Privacy Policy

1. WHO WE ARE

Tracking One is operated by:

MLab Digital Business Expertise L.L.C-FZ
Registered in Dubai, United Arab Emirates.

For purposes of applicable data protection law, Tracking One may act:

• as a controller, where we determine the purposes and means of processing personal data; and
• as a processor, where we process personal data on behalf of a business Customer under its instructions.

Our contact details are provided in Section 31.

2. APPLICABLE DATA PROTECTION FRAMEWORK

Depending on the circumstances, our processing may be subject to:

• UAE Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data;
• Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”);
• applicable United Kingdom data protection law; and
• other applicable privacy or data protection laws.

Nothing in this Privacy Policy is intended to limit rights that cannot lawfully be limited under applicable law.

3. SCOPE AND OUR ROLE

This Privacy Policy applies to personal data relating to:

• website visitors;
• registered users;
• prospective Customers;
• Customers and their personnel;
• representatives of Customers;
• API users;
• sales contacts;
• billing contacts;
• support contacts; and
• other individuals who interact with Tracking One.

3.1 Tracking One as Controller

Tracking One generally acts as controller for personal data processed for:

• Account registration and administration;
• authentication;
• customer relationship management;
• sales and commercial communications;
• billing and accounting;
• payment administration;
• website analytics;
• security;
• fraud prevention;
• legal and regulatory compliance;
• Service improvement; and
• permitted business-to-business marketing.

3.2 Tracking One as Processor

Tracking One may act as processor where it processes personal data contained in Customer Data on behalf of a Customer.

Where required by applicable law, such processing shall be governed by an applicable Data Processing Addendum (“DPA”).

The Customer remains responsible for determining the lawful basis for the personal data it instructs Tracking One to process.

4. PERSONAL DATA WE COLLECT

The categories of personal data we process depend on how you interact with Tracking One.

4.1 Account Data

We may process:

• first and last name;
• work email address;
• company name;
• job title;
• telephone number, where provided;
• account identifier;
• authentication information;
• login history;
• user preferences; and
• security-related account information.

4.2 Authentication Data

Tracking One may support:

• email and password authentication;
• passkeys; and
• Google sign-in.

Where you choose Google sign-in, we may receive limited information made available through the authentication process, such as:

• name;
• email address;
• Google account identifier; and
• other information authorized through the relevant sign-in flow.

Tracking One does not receive your Google account password through Google sign-in.

Authentication information is used to create, connect, secure and authenticate your Tracking One Account.

5. BUSINESS AND CUSTOMER DATA

We may process business information including:

• Customer legal name;
• registration details;
• registered address;
• billing address;
• tax identification information;
• VAT information where applicable;
• business contact information;
• contractual information;
• Commercial Offers;
• Orders;
• purchased Services;
• Shipment Credit information;
• billing status; and
• customer relationship history.

6. SHIPMENT AND TRACKING DATA

Tracking One is designed primarily to process logistics and transportation information.

Shipment Data may include:

• bill of lading numbers;
• booking references;
• container numbers;
• air waybill numbers;
• other supported tracking identifiers;
• shipment statuses;
• tracking events;
• event dates and times;
• transport type;
• routes;
• origin and destination information;
• carrier information;
• vessel or aircraft-related information;
• estimated arrival or departure information; and
• shipment history.

Tracking One’s standard shipment tracking functionality is not designed to collect or store information concerning the contents of cargo or personal details of shippers, consignees, passengers or other natural persons.

Customers should not submit personal data, sensitive information, cargo-content information or unrelated confidential information into fields intended solely for tracking identifiers or standard tracking functionality.

Shipment Data ordinarily consists of logistics information and is not intended to identify natural persons.

However, where any Shipment Data constitutes personal data under applicable law, it will be treated as personal data.

7. PAYMENT AND BILLING DATA

We may process:

• billing contact information;
• invoice information;
• transaction identifiers;
• payment amounts;
• payment currency;
• payment date;
• payment status;
• refunds;
• chargebacks; and
• related accounting records.

Payment processing may be provided through Stripe.

