Draft for client review
Source observation date: 15 September 2026. This is not an effective-policy date.
This proposal explains the data-processing position observed on the FreightHub Logistics development website at https://fhl.minvaleev.com and the disclosures needed for communications and freight services. It does not describe the different technology on fh-logistics.com as if it were installed on this development website.
Draft decision note: CLIENT DECISION D01: Confirm the final domain and scope before publication. D02–D09 must be resolved; this proposal is not yet a complete operative privacy notice.
Who is responsible for your data?
FreightHub Logistics’ published office information identifies FreightHub Logistics B.V. in the Netherlands, FreightHub Logistics GmbH in Germany, and FREIGHT HUB SUPPLY CHAIN MANAGEMENT SUZHOU LIMITED in China. A shared brand or office list does not establish which company decides how website visitors’ data is used.
Draft decision note: CLIENT / LEGAL DECISION D02: Insert the website controller’s full legal name, complete serviceable address and direct contact details. Identify the controller separately for office enquiries and freight services. If companies jointly determine a processing activity, identify them, explain their respective responsibilities and make the essence of the joint-controller arrangement available. Do not designate all offices as joint controllers merely because they share a brand.
Draft decision note: CLIENT DECISION D03: Insert an approved, monitored privacy contact. Confirm whether a data protection officer is appointed or legally required and, if applicable, insert their contact details. An office manager or general sales mailbox is not automatically a data protection officer.
Company information is proposed at /legal/. Operational contacts are listed at /contact/; those contacts have not been designated as privacy-request contacts in the evidence reviewed.
Visiting the website
To deliver a page, the website infrastructure receives a network request, including the connecting IP address and request information. Technical request information can include the requested URL, request time, browser and operating-system information and, depending on your browser and the referring page, referrer information. This is different from optional visitor analytics.
The inspected pages delivered their fonts, navigation code and ordinary page assets from the development website’s own origin. The site also runs WordPress emoji-support code and stores a browser-support result in session storage; see /cookie-policy/. No analytics or advertising requests were observed in the bounded page-load check. This does not establish that every page, browser state or server-side service is free of tracking.
Draft decision note: CLIENT / IT / LEGAL DECISION D04: Identify the hosting, network/security and maintenance providers, their recipient roles and access locations, the actual log fields and purposes, and the applicable legal basis. Proposed purpose: delivering and protecting the website. Article 6(1)(f) GDPR may be appropriate for necessary delivery/security processing after a documented necessity and balancing assessment; it is not a confirmed basis for this installation. Specify log retention and access restrictions under D06, and any international access under D07.
Preparing a quotation on the development website
The /request-a-quote/ page is a quotation form. Processing of the details entered there begins only when a visitor submits an activated quotation form. This does not mean the currently held route is active, or that any real submission succeeds, is delivered, quoted or booked.
The interface asks for origin, destination, cargo description, ready date, name, company and email. Optional inputs cover pieces; dimensions and units; weight and unit; volume and unit; stackability; dangerous-goods, high-value and oversized/overweight conditions; temperature requirements; handling notes; phone; preferred office; and an additional message. The interface also contains a privacy checkbox. Required fields relate to the tool’s validation, not to a statutory duty to provide personal data.
Filling in the form does not start processing; processing begins only when a visitor submits an activated quotation form. Submitting the form does not confirm that any enquiry is delivered or that a booking exists. Browser autofill, extensions and session restoration may behave separately from the site’s script; this proposal does not guarantee that closing a tab erases every copy held by your browser. Do not enter identification documents, payment details or unnecessary personal or sensitive information into the quotation form.
Draft decision note: CLIENT / LEGAL DECISION D05: Confirm the final tool behaviour, lawful basis for any personal-data processing by the tool and its point-of-use notice. The current checkbox combines acknowledgement with agreement; checking it is not evidence of a complete valid consent process or a sent request. Proposed replacement for a non-transmitting tool: “I have read the privacy information for this preparation tool.” Do not activate transmission until controller, recipients, legal basis, retention and notice are approved.
The /tracking/ page is an illustrative display. Its current notice states that no live shipment data is connected and the example cannot be queried. It is not a customer tracking account.
Contacting an office and arranging freight
Sending an email to a listed office is a separate action from using the preparation tool. Your email contains the sender details, message and any attachments you choose to send. For an initial enquiry, provide the shipment context and the business contact details needed for a reply; avoid unrelated personal information.
Draft decision note: PROPOSED BUSINESS-PROCESS MODULE — D05: Confirm before treating the following as an account of current operations.
For enquiries, the relevant office would use your contact and shipment details to understand the request, discuss options and prepare a quotation. For an agreed freight service, the relevant entity may need shipper, consignee and other business-contact details, collection and delivery instructions, shipment documents, correspondence and billing information to coordinate transport and administration. Details may be received from you, your company or a party arranging the shipment, rather than directly from every individual named in a document.
