In accordance with Art. 13 and 14 of the GDPR, OTSL Sp. z o.o. informs carriers and subcontractors, their representatives, dispatchers and drivers how personal data are processed in connection with establishing and performing haulage cooperation. This covers data provided when applying through the contact form with the subject “Carrier cooperation” as well as data passed on during the performance of individual transport orders. Version 1.0, in force from 5 September 2026.
1. Controller
The controller is OTSL Sp. z o.o., ul. Batalionów Chłopskich 71, 25-671 Kielce, Poland, entered in the register of entrepreneurs under KRS number 0001012523. No data protection officer has been appointed. Contact for personal data matters: info@otsl.pl or the contact form.
2. Categories of data and their source
- Contact details of the carrier’s representatives and dispatchers: name and surname, position, telephone number, e-mail address, the company they represent.
- Drivers’ data passed on for the performance of an order: name and surname, telephone number, registration numbers of the vehicle and trailer and, for journeys to the United Kingdom, Switzerland or Norway, the data required for customs and border declarations (including the GMR in the GVMS system and identity document details needed for the ferry booking and border control).
- Data from the carrier’s verification documents: Community licence and certified copies, CMR liability insurance (OCP) policy, extract from the KRS or CEIDG register, certificates — to the extent that they contain personal data (for example the name of the owner or of the persons representing the company).
Source of data (Art. 14 GDPR). Representatives’ data are received from the representatives themselves. Drivers’ data are received from the carrier that employs or contracts them; the carrier is obliged to inform them that their data have been passed on to OTSL. Data from public registers (KRS, CEIDG, licence register) are taken from those registers.
3. Purposes and legal bases of processing
- Establishing and performing haulage cooperation, including passing on the order, delivery booking, ferry booking and settlement — Art. 6(1)(b) GDPR in respect of sole traders, and in respect of the carrier’s employees and representatives — Art. 6(1)(f) GDPR (legitimate interest of both parties in performing the contract).
- Carrier verification and cargo security: checking the licence, CMR liability insurance, conformity of the vehicle and driver with the order at loading, prevention of fictitious carriers — Art. 6(1)(f) GDPR.
- Compliance with legal obligations: tax and accounting, customs (export, import and transit declarations), obligations under the CMR Convention, the EU Mobility Package and the Polish Road Transport Act — Art. 6(1)(c) GDPR.
- Establishing, exercising and defending claims under the contract of carriage, for cargo damage, delay or demurrage — Art. 6(1)(f) GDPR.
4. Recipients
- OTSL customers (consignors and consignees) — to the extent necessary for delivery: driver and vehicle details for delivery booking and site access;
- OTSL customs agencies in Poland and in the United Kingdom, and the customs and border authorities of Poland, the United Kingdom, Switzerland and Norway;
- ferry operators and terminals for the booking of crossings and vehicle manifests;
- insurers and loss adjusters, law firms, accounting offices;
- IT service providers: hosting, e-mail, order management systems.
5. Transfers outside the European Economic Area
For journeys to the United Kingdom, driver and vehicle data are transferred to British customs and border authorities and to ferry operators on the basis of the European Commission’s decision recognising the adequate level of data protection in the United Kingdom. Transfers to Switzerland are based on the Commission’s adequacy decision; Norway is part of the EEA. In other cases, transfers take place only to the extent required by the customs rules of the country of destination or on the basis of standard contractual clauses.
6. Retention period
- Carrier contact and verification data — for the duration of the cooperation and, after it ends, until the expiry of the limitation periods for claims.
- Data relating to a specific carriage — until the expiry of the limitation period for claims under the contract of carriage: under Art. 32 of the CMR Convention one year, or three years in the case of wilful misconduct or default considered equivalent to wilful misconduct, counted from the date set out in that provision.
- Data in accounting and customs records — 5 years from the end of the calendar year in which the tax payment deadline expired, in accordance with tax and customs regulations.
- Data from a form application not followed by cooperation — until the discussions end, and no longer than 12 months from the application.
7. Rights of data subjects
- the right of access to data and to obtain a copy;
- the right to rectification;
- the right to erasure or restriction of processing — subject to the obligation to retain transport, customs and tax records;
- the right to portability of data processed on the basis of a contract;
- the right to object to processing based on legitimate interest (Art. 6(1)(f) GDPR);
- the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
Requests should be sent to info@otsl.pl. We respond without undue delay and at the latest within one month.
8. Voluntary nature of providing data
Providing data by the carrier is voluntary but necessary to carry out verification, conclude a cooperation agreement and perform orders. Without driver and vehicle data it is not possible to make delivery bookings, customs declarations or ferry reservations.
9. Automated decision-making
The controller does not take decisions concerning carriers or drivers based solely on automated processing, including profiling. Carrier verification is carried out by OTSL staff.
The general rules for processing data in connection with OTSL services are set out in the GDPR information notice, and the rules for website users in the Privacy policy.