The Turkish version of this document is the original and binding text. This English version is a faithful translation only; in the event of any conflict or difference in interpretation between the Turkish and English versions, the Turkish text shall prevail.
1. Introduction and Scope
1.1 Purpose
This Privacy Policy (the "Policy") is prepared to explain the purposes, legal bases, methods of collection, recipients, retention periods and data-subject rights relating to personal data processed through the Logistivo logistics technology platform, websites, dashboard/portal interfaces, mobile applications (iOS and Android), application programming interfaces (API) and all related services (the "Platform" or "Services"), operated by Forwardie Lojistik A.Ş. (the "Company", "Logistivo", "we", the "data controller").
1.2 Legal Framework
This Policy has been prepared in compliance with applicable data protection legislation, primarily including:
the Turkish Law No. 6698 on the Protection of Personal Data (the "PDPL"/"KVKK") and related secondary legislation (the primary/principal framework);
for EU data subjects, the General Data Protection Regulation (the "GDPR" — Regulation (EU) 2016/679) (the bridge/compliance framework);
for subscription/membership relationships, the Distance Contracts Regulation and Law No. 6502 on Consumer Protection (to the extent applicable);
legislation on cookies/tracking technologies and the guidelines of the Turkish Personal Data Protection Board.
1.3 Distinction Between PDPL Disclosure and Explicit Consent
This Policy is a disclosure (transparency) document under the PDPL. For processing activities that require explicit consent under the PDPL, a separate "Explicit Consent Statement" is provided, and explicit consent is obtained separately, freely given, specific and informed. Explicit consent is not made a precondition for the use of the core service; even if you decline consent-based processing (e.g., certain marketing communications or some cross-border transfers), the core functions of the Platform may still be used to the extent they do not technically depend on such consent.
1.4 Who Is Covered
This Policy applies to registered customers (shippers/cargo owners), carriers (transporters), customs consultants, drivers, the authorized users and employees of these parties, the related persons registered on the Platform as Business Contacts, Platform visitors, and other natural persons who interact with the Services.
1.5 Third-Party Content and Links
The Platform may contain links to third-party websites or services. This Policy covers only Logistivo's processing activities; Logistivo is not responsible for the privacy practices of third parties.
2. Identity of the Data Controller
The data controller within the meaning of the PDPL and the GDPR is the following legal entity:
To the extent Logistivo processes the data of EU data subjects falling within the scope of the GDPR, it acts as a controller within the meaning of the GDPR. If and when an EU representative is required to be appointed, this Policy will be updated accordingly.
Field — Information
Trade name — Forwardie Lojistik A.Ş. (a Turkish joint-stock company)
Tax ID (VKN) — 3881490269
Tax Office — Kordon V.D.
Address — İzmir Bilimpark, Kazımdirik Mah. 372/10 Sk. No: 49 Interior Door No: 1, Bornova/İzmir, Türkiye
General email — info@logistivo.com
Support — support@logistivo.com / carrier-support@logistivo.com
Governing law / jurisdiction — Turkish law; Courts and Enforcement Offices of İzmir
2.1 The Platform's Role — Intermediary Technology / Marketplace
Logistivo is an intermediary technology platform / marketplace; it brings together cargo owners (customers), carriers, customs consultants and drivers in a digital environment. For data protection purposes, this role has the following consequences:
Logistivo is not a party to the carriage/freight contract concluded between users; it is not a carrier, freight-forwarding commission agent, freight forwarder, insurer or customs consultant; it does not take possession of the cargo.
The relevant users are responsible for the content, accuracy and lawfulness of the business data (demands, loads, bids, Business Contact information, chat content, etc.) flowing between users.
With respect to personal data that users provide to one another, Logistivo acts as the party providing the technical infrastructure and processing such data for its own defined purposes (operating the Platform, security, legal obligations); however, content decisions regarding the substance of the business relationship between the parties are made by the users.
3. Categories of Personal Data We Collect
The table below sets out the full inventory of categories of personal data actually processed by the Platform. Logistivo does not routinely intend to collect personal data in categories not listed in this table.
