Privacy Policy

Effective Date: 09/10/2026

Last Updated: 10/10/2026

1. Controller Identity

This Privacy Policy applies to personal data processed by:

Company Name: Mudravia OÜ (registry code 17617532)
Registered office: Tartu mnt 67/1-13b, 10115 Tallinn, Estonia
Establishment: European Union (Estonia-based, EU domestic establishment)
Activity: Software-as-a-Service platform for freight document compliance and driver credential management
Data-protection contact: privacy@mudravia.com. Mudravia has not appointed a Data Protection Officer; this mailbox is the contact point for every data-protection matter.

As an EU-established data controller, Mudravia has no requirement for an Article 27 representative and stores all personal data within the European Union. The few transfers outside the European Union that do occur are listed in Section 5.

2. Personal Data Categories Processed

Mudravia processes the following categories of personal data in its role as a processor for its carrier-customers (who act as data controllers) and as a controller for its own account and billing data:

2.1 Carrier Staff Account Data (Processor role)

• Full name
• Email address
• Job role / designation
• Account creation date
• IP address (for account access logging)

2.2 Driver Licence and ADR Data (Processor role)

• Driver name and date of birth
• Driver licence number and category
• Licence expiry date
• ADR (Hazardous Materials) certification status and expiry date
• Scanned copies or attachments of driver licence or ADR documentation

2.3 Consignor and Consignee Contact Data (Processor role)

• Name of consignor / consignee
• Email address and telephone number
• Postal address
• Company registration number or tax identification number
• Any other contact details embedded in uploaded shipping documents

2.4 Billing and Customer Contact Data (Controller role)

• Organisation/company name and address
• Billing contact name and email
• Payment method details (once paid subscriptions start, collected and processed by Paddle as Merchant of Record; see Section 4)
• Invoice history
• Subscription tier and usage metrics

2.5 Document Contents (Processor role)

• Personal data incidentally embedded in uploaded documents (e.g., invoices, shipping manifests, regulatory filings, permits)
• This may include consignor/consignee details, driver information, vehicle registration data, or other personal identifiers present in carrier-supplied documentation

3. Purposes and Legal Bases

3.1 When Mudravia Acts as Processor (for carrier-customers)

Purpose: To enable carriers (data controllers) to manage driver compliance, document ingestion, regulatory filing, and driver credential expiry tracking.

Legal Basis: Mudravia processes this data on the documented instructions of the carrier customer, under Article 28 GDPR and the Data Processing Annex to the Terms of Service. The carrier, as controller, determines the legal basis for this processing and is responsible for it (typically Article 6(1)(b), (c) or (f) GDPR). Where a legal basis is shown in Section 3.3 for an activity Mudravia carries out as processor, it is the carrier's, given for information.

3.2 When Mudravia Acts as Controller (for its own account/billing data)

Purpose: To manage customer accounts, provide billing and invoicing, maintain audit and transaction logs, and comply with legal and regulatory obligations.

Legal Bases:

• Article 6(1)(b) GDPR — Necessary for performance of the contract between Mudravia and the customer for provision of the SaaS platform.
• Article 6(1)(c) GDPR — Necessary to comply with legal obligations, including VAT reporting, tax record-keeping, and EU freight-compliance regulatory requirements.
• Article 6(1)(f) GDPR — Legitimate interests in fraud prevention, security monitoring, operational analytics, and legal defence, where the processing does not override the rights and interests of data subjects.

3.3 Specific Processing Activities

Account Management and Access

• Purpose: To create, maintain, and authenticate user accounts.
• Legal Basis: Article 6(1)(b) GDPR.
• Retention: See Section 6.

Document Ingestion and Compliance Generation

• Purpose: To ingest carrier-supplied documents (invoices, manifests, permits, credentials) and generate compliance reports and regulatory filings.
• Legal Basis: Article 6(1)(b) GDPR (carrier's contractual instruction); Article 6(1)(c) GDPR (EU regulatory compliance obligations).
• Retention: See Section 6.

