Privacy Policy

1. Who We Are

Koda Technologies Ltd ("Koda", "we", "us", or "our") handles personal data through our freight management platform ("Platform") in two capacities. For the shipment, consignment and customs data our customers upload to use Koda, the customer is the data controller and Koda acts as a data processor on their behalf. For data we decide the use of ourselves - account and billing details, records we keep to meet HMRC and other legal obligations, and anonymised data we use to improve the Platform - Koda is the data controller. Our Data Processing Agreement sets out how we handle personal data as a processor and is available on request. We are committed to protecting your privacy and handling your data transparently and securely.

If you have questions about this policy or our data practices, please contact us at: support@kodatechnologies.co.uk

2. What Data We Collect

We collect and process the following categories of personal data:

Account and User Data

• Full name and email address of Platform users
• Job role and organisation affiliation
• Authentication credentials (passwords are hashed and never stored in plain text)
• Login timestamps and session activity
• Billing contact details for your organisation. Payment card details are handled by our payment provider (Stripe) and are not stored by us.

Shipment and Business Data

• Names, addresses, EORI numbers, and VAT numbers of shippers, consignees, and agents appearing on shipping documents
• Contact details for customers, agents, carriers, and airlines in your CRM
• Commercial documents (invoices, bills of lading, air waybills, packing lists) containing business and personal information
• Customs declarations and commodity data

Technical Data

• IP addresses and browser/device information for security and audit purposes
• Application logs recording actions taken on the Platform
• Usage patterns to support platform stability and improvement

3. How We Use Your Data

We process personal data for the following purposes:

• Service delivery: Providing, operating, and maintaining the Koda Platform for your organisation.
• Authentication and security: Verifying your identity, managing access control, and detecting and preventing fraud or unauthorised access.
• Document processing: Extracting and structuring shipment data from uploaded documents using AI-based document analysis.
• Communications: Sending operational notifications (e.g. document requests, proof of delivery confirmations, ETA alerts) relating to your shipments.
• Compliance and audit: Maintaining records of actions taken on the Platform for audit and legal compliance purposes.
• Platform improvement: Analysing anonymised usage data to improve the reliability and features of our service.

4. Legal Basis for Processing

We rely on the following legal bases under the UK GDPR:

• Contractual necessity (Article 6(1)(b)): Processing required to provide the Platform services as agreed in your commercial contract.
• Legitimate interests (Article 6(1)(f)): Security monitoring, audit logging, and platform improvement where these interests are not overridden by your rights.
• Legal obligation (Article 6(1)(c)): Retaining records as required by applicable law (e.g. customs and tax regulations).
• Consent (Article 6(1)(a)): Where we have obtained your explicit consent, for example for marketing communications. You may withdraw consent at any time.

5. Data Sharing

We do not sell your personal data. We may share personal data with the following categories of third parties, strictly as necessary to provide the Service:

• Cloud infrastructure providers: Amazon Web Services (AWS), used to host the Platform and store documents securely (UK data residency in AWS eu-west-2, London).
• AI document processing: A third-party AI service (Anthropic) used to extract data from shipping documents, under confidentiality obligations.
• Email delivery: Amazon Simple Email Service (SES) for operational notifications.
• Payments: Stripe, which processes subscription payments for your organisation.
• Container tracking: TrackCargo, which receives container and booking numbers so that it can report where a shipment is.
• Accounting software: Xero or QuickBooks, only if your organisation chooses to connect them, to send invoice and customer details to your own accounts.
• Customs: HMRC, to which the customs declarations your organisation makes through the Platform are submitted.
• Website and app analytics: Google Analytics, which receives your IP address, device and browser details and the pages you visit, to show us how the Platform and website are used, but only if you accept analytics cookies.
• Spam protection: Google reCAPTCHA on public forms such as enquiries and the demo, which checks that a person is using the form.
• Professional advisers: Legal, accounting, or regulatory advisers where required.
• Law enforcement or regulators: Where required by law or court order.

All third-party processors are subject to data processing agreements and appropriate safeguards.

6. International Transfers

Your data is stored within the United Kingdom (AWS eu-west-2, London). Data sent to some of the providers listed above, such as our AI document processing provider, Google Analytics and Google reCAPTCHA, may be processed outside the United Kingdom and the European Economic Area. Where that happens, we ensure appropriate safeguards are in place in accordance with UK GDPR Chapter V.

7. Data Retention

We retain personal data for as long as necessary to provide the Service and comply with our legal obligations:

• Account data: Retained while your organisation has an active subscription or trial. If a trial ends without a subscription, a payment stays unpaid beyond a 14-day grace period, or a subscription is cancelled, your organisation becomes read-only (you can still view and download everything) and we keep its data for 90 days from that day so you can export it. After that the organisation is anonymised: user accounts, contact and bank details, accounting and API connections and uploaded document files are permanently removed. Shipment, invoice and audit records remain, with names and contact details removed. You remain responsible for keeping your own customs and tax records.
• Shipment and customs data: Retained for 7 years from the date of shipment completion, in line with HMRC record-keeping requirements.
• Application logs: Retained for 90 days for security and troubleshooting purposes.
• Audit logs: Retained for 2 years.
• Automatic database backups: Kept for 14 days, so data removed from the live Platform can remain in a backup for up to 14 days. One-off copies taken before major changes are deleted once they are no longer needed.
• Replaced and deleted shipment documents: Kept in recoverable storage for 90 days after they are replaced or deleted, then removed permanently.
• AWS account activity records: Records of administrative actions in our hosting account are kept for 400 days for security investigations.

When an account is anonymised at the request of the person or their organisation, the name, email address, telephone number, password, sign-in security settings and notifications are removed, and the name, email address and IP address are removed from the audit records. The audit records themselves, and the shipment history, stay for the periods above, linked to the account only by a pseudonymous identifier, because they are business and customs records. Names typed into other records, such as the name of someone who signed for a delivery, are not changed by this and are dealt with on request.

8. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• Connections from your browser to the Platform are encrypted (TLS), and the database and document storage are encrypted at rest
• Role-based access control with multi-tenant data isolation
• Pre-signed URLs with short expiry for document access
• Automated security scanning of dependencies
• An audit log of actions taken on the Platform, and records of administrative activity in our hosting account

Despite these measures, no transmission over the internet is completely secure. If you believe your data has been compromised, please contact us immediately.

9. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data, subject to legal retention obligations.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

Signed-in users can download a copy of the personal data held about their own account at any time from Profile, under Your Data. An organisation's administrators can also export, or anonymise, a team member's account from Users. To exercise any of these rights in another way, please contact us at support@kodatechnologies.co.uk. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Cookies

The Platform uses session cookies strictly necessary for authentication. We do not use advertising cookies. The Platform and website use Google Analytics only if you accept it in the cookie banner. If you do, it sets cookies (for example _ga) and sends your IP address, device details and the pages you visit to Google. If you decline or do not choose, nothing is sent to Google. Analytics is never loaded on single-use link pages such as set-password and proof-of-delivery links. Public forms such as enquiries and the demo also use Google reCAPTCHA to prevent abuse, which may set its own cookie and receive your IP address.

Change your cookie choice

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email or in-Platform notification. The "Last updated" date at the top of this page reflects when the policy was last revised. Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related enquiries or to exercise your rights, please contact:

Koda Technologies Ltd
Email: support@kodatechnologies.co.uk
United Kingdom