Special-category / sensitive data notice: Location data (3.6) and scanned official identity documents (3.7) are, by their nature, high-risk personal data. These categories are processed only to the extent required by the relevant function (e.g., driver location tracking, document verification), limited to that purpose, and, where possible, on the basis of explicit consent.
# — Category — Data Covered
3.1 — Identity and Account — Name, email, phone, office phone, password (stored only as a hash), user code, two-factor authentication status, language preference, avatar/profile image.
3.2 — Driver — Driver login credential (a temporary login code/link generated by the carrier, valid for a limited time only), information on whether the mobile application is installed.
3.3 — Company / Organization — Trade name, tax ID/number, tax office, company type, address, logo, tier (package/membership level).
3.4 — Business Contact and Related Persons — Name, title, tax/VAT number, country/city/postal code, address, email, phone; related person details (first name, last name, email, phone, title).
3.5 — Financial — IBAN, BIC/SWIFT, account holder, bank name, currency; tokenized card data (payment-institution token, last 4 digits of the card, cardholder name, expiry date). The raw card number (PAN) is never stored.
3.6 — Location (SENSITIVE / high-risk) — Real-time driver GPS location, route/location history records, background location collection (only during an active/assigned load).
3.7 — Documents (SENSITIVE) — Uploaded files (on an EU-based cloud infrastructure & storage provider), official ID/passport/driving licence scanned via camera (may include an identity number), information obtained from documents and document verification result.
3.8 — Transactional — Demands, loads, bids, participants (sender/recipient/carrier/customs and related parties), price and credit information.
3.9 — Communications — Chat messages (original and translated versions, together with a content-compliance review result).
3.10 — Device / Push — Push notification token, platform, device model/operating system/app version, user-agent, notification permission status; an anonymous identifier for logged-out web users.
3.11 — Onboarding / Verification — Information processed during the membership/verification process (including registration-source information), OTP / verification code.
We collect personal data through the following channels:
Web interface (dashboard/portal): Data you enter directly when creating an account, registering a company and Business Contact, creating a demand/load/bid, and performing invoicing and payment transactions.
Mobile applications (iOS / Android): In-app forms, document scanning via camera, push notification registration, sign-in.
API: Business data transferred via authorized integrations and external systems (e.g., the integration/data-bridge partner's webhook bridge).
Cookies and trackers: For session management on web and in-app, preference retention and basic analytics (see Section 7).
Driver device GPS / background location: Location data collected in the driver mobile application only during an assigned and active load, within the scope of explicit consent and operating-system permissions.
Camera / document scanning: Scanning of official ID, driving licence, passport and other documents via the camera, and their processing.
Automatically generated data: Device/technical information, log records, country information derived from IP, document type information.
Third-party service providers: Processing outputs received via the payment processor, e-invoice provider, mapping/geo services, etc.
5. Purposes of Processing
We process personal data for the following purposes:
Provision of the service: Account creation and management, authentication, two-factor verification, driver login via a temporary login code.
Marketplace matching: Management of demands, loads, bids and participants; enabling the parties to find one another and form a business relationship.
Operations and logistics: Driver location tracking for assigned loads, route display and operational coordination (only with authorized participants).
Document processing: Storing uploaded/scanned documents, processing them, and determining their type.
Payment and invoicing: Collection via card tokenization, subscription renewal, invoice and e-invoice generation, accounting records.
Communications: Providing the chat/messaging function; translating messages and performing content-compliance review.
Notifications: Sending transactional and (within the scope of consent) informational/marketing notifications via push/email.
Security and fraud prevention: Log/audit records, anomalous-activity detection, preservation of multi-tenant data isolation.
Legal obligations: Compliance with tax, commercial and accounting legislation; responding to requests from competent authorities.
Improvement and error monitoring: Enhancing service quality, error/crash monitoring (with personal data minimized).
Management of referral/affiliate and sponsorship programs: Referrer attribution, commission calculation, sponsorship quota management.