Driver Licence and ADR Expiry Tracking

• Purpose: To monitor expiry dates of driver licences and ADR certifications and alert carriers to renewal requirements.
• Legal Basis: Article 6(1)(b) GDPR (carrier's contractual instruction); Article 6(1)(c) GDPR (legal obligation to comply with transport safety regulations).
• Retention: See Section 6.

Billing and Invoicing

• Purpose: To generate invoices, manage subscriptions, process payments, and maintain financial records.
• Legal Basis: Article 6(1)(b) GDPR (contract); Article 6(1)(c) GDPR (tax and accounting obligations).
• Retention: See Section 6.

Security Monitoring and Fraud Prevention

• Purpose: To detect and prevent abuse, fraud, unauthorized access, and security incidents.
• Legal Basis: Article 6(1)(f) GDPR (legitimate interests in network security and fraud prevention).
• Retention: See Section 6.

Customer Support and Communication

• Purpose: To respond to customer inquiries, provide technical support, and communicate platform updates or service notices.
• Legal Basis: Article 6(1)(b) GDPR (contract); Article 6(1)(f) GDPR (customer service and communication).
• Retention: See Section 6.

3.4 Customer eligibility screening

When a business applies to use Mudravia, Mudravia checks, as controller, that the business is eligible under the Terms (§3), that the details it gives are genuine, that the application is not automated abuse, and that the business does not supply or develop competing software. A person at Mudravia makes every decision; no decision is automated.

Data we use. The details entered in the application (organisation name, country, tax identifier, VAT number, registered address, website, transport authorisation number, colegiado number, EORI number and fleet size), the applicant's email address and language, the version of the Terms accepted, the result of each automatic check (outcome, source, date and a short detail), entries in the internal list Mudravia keeps of businesses it cannot serve (the deny-list), and any documents the applicant sends by reply. The fields marked as required in the application are needed to review it; without them Mudravia cannot open an account.

Where the data comes from (Article 14 GDPR). Besides what the applicant enters, Mudravia uses:

• the European Commission's VIES service (validity of a VAT number) and its EORI validation service, both run by the European Commission as an independent public body;
• the DNS records of the applicant's email domain, looked up through the resolver of the hosting provider of Mudravia;
• public registers consulted by a person: the Spanish register of road transport companies (consulted through CRGT), the Registro de Gestores Administrativos, the Official Gazette of the Commercial Register (BORME) and, for other countries, the national business registers;
• the deny-list Mudravia keeps.

Legal bases.

The legitimate-interest assessment is available on request.

Recipients.

• Cloudflare, Inc. (United States) runs the Turnstile bot check on the signup page, which Section 3.6 describes in full. It receives the applicant's IP address and browser signals. The transfer to the United States relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795), under which Cloudflare, Inc. is certified. If that certification lapses or the decision ceases to apply, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) incorporated in Cloudflare's data processing addendum apply instead. Transfer basis confirmed on 09/10/2026: Cloudflare, Inc. appears as an active participant on the Data Privacy Framework List (dataprivacyframework.gov), and Cloudflare's customer data processing addendum (version 6.4) incorporates those clauses.
• The European Commission receives the VAT number or tax identifier (VIES) and the EORI number (EOS) to validate them. It acts as an independent public body, not on behalf of Mudravia.
• Brevo (Sendinblue SAS, France) delivers the emails Mudravia sends about the application.
• Microsoft Ireland Operations Ltd hosts the onboarding mailbox of Mudravia (Microsoft 365), which receives the review copy of each application and the applicant's replies (see Section 4, "Providers Mudravia uses for its own purposes").

