Privacy Policy

Last updated: 2026-07-07

This Privacy Policy explains how ForwarderScanner ("we", "us", "our") collects, uses, stores and shares personal data when you use ForwarderScanner (the "Service"). We comply with the Turkish Personal Data Protection Law (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Data we collect

We collect only the data we need to operate the Service:

  • Account data: name, work email, company (optional), hashed password.
  • Billing data: billing address, plan tier, payment processor customer ID. Full card numbers are never stored on our servers.
  • Usage data: directory searches, contact unlocks, export requests, timestamps, and the plan tier they were charged against.
  • Technical data: IP address, browser user-agent, language, referrer. Used for security, abuse prevention and aggregate analytics.
  • Communications: support tickets, data removal requests, feedback you submit.

2. The forwarder contact database

ForwarderScanner maintains a B2B directory of freight forwarders and their business contacts. This dataset is a core product surface — it powers search, country/city landing pages, and gated contact unlocks. This section explains how we handle third-party personal data (forwarder employees and decision-makers) that appears in the directory.

2.1 Data sources

We compile directory records from the following categories of sources:

  • Public business registries and directories — company names, registered addresses, and publicly listed contact details published by trade authorities or government databases.
  • Network membership lists — publicly published member directories from freight networks (e.g. WCA, FIATA, and similar associations) where members opt in to directory visibility.
  • Licensed commercial data feeds — B2B contact datasets acquired under licence from data providers, subject to their own compliance frameworks and our contractual use restrictions.
  • Company websites and public profiles — business emails, phone numbers, and role titles published on forwarder websites or professional profiles.
  • Voluntary claims — forwarders who claim or update their profile through our platform supply data directly with consent.

We do not purchase consumer marketing lists. All contacts in the directory are business-role contacts (sales, operations, management) at freight forwarding companies.

2.2 Categories of data in the directory

  • Company name, branch name, registered and operational addresses.
  • Business email addresses, direct-dial phone numbers, and job titles.
  • Modes, services, network memberships, and verification status.
  • Public website URLs and social profiles where published.

2.3 Legal basis (GDPR Art. 6)

For third-party contacts in the directory, we rely on legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) as our primary legal basis. Our legitimate interests are:

  • Operating a searchable B2B directory that helps shippers and exporters find qualified freight forwarders.
  • Publishing business contact information that is already publicly available or published for professional networking purposes.
  • Protecting the commercial value of the dataset through gated access, rate limits, and anti-scraping controls.

We have balanced these interests against the rights of data subjects. Contacts are business professionals; data is limited to professional context; unlock access is tiered and logged; and we provide a straightforward opt-out process (see §2.5). Where we process data based on consent (e.g. claimed profiles), that consent can be withdrawn at any time.

2.4 How we use directory data

  • Display company profiles and masked contact hints in search results.
  • Reveal full contact details only to authenticated users within their plan quota.
  • Generate aggregate statistics (country counts, mode distribution) without exposing individual contacts.
  • Improve data quality through deduplication, validation, and periodic re-ingestion.

We do not sell raw contact lists. CSV export is available only to Data-tier subscribers under our Terms of Service and is rate-limited and watermarked.

2.5 Removal and opt-out

If you are a forwarder, employee, or contact listed in our directory and you want your record removed or corrected, you may:

We verify identity (typically by replying to the business email on file or confirming company authority) and add approved records to our pipeline exclusion list. We aim to complete removals within 30 calendar days. Removed records will not reappear in future pipeline runs unless you voluntarily re-submit them through a profile claim.

2.6 Retention of directory data

Active directory records are retained while they remain accurate and relevant to the Service. Records on the exclusion list are suppressed permanently. Pipeline snapshots and audit logs of unlock events are retained for 12 months, then aggregated with personal identifiers removed.

3. Why we collect account data (legal basis)

  • Contract: to provide the Service you signed up for (account, billing, contact unlocks).
  • Legitimate interests: security monitoring, fraud and abuse prevention, product analytics, customer support.
  • Consent: optional marketing emails (opt-out in every email footer).
  • Legal obligation: tax records, financial reporting, responding to court orders.

4. How long we keep account data

  • Account data: for the life of your account, then deleted within 30 days of closure.
  • Billing records: 10 years, as required by Turkish tax law (VUK).
  • Usage and access logs: 12 months rolling, then aggregated.
  • Marketing consent: until you unsubscribe.

5. Who we share data with

We do not sell personal data. We share it only with processors bound by a Data Processing Agreement:

  • Payment processors — subscription billing.
  • Hosting providers — application delivery and edge caching.
  • Email delivery providers — transactional email.
  • Authorities — only when compelled by a valid legal order.

6. International transfers

Some processors operate outside Türkiye and the EEA. Transfers rely on Standard Contractual Clauses or equivalent KVKK-approved mechanisms.

7. Your rights

Subject to KVKK / GDPR you may request:

  • Access to the personal data we hold about you.
  • Correction of inaccurate or incomplete data.
  • Deletion ("right to be forgotten") subject to legal retention obligations.
  • Restriction or objection to certain processing activities.
  • Data portability — a machine-readable export of data you supplied.
  • Withdrawal of consent for consent-based processing.

Send requests to privacy@forwarderscanner.co. We aim to respond within 30 calendar days.

8. Security

Passwords are hashed with industry-standard algorithms. Data in transit is protected by TLS 1.2+. Contact details are not embedded in public HTML — they are served via authenticated API after unlock. Sensitive operator actions are audit-logged.

9. Cookies

See our Cookie Policy for details.

10. Children

The Service is not directed at children under 18. If you believe a minor has signed up, contact us and we will delete the account.

11. Changes to this Policy

Material changes will be announced by email and a prominent in-app banner at least 14 days before they take effect.

12. Contact and complaints

Privacy questions: privacy@forwarderscanner.co. Support: support@forwarderscanner.co. Data removal: /contact/remove-my-data.

You may lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Kurumu, kvkk.gov.tr) or your national EU data protection authority.

This Privacy Policy is a plain-language description of our data practices. It is not legal advice.