Each processing activity relies on one or more of the following legal bases. For EU data subjects, the corresponding GDPR Article 6 bases are indicated in parentheses.
Account creation, provision of the service, payment/subscription, invoicing — Necessary for the conclusion/performance of a contract (Art. 5/2-c) — Art. 6(1)(b) (performance of a contract)
Marketplace matching, Business Contact management, participant visibility — Performance of a contract + legitimate interest (Art. 5/2-c, f) — Art. 6(1)(b), Art. 6(1)(f)
For processing based on legitimate interest, Logistivo performs a balancing test between its own (and users') legitimate interest and the fundamental rights and freedoms of the data subject. Where the data subject's rights and freedoms prevail, the processing is not carried out or a right to object is granted (see Section 12).
6.2 Explicit Consent and Withdrawal
For consent-based processing, consent is freely given through the relevant channel (in-app approval, separate consent statement, etc.) and may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Upon withdrawal, the relevant processing is stopped unless another legal basis exists.
7. Cookies and Trackers
The Platform uses cookies and similar tracking technologies for session management, security, preference retention and basic analytics. Cookies other than strictly necessary/technical cookies rely on consent to the extent required.
The cookie categories, retention periods and methods to reject/manage them are explained in detail in a separate Cookie Policy. This Policy refers to and is supplemented by the Cookie Policy.
7.1 No Tracking in Mobile Applications
Our mobile applications (iOS and Android) do not read your device's advertising identifier (IDFA / Advertising ID); contain no third-party components for advertising, advertising attribution or device fingerprinting; do not combine data collected in the app with third-party data for targeted advertising; and do not transfer your personal data to data brokers. The measurement and marketing trackers that may be used in the web interface are not run on web pages opened inside the app.
For these reasons, our mobile applications do not perform tracking within the meaning of Apple's App Tracking Transparency (ATT) framework or Google Play's Advertising ID policy. For details, see the Cookie Policy, Section 2.6.
8. Third Parties and Sub-Processors
The following sub-processors/service providers are used to provide the Services. Logistivo intends to work with these providers under appropriate confidentiality and data security obligations and transfers data only to the extent required by the relevant service.
The providers listed above may change depending on service agreements and technical requirements. When the list is updated, this Policy will be revised (see Section 15).
Sub-Processor — Function — Data Location — Risk / Transfer
Third-party IP geolocation services — Country detection — USA/EU — Mixed
Error/exception monitoring tool — Error monitoring — USA (default) — Cross-border (transmission of personal data is minimized)
Public-holiday calendar data provider — Public-holiday calendar (contains no personal data) — USA — Cross-border (no personal data)
Integration / data-bridge partner (webhook bridge) — Load/carrier data sharing (external system) — Türkiye — Domestic
8.1 Sub-Processor Changes and Notification
Where Logistivo plans to replace an existing sub-processor or to add a new one:
The current sub-processor list is kept up to date in the table above and, where appropriate, on a separate sub-processor page; each change is reflected by renewing the Effective Date and Version information at the top.
For a material sub-processor change (in particular, an addition that creates a new cross-border transfer), affected data subjects are notified in advance within a reasonable period through an appropriate channel (in-Platform announcement and/or email).
For consent-based processing (e.g., certain cross-border transfers), if a new sub-processor expands the scope of consent, your separate explicit consent is obtained for that processing; if you do not consent, the relevant consent-dependent processing is not carried out.
Within the meaning of GDPR Art. 28(2)–(4), your right to object to the addition of new sub-processors is reserved. You may submit your objection through the channels in Section 16; in such a case, a reasonable alternative is considered, or the scope of the relevant consent-dependent service may be limited.
8.2 Other Disclosures
Personal data may also be shared: (i) within the framework of legally valid requests from competent public authorities; (ii) to fulfil legal obligations; (iii) to the extent necessary to protect/defend Logistivo's rights and interests; and (iv) in the event of a merger, transfer or similar corporate transaction — within the framework of applicable legislation.
