Privacy Policy | BlueCMR

In this Privacy Policy we explain how BlueCMR S.L.U. processes your personal data when you visit our website, contact us, request information or demonstrations, use our support channels or interact with our services in those cases in which we act as controller.

We also include a general explanation of the cases in which BlueCMR acts as processor or sub-processor on behalf of its clients in the context of providing the BlueCMR platform.

1. Data controller

The controller is:

BlueCMR S.L.U.
Tax ID (NIF): B26654517
Address: Calle Fueros de León 1, 24402, Ponferrada, León, Spain
Privacy contact email: contact@bluecmr.com

2. Scope of this Policy

This Policy applies to the processing of personal data carried out by BlueCMR when we act as controller, in particular in relation to:

website visitors;
persons who contact BlueCMR;
persons requesting information, quotes, demonstrations or trials;
clients and their contact persons;
support and customer service users;
persons who receive communications from BlueCMR;
persons who interact with our corporate profiles or communication channels.

This Policy does not replace the information that BlueCMR clients must provide to the users, signatories, drivers, consignees or other third parties whose data are processed through the platform when BlueCMR acts on behalf of those clients as processor.

3. Categories of data we may process

Depending on your relationship with BlueCMR, we may process the following categories of data:

a) Identification and contact data

first name and surname(s);
company;
position or role;
email address;
telephone number;
postal address, where applicable.

b) Professional and commercial data

sector or activity;
information relating to your interest in our products or services;
information included in requests, forms, meetings, demonstrations or commercial communications.

c) Technical and usage data

IP address;
session identifiers;
date and time of access;
technical logs;
browser or device information;
information necessary for technical support, security or incident diagnosis.

d) Browsing data

data obtained through cookies or similar technologies, in accordance with the applicable Cookie Policy.

e) Data included in communications

content of messages sent by email, forms, chat, instant messaging or other channels enabled by BlueCMR.

4. How we obtain your data

We may obtain your personal data:

directly from you, when you fill in forms, request a demo, contact BlueCMR or contract our services;
during the contractual or pre-contractual relationship with BlueCMR;
through the use of the website or our digital channels;
through third parties where there is a sufficient legal basis for doing so, for example, within a legitimate business relationship or where you have authorised such disclosure.

5. Purposes and legal bases of the processing

5.1. Handling of requests for information, contact and demonstrations

We process your data to handle enquiries, requests for information, contact requests, meetings, demonstrations and, where applicable, steps prior to entering into a contract.

Legal basis: taking steps at the request of the data subject prior to entering into a contract and, where appropriate, legitimate interest in managing the business relationship.

Data processed: identification, contact and professional data, and the content of the request.

5.2. Client management and performance of the contractual relationship

We process your data to formalise, maintain and perform the contractual relationship with clients, including the administrative, operational, contractual and commercial management associated with the contracted services.

Legal basis: performance of the contract and compliance with legal obligations associated with the contractual relationship.

Data processed: identification, contact, professional and billing data, and data relating to the management of the business relationship.

5.3. Technical support and customer service

We process data to resolve incidents, provide technical or functional assistance, follow up on tickets, handle support enquiries and maintain traceability of the assistance provided.

Legal basis: performance of the contract and, in certain cases, legitimate interest in ensuring the security, continuity and proper provision of the services.

Data processed: identification and contact data, technical data, logs and information included in the support request.

5.4. Invoicing, accounting and collections management

We process the data necessary to issue invoices, manage payments, comply with accounting and tax obligations and, where applicable, manage collection issues.

Legal basis: performance of the contract and compliance with legal obligations.

Data processed: identification and contact data, billing data, and accounting and payment information.

5.5. Service-related communications

We process your data to send you communications necessary for the provision of the service, such as operational notices, incidents, relevant changes, contractual updates, security communications or essential information about the account or the service.

Legal basis: performance of the contract and legitimate interest in the proper management of the relationship with clients and contact users.

Data processed: identification and contact data.

5.6. Commercial communications

We may process your data to send you information about BlueCMR products, services, news, events, content or initiatives.

Legal basis: consent, where required, or legitimate interest in keeping clients or professional contacts informed about similar BlueCMR services, on the terms permitted by applicable law.

Data processed: identification and contact data, and data relating to the business relationship.

You may object to this type of communication or withdraw your consent at any time, as applicable.

5.7. Security, fraud prevention and protection of the platform

We process certain data to protect our systems, prevent unauthorised access, investigate security incidents, detect misuse and preserve the integrity and availability of our services.

Legal basis: legitimate interest in ensuring the security of the information, the platform and the services, as well as compliance with legal obligations where applicable.

Data processed: technical data, logs, identifiers and, where applicable, data linked to incidents.

5.8. Compliance with legal obligations

We process your data where necessary to comply with legal obligations, respond to requests from authorities, and meet tax, accounting, commercial-law, data protection or any other legally enforceable obligations.

Legal basis: compliance with a legal obligation.

Data processed: only the data strictly necessary in each case.

6. Data retention

As a general rule, we will retain your data for as long as necessary to fulfil the purpose for which they were collected and, thereafter, for the applicable statutory retention and limitation periods.

