Privacy Policy (Interim — Pre-Incorporation)
1. Who is responsible
The Mudravia service is operated by Mukesh Mohanlal Rebari, a sole proprietor resident in India ("we"). We are not established in the EU; the GDPR applies to us under Art. 3(2) because we offer the service to businesses in Spain and process data of people in the EU.
Our EU representative (Art. 27 GDPR): [EU representative — appointment in progress; name, Spanish address and email will be published here]. You may address any data-protection matter to the representative or directly to us at legal@mudravia.com.
An Estonian company (OÜ) is being incorporated and will take over the service; this policy will be replaced when it does.
2. Two roles
- We are the processor for data your organisation uploads to the platform (driver, shipment, consignor/consignee data). Your organisation is the controller; the Data Processing Annex to the Terms of Service governs that processing. Rights requests about that data should go to your organisation; we will assist it.
- We are the controller for the data described in this policy: your account data and website/usage data.
3. Data we process as controller
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, role, organisation (registration) | Provide and administer your account | Art. 6(1)(b) — contract | Account life + 12 months |
| Authentication data, IP, access logs | Security, abuse prevention | Art. 6(1)(f) — legitimate interest in securing the service | 12 months |
| Support correspondence | Answering you | Art. 6(1)(b)/(f) | 24 months |
| Technical error telemetry (may incidentally include user IDs) | Reliability | Art. 6(1)(f) | 90 days |
| Email address, language, referral source (pilot-request form) | Contacting you about the pilot programme | Art. 6(1)(a) — consent, given at the form | Until withdrawn, or 12 months from collection |
You can withdraw the pilot-request consent at any time by writing to legal@mudravia.com; withdrawal does not affect the lawfulness of processing before it.
No marketing use without separate consent. No automated decision-making producing legal effects. No cookies beyond those strictly necessary for login/session; the marketing pages set no cookies at all.
4. Where data lives, and transfers
All personal data is hosted in the EU (Hetzner, Falkenstein, Germany). AI document extraction runs self-hosted on that EU infrastructure — no cloud AI provider receives your data.
No personal data is stored in or exported to India. Although the operator is resident in India, all storage and processing occur on EU infrastructure, and administrative access to raw personal data occurs only through a time-boxed, logged break-glass procedure executed via EU infrastructure, without export of data. If our processing locations ever change, we will implement the appropriate Chapter V GDPR safeguards (Standard Contractual Clauses) and update this policy first.
5. Recipients
Sub-processors: hosting, email delivery and monitoring providers, all EU-based; the current list is available on request at legal@mudravia.com. No sale of data; disclosure to authorities only where legally required.
6. Your rights
Access, rectification, erasure, restriction, portability and objection (Arts. 15–21 GDPR). Write to legal@mudravia.com or the EU representative; we respond within one month. During the pilot, requests are fulfilled manually.
You may lodge a complaint with a supervisory authority — for Spain, the AEPD (www.aepd.es).
7. Changes
Material changes will be notified by email or in-product at least 15 days before taking effect. The controller identity will change to the Estonian company on incorporation (see Terms §11); your rights are unaffected.