Version 2.0 · in force from 26 August 2026
1. Who is responsible for your data
UB Logistics Ltd (the “Company”, “we”) is the controller of the personal data described in this policy within the meaning of Regulation (EU) 2016/679 (GDPR).
- UIC (EIK): 206656554
- Registered address: Varna 9000, Petko Karavelov str. 9A, ap. 212, Republic of Bulgaria
- E-mail: office@ublogistic.com · Phone: +359 866 896 291
We have not appointed a Data Protection Officer, because none of the conditions in Art. 37(1) GDPR applies to us. All data protection matters are handled at the e-mail address above.
2. What this policy covers
It covers personal data we process when you visit this website, send us an enquiry, correspond with us, or when we perform a forwarding contract — including data about people who are not our clients themselves, such as drivers, consignees and contact persons named in shipping documents.
3. What data we process and where it comes from
3.1. Data you give us. Name, company, e-mail, telephone, the route and cargo details, Incoterms, and anything else you write in the contact form or in your message; later, the data needed to conclude and perform the contract.
3.2. Data we receive from others. To move a shipment we receive personal data from our clients, carriers, agents and terminals: names and contact details of contact persons, consignor and consignee details, driver names, driving licence and vehicle data, gate-pass data required by ports and warehouses, and signatures on transport documents. Where a port, terminal or customs authority requires it, this may include an identity document number for site access or border formalities. We process such data only to the extent necessary for that shipment and for the legal obligations attached to it. This section is our information notice under Art. 14 GDPR; where we cannot reach the person directly, we ask the party that provided the data to make this policy available to them.
3.3. Data collected automatically. Our hosting provider records technical data in server logs — IP address, browser type, requested page and time of access — for security and availability of the site.
We do not ask for and do not need special categories of data (Art. 9 GDPR) — health, religion, political views, biometric or similar data. Please do not send them to us.
4. Why we process the data and on what legal basis
- Answering enquiries and preparing an offer — Art. 6(1)(b) GDPR: steps taken at your request before entering into a contract.
- Concluding and performing the forwarding contract — booking, transport, port handling, customs, delivery, invoicing: Art. 6(1)(b) GDPR. Where the data concerns your employees or your counterparties rather than you personally, the basis is Art. 6(1)(f): our legitimate interest in performing the contract we have with your company.
- Customs, tax and accounting obligations — Art. 6(1)(c) GDPR, in particular Regulation (EU) 952/2013 (Union Customs Code), the Bulgarian Accountancy Act, the VAT Act and the Tax and Social Insurance Procedure Code.
- Transport-law obligations — issuing and keeping bills of lading, CMR consignment notes and transit documents: Art. 6(1)(c) GDPR.
- Establishing, exercising and defending legal claims; keeping an archive of shipments; security of our systems — Art. 6(1)(f) GDPR. Our interest is the ability to prove what was agreed and delivered, and to protect the business against claims and abuse; we have weighed it against your interests and process only what is needed for that purpose.
- Commercial e-mails to people who are not our clients — Art. 6(1)(a) GDPR, consent, which you may withdraw at any time with effect for the future.
5. Is providing the data obligatory
Providing the data in the contact form is voluntary, but without a route, a description of the cargo and a way to reach you we cannot prepare an offer. Once a contract is concluded, providing the data required for transport, customs and accounting is a contractual and statutory requirement — without it the shipment cannot be booked, cleared or invoiced.
6. Who receives the data
Only those who need it to move your cargo or to keep us compliant with the law:
- Carriers, shipping lines, port terminals, stevedores, agents, surveyors and warehouses involved in the specific shipment — they act as separate controllers or as our processors, depending on their role.
- Customs, port, phytosanitary, veterinary, tax and other authorities, where the law requires it.
- Our accountants, auditors, bank, insurers and legal advisers.
- IT service providers acting as processors under a contract meeting Art. 28 GDPR — in particular Cloudflare, Inc. (hosting of this website and forwarding of e-mail sent to our domain), Formspree, Inc. (delivery of the enquiry form on this website) and Google LLC (our e-mail service).