Access from India. Staff of Mudravia OÜ who work from India may access application data to review it. The data stays stored in the EU; the access runs through EU infrastructure, is logged and is limited in time. Remote access by the company's own staff is not a transfer to another organisation under EDPB Guidelines 05/2021, provided the conditions of the non-EU support operating model hold (direct employment by Mudravia OÜ, EU-hosted data, logged time-limited access); otherwise it is a transfer under the Standard Contractual Clauses. In either case Mudravia treats it as high-risk processing and protects it accordingly.

How long we keep it.

• A refused application, its history and the locked account: 90 days after the decision.
• A pseudonymised record of a refusal (date, type of applicant, country and reason category; no name, tax identifier or email address): 12 months after the refusal.
• An approved application: for the life of the account, as the record of eligibility. The detail of each check, the website and the detail of the history are removed 12 months after approval.
• A deny-list entry: up to 24 months, renewed only for a written reason.
• Emails about an application in the onboarding mailbox: deleted by hand 90 days after the decision, and automatically after 120 days at the latest.

Decisions and your rights. No decision on an application is automated: a person decides, and uses the checks only as evidence. An applicant may contest a refusal by replying to the refusal email, and a person will look at the application again. The rights in Section 7 apply, including the right to object, under Article 21 GDPR, to processing based on legitimate interests. Write to privacy@mudravia.com. You may also complain to a supervisory authority: the lead authority for Mudravia is the Estonian Data Protection Inspectorate (Section 8); in Spain, you may complain to the Agencia Española de Protección de Datos (AEPD, www.aepd.es).

3.5 Cookies and advertising measurement

The marketing pages carry Google Ads conversion measurement (tag AW-18436294638). Its only purpose is to tell Mudravia which search advertisements lead someone to request pilot access. Nothing is stored on your device, and no identifier is sent, unless you accept it.

On your first visit a banner asks you to accept or reject, and both choices are given equal weight. Until you accept, Google Consent Mode v2 runs with ad_storage, ad_user_data, ad_personalization and analytics_storage all set to denied: no advertising cookie is written, and anything sent to Google is cookieless and carries no identifier for you.

Where you accept, the data reaching Google is your IP address, browser and device information, the advertisement click identifier, and the fact and time that you submitted the pilot form. Mudravia never sends the contents of that form: not your email address, not your name, not your organisation. Mudravia holds no personal data from this measurement itself; it sees only aggregate counts in the Google Ads interface.

Withdrawing your consent. You may change your mind at any time, and doing so is as easy as giving consent in the first place: use Cookie settings at the foot of any page. Withdrawal stops all future measurement. It does not affect the lawfulness of processing carried out before you withdrew (Article 7(3) GDPR).

Roles of Mudravia and Google. Mudravia decides to run this measurement and why; Google decides how the service operates and uses the data for its own purposes as well. For the step in which data is collected in your browser and transmitted to Google, Mudravia and Google act as joint controllers, following the reasoning of the Court of Justice in Fashion ID (C-40/17). For everything Google does with the data afterwards, Google is an independent controller and its own privacy policy governs. The contracting entity for advertisers in the European Economic Area is Google Ireland Limited.

Transfer to the United States. If, and only if, you accept advertising cookies, data reaches Google LLC in the United States. That transfer relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023), under which Google LLC is certified, with the Standard Contractual Clauses of Google applying in addition. The General Court upheld that decision on 3 September 2025 (T-553/23) and an appeal is pending before the Court of Justice (C-703/25 P). Should the decision be annulled, Mudravia will suspend the advertising measurement rather than continue on a doubtful basis. This exception does not touch platform data, which is stored in the EU (its transit through Cloudflare is described in Section 5).

3.6 Pilot requests and the bot check on the website forms

Pilot requests and contact forms. When you request pilot access or contact Mudravia through a form on the website (the pilot-request page in every language and the request forms on the software pages), Mudravia receives what you enter (your email address and, where you give them, your name, company, telephone number, fleet size, country, role and message), the language of the page and the page you came from. The notification of your request also records your IP address and the country that Cloudflare derives from it. Mudravia uses this data only to answer your request and to contact you about the pilot programme. The legal basis is your consent, given with the checkbox on the form (Article 6(1)(a) GDPR); you may withdraw it at any time by writing to privacy@mudravia.com, without affecting the lawfulness of processing before the withdrawal. The request is deleted 12 months after it is submitted, or earlier if you withdraw your consent (Section 6.2); this applies to the copy in the business mailbox as well, which is deleted by hand.