In particular:

requests for information, contact or demos: for the time necessary to handle them and, thereafter, for a reasonable period for commercial follow-up, unless you object or request erasure where applicable;
data of clients and contact persons: for the duration of the contractual relationship and, thereafter, for the applicable statutory periods relating to tax, accounting and contractual liability;
support data: for the duration of the relationship and, thereafter, for the time necessary to address any potential liabilities or to ensure the traceability of the assistance provided;
commercial communications: until you withdraw your consent or object to the processing, as applicable;
technical data and logs: for the period necessary for security, diagnosis, service continuity and regulatory compliance.

When the data are no longer necessary, they will be erased, anonymised or retained in a duly blocked state where required by applicable law.

7. Recipients and categories of recipients

Your data may be disclosed or made available to:

technology and infrastructure providers;
cloud hosting providers;
email and communications providers;
support, maintenance or security providers;
legal, tax or accounting advisers, or auditors;
financial institutions and payment service providers, where applicable;
administrative, judicial or regulatory authorities, where there is a legal obligation or a valid request.

These third parties will act, as applicable, as processors or as independent controllers.

BlueCMR will contractually require its processors to act in accordance with applicable law and with appropriate instructions.

8. International data transfers

As a general rule, BlueCMR endeavours to ensure that data processing takes place within the European Economic Area.

Should it be necessary in any case to carry out an international data transfer outside the European Economic Area, such transfer will only take place on a valid basis under applicable law and with appropriate safeguards, such as standard contractual clauses or other legally accepted mechanisms.

9. Rights of data subjects

Where applicable, you may exercise the following rights:

access;
rectification;
erasure;
objection;
restriction of processing;
portability;
withdrawal of consent, where the processing is based on consent;
not to be subject to decisions based solely on automated processing which produce legal effects or similarly significant effects, in the cases provided for by law.

To exercise your rights you may write to:

contact@bluecmr.com

or by post to:

BlueCMR S.L.U.
Calle Fueros de León 1, 24402, Ponferrada, León, Spain
Ref.: "Data Protection"

We may ask you for reasonable information to verify your identity.

Furthermore, if you consider that the processing does not comply with applicable law, you may lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Authority).

10. Mandatory or optional nature of the data

Where the collection of certain data is necessary to handle a request, provide a service or maintain a contractual relationship, failure to provide such data may prevent us from handling your request or providing the corresponding service.

11. Communications and social media

BlueCMR may maintain a presence on social media or use messaging and digital communication channels. Your interactions with BlueCMR through such environments will also be subject to the privacy policies and terms of the relevant platform.

BlueCMR will process the data you provide through those channels only to the extent necessary to respond to your enquiry, manage the relevant relationship or maintain the communication requested.

12. Processing carried out by BlueCMR as processor or sub-processor

In the context of providing the BlueCMR platform, BlueCMR commonly processes personal data on behalf of its clients, who are the ones that determine the main purposes and means of the processing with regard to the data entered into the platform in the course of their operations.

In these cases:

BlueCMR acts as processor or, where applicable, as sub-processor;
the BlueCMR client acts as controller or, where applicable, as principal processor;
BlueCMR processes the data in accordance with the applicable contract, the DPA and the client’s documented instructions;
it is the client’s responsibility to fulfil its information obligations and to ensure the lawfulness of the processing it carries out through the platform.

This may include, among others, processing relating to:

transport documents;
data of drivers, consignees, consignors or signatories;
electronic evidence;
point-in-time geolocation data associated with events in the transport operation (for example, the position of the driver’s device at the moment a delivery is confirmed, with its accuracy in metres, as evidence of the place and time of the delivery);
support linked to the client’s operations;
technical and operational records necessary for the provision of the service.

Where the platform allows the position of the device to be recorded when a delivery is confirmed, this capture is a one-off (it does not involve continuous location tracking), is visibly displayed to the user before confirming, and is subject to the device’s location permission: if permission is denied, the delivery confirmation is still recorded, without a position. These data are retained together with the transport document into which they are incorporated and for the same periods applicable to that document.

In these cases, this Policy is merely general and informative in scope. The main information about such processing must be provided by the relevant controller.

13. Electronic signature and signature data

BlueCMR may provide technical means for the capture, storage, preservation or management of electronic evidence and of certain data associated with signature processes, always within the framework of the service contracted by its clients.

When such data are processed on behalf of a BlueCMR client, BlueCMR will act in accordance with the instructions of the relevant controller and the applicable DPA, without using such data for its own purposes incompatible with the provision of the service.

BlueCMR will not use the signature data processed on behalf of its clients for its own purposes of biometric identification, profiling, model training or commercial reuse.

Determining the applicable legal basis, informing signatories and ensuring the validity of the processing in each case will be the responsibility of the controller using the platform, without prejudice to BlueCMR’s own obligations as technology provider and processor.

14. Security measures

BlueCMR applies appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, unauthorised access or improper disclosure, taking into account the nature of the data, the context of the processing and the existing risks.

However, no system is completely invulnerable, so absolute security cannot be guaranteed.

15. Changes to this Policy

BlueCMR may update this Privacy Policy to adapt it to regulatory, interpretative, technical or operational changes.

Where the changes are significant, we will communicate them by reasonable means. In any event, the version in force will be the one published at any given time.

Version: July 2026