Where Stripe processes payment-card information directly, Tracking One does not need to receive or store full payment-card credentials for the transaction.

Stripe may process information under its own applicable privacy and contractual framework.

8. TECHNICAL AND USAGE DATA

When you use tracking.one, the Platform or API, we may process technical information including:

• IP address;
• browser type;
• operating system;
• device type;
• session identifiers;
• login events;
• timestamps;
• pages accessed;
• functionality used;
• API requests;
• error information;
• system activity;
• security events; and
• technical performance information.

We may also process information concerning:

• number and type of tracking requests;
• API usage;
• Shipment activity;
• feature usage;
• Account activity; and
• Service configuration.

9. COMMUNICATIONS AND SUPPORT DATA

Where you communicate with Tracking One, we may process:

• name;
• email address;
• company;
• correspondence;
• sales enquiries;
• support requests;
• complaints;
• feedback;
• technical information supplied during troubleshooting; and
• other information voluntarily provided in communications.

Corporate email communications are currently provided through Google Workspace / Gmail.

10. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

10.1 Directly from You

For example, when you:

• register an Account;
• contact us;
• request a proposal;
• purchase Services;
• use the Platform;
• communicate with sales or support; or
• provide information through a form.

10.2 From Customers

A Customer may provide information concerning its authorized users, employees, representatives or other business contacts.

10.3 Automatically

Technical, security, usage and analytics data may be generated automatically when the Services are used.

10.4 From Third Parties

We may receive information from:

• supported authentication providers;
• payment providers;
• transportation and tracking data sources;
• carriers;
• technology providers;
• public sources; and
• other legitimate sources.

11. HOW WE USE PERSONAL DATA

We may process personal data to:

• create and administer Accounts;
• authenticate users;
• provide shipment tracking Services;
• process tracking requests;
• display Shipment history;
• provide API access;
• process Orders;
• issue invoices;
• administer payments;
• provide support;
• communicate with Customers;
• send operational and security messages;
• provide notifications and alerts;
• maintain and secure the Services;
• detect unauthorized access;
• prevent fraud and misuse;
• conduct business verification;
• conduct sanctions and compliance checks;
• troubleshoot errors;
• monitor technical performance;
• analyze Service usage;
• improve functionality;
• maintain records;
• comply with legal obligations;
• establish, exercise or defend legal claims; and
• conduct permitted B2B marketing.

12. LEGAL BASES UNDER GDPR

Where GDPR applies, we rely on one or more of the following legal bases.

12.1 Performance of a Contract

Processing may be necessary to:

• create and operate an Account;
• provide Services;
• administer an Order;
• authenticate users;
• process payments;
• provide support; or
• take requested steps before entering into a contract.

12.2 Legitimate Interests

We may process personal data where necessary for legitimate interests such as:

• operating a B2B SaaS platform;
• maintaining customer relationships;
• securing the Services;
• preventing fraud and abuse;
• monitoring technical performance;
• improving the Services;
• maintaining business records;
• protecting contractual rights; and
• conducting appropriate B2B marketing.

We consider whether such interests are overridden by the rights and interests of affected individuals.

12.3 Legal Obligations

We may process personal data where necessary for:

• accounting;
• taxation;
• sanctions compliance;
• regulatory compliance;
• fraud prevention;
• lawful governmental requests; and
• judicial or regulatory obligations.

12.4 Consent

Where required by law, we may rely on consent.

Where processing is based on consent, consent may be withdrawn at any time without affecting processing already lawfully conducted before withdrawal.

13. ANALYTICS

Tracking One uses Google Analytics 4 (“GA4”) to understand how users interact with tracking.one and to improve the website and Services.

Google Analytics may process information such as:

• device information;
• browser information;
• approximate technical location derived from IP address;
• website interactions;
• pages viewed;
• session information; and
• related analytics information.

Tracking One’s configured GA4 user/event-level data retention period is 14 months.

Google confirms that GA4 supports 2-month and 14-month retention settings for applicable user/event-level data.