Your request reaches Mudravia through these providers: Cloudflare, Inc. (United States) runs the website and relays the form without storing it; Brevo (Sendinblue SAS, France) delivers the notification email; and Microsoft Ireland Operations Ltd hosts the business mailbox of Mudravia (Microsoft 365), in which the notification is received and kept (Section 4). Once the platform is live, the request is also stored on the servers of Mudravia in the EU (Hetzner Online GmbH, Germany).

Bot check (Cloudflare Turnstile). The signup page (Section 3.4) and the pilot-request and contact forms on the website are protected by Cloudflare Turnstile, a bot check run by Cloudflare, Inc. (United States). When a protected form is shown and submitted, Turnstile processes your IP address and browser signals (for example the browser's identification string and characteristics of the connection), and Cloudflare returns the result of the challenge to Mudravia. Mudravia uses that result only to accept or refuse the submission and does not keep it; the single-use challenge token is never emailed or passed on.

• Purpose: protecting the forms from bots and automated abuse.
• Legal basis: Article 6(1)(f) GDPR: the legitimate interest in keeping the signup and the forms free of automated abuse. Turnstile stores and reads information on your device only as strictly necessary for the submission you requested (Article 22.2 LSSI-CE), so no consent is asked. You may object under Article 21 GDPR (Section 7).
• No advertising use: Mudravia does not use the bot check, or anything it returns, for advertising or measurement. Cloudflare states in its Turnstile privacy addendum that it processes these signals only to detect and block bots, not to identify, profile or target individuals; it also uses them, as a controller in its own right, to improve its bot detection.
• Recipient and transfer: Cloudflare, Inc. (United States). The transfer to the United States relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795), under which Cloudflare, Inc. is certified. If that certification lapses or the decision ceases to apply, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) incorporated in Cloudflare's data processing addendum apply instead.

4. Sub-processors

Mudravia engages the following sub-processors to provide hosting, network and communication services. Personal data that Mudravia processes for its customers is stored, and processed by the application, in the European Union. In transit it passes through the network of Cloudflare, Inc., a United States company, which may handle it outside the EU (Section 5). The services Mudravia uses for its own purposes as controller are not sub-processors; they are described where they are used (Sections 3.4, 3.5 and 3.6) and, for business email, in the paragraph after the table.

Sub-processors Table

Providers Mudravia uses for its own purposes. Microsoft Ireland Operations Ltd (Microsoft 365) hosts the business email of Mudravia for the mudravia.com domain. Pilot requests and contact enquiries from the website are delivered to, and kept in, that mailbox (Section 3.6), and so are the review copies of signup applications and the applicants' replies (Section 3.4), together with the other correspondence of Mudravia with prospective customers and partners. Microsoft acts as processor for Mudravia under its Data Processing Agreement. The mail is stored and processed in the EU, within the Microsoft EU Data Boundary; the EU Standard Contractual Clauses in that agreement cover any residual transfer outside the EU. The data Mudravia processes for its customers is handled in the platform, not in this mailbox, so Microsoft is not a sub-processor of that data.

Not sub-processors. The following run on the servers of Mudravia at the hosting provider above and do not involve any further provider:

• Error tracking and performance telemetry (limited technical metadata, and incidental personal data such as user identifiers in error context): self-hosted by Mudravia in the EU; no third-party monitoring provider receives data.
• AI-powered document extraction (Ollama / Qwen) of invoices, shipping manifests and regulatory filings, which may contain personal data embedded in uploaded documents: self-hosted by Mudravia in the EU; no external transfer and no cloud LLM.

