The application 22 TONS (hereinafter referred to as the "Application" or "Platform") is operated by INVEST REGIONAL S.R.L. We are committed to protecting personal data and complying with applicable legislation, including Law No. 133/2011 (Republic of Moldova) and, for data subjects from the EU/EEA, Regulation (EU) 2016/679 – GDPR.

1) What data do we collect

• Identification data: first name, last name, email, phone, company data (name, tax code, address).

• Authentication data: username, password (stored encrypted), session tokens, roles.

• Usage data: published/accepted rides, offers, rating/feedback, account settings.

• Location data (tracking): GPS position of the vehicle and route history when the function is active.

• Messaging data: content of internal messages, attachments, metadata (time, participants).

• Technical data: IP address, device type, operating system, application version, access logs, SDK identifiers.

Note: We do not intentionally collect special categories of data. If such data is voluntarily submitted in free text fields, we only process it as strictly necessary for the purpose of communication.

2) Purposes and legal grounds

• Account creation/administration, access: executing the contract (GDPR art. 6(1)(b) / Law 133/2011).

• Load Board (publishing/accepting rides): executing the contract.

• Internal messaging: executing the contract.

• Vehicle tracking, ETA, safety: legitimate interest (art. 6(1)(f)) and/or consent, as applicable.

• Security, fraud prevention: legitimate interest.

• Usage analysis, improvements, telemetry: legitimate interest / consent (where necessary).

• Legal obligations (accounting/tax): art. 6(1)(c) GDPR.

• Operational communications and support: executing the contract / legitimate interest.

Tracking for employees/drivers: must be managed by the employer company based on transparent informing and an appropriate legal ground. The application provides management settings and access logs.

3) Data sources

• Data provided directly by you (account creation, in-app, messaging).

• Data provided by your company (team accounts, vehicle assignments).

• Data automatically collected from the device (GPS, logs, SDKs).

• Data from partner integrations (maps/geolocation, push notifications, analytics).

4) Recipients and authorized persons

• Other users of the Platform (carriers, shippers, dispatchers) – strictly for carrying out the service.

• IT providers (hosting, cloud, CDN, backup, monitoring, security, email/SMS/push).

• Map and geolocation providers; analytics/telemetry providers.

• Public authorities, when required by law, or for the defense of rights.

• Corporate transactions (merger/acquisition/asset transfer) – with confidentiality guarantees.

We conclude agreements with all authorized persons that impose adequate security and confidentiality measures.

5) International transfers

The operator is in the Republic of Moldova. If we process data of data subjects from the EU/EEA or transfer data outside the EEA, we use appropriate safeguards (e.g. Standard Contractual Clauses – SCC) and additional security measures. A copy of the main safeguards can be requested at support@ogo.contact.

Representative in the EU (art. 27 GDPR): [to be completed, if necessary].

6) Retention periods

• Account data: for the duration of the account + 12 months (logs/audit).

• Internal messaging: 24 months, then deletion/anonymization.

• GPS tracking & routes: 12 months, with legal exceptions/litigation.

• Technical/security logs: 12 months.

• Accounting/tax documents: according to law (5–10 years).

If the law imposes other terms, those will prevail.

7) Data security

We apply appropriate technical and organizational measures: TLS encryption in transit, password storage with hashing, role-based access control, event logging, backup & recovery, periodic testing, access reviews, data minimization.

8) Rights of data subjects

• The right of access, rectification, and updating.

• The right to erasure ("to be forgotten") and/or restriction.

• The right to data portability (where applicable).

• The right to object to processing based on legitimate interest.

• The right to withdraw consent (where the basis is consent).

• The right to lodge a complaint with CNPDCP (Republic of Moldova) or, for persons in the EU/EEA, with the local competent authority.

Requests regarding rights can be sent to support@ogo.contact or to the mailing address of the Operator. We will respond, usually, within 30 days.

9) Cookies, SDKs, and similar technologies

The web version and mobile applications may use cookies and SDKs for authentication, preferences, analytics, crash reporting, and notifications. Where necessary, we will display dedicated banners and obtain consent. Preferences can be managed from the settings of the browser/device or from the application.

10) Automated decisions and profiling

We do not make solely automated decisions that have significant legal effects on you. We may use algorithms for matching offers (e.g. suitable routes/vehicles), but final decisions involve human intervention. You have the right to request human intervention, to express your point of view, and to contest the decision.

11) Children

The Platform is not intended for individuals under 16 years of age. We do not knowingly collect data from minors. If you become aware that a minor has provided us with data, please contact us to take appropriate measures.

12) Changes to the Policy

We may periodically update this Policy. We will publish the updated version in the Application/website and indicate the date of the last update. If changes are significant, we may notify users through reasonable means.

13) Contact

For questions or to exercise your rights regarding your personal data:

• Operator: INVEST REGIONAL S.R.L.

• Address: Cotiujeni village, Briceni district, Republic of Moldova

• Email: support@ogo.contact

• Phone: +373 60 999 913