dates, results, the team member who decided and the reasons (audit log).
• EU companies: the VAT number and country code are checked against the European Commission's VAT number validation system (VIES), at registration and monthly afterwards. If the number is valid and the name matches, the badge is granted automatically.
• Companies in Türkiye: our team checks the uploaded tax certificate by hand on the official verification page of the Turkish Revenue Administration (GİB). The Platform does not send automatic queries to GİB. Tax certificates are annual, so an up-to-date certificate is requested once a year.
• Decisions: when the name does not match, the number cannot be verified or a document needs review, our team decides. After a negative result you can correct your details and try again, send an additional document or ask for the decision to be reviewed.
• Who sees what: other users only see the badge, the verification method (official register or LogiFindex team) and the date. The tax certificate, approval code and registered address are visible only to authorised LogiFindex staff. Anonymous quotes show the badge without revealing the company name.
• Legal basis: entering into and performing the contract (GDPR Art. 6(1)(b), KVKK Art. 5/2-c) and our legitimate interest in running a safe marketplace and preventing fraud (GDPR Art. 6(1)(f), KVKK Art. 5/2-f).
• Retention: the tax certificate file is deleted 180 days after the verification is rejected or the account is closed. The verification result and audit log follow the retention period for verification records in the “Retention periods” section.

For corrections, reviews or other requests about verification, write to info@logifindex.com.

10. Invoices and accounting export

• LogiFindex does not issue invoices and is not a legal archive. The service provider uploads the invoice issued in its own system (PDF or e-invoice XML) to an accepted job and enters details such as invoice number, dates, amounts, VAT, tax ID and a note.
• Invoices and their files are visible only to the job's shipper and the service provider who uploaded them. Files are kept in non-public storage; download links are short-lived and access is re-checked every time. Views, disputes and payment marks are written to an audit log.
• Uploaded files are not deleted; corrections are made by uploading a new version and the previous one is kept as “replaced”.
• Payments do not go through the Platform; “Paid” and “Payment confirmed” are tracking marks set by the parties.
• The accounting export only contains your own company's accepted jobs. It includes the counterparty's name, country and tax ID, but no e-mail or phone number. The file is downloaded to your device; large files are kept on the server for at most 24 hours while being prepared and are then deleted.
• Legal basis: performing the contract (GDPR Art. 6(1)(b), KVKK Art. 5/2-c), the parties' legal obligations and our legitimate interest in evidence for disputes (GDPR Art. 6(1)(c) and (f), KVKK Art. 5/2-ç and 5/2-f).
• Retention: the retention period for agreements, invoices and commercial records in the “Retention periods” section applies.

11. Cookies and local storage

The Platform does not use advertising cookies. We always use browser local storage (localStorage / sessionStorage) that is strictly necessary for the service:

• Session tokens and user information (to keep you signed in).
• Preferences: language, theme (light/dark), dismissed notices and similar interface settings.
• Temporary state between pages (e.g. the selected deal, an unfinished form).

Because these are strictly necessary to provide the service, they do not require consent. You can delete them in your browser settings; you will then be signed out and your preferences reset. Font and map providers may keep their own server logs when content loads.

We use Google Analytics 4 analytics cookies to measure, in aggregate, how the site is used only with your explicit consent (Article 5(1) KVKK, Article 6(1)(a) GDPR). You can withdraw consent at any time with the “Cookie preferences” link at the bottom of the page. Details, the cookie list and durations: Cookie Policy.

12. Retention periods

We keep personal data for as long as the purpose requires and for mandatory statutory periods, after which it is deleted, destroyed or anonymised:

• Account and profile data: while your account is open; after closure, for the general limitation period for possible disputes (up to 10 years).
• Deal, invoice and commercial records: up to 10 years under Article 82 of the Turkish Commercial Code and the Tax Procedure Law.
• Messages and job documents: together with the related job records; up to 10 years after account closure.
• Server and traffic logs: at least 1 and at most 2 years under Law No. 5651 and its regulation.
• Live-tracking location data: up to 12 months after the shipment is completed; then deleted or anonymised.
• Verification records: the verification result and audit log during membership and up to 10 years after account closure; the tax certificate file is deleted 180 days after the verification is rejected or the account is closed.
• Quote wizard and contact form requests: up to 3 years from the last contact.
• Daily digest subscription: until you unsubscribe; unconfirmed sign-ups are deleted shortly. Consent records are kept for 3 years as proof.

13. Security

We take reasonable administrative and technical measures to protect your data: encrypted connections (HTTPS/TLS), passwords stored in irreversibly hashed form, role- and job-based access control (a user who is not a party to a job cannot see its messages or documents), access limited to authorised staff, logging and regular backups. No system is completely secure, so absolute security cannot be guaranteed. In the event of a data breach, we will notify the Personal Data Protection Board and affected individuals within the time and in the manner required by law.

14. Your rights

Under Article 11 KVKK you have the right to:

• learn whether your personal data is processed and request information about it;
• learn the purpose of processing and whether it is used accordingly;
• know the third parties in Türkiye or abroad to whom it is transferred;
• request rectification of incomplete or inaccurate data;
• request erasure or destruction under the conditions of Article 7 KVKK;
• request that rectification, erasure or destruction be notified to third parties to whom data was transferred;
• object to a result against you arising solely from automated analysis;
• claim compensation for damage caused by unlawful processing.

Individuals in the EEA also have the rights of access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests under Articles 15–22 GDPR, and the right to withdraw consent.

15. How to make a request

Send your request with enough information for us to verify your identity to info@logifindex.com, in writing to our operator address, or by the other methods set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. We will respond free of charge within 30 days at the latest; if the request involves an additional cost, a fee set by the Board may be charged.

If your request is rejected, our answer is insufficient or we do not respond in time, you may complain to the Turkish Personal Data Protection Board. Individuals in the EEA may contact the supervisory authority in their country.

16. E-mail notifications and commercial messages

E-mails about the operation of the service (new quotes, messages, documents, signatures, reminders, security and billing notices) are sent to perform our contract. Daily lane digests and promotional e-mails are sent only with your consent; you can unsubscribe at any time using the link in each e-mail or by writing to info@logifindex.com.

17. Children

The Platform is not designed for people under 18 and we do not knowingly collect children's personal data. If we become aware of such data we will delete it.

18. Changes to this policy

We may update this policy to reflect changes to our services or the law. The current version is always published on this page with its last-updated date. We announce material changes by e-mail or Platform notice.

19. Contact

For any question about this policy or your personal data: info@logifindex.com