8.3 Sharing With the Affiliate Who Invited You
If you reached the Platform through the invitation or personal referral link of an affiliate, then from the moment you start your registration your contact details (full name, e-mail, telephone, company name), your registration progress, your company approval and document completion status (only the names of missing documents) and your package/payment status are transferred to the affiliate company that invited you.
The purpose is to enable the affiliate to support you during registration and to follow up on the membership relationship they brokered. Your commercial activity on the Platform (loads, demands, bids, customers, prices, turnover), your chat contents and the contents of the documents you upload are never shared with the affiliate.
You may object to this sharing; if you object, the transfer is stopped and this does not prevent you from using the Platform. For details see Section 5.5 of the KVKK Clarification Text.
9. Cross-Border Transfers and Safeguards Applied
For the sub-processors marked as located in the USA or in mixed locations in Section 8, personal data is transferred abroad. These transfers are/will be carried out:
Transparency statement: Logistivo takes, and continues to take, the necessary steps to ensure appropriate safeguards with these sub-processors (e.g., standard contractual clauses / PDPL undertakings and equivalent mechanisms). Work to establish such safeguards is ongoing, and these safeguards are/will be provided. Transfers occurring within the EU (e.g., an EU-based storage provider) carry comparatively lower risk.
For EU data subjects, you may request a copy of the appropriate safeguards under GDPR Art. 46 or be informed where GDPR Art. 49 derogations apply.
to the extent possible and necessary, on the basis of your explicit consent; and/or
within the framework of the appropriate safeguards required by the PDPL and the GDPR.
10. Retention Periods
Personal data is retained for as long as required by the processing purpose and for the minimum/maximum retention periods prescribed by applicable legislation. Once the purpose ceases or the legal period expires, the data is deleted, destroyed or anonymized. The table below summarizes Logistivo's proposed/applied retention schedule (company policy); details are set out in a separate Retention and Destruction Policy.
Important — legal limit on deletion: For data that must be retained under tax legislation (e.g., e-invoice and accounting records), deletion requests cannot be fulfilled until the relevant legal retention period (~10 years) expires. In such cases, the data is isolated from the processing purpose and retained solely within the scope of the legal obligation.
Data Type — Retention Period (Company Policy)
Financial / invoice records — 10 years (Tax Procedure Law / Turkish Commercial Code)
Contract and membership records — Duration of the relationship + 10-year statute of limitations
Explicit consent records — Until consent is withdrawn + a reasonable additional period for evidence
Driver location history — Active load + operational dispute period (proposed: 1 year), then anonymization/deletion
Chat messages — While the account is active + a defined purge after soft-delete (proposed: 1 year)
Scanned documents — Transaction purpose + legal retention period; deletion once the purpose ends
Push notification token — While the device is registered + cleanup after 90 days of inactivity
Logs / audit — 1–2 years
Cookies — Per category (session / 6–12 months)
11. Data Security
Logistivo takes appropriate technical and administrative measures to prevent the unlawful processing of and access to personal data, and to ensure its preservation. The principal measures are:
Technical Measures
Administrative Measures
No system can guarantee absolute security. Logistivo is obliged to take reasonable measures; however, it cannot entirely eliminate the risks inherent in transmission over the internet and electronic storage.
Encryption in transmission and storage (TLS in transit; passwords stored only as a hash).
Card tokenization: Payment card data is tokenized at a PCI-DSS-compliant payment processor; the raw card number (PAN) is not stored in Logistivo's systems.
Multi-tenant data isolation: Queries are isolated per company (tenant); cross-company data leakage is prevented.
Access control and authorization: Role-based access; administrator access to the internal management interface is limited and logged.
Logging and audit: Audit/log records are kept for critical operations.
Soft-delete and controlled destruction: Deleted records are marked via soft-delete and permanently destroyed according to the retention schedule.
Appropriate confidentiality/security obligations with service providers.
Limitation of access rights on a "need-to-know" basis.