Payments. The pilot is free and no payment data is processed. When paid subscriptions start, Paddle will act as Merchant of Record: it sells the subscription to the customer in its own name and is an independent controller of the payment data it collects, not a sub-processor of Mudravia. This policy will be updated, including on any transfer outside the EU that this involves, before Paddle receives any data.

Data Processing Agreements: Every sub-processor executes a Data Processing Agreement compliant with Article 28 GDPR before it processes personal data.

5. Data Residency

Mudravia stores all personal data within the European Union. Processing also takes place outside the Union only as stated in the last two points below and in the access from India described in Section 3.4. Mudravia:

• Does not use cloud Large Language Models (LLMs) such as OpenAI, Google Cloud AI, or Claude API for processing personal data.
• Runs AI-powered document extraction (Ollama / Qwen) self-hosted within the EU infrastructure of Mudravia, at its hosting provider Hetzner Online GmbH (Germany).
• Sends all traffic to and from the platform (app, api, bff and auth.mudravia.eu) through the network of Cloudflare, Inc. The encrypted connection ends at the Cloudflare location that receives it, where the request is checked for security, and a new encrypted connection carries it to the servers in the EU. Cloudflare can read the data while it passes, does not cache or store its content, and keeps request metadata under its own terms. Mudravia has not bought Cloudflare's option to keep this processing in the EU, so the Cloudflare location may be outside the EU. This is a transfer to the United States under the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), with the Standard Contractual Clauses of Cloudflare's data processing addendum as the fallback.
• Apart from that transit, does not transfer personal data processed for its customers to any country outside the European Economic Area (EEA). Two exceptions concern data Mudravia processes for its own purposes as controller: the bot check on the signup page and on the pilot-request and contact forms, run by Cloudflare, Inc. (Section 3.6), and advertising measurement on the marketing website, only with your consent (Section 3.5). Remote access by staff of Mudravia OÜ working from India is described under "Access from India" in Section 3.4.

6. Data Retention Periods

This section states how long Mudravia keeps each category of personal data. A period is stated where the platform deletes the data automatically when that period ends, or where the law fixes the period and this section says that deletion is not yet automatic. Where no automatic deletion date has yet been set, this section says so: the data is kept until it is deleted on instruction or a deletion date is set, and this policy will be updated when that happens.

6.1 Data Mudravia processes for carrier customers (Processor role)

The carrier customer, as controller, decides how long most of this data is kept. The periods below are the ones the platform applies automatically.

• Vehicle positions: Raw positions received from a vehicle's telematics provider are deleted 15 days after they are received. Before they are deleted, the platform keeps a simplified record of the route each vehicle travelled for each shipment (the path with times, stops of at least 15 minutes with locations rounded to about 100 metres, and the distance). Where building that route record fails, the affected positions are kept until it succeeds, and may in that case be kept for longer than 15 days. The last known position of each vehicle is deleted when no new position has been received for 15 days.
• Route records: Deleted 3 years after the shipment they belong to is delivered, unless the shipment is subject to a litigation hold, which suspends deletion while it stands. The shipment itself is kept as described under "Shipments and documents" below. The route record of a shipment that is never recorded as delivered is kept with the shipment.
• Electronic-signature evidence: Device location and browser identification captured at signing are deleted after 1 year; signature images and the signing audit trail after 3 years; the sealed evidence record after 7 years. Each period is counted from the time the record was created. Deletion is suspended while the record is subject to a litigation hold.
• Spanish transport control documents (DeCA): The public retrieval link stops working 7 days after the shipment it covers is delivered. Once the link has stopped working, the generated document file is deleted 400 days after the document was created (never fewer than 365 days, the legal minimum). The file of a document whose shipment is never recorded as delivered, or that was never submitted, is retained; no deletion date has been set yet. The log of retrievals of a document is deleted 400 days after each retrieval, or earlier when the document file is deleted. The underlying document data is retained; no deletion date has been set yet.
• Emails sent to a carrier's intake address: The raw message as received is deleted after 30 days. Documents extracted from it are kept as described under "Shipments and documents". The sender address and subject line are retained; no deletion date has been set yet.
• Shipments and documents, drivers, carrier staff accounts and trading-partner contacts: Retained; no deletion date has been set yet. They are deleted on the carrier customer's instruction, including on termination of its contract.
• Customs entry summary declarations (ENS): Retained; no deletion date has been set yet. Customs law requires these records to be kept for at least 3 years from the end of the year in which the related customs declaration is accepted, and longer while an appeal or court proceedings are pending (Article 51 of the Union Customs Code, Regulation (EU) No 952/2013).