We do not sell personal data, do not share it for advertising, and do not disclose it to anyone else without a legal basis.
7. Transfers outside the EU / EEA
International forwarding means that data sometimes has to travel with the cargo. Where a shipment involves a country outside the European Economic Area — for example the United States, China, Türkiye or Ukraine — we transfer to carriers, agents and authorities there only the data necessary for that shipment.
Such transfers take place on one of the following grounds:
- an adequacy decision of the European Commission, where one exists for that country or, in the case of the United States, where the recipient is certified under the EU–US Data Privacy Framework (Art. 45 GDPR);
- standard contractual clauses adopted by the European Commission, supplemented where necessary by additional safeguards (Art. 46(2)(c) GDPR);
- for occasional transfers for which no such instrument is in place — because the transfer is necessary for the performance of the contract with you or of a contract concluded in your interest (Art. 49(1)(b) and (c) GDPR).
Countries such as China, Türkiye and Ukraine are not covered by an adequacy decision, which means the protection there may be weaker than under EU law. You may request a copy of the safeguards we apply by writing to the address in section 1.
8. How long we keep the data
- Enquiries that do not lead to a contract — 12 months from the last contact.
- Shipment files, transport documents and related correspondence — 5 years from completion of the shipment, and longer where a claim or dispute is pending, until it is finally resolved.
- Customs documents — for the period required by the Union Customs Code (at least 3 calendar years) and by Bulgarian customs and tax law.
- Accounting registers and financial statements — 10 years; other accounting documents and documents relevant for tax control — for the periods set out in the Bulgarian Accountancy Act and the Tax and Social Insurance Procedure Code.
- Server logs — up to 12 months.
- Data processed on the basis of consent — until you withdraw it.
When a period expires, the data is deleted or anonymised.
9. Security
We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR): access to data is limited to the people who need it for their work, the website is served over an encrypted connection, accounts are protected by strong authentication, and everyone who handles the data is bound by confidentiality. If a personal data breach occurs and it is likely to result in a risk to your rights, we notify the supervisory authority within 72 hours and inform you where the law requires it.
10. Your rights
Under the GDPR you have the right to:
- be informed and to obtain access to your data and a copy of it (Art. 15);
- have inaccurate data corrected and incomplete data completed (Art. 16);
- have data erased where the conditions of Art. 17 are met;
- restrict processing (Art. 18);
- receive the data you provided in a structured, machine-readable format and have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means (Art. 20);
- object at any time to processing based on our legitimate interest, on grounds relating to your particular situation, and to object at any time to direct marketing (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)).
To exercise any of these rights, write to office@ublogistic.com. We reply within one month; where a request is complex or numerous, we may extend this by two further months and will tell you why. Exercising your rights is free of charge; for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse to act, giving reasons. Where we have reasonable doubts about the identity of the person making the request, we may ask for additional information to confirm it.
You also have the right to lodge a complaint with the Bulgarian supervisory authority — Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, kzld@cpdp.bg, www.cpdp.bg — or with the supervisory authority of the EU country where you live, work, or where the alleged infringement took place. You may also seek a judicial remedy.
11. Automated decision-making
We do not take decisions producing legal or similarly significant effects for you based solely on automated processing, and we do not carry out profiling.
12. Children
This website and our services are addressed to businesses. We do not knowingly collect data of persons under 18. If you believe we hold such data, write to us and we will delete it.
13. Cookies and browser storage
This website sets no advertising, analytics or profiling cookies, and does not track visitors across websites. It stores a single item in your browser’s local storage — the language you selected — so that the site opens in that language on your next visit. That item stays in your browser, is never transmitted to us, and can be deleted through your browser settings. Because it is strictly necessary to provide the service you explicitly requested, no consent is required for it under Art. 5(3) of Directive 2002/58/EC. If we later add analytics or any non-essential technology, we will ask for your consent beforehand and update this policy.
14. Changes to this policy
We update this policy when our processing or the applicable law changes. The version in force is always the one published here, with its version number and date at the top. Where a change materially affects you, we will inform you before it takes effect.