The proposed legal-basis allocation is: Article 6(1)(b) GDPR for steps requested by, or a contract with, the individual concerned; Article 6(1)(f) for necessary business-contact and coordination processing where the contract is with a company, subject to an assessment of the interests and safeguards; Article 6(1)(c) only for identified legal duties; and Article 6(1)(a) only where a genuine, specific consent-based activity is approved. These are alternatives for confirmation, not a blanket statement that every basis applies to every record.
Draft decision note: LEGAL DECISION D05: Confirm actual purposes, sources, legal bases and any applicable tax, customs or other legal duty. State what information is necessary for an enquiry or contract and the consequences if it is not provided. Decide how Article 14 information reaches people whose data is supplied by others: ordinarily within one month, or earlier at the first communication or disclosure where applicable. Do not assume publishing this page alone meets that duty.
Recipients and international access
Draft decision note: CLIENT / IT DECISIONS D04, D05 AND D07: Confirm actual recipients before publication. The original client draft proposes office entities, transport providers, agents, customs brokers, warehouses, insurers, IT/email providers, advisers and authorities. Retain only categories actually relevant to each process and distinguish processors acting on instructions from independent controllers.
The existence of a China office does not prove that all website or enquiry data is transferred there. Conversely, an EU-hosted server does not establish that all support access stays in the EEA.
Draft decision note: LEGAL DECISION D07: For each actual transfer or access outside the EEA, identify recipient category, country, purpose and the mechanism actually used. State whether an adequacy decision applies or specify the safeguards and how to obtain a copy. Do not claim that standard contractual clauses, an adequacy decision or processor agreements are in place without checking them.
How long information is kept
The observed emoji-support item uses browser session storage; its separate script freshness check is described in /cookie-policy/. Personal data from the quotation form is processed only after a visitor submits an activated quotation form. That condition does not mean the currently held route stores, delivers or confirms any request.
Draft decision note: CLIENT / LEGAL DECISION D06: Insert approved periods, or sufficiently specific determining criteria where periods cannot be stated, for access/security logs, unanswered and completed enquiries, quotations, shipment records, invoices, rights requests and backups. Tie statutory records to the applicable entity and duty. Define when each period starts, deletion/anonymisation and any justified legal hold. No fixed business retention period has been evidenced.
Security and automated decisions
HTTPS was observed on the development website. That observation is not evidence of encryption at rest, a particular security certification or a complete security programme.
Draft decision note: CLIENT / IT DECISION D08: Approve a proportionate security description supported by the actual access, backup, incident and deletion arrangements. Confirm whether any process uses decisions based solely on automated processing with legal or similarly significant effects, including profiling. The inspected quote tool checks field completeness; it does not calculate a binding rate or decide cargo acceptance. Do not extend that observation to all company systems.
Your rights under the GDPR
Where the GDPR applies, you can request access to your personal data and correction of inaccurate data. Subject to the statutory conditions, you can also request erasure, restriction of processing or data portability. Portability applies to qualifying automated processing based on consent or contract; it is not a right to every business document.
RIGHT TO OBJECT: If processing is based on legitimate interests, you may object on grounds relating to your particular situation. Processing must then stop unless the controller demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed for legal claims. You may object to processing for direct marketing at any time; this includes profiling related to that marketing. This statement of rights does not mean marketing is currently active.
Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of earlier processing. Withdrawal and objection are different rights.
Draft decision note: CLIENT DECISION D03: Insert the approved privacy-request email and postal contact here before release.
The GDPR normally requires a response without undue delay and within one month. A permitted extension of up to two further months must be explained within the first month. Requests are normally free; the GDPR provides limited exceptions. Additional identification information may be requested where there are reasonable doubts about identity, and should be limited to what is necessary.
You may complain to a supervisory authority, in particular in the EU country of your habitual residence, place of work or the alleged infringement. You do not have to contact the company first. The Netherlands authority is the Autoriteit Persoonsgegevens: https://www.autoriteitpersoonsgegevens.nl/. In Hesse, Germany, the authority is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit: https://datenschutz.hessen.de/service/beschwerde-uebermitteln.
Draft decision note: LEGAL DECISION D09: Confirm the entity-specific supervisory-authority information and any representative obligations; these links do not designate a lead authority for a group.
Changes and related information
The final notice should show its actual approval/effective date and be updated before new processing begins. Planned forms, marketing, analytics, third-party embeds or live tracking are not covered as active services merely by appearing in a proposal.
Related proposed pages: Cookie Policy — /cookie-policy/; Legal Notice — /legal/.
Draft decision note: RELEASE DECISION D12: All three routes returned 404 in the development-site check. These are intended links, not verified live policy destinations. Client and qualified legal review remain pending.