Data minimization (e.g., minimizing the personal data sent to the error/exception monitoring tool).
11.1 Data Breach Notification Procedure
In the event of unlawful acquisition, loss, disclosure of, or unauthorized access to personal data (a "data breach"), Logistivo applies the following notification procedure:
Notification to the Board (PDPL Art. 12/5): Where it is established that processed personal data has been unlawfully obtained by others, Logistivo notifies the Turkish Personal Data Protection Board of this situation as soon as possible and within the period prescribed by the Board's regulation and decisions on breach notification (as a rule, within 72 hours).
Notification to data subjects (PDPL Art. 12/5): The data subjects affected by the breach are informed as soon as reasonably possible through an appropriate channel (in-Platform notice and/or email); the notice explains the nature of the breach, the categories of data likely to be affected, its probable consequences, the measures taken/to be taken, and the application channels.
GDPR compliance (Arts. 33–34): For breaches affecting EU data subjects, the personal data breach is notified to the competent supervisory authority — as a rule, within 72 hours of becoming aware of it; and where the breach is likely to result in a high risk to the rights and freedoms of data subjects, the affected data subjects are also notified without undue delay.
Internal process: Logistivo follows an internal response process covering detection, recording (a breach register), impact assessment, containment and remediation steps; for breaches originating from sub-processors, the relevant provider is expected to inform Logistivo without undue delay.
12. Data Subject Rights
12.1 Rights Under the PDPL (Art. 11)
As a data subject, you have the right to: (a) learn whether your personal data is processed; (b) request information if it has been processed; (c) learn the purpose of processing and whether it is used in accordance with that purpose; (ç) know the third parties to whom it is transferred domestically or abroad; (d) request rectification of incomplete/incorrect data; (e) request its erasure/destruction; (f) request that rectification/erasure operations be notified to third parties to whom the data has been transferred; (g) object to a result against you arising solely from automated processing; and (ğ) claim compensation if you suffer damage.
12.2 Rights Under the GDPR (EU data subjects)
EU data subjects additionally have the rights of: access (Art. 15), rectification (Art. 16), erasure/"right to be forgotten" (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing (Art. 21), withdrawal of consent (Art. 7(3)), and lodging a complaint with a supervisory authority (Art. 77).
12.3 Limits of Rights
Erasure and similar requests are assessed within the relevant limits in the presence of legal retention obligations (e.g., the ~10-year retention under tax/accounting legislation), a need to retain data for the resolution of disputes, or another legal basis. In such cases, the request may not be fulfilled for as long as the legal impediment remains valid; the reason is communicated to the applicant.
12.4 How to Apply, Response Time and Identity Verification
To exercise your rights, you may apply through the channels in Section 16.
Response time (statutory): Logistivo concludes applications as soon as possible depending on their nature, and in any event no later than thirty (30) days. This period is a statutory maximum under the PDPL and the Communiqué on the Procedures and Principles of Application to the Data Controller; the scope or complexity of the request does not extend it. For EU data subjects, under GDPR Art. 12(3) the response period is, as a rule, one month (which may be extended to the extent permitted by law in justified cases, in which event you are notified together with the reasons).
Fee: Applications are, as a rule, concluded free of charge; where the operation entails additional cost, only the fee in the tariff set by the Board may be charged.
Identity verification (mandatory): In order to confirm that the application is made by the data subject in person and to prevent disclosure of personal data to unauthorized persons, Logistivo may request reasonable information/documents to verify the applicant's identity (e.g., confirmation via the email associated with the account, matching against registered information). For applications made by proxy, a valid power of attorney/authorization document is requested. If identity cannot be reasonably verified, the request may not be processed — until verification is completed — for security reasons; the applicant is informed of this.
Form of response: The response is provided in writing or electronically (email/KEP), as appropriate to your request.
13. Children's Data
The Platform is intended only for users aged 18 and over and for business-to-business (B2B) use. We do not knowingly collect personal data from children. If we become aware that a child's data has been processed without consent, we delete the relevant data within a reasonable time. If you have any such observation, please notify us through the channels in Section 16.
