Privacy Policy (Interim — Pre-Incorporation)
1. Who is responsible
The Mudravia service is operated by Mukesh Mohanlal Rebari, a sole proprietor resident in India ("we"). We are not established in the EU; the GDPR applies to us under Art. 3(2) because we offer the service to businesses in Spain and process data of people in the EU.
Our EU representative (Art. 27 GDPR): [EU representative — appointment in progress; name, Spanish address and email will be published here]. You may address any data-protection matter to the representative or directly to us at legal@mudravia.com.
An Estonian company (OÜ) is being incorporated and will take over the service; this policy will be replaced when it does.
2. Two roles
- We are the processor for data your organisation uploads to the platform (driver, shipment, consignor/consignee data). Your organisation is the controller; the Data Processing Annex to the Terms of Service governs that processing. Rights requests about that data should go to your organisation; we will assist it.
- We are the controller for the data described in this policy: your account data and website/usage data.
3. Data we process as controller
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, role, organisation (registration) | Provide and administer your account | Art. 6(1)(b) — contract | Account life + 12 months |
| Authentication data, IP, access logs | Security, abuse prevention | Art. 6(1)(f) — legitimate interest in securing the service | 12 months |
| Support correspondence | Answering you | Art. 6(1)(b)/(f) | 24 months |
| Technical error telemetry (may incidentally include user IDs) | Reliability | Art. 6(1)(f) | 90 days |
| Email address, language, referral source (pilot-request form) | Contacting you about the pilot programme | Art. 6(1)(a) — consent, given at the form | Until withdrawn, or 12 months from collection |
You can withdraw the pilot-request consent at any time by writing to legal@mudravia.com; withdrawal does not affect the lawfulness of processing before it.
No marketing use without separate consent. No automated decision-making producing legal effects. On the platform we set only cookies strictly necessary for login and session; the marketing pages set advertising-measurement cookies only if you accept them (section 4).
4. Cookies and advertising measurement
The marketing pages carry Google Ads conversion measurement (tag AW-18436294638). Its only purpose is to tell us which search advertisements lead someone to request pilot access. Nothing is stored on your device, and no identifier is sent, unless you accept it.
On your first visit a banner asks you to accept or reject, and both choices are given equal weight. Until you accept, Google Consent Mode v2 runs with ad_storage, ad_user_data, ad_personalization and analytics_storage all set to denied: no advertising cookie is written, and anything sent to Google is cookieless and carries no identifier for you.
| Storage | Purpose | Legal basis | Retention |
|---|---|---|---|
mv_consent (browser local storage) | Remembering whether you accepted or rejected, so we do not ask again | Strictly necessary, and therefore exempt from consent under Art. 22.2 LSSI-CE | Until you change your choice or clear your browser storage |
Google Ads cookies (_gcl_*) and the gclid advertisement click identifier | Attributing a pilot request to the advertisement that produced it | Consent — Art. 22.2 LSSI-CE for the storage, Art. 6(1)(a) GDPR for the processing | Set by Google, up to 90 days |
Where you accept, the data reaching Google is your IP address, browser and device information, the advertisement click identifier, and the fact and time that you submitted the pilot form. We never send the contents of that form — not your email address, not your name, not your organisation. We hold no personal data from this measurement ourselves; we see only aggregate counts in the Google Ads interface.
Withdrawing your consent. You may change your mind at any time, and doing so is as easy as giving consent in the first place: use Cookie settings at the foot of any page. Withdrawal stops all future measurement. It does not affect the lawfulness of processing carried out before you withdrew (Art. 7(3) GDPR).
Our role and Google’s. We decide to run this measurement and why; Google decides how the service operates and uses the data for its own purposes as well. For the step in which data is collected in your browser and transmitted to Google, we and Google act as joint controllers, following the reasoning of the Court of Justice in Fashion ID (C-40/17). For everything Google does with the data afterwards, Google is an independent controller and its own privacy policy governs. The contracting entity for advertisers in the European Economic Area is Google Ireland Limited.
5. Where data lives, and transfers
All personal data is hosted in the EU (Hetzner, Falkenstein, Germany). AI document extraction runs self-hosted on that EU infrastructure — no cloud AI provider receives your data.
No personal data is stored in or exported to India. Although the operator is resident in India, all storage and processing occur on EU infrastructure, and administrative access to raw personal data occurs only through a time-boxed, logged break-glass procedure executed via EU infrastructure, without export of data. If our processing locations ever change, we will implement the appropriate Chapter V GDPR safeguards (Standard Contractual Clauses) and update this policy first.
Advertising measurement is the one exception. If, and only if, you accept advertising cookies (section 4), data reaches Google LLC in the United States. That transfer relies on the European Commission’s adequacy decision for the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023), under which Google LLC is certified, with Google’s Standard Contractual Clauses applying in addition. The General Court upheld that decision on 3 September 2025 (T-553/23) and an appeal is pending before the Court of Justice (C-703/25 P). Should the decision be annulled, we will suspend the advertising measurement rather than continue on a doubtful basis. This exception does not touch platform data, which stays in the EU.
6. Recipients
Sub-processors: hosting, email delivery and monitoring providers, all EU-based; the current list is available on request at legal@mudravia.com. No sale of data; disclosure to authorities only where legally required.
7. Your rights
Access, rectification, erasure, restriction, portability and objection (Arts. 15–21 GDPR). Write to legal@mudravia.com or the EU representative; we respond within one month. During the pilot, requests are fulfilled manually.
You may lodge a complaint with a supervisory authority — for Spain, the AEPD (www.aepd.es).
8. Changes
Material changes will be notified by email or in-product at least 15 days before taking effect. The controller identity will change to the Estonian company on incorporation (see Terms §11); your rights are unaffected.