Privacy Notice

Carriyo FZ-LLC ("Carriyo", "we", "us", or "our") is committed to protecting the privacy and security of personal information. This Privacy Notice explains how we collect, use, disclose, and safeguard personal data when you use our services, visit our websites, or interact with us.

This notice applies to personal data we process as a data controller (e.g., website visitors, prospective customers, business contacts) and provides transparency about our practices as a data processor on behalf of our customers.

Carriyo FZ-LLC (Dubai, United Arab Emirates) is the data controller for the personal data described in this notice. For privacy-related inquiries:

We collect and process the following categories of personal data:

As a data controller

• Contact information: Name, email address, phone number, company name, and job title when you contact us, request a demo, or sign up for our services.
• Website usage data: IP address, browser type, pages visited, and interaction data collected through cookies and similar technologies.
• Business relationship data: Communication records, contract details, and billing information for our customers and partners.

As a data processor

• Customer end-user data: When our customers use the Carriyo platform, we process personal data on their behalf. This may include order recipient names, delivery addresses, email addresses, and phone numbers. Our customers are the data controllers for this data, and processing is governed by the data processing terms of the customer agreement.

We process personal data for the following purposes:

• Service delivery: To provide, maintain, and improve our platform and services.
• Customer support: To respond to inquiries, provide technical support, and manage customer relationships.
• Security: To protect our systems, detect fraud, and ensure the security of our platform and users.
• Compliance: To comply with legal obligations, enforce our terms of service, and respond to lawful requests.
• Business communications: To send service-related notices, updates, and, where consent is given, marketing communications.
• Analytics: To understand usage patterns, improve our services, and develop new features.

We process personal data based on the following legal grounds under GDPR and applicable data protection laws:

We do not sell personal data. We may share personal data with the following categories of recipients:

• Sub-processors: Third-party service providers who process data on our behalf to deliver our services (see our Sub-processors page for the current list).
• Professional advisors: Legal, accounting, and audit professionals as required.
• Law enforcement: When required by law or to protect our rights.

Sub-processors are assessed under our Supplier Security Policy and are bound by contractual data protection obligations. The current list is published on our Sub-processors page and kept up to date.

Carriyo operates globally and may transfer personal data to countries outside the European Economic Area (EEA) or the originating jurisdiction. Where such transfers occur, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Supplementary technical and organizational measures

We retain personal data only as long as necessary to fulfill the purposes described in this notice:

• Customer data (as processor): Per the customer agreement and our retention policy, after which it is securely deleted.
• Business contact data: For the duration of the business relationship and a reasonable period thereafter.
• Website analytics: Retained for up to 24 months.
• Audit and security logs: Retained for a minimum of 12 months to support security and compliance requirements.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Restriction: Request that we limit how we use your data.
• Portability: Request your data in a structured, commonly used, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact privacy@carriyo.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority if you believe your rights have not been adequately addressed.

Our websites use cookies and similar technologies for essential functionality, analytics, and user experience improvement. You can manage cookie preferences through your browser settings. Essential cookies required for site functionality cannot be disabled.

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption of data at rest (AES-256) and in transit (TLS 1.2+)
• Role-based access controls with least privilege enforcement
• Multi-factor authentication for all administrative access
• ISO 27001:2022 certified Information Security Management System

For more details, see our Infrastructure and Data Handling pages.

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will promptly delete it.

We may update this Privacy Notice from time to time to reflect changes in our practices, legal requirements, or services. Material changes will be communicated through our website or direct notification. The "last updated" date at the top of this page indicates when this notice was last revised.

This Privacy Notice is designed to comply with applicable data protection laws, including:

• EU General Data Protection Regulation (GDPR)
• UK General Data Protection Regulation (UK GDPR)
• Other applicable data protection laws in jurisdictions where we operate