Legal

Privacy Policy

Last updated: 28 July 2026

Enigma Express Limited (“Enigma OS”, “we”, “us”) operates the Enigma OS logistics and freight-forwarding platform, including this website (enigmatrans.eu) and the Enigma OS application. This policy explains what personal data we collect, why, and how it is handled.

Who this applies to

This policy covers visitors to our website, and the employees, drivers, and contacts of companies that use Enigma OS (our “customers”). Enigma OS is a business-to-business platform: each customer company controls its own account and the data it enters, and is responsible for having a lawful basis to process the personal data of its own staff, drivers, clients, and partners within the platform.

Data we collect

Depending on how a customer uses Enigma OS, we process:

Account data: name, work email, phone number, role, and company/organization details.
Operational data entered into the platform: transport orders, trips, clients, suppliers, invoices, and related documents (e.g. CMRs, proof of delivery, invoices).
Communications: internal messages between platform users, and messages exchanged with drivers or customers through connected channels — including email (when a customer connects a mailbox) and WhatsApp (when a customer connects WhatsApp Business).
Vehicle and shipment location data, where a customer enables GPS tracking through a connected telematics/GPS provider.
Billing data, processed on our behalf by our payment provider (Stripe).
Technical data: IP address, browser type, and basic usage/log data, for security and reliability purposes.
Essential and, with consent, analytics cookies on our marketing website — see our Cookie Policy.

How we use this data

To provide, operate, and maintain the Enigma OS platform for our customers.
To enable the communication features a customer chooses to turn on (internal messaging, email integration, WhatsApp Business messaging), so that dispatchers, drivers, and customers can coordinate shipments.
To process payments and manage subscriptions.
To provide customer support and respond to enquiries.
To maintain the security, integrity, and availability of the platform.
Where a customer enables AI-assisted features (e.g. extracting order details from an email or document), to process that content for the purpose of populating the customer’s own records — this content is not used to train shared or third-party models.

WhatsApp Business messaging

When a customer connects their own WhatsApp Business Account to Enigma OS, messages sent and received through that number are processed via Meta’s official WhatsApp Business Cloud API and stored within that customer’s Enigma OS account, so their team can view and reply to the same conversation from within the platform. We do not use WhatsApp message content for advertising, and we do not sell message data. Use of WhatsApp’s platform is additionally subject to Meta’s own WhatsApp Business Terms and Privacy Policy.

Email integration

If a customer connects a mailbox (e.g. via Google/Gmail), we access that mailbox only to the extent needed to display and process messages inside Enigma OS on the customer’s behalf (for example, extracting a transport order from an incoming email). Access is scoped to that customer’s own account and can be disconnected at any time from Settings.

Sharing and third parties

We share data only as needed to operate the service, with providers such as:

Meta Platforms, Inc. — for WhatsApp Business Cloud API messaging, where enabled.
Google LLC — for Gmail-based email integration, where enabled.
Stripe, Inc. — for payment processing.
GPS/telematics providers connected by a customer, for live vehicle tracking, where enabled.
Groq, Inc. — an AI inference provider used, where a customer organization has opted in, as a fallback for a small number of AI-assisted features (e.g. extracting fields from an email or document, sorting an inbound email, or correcting an address for mapping) when our primary, self-hosted AI model cannot complete the request. This can include commercial content such as email or document text, business contact details, and addresses. Before this content is sent, we automatically redact common personal identifiers we can reliably detect (such as email addresses, phone numbers, and bank account/national ID numbers); this reduces, but does not eliminate, the personal data such content may contain. It is off by default; an organization administrator must explicitly enable it in AI settings. Groq does not use this content to train its models. Identity documents and other high-sensitivity document types are never sent to Groq under any setting — they are processed exclusively by our own, self-hosted AI model.
Our infrastructure and hosting providers, to run the platform.

Where we transfer personal data outside the European Economic Area (for example, to Groq, Inc. in the United States), we rely on the EU Standard Contractual Clauses as our transfer safeguard, as provided for in that provider’s own data processing terms.

We do not sell personal data to third parties.

Data retention

We retain operational and communications data for as long as a customer’s account is active, plus a reasonable period afterwards for legal, accounting, and backup purposes, after which it is deleted or anonymized.

Your rights

Depending on your location, you may have rights to access, correct, export, or request deletion of your personal data, and to object to or restrict certain processing. If Enigma OS is not your direct employer/contracting party, please start with the company that manages your Enigma OS account, as they control that data; you can also contact us directly at the address below.

Security

We use encryption in transit and at rest for sensitive data (including access tokens and credentials), role-based access controls, and per-organization data isolation across the platform.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

Contact

Questions about this policy or your data can be sent to hello@enigmatrans.eu.

Enigma Express Limited · 2nd Floor, College House, 17 King Edwards Road, Ruislip, London, HA4 7AE, United Kingdom · Company No. GB15265088 · VAT Reg. 455 1249 96