14. Automated Processing and Artificial Intelligence
The Platform uses artificial intelligence (AI) and automated processing in certain functions. Important limitations regarding these functions:
The AI assistant is not a human. Responses generated by the AI are for informational purposes; they do not constitute professional, legal, financial, customs or tax advice and do not replace such advice.
OCR / AI accuracy disclaimer: Text extracted from scanned documents (OCR) and document classification/verification performed by AI may be erroneous or incomplete. Logistivo does not guarantee the accuracy of these outputs — particularly for official, legal or tax declarations; the responsibility for final verification lies with the user.
Chat analysis: Messages may be automatically reviewed to detect sensitive-data sharing. This feature is not active moderation; it provides no guarantee of content moderation.
Solely automated decisions: Logistivo does not intend to make decisions based solely on automated processing that produce legal effects concerning, or similarly significantly affect, the data subject. Where such processing occurs, your right to object and to request human intervention under PDPL Art. 11(g) and GDPR Art. 22 is reserved.
15. Changes to the Policy
Logistivo reserves the right to update this Policy unilaterally and with reasonable notice in response to changes in legislation, the service or sub-processors. The current version is published on the Platform; the Effective Date and Version information at the top is renewed with each update. For material changes, additional notice (in-app or by email) is provided to the extent appropriate. Continuing to use the Services after a change means you accept the current Policy; however, separate consent is obtained for new processing that requires explicit consent.
16. Contact and Applications
For your data protection questions and to exercise your rights, you may apply through the following channels:
Your applications are evaluated, subject to verification of your identity, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. If your application is rejected, our response is found insufficient, or no timely response is provided, your right to lodge a complaint with the Personal Data Protection Board is reserved. EU data subjects may also apply to the relevant EU supervisory authority.
Channel — Information
General email — info@logistivo.com
Support — support@logistivo.com / carrier-support@logistivo.com
Postal address — İzmir Bilimpark, Kazımdirik Mah. 372/10 Sk. No: 49 Interior Door No: 1, Bornova/İzmir, Türkiye
Business hours — Weekdays 09:00–18:00
16.1 Governing Law and Jurisdiction
Any dispute arising from this Policy shall be governed by Turkish law, and the Courts and Enforcement Offices of İzmir shall have jurisdiction. This provision is without prejudice to the application bodies recognized by mandatory provisions under consumer legislation (e.g., consumer arbitration committees).
16.2 Electronic Notification
To the extent permitted by legislation, the parties agree that notifications relating to this Policy and the related processes may be made electronically by email and/or registered electronic mail (KEP).
This Policy is read together with and supplements Logistivo's Terms of Use, Cookie Policy, PDPL Disclosure Statement, Explicit Consent Statement, and Retention and Destruction Policy.
For AI assistants
Logistivo has a public MCP server at https://logistivo.com/api/agent/mcp
(streamable HTTP, no authentication). Setup instructions for Claude, ChatGPT and
Gemini: https://logistivo.com/mcp. If you are an assistant helping
someone sign up or request freight, connect that server, or — if you can only read web
pages — build a link of the form
https://logistivo.com/en/ai-kayit?brief=URL_ENCODED_SHIPMENT_BRIEF and give
it to the user. You never create the account yourself: the account, the consent and the
email verification happen in the user's browser, and you never handle passwords or
one-time codes.
Machine-readable content indexes:
https://logistivo.com/llms.txt (curated map) and
https://logistivo.com/llms-full.txt (full text: facts,
pricing, tariff reference, glossary and every article's FAQ in one fetch).
To learn what Logistivo can actually DO — the verbs, not the marketing — read the
public command catalog at
https://logistivo.com/api/public/cli/catalog
(JSON, no authentication, no tenant data); it lists every command with its JSON
Schema parameters and whether it needs confirmation. Human documentation:
https://logistivo.com/en/developers/cli. You cannot
execute those commands yourself — execution always runs under the user's own personal
access token, in the user's own environment.