Tracking One does not currently use:

• Google Signals;
• Google Analytics advertising features;
• remarketing through Google Analytics; or
• Google Analytics for targeted advertising.

14. GOOGLE TAG MANAGER

Tracking One uses Google Tag Manager (“GTM”) to manage website tags and analytics implementation.

GTM is a tag-management technology and may facilitate the deployment of analytics or other technical tags used on tracking.one.

The use of analytics and non-essential technologies through GTM is subject to applicable consent requirements.

15. COOKIES AND SIMILAR TECHNOLOGIES

Tracking One may use cookies and similar technologies for:

• authentication;
• session management;
• Account security;
• remembering user settings;
• website functionality;
• analytics; and
• technical performance.

Cookies may be classified as:

Strictly Necessary

Required for core functionality, authentication, security or session management.

Functional

Used to remember supported preferences or improve functionality where applicable.

Analytics

Used to understand website usage and Service performance.

Tracking One currently uses Google Analytics for analytics as described above.

Advertising

Tracking One does not currently use advertising or remarketing cookies for targeted advertising.

Where applicable law requires consent for non-essential cookies, Tracking One will seek appropriate consent before activating them.

Further details may be provided in a separate Cookie Policy.

16. MARKETING COMMUNICATIONS

Tracking One may send relevant B2B communications concerning:

• Tracking One Services;
• product updates;
• commercial offers;
• product demonstrations;
• new functionality; and
• other relevant business information.

Where consent is required by applicable law, we will obtain it before sending the relevant marketing communication.

Recipients may opt out of marketing communications at any time using an unsubscribe mechanism or by contacting us.

Opting out of marketing does not prevent Tracking One from sending:

• security notices;
• contractual communications;
• billing communications;
• Service notifications; or
• other necessary transactional messages.

17. SERVICE PROVIDERS

Tracking One may use service providers to operate and support the Services.

These may include providers of:

• infrastructure;
• hosting;
• databases;
• authentication;
• email;
• analytics;
• tag management;
• payment processing;
• technical operations;
• logging;
• transportation data; and
• professional services.

Where required, providers are subject to contractual and legal requirements appropriate to their role.

18. CURRENT MATERIAL SERVICE PROVIDERS

Tracking One currently uses or may use the following material providers:

Hetzner

Purpose:

• production infrastructure;
• hosting;
• database infrastructure.

Primary production and database location: Frankfurt, Germany.

Google

Services may include:

• Google sign-in;
• Google Workspace / Gmail;
• Google Analytics 4; and
• Google Tag Manager.

Stripe

Purpose:

• payment processing;
• transaction administration; and
• related payment services.

Tracking One may maintain a separate and more detailed Subprocessor and Service Provider List.

19. CUSTOM LOGGING AND MONITORING

Tracking One uses internal/custom technical logging and monitoring systems.

Tracking One does not currently rely on a separate external error-monitoring provider for the custom logging function described to us.

Technical logs may be generated for:

• security;
• troubleshooting;
• technical performance;
• Service integrity; and
• investigation of errors or misuse.

20. DATA HOSTING AND LOCATION

Tracking One’s production environment and primary database infrastructure are hosted in Frankfurt, Germany, using infrastructure provided by Hetzner.

Personal data may also be processed by service providers in other countries depending on the relevant Service and provider.

Where an international transfer is subject to applicable transfer restrictions, Tracking One will use an appropriate legal mechanism where required.

21. INTERNATIONAL DATA TRANSFERS

Tracking One is operated by a company established in the United Arab Emirates, while parts of its technical infrastructure and service-provider ecosystem may operate in the European Economic Area or other jurisdictions.

Accordingly, personal data may be transferred between jurisdictions.

Where applicable law restricts an international transfer, Tracking One will use a lawful transfer mechanism where required.

Such mechanisms may include:

• an adequacy decision;
• Standard Contractual Clauses;
• an applicable data-processing agreement;
• another legally recognized safeguard; or
• a lawful derogation where appropriate.

The European Commission provides Standard Contractual Clauses as a transfer safeguard for applicable transfers from the EEA to third countries.