6.2 Data Mudravia processes for its own purposes (Controller role)

• Applications to use the service (customer eligibility screening): as stated in Section 3.4. Refused applications 90 days after the decision; pseudonymised refusal records 12 months; approved applications for the life of the account, with check details removed after 12 months; deny-list entries up to 24 months; emails in the onboarding mailbox deleted by hand 90 days after the decision, and automatically after 120 days at the latest.
• Pilot-programme requests submitted on the Mudravia website: Deleted 12 months after they are submitted, whether or not the request led to a customer relationship, or earlier if you withdraw your consent.
• Security and audit records: Records of actions taken on the platform (including user identifiers and IP addresses) are deleted after 12 months. Two exceptions apply: records of customs filings are kept until the end of the fourth year after the year in which they were made, because customs law counts its minimum period of 3 years from the end of the year in which the customs declaration is accepted, which can be the year after the filing; and records of the issue and delivery of transport documents are kept for 6 years, because they may be needed as evidence in legal claims and support the carrier's own 6-year duty to keep its business records. A record about a shipment or document that is subject to a litigation hold is kept for as long as the hold stands.
• Server logs: Limited by size rather than by time. Older entries are overwritten as new entries are written.
• Billing records: Kept until the end of the seventh year after the financial year to which they relate (the financial year of Mudravia is the calendar year), the period for which Estonian accounting law requires accounting records to be kept (Accounting Act, § 12). The platform does not yet delete these records automatically at the end of that period.
• Customer contact data that is not part of an accounting record (for example a billing contact's name and email address held for communication): Kept while the customer relationship lasts and then deleted. No automatic deletion date has been set yet.
• Internal system messages that may contain personal data: Retained; no deletion date has been set yet.

6.3 Backups

Backups are encrypted and kept for 30 days. Personal data deleted from the live platform may remain in a backup until that backup expires, and is removed from every backup copy within 40 days of its deletion. Data erased in answer to a data-protection request made through the platform's request process (Section 7.2) is never put back into use: if a backup is ever restored, the platform erases that data again, before the platform is used again. This protection does not yet cover other deletions, such as a record deleted in the ordinary course of using the platform, a deletion made by Mudravia on a customer's written request, or a pilot-programme request deleted by hand; a restore from an older backup could bring such data back until it is deleted again.

7. Data-Subject Rights

7.1 Your Rights

Under GDPR, you have the right to:

1. Access (Article 15): Obtain a copy of personal data Mudravia holds about you, the purposes of processing, and recipients of your data.
2. Rectification (Article 16): Request correction of inaccurate personal data.
3. Erasure (Article 17): Request deletion of personal data ("right to be forgotten"), except where processing is necessary for legal or contractual obligations or other GDPR exceptions.
4. Restriction of Processing (Article 18): Request that processing be limited (e.g., during a rectification dispute).
5. Portability (Article 20): Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller, where the processing is based on consent or on a contract and is carried out by automated means.
6. Objection (Article 21): Object to processing based on legitimate interests (Article 6(1)(f)) or for direct marketing.
7. Automated Decision-Making (Article 22): Request human review of automated processing that produces legal or similarly significant effects on you.

