Privacy Policy

The data controller in respect of personal data processed in connection with the Platform is "Narchin" LLC (VÖEN 1704145281; hereinafter "Narchin", "we", or "us"). This Privacy Policy (the "Policy") sets out the manner in which Narchin collects, uses, discloses, and safeguards your personal data when you access or use the Platform, the website located at narchin.ai, and our mobile applications.

This Policy is governed by the Law of the Republic of Azerbaijan "On Personal Data" dated 11 May 2010, as amended. Data subject rights established under the EU General Data Protection Regulation (Regulation (EU) 2016/679) are afforded as additional safeguards where applicable. The English text of this Policy is provided for convenience of reference only; the Azerbaijani-language version shall constitute the controlling text in the event of any inconsistency.

Personal Information

Narchin collects personal information that you provide directly, including, without limitation:

• Identification and contact details (full name, e-mail address, telephone number, and postal address);
• Corporate particulars (company name, registration number, and other business details);
• Account credentials and authentication factors;
• Billing and payment information; and
• Identity documentation supplied for verification, know-your-customer, or anti-money-laundering purposes.

Shipment Information

In connection with the performance of freight-related services on the Platform, Narchin collects:

• Cargo descriptions, specifications, and commodity classifications;
• Origin, transit, and destination addresses; and
• Shipping documents, customs declarations, and related operational records.

Technical Information

Narchin automatically collects the following categories of technical data:

• Device identifiers, operating system, and hardware characteristics;
• Internet Protocol (IP) address and approximate geolocation derived therefrom;
• Browser type, version, and configuration settings;
• Usage and analytics data, including access logs and session metadata; and
• Cookies, pixel tags, and similar tracking technologies.

Narchin processes the personal data it collects for the following purposes:

• To provide, operate, and improve the Platform and the Services made available thereon;
• To process transactions concluded by participants and to transmit related communications;
• To establish and administer your account, including authentication and access control;
• To track shipments and furnish real-time operational updates;
• To communicate with you in respect of the Services, product updates, and, where lawfully permitted, marketing offers;
• To comply with applicable legal, regulatory, tax, and accounting obligations;
• To detect, prevent, and investigate fraud, unauthorised access, and other security incidents; and
• To analyse usage patterns for the purpose of improving the functionality and user experience of the Platform.

Lawful bases for processing. Each processing activity is carried out on the basis of one or more of the following grounds: the establishment and administration of accounts, operation of transactions, and subscription billing are based on the necessity for the performance of a contract; legal, tax, and regulatory retention is based on compliance with a legal obligation; security, fraud prevention, and analytics are based on legitimate interests duly balanced against your fundamental rights; and direct marketing communications are based on your freely given consent, which may be withdrawn at any time.

Narchin may disclose your personal data to the following categories of recipients, in each case subject to appropriate contractual, technical, and organisational safeguards:

• Other participants in a transaction: solely to the extent strictly necessary for the performance of the transaction in which you take part;
• Sub-processors: Google Firebase (hosting and database), SendGrid (electronic mail delivery), Wialon (GPS and telematics), and other vetted service providers engaged to act on our documented instructions. A current list of sub-processors is maintained at narchin.ai/sub-processors;
• Competent authorities: where disclosure is required pursuant to applicable law, court order, or binding administrative request, or to protect Narchin's legitimate interests;
• Successors in interest: in connection with any merger, acquisition, reorganisation, financing, or sale of all or part of Narchin's business or assets.

Narchin does not, and shall not, sell your personal data to any third party.

Narchin implements technical and organisational measures designed to ensure a level of security appropriate to the risks presented by the processing of personal data, having regard to the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. Such measures include, without limitation:

• Encryption of personal data in transit using industry-standard Transport Layer Security (TLS) and at rest using equivalent cryptographic algorithms;
• Hardened and continuously monitored server infrastructure;
• Role-based access controls, multi-factor authentication, and the principle of least privilege;
• Periodic security assessments, vulnerability scanning, and penetration testing; and
• Mandatory training of personnel in data-protection and information-security obligations.