22. EU / EEA DATA TRANSFERS

Where GDPR applies and personal data is transferred from the EEA to a recipient in a country that does not benefit from an applicable adequacy decision, Tracking One will implement an appropriate transfer mechanism where legally required.

This may include the European Commission’s Standard Contractual Clauses and supplementary safeguards where appropriate.

The applicable mechanism may depend on:

• the role of the Parties;
• the recipient;
• processing location;
• type of personal data; and
• applicable data-protection law.

23. CUSTOMER DATA AND SUBPROCESSORS

Where Tracking One acts as a processor for Customer Personal Data, Tracking One may engage subprocessors in accordance with applicable law and the applicable DPA.

A Subprocessor List may identify:

• provider;
• purpose;
• processing role;
• relevant processing location; and
• applicable transfer information.

The applicable DPA may provide additional provisions concerning:

• subprocessor authorization;
• notification of changes;
• international transfers;
• security; and
• deletion or return of personal data.

24. DATA RETENTION

Tracking One retains information for periods appropriate to the nature and purpose of the information.

Current standard retention practices include:

Account Data

Account Data is generally retained for the duration of the Account.

If an Account is deleted, active Account Data may be deleted or anonymized, subject to information that must or may be retained for:

• legal obligations;
• accounting;
• security;
• fraud prevention;
• dispute resolution;
• enforcement of contracts; or
• regulatory requirements.

Shipment History

Shipment history may be retained for up to five (5) years.

After a Shipment reaches Delivered or another equivalent completion status, Tracking One may cease active monitoring and retain previously collected Tracking Data as read-only historical information.

Temporary Server Logs

Temporary server logs are generally retained for approximately 14 days.

Customer Request / Activity Logs

Certain records relating to Customer requests and Service activity may be retained for up to five (5) years where relevant to:

• customer support;
• security;
• contractual records;
• audit;
• fraud prevention;
• dispute resolution; or
• Service integrity.

Google Analytics

Relevant GA4 user/event-level data is configured for a retention period of 14 months.

Backups

Tracking One creates daily backups.

Backup copies are retained for up to 30 days, subject to normal backup rotation.

Deletion from active systems may therefore not immediately remove data from an existing backup copy.

Data contained in backups is not intended to be restored except for legitimate disaster recovery, security or continuity purposes.

25. ACCOUNT DELETION

A user may request deletion of an Account through available Account functionality or by contacting Tracking One.

Following Account deletion, Tracking One may:

• disable the Account;
• delete or anonymize active Account Data;
• remove or restrict access to associated information; and
• retain information where legally or reasonably necessary for legitimate purposes described in this Privacy Policy.

Deletion of an Account does not necessarily require immediate deletion of:

• invoices;
• contractual records;
• legal records;
• fraud-prevention records;
• dispute records;
• security records; or
• information temporarily contained in backups.

26. SECURITY

Tracking One maintains reasonable technical and organizational measures designed to protect personal data from:

• unauthorized access;
• unauthorized disclosure;
• alteration;
• loss;
• destruction;
• misuse; and
• unlawful processing.

Measures may include:

• authentication controls;
• access restrictions;
• passkeys;
• account security controls;
• network protections;
• technical logging;
• monitoring;
• backups;
• incident response; and
• appropriate personnel access limitations.

No internet or computer system can be guaranteed to be completely secure.

27. PERSONAL DATA BREACHES

Tracking One maintains procedures intended to identify, assess and respond to security incidents and personal data breaches.

Where required by applicable law, Tracking One will:

• assess the relevant incident;
• notify the competent authority;
• notify affected individuals where legally required; and
• take reasonable remedial measures.

Where Tracking One acts as a processor, it will notify the relevant Customer of a qualifying personal data breach in accordance with applicable law and the applicable DPA.

28. YOUR PRIVACY RIGHTS

Depending on applicable law, you may have rights concerning your personal data.

These may include rights to:

• obtain information concerning processing;
• access personal data;
• correct inaccurate personal data;
• request deletion;
• restrict processing;
• object to certain processing;
• obtain portability of eligible data;
• withdraw consent;
• object to direct marketing; and
• exercise rights concerning certain automated decisions.

