1. Who we are
TransferX is the data controller responsible for your personal data. We operate a vehicle and equipment transport marketplace based in Marbella, Málaga, Spain.
Privacy contact: info@transferx.es
2. What we collect
| Category | Data | Why |
|---|
| Account | Name, email, encrypted password, role, date joined | Create your account |
| Job | Vehicle description, locations, contact phone | Display & fulfil jobs |
| KYC | Government-issued ID document (Carriers only) | Verify identity |
| Payment | Amount, Stripe transaction reference | Process payments |
| Messages | Chat between Sender and Carrier | Coordinate jobs |
| Reviews | Rating and comment | Display carrier reputation |
| Usage | IP address, browser, pages visited | Security & improvement |
We don't store card numbers — payments are handled by Stripe.
3. Legal basis for processing
We process your data based on the following legal grounds under GDPR Article 6:
- Contract — to provide the service you signed up for
- Legal obligation — financial record-keeping etc.
- Legitimate interests — fraud prevention, security, improvement
- Consent — for marketing communications, where you opt in
4. How we use your data
- Create and maintain your account
- Display your jobs or carrier profile to other users
- Process payments and release funds via Stripe
- Send transactional emails — new offers, payment confirmations, outbid alerts
- Verify carrier identity and approve KYC applications
- Detect and prevent fraud and abuse
- Comply with legal obligations including tax records
We never sell your data. We don't use your data for advertising. Your information stays inside TransferX and Stripe — that's it.
5. Who we share data with
- Other users — your name and contact details are shared with the other party only after payment unlocks contact
- Stripe — payment processing, PCI-DSS certified
- Railway — our hosting provider, with standard contractual clauses for EU data
- Law enforcement — only where required by court order or law
6. Data retention
- Account data — while active, plus 2 years after deletion for legal compliance
- Payment records — 7 years (Spanish tax law)
- KYC documents — 5 years after the carrier relationship ends
- Chat messages — 1 year after job completion, then deleted
- Reviews — kept indefinitely as part of public reputation, unless removal is requested
7. Your rights under GDPR
As a resident of the EU you have the following rights:
Access
Request a copy of all personal data we hold about you
Rectification
Request correction of inaccurate data
Erasure
Request deletion where there's no legal reason to retain
Restriction
Request we limit how we use your data
Portability
Receive your data in a machine-readable format
Object
Object to processing based on legitimate interests
To exercise any right, email info@transferx.es. We respond within 30 days. You may also complain to the Spanish Data Protection Authority (AEPD) at aepd.es.
8. Cookies
TransferX uses only essential cookies needed for the platform to function — like keeping you logged in. We don't use advertising, tracking, or analytics cookies.
Essential cookies can't be disabled as they're required for the service to work.
9. Security
Measures we have in place:
- Passwords encrypted using industry-standard hashing — even we can't read them
- All data transmitted over HTTPS encryption
- Session cookies are HTTP-only and protected against CSRF
- KYC documents stored with randomised filenames, not publicly accessible
- Rate limiting on all forms to prevent automated attacks
- Security headers applied to all pages
Breach notification: If a breach is likely to risk your rights, we'll notify you and the AEPD within 72 hours, as required by GDPR Article 33.