Narchin shall retain your personal data only for so long as is necessary to fulfil the purposes for which it was collected, including for the satisfaction of any legal, accounting, tax, regulatory, or reporting obligation, save where a longer retention period is required or permitted by applicable law. Shipment and transactional records shall be retained for a minimum period of seven (7) years in order to comply with statutory record-keeping requirements. Upon expiry of the applicable retention period, personal data shall be securely erased, anonymised, or, where erasure is not technically feasible, placed beyond further use.

Subject to, and in accordance with, applicable data-protection law, you are entitled to exercise the following rights in relation to your personal data:

• Right of access — to obtain confirmation as to whether your personal data is being processed and to receive a copy thereof;
• Right to rectification — to have inaccurate or incomplete personal data corrected without undue delay;
• Right to erasure — to obtain the deletion of personal data in the circumstances prescribed by law;
• Right to object to, or restrict, processing — in respect of processing based on legitimate interests or for direct-marketing purposes;
• Right to data portability — to receive your personal data in a structured, commonly used, and machine-readable format; and
• Right to withdraw consent — at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

Requests to exercise the foregoing rights shall be directed to the contact details set out below and shall be addressed within the period prescribed by applicable law. Your right to lodge a complaint with the competent supervisory authority is expressly preserved.

Narchin employs cookies, pixel tags, and similar tracking technologies (collectively, "Cookies") in order to operate the Platform, enhance the user experience, analyse usage, and, where lawfully permitted, support marketing activities. Where required by applicable law, non-essential Cookies are deployed only upon your prior consent. You may manage or withdraw consent through our cookie-management interface or through your browser settings; the disabling of certain Cookies may impair the functionality of the Platform.

The categories of Cookies employed are as follows:

• Strictly Necessary Cookies: essential to the operation of the Platform and may not be disabled;
• Analytics Cookies: collect aggregated statistical information regarding the use of the Platform; and
• Preference Cookies: retain user settings and preferences for the convenience of subsequent visits.

A more detailed description of Cookie use is set forth in our separate Cookie Policy, available at narchin.ai/cookies.

Personal data is processed and stored within the European Union (in Belgium and the Netherlands) by way of Google Firebase / Firestore in the eur3 multi-region. The transfer of personal data from the Republic of Azerbaijan to the European Union is effected on the basis of an appropriate lawful ground for transfer, including, as applicable, the necessity of the contract, your consent, and the implementation of appropriate safeguards (such as standard contractual clauses).

Narchin may, in the future, relocate processing operations to its own infrastructure, whether situated in the Republic of Azerbaijan or in another jurisdiction. Affected data subjects shall be notified in advance of any such relocation.

In the event of a personal-data breach that is likely to result in a risk to the rights and freedoms of data subjects, Narchin shall, without undue delay and in any event within seventy-two (72) hours of becoming aware of the breach, notify the competent supervisory authority and any affected data subjects, in accordance with the requirements of the laws of the Republic of Azerbaijan and any other applicable data-protection legislation.

The Services are intended for use by businesses and adult professionals, and are not directed at, nor designed for use by, individuals under the age of eighteen (18) years. Narchin does not knowingly collect personal data from children. Should Narchin become aware that personal data of a child has been collected without verifiable parental consent, it shall take prompt steps to delete such information from its records.

Narchin reserves the right to amend, modify, or supplement this Policy from time to time in order to reflect changes in legal, regulatory, technical, or operational requirements. Material amendments shall be communicated by posting the revised Policy on this page and updating the "Last updated" date and, where required by law, by providing reasonable advance notice to affected data subjects. Your continued use of the Services following the effective date of any such amendment shall constitute your acceptance thereof, subject to your rights under applicable law.

Any inquiries regarding this Policy, the data practices of Narchin, or the exercise of data subject rights shall be directed to our Data Protection Officer at the address set forth below. Your right to lodge a complaint with the competent supervisory authority is expressly preserved.