These rights may be subject to legal conditions and exceptions.

UAE PDPL expressly provides rights concerning transfer/portability, correction or erasure and restriction of processing.

GDPR also provides data-subject rights and transparency requirements through Articles 13–22 and related provisions.

29. AUTOMATED PROCESSING AND AI

Tracking One may use automated or algorithmic systems in connection with:

• shipment tracking;
• logistics-event processing;
• normalization of transportation data;
• predictive information;
• technical security;
• analytics; and
• Service functionality.

Tracking One does not currently provide Customer Data to external AI or machine-learning providers for processing.

Tracking One does not currently use personal data to make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect that individual within the meaning of GDPR.

If this changes, this Privacy Policy will be updated where required.

30. CHILDREN

Tracking One is a business-to-business service.

The Services are not directed to children or intended for personal use by persons under 18.

Tracking One does not knowingly seek to collect personal data from children for consumer purposes.

Where we become aware that information was submitted contrary to this provision, we may delete or otherwise restrict the relevant information where appropriate.

31. CONTACT AND LEGAL ENTITY

Tracking One is operated by:

MLab Digital Business Expertise L.L.C-FZ
Registration No.: 2539104
Meydan Grandstand, 6th Floor
Meydan Road, Nad Al Sheba
Dubai, United Arab Emirates

Privacy contact: it@tracking.one
Website: tracking.one

Privacy requests should include sufficient information to enable us to identify the relevant Account, interaction or information and understand the request.

We may request reasonable verification before responding to a request concerning personal data.

32. COMPLAINTS

If you have concerns regarding our processing of personal data, you may contact Tracking One using the contact details above.

Where GDPR applies, you may also have the right to lodge a complaint with the competent data protection supervisory authority.

Where UAE PDPL or another privacy regime applies, you may have rights to raise a complaint with the competent authority in accordance with applicable law.

33. EU REPRESENTATIVE

Tracking One will assess and, where legally required, maintain an EU representative in accordance with Article 27 GDPR.

If an EU representative is appointed or legally required for the relevant processing, the representative’s contact details will be published in this Privacy Policy or otherwise made appropriately available.

34. DATA PROTECTION OFFICER

Tracking One will maintain a Data Protection Officer where legally required.

Where a separate Data Protection Officer has not been designated, privacy-related requests may be sent to it@tracking.one.

35. THIRD-PARTY WEBSITES

The Tracking One website or Services may contain links to independent third-party websites or services.

Tracking One is not responsible for the privacy practices of independent third parties.

Users should review the privacy documentation of a relevant third party before providing personal data directly to that party.

36. CORPORATE TRANSACTIONS

Personal data may be transferred or disclosed in connection with an actual or proposed:

• merger;
• financing;
• acquisition;
• investment;
• restructuring;
• reorganization;
• sale of assets; or
• transfer of all or part of the Tracking One business.

Where required, appropriate confidentiality and data-protection safeguards will apply.

37. LEGAL AND REGULATORY DISCLOSURES

Tracking One may process or disclose personal data where reasonably necessary to:

• comply with applicable law;
• respond to a valid legal process;
• comply with a lawful governmental or regulatory request;
• enforce contractual rights;
• investigate fraud or misuse;
• establish, exercise or defend legal claims;
• protect the security of the Services; or
• protect the rights, property or safety of Tracking One, its Customers, users or others.

38. CHANGES TO THIS PRIVACY POLICY

Tracking One may update this Privacy Policy from time to time.

Changes may reflect:

• changes to the Services;
• changes to technology;
• new service providers;
• changes to data-processing activities;
• new legal requirements; or
• other operational developments.

The current version will be published on tracking.one with the applicable effective date.

Where required by applicable law, Tracking One will provide additional notice of material changes.

39. LANGUAGE

This Privacy Policy is originally prepared in English.

Tracking One may provide translations for convenience.

To the extent permitted by applicable law, if there is an inconsistency between the English version and a translation, the English-language version shall prevail.