7.2 How to Exercise Your Rights

Where Mudravia processes your data for a carrier customer (Sections 2.1, 2.2, 2.3 and 2.5 — for example, as a driver, a member of a carrier's staff, or a consignor or consignee named on a transport document), the carrier is the controller of that data. Please address your request to the carrier. Mudravia assists the carrier in answering it: the carrier can record your request in the Mudravia platform, which finds the data about you that the platform holds for that carrier.

• A copy of your data. The carrier can give you a file, in a common machine-readable format, that is built to contain only your own data. Scanned documents and emails can show other people, so they are not included automatically: a person checks them, and removes what concerns others, before they are released to you.
• Deletion. Before anything is deleted, the platform shows the carrier a list of every record that holds your data and what will happen to it: deleted; anonymised, which means your details are removed and the rest of the record is kept; kept, with the legal reason and until when; or kept because it is needed for a legal dispute. Nothing is deleted until a named person at the carrier approves that exact list. The platform then deletes no more than what was approved, and records a confirmation of what was done, including anything it left in place because a legal reason to keep it arose after the approval. The confirmation names records only by reference numbers, not by your name or contact details.
• Data the law requires to be kept. Some records must be kept for a period set by law, for example transport control documents, customs records, signature evidence and billing records. These are kept for that period. The list shows the legal reason for keeping each one, so that the reason can be given to you.

Where Mudravia is the controller (Section 2.4, pilot-programme requests submitted on the Mudravia website, and applications to use the service, Section 3.4), please contact Mudravia directly:

Email: privacy@mudravia.com
Mailing Address: Mudravia OÜ, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia

Mudravia handles these requests in the same way: for a deletion, a named person at Mudravia approves the list of records before anything is deleted.

Mudravia may ask you for information needed to confirm your identity before acting on a request. Mudravia will respond without undue delay and in any event within one month of receiving the request. Where a request is complex, or where there are many requests, that period may be extended by up to two further months; Mudravia will tell you of any extension, and the reasons for it, within the first month (Article 12(3) GDPR). Where Mudravia does not act on a request, it will tell you why and inform you of your right to complain to a supervisory authority (Article 12(4) GDPR).

Mudravia keeps a record of each request for three years after it is closed, to show how the request was handled. The record does not keep your email address, tax number or other identifier in readable form: it keeps only a code derived from them, which lets Mudravia recognise a later request from you. If you want another copy of your data later, please make a new request.

8. Complaint to a Supervisory Authority

If you believe that Mudravia is not complying with GDPR, you have the right to lodge a complaint with a data-protection supervisory authority. Mudravia OÜ is established in Estonia, so its lead supervisory authority is:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 39, 10134 Tallinn, Estonia
Email: info@aki.ee · Website: www.aki.ee

You also retain the right to lodge a complaint with the supervisory authority in any EU Member State in which you reside, work, or where an alleged infringement occurs (Article 77 GDPR); in Spain, that is the Agencia Española de Protección de Datos (AEPD, www.aepd.es).

9. Contact Information

For questions about this Privacy Policy, your personal data, or to exercise your rights, please contact:

Mudravia
Mudravia OÜ (registry code 17617532)
Email: privacy@mudravia.com (no Data Protection Officer has been appointed; this mailbox is the data-protection contact point)
Address: Tartu mnt 67/1-13b, 10115 Tallinn, Estonia

10. Changes to This Privacy Policy

Mudravia may update this Privacy Policy, for example when its processing or the law changes. The current version is always published on this page with its "Last Updated" date. Material changes will be communicated to customers in writing before they take effect.

Annex: Sub-processor Authorisation

This Privacy Policy is an information notice, not a contract. Customers authorise Mudravia to engage sub-processors, and to change them on notice with a right to object, in the Data Processing Annex to the Terms of Service (Annex 1, §7). Section 4 lists the sub-processors for information.