Privacy
Policy

Xpeditis operates a professional LCL ocean freight booking platform at www.xpeditis.com, and acts as the controller for the data described here. Any question, access request or exercise of your rights: privacy@xpeditis.com. We answer within one month.

• Identity and contact : name, business email address, phone number • Company : registered name, SIREN and SIRET numbers, address, EORI number • Account : role, language, last sign-in, cookie preferences • Commercial activity : rate searches, booking requests, transport documents, amounts and commissions • Assistant conversations : the content of the questions you ask and the answers you receive • Security and technical : IP address, browser used, sign-in and sensitive-action logs We process no special category data within the meaning of Article 9 GDPR: no health data, no opinions, no biometrics. The service is aimed at professionals, and what you provide concerns your business activity.

Each processing activity rests on a specific legal basis (Article 6): • Providing the service — rate search, bookings, documents, invoicing: *performance of the contract* • Managing your account and authentication — sign-in, two-factor, password reset: *performance of the contract* • Verifying the company at registration through its SIREN or SIRET: *legitimate interest in contracting only with identified professionals* • Securing the platform — access logs, intrusion detection, rate limiting: *legitimate interest* • Retaining accounting records: *legal obligation* • Notifying you about your bookings: *performance of the contract* • Non-essential cookies and commercial communications: *your consent*, withdrawable at any time No decision producing legal effects concerning you is taken solely by automated means (Article 22). Displayed rates and assistant answers support your decision; the decision itself stays human.

The assistant built into the platform runs on OpenAI models. • The content of your messages is sent to OpenAI to produce the answer. • These exchanges are not used to train models: processing goes through OpenAI's business offering, which excludes that use contractually. • The assistant can read your own data — your bookings, your organisation — within the limits of your access rights, and every such lookup is logged. • Your conversations are kept so you can find them again, and deleted on request. As with any service relying on an external provider, do not enter information you would not want leaving the platform.

Your data is never sold, rented or shared for advertising purposes. It is accessible to members of your organisation according to their rights, to specifically authorised Xpeditis staff, and to the carrier concerned when you send them a booking request — in which case only what the carrier needs to perform the transport is shared. It is also processed, on our behalf and on our instructions, by the following processors:

Some of the providers above process data in the United States. These transfers are governed by the standard contractual clauses adopted by the European Commission on 4 June 2021, supplemented by technical measures: encryption in transit and at rest, and limiting transferred data to what is strictly necessary. We rely on no Privacy Shield certification: that mechanism was invalidated by the Court of Justice of the European Union on 16 July 2020 (Schrems II, case C-311/18). A copy of the applicable safeguards is available on request at privacy@xpeditis.com.

• Account and profile : for the duration of the commercial relationship. On closure, the account is anonymised. • Bookings and accounting records : 10 years, under Article L123-22 of the French Commercial Code • Security logs : 12 months • Notifications : 12 months • Assistant conversations : 12 months • Proof of cookie consent : 13 months At the end of these periods, data is deleted or anonymised. Anonymised data can no longer identify you: it is no longer personal data.

• Access and portability : download all of your data from your account, as JSON or a spreadsheet, without writing to us • Rectification : correct your details in your settings, or ask us to do it • Erasure : deleting your account erases your notifications, conversations, API keys and preferences, and anonymises your account and the logs. Accounting records are kept without your identity, as the law requires. • Objection and restriction : you may object to processing based on our legitimate interest, or ask for it to be restricted • Withdrawing consent : at any time, as easily as it was given, without affecting what was done beforehand We answer within one month (Article 12.3). If our answer does not satisfy you, you may lodge a complaint with the CNIL.

• All communications encrypted with TLS • Passwords protected with Argon2: never stored in clear text, never readable by our staff • Session tokens set as httpOnly cookies, out of reach of page JavaScript • Two-factor authentication available • Logging of sensitive actions and administrator access • Sign-in attempt limiting No measure removes all risk. Should a breach be likely to result in a high risk to your rights, you will be informed (Article 34).