Privacy Policy

1. Who processes your data

This policy describes how Faber Opus, company ID (ЕИК) 208821855, with registered office at 57A Kazbek St., Sofia, Bulgaria ("we"), processes personal data in connection with the Faber Ramp service and this website.

We have not appointed a data protection officer (DPO) - the scale and nature of our operations do not require one. For any personal data enquiries, write to support@faber-ramp.com.

2. Our roles: controller and processor

For data our customers (warehouses and logistics operators) enter into the system - data about their employees, carriers and business partners - the respective customer is the data controller, and Faber Opus acts as a processor under Article 28 GDPR, processing the data only on the customer's instructions.

For data about our own customers and contacts - administrator accounts, contract and invoicing information, correspondence - Faber Opus is the data controller.

For business customers we provide a Data Processing Agreement (DPA) on request, governing the controller–processor relationship.

3. What data we process

Depending on your role in the system, we process the following categories of data:

• company name, email address and (optionally) first and last name, provided during self-serve tenant registration (/signup);
• names, work email addresses and phone numbers of warehouse and carrier employees;
• registration plates of tractor units and trailers;
• booking data - date, time and ramp of a delivery or loading;
• IP addresses, sign-in records and audit-log entries (who performed which action and when);
• the content of uploaded waybills (PDF), including registration plates extracted from them;
• invoicing data and correspondence with our customers.

4. Purposes and legal bases

We process data on the following bases under Article 6(1) GDPR:

• point (b) (performance of a contract) - providing the Service: accounts, bookings, notifications, waybill processing;
• point (f) (legitimate interest) - system security, abuse prevention, sign-in and audit logs, troubleshooting;
• point (c) (legal obligation) - accounting and tax records for issued invoices.

5. Recipients and sub-processors

We do not sell personal data and do not share it with third parties for marketing. The Service runs on a virtual server rented from Hostinger International Ltd. (Cyprus, EU), in a data center in Frankfurt am Main, Germany (EU). Data is stored and processed on that server within the EU. Data is shared only with sub-processors necessary to run the Service:

• hosting of the Service and its database: Hostinger International Ltd., Cyprus (data center in Frankfurt, Germany, EU);
• email delivery (notifications and sign-in links): Resend, Inc., USA;
• protection against automated attacks and visit statistics: Cloudflare, Inc., USA (the Turnstile check loads on the registration form, on the email sign-in link page and on password sign-in after failed attempts; Cloudflare Web Analytics runs on all pages, without cookies, and records only aggregated page views, referrer, country and device type);
• payment processing and billing data (once payments are activated): Stripe, Inc., USA;
• accounting services for Faber Opus (invoicing data only): an external accounting provider.

6. Transfers outside the EU/EEA

The Service runs on a virtual server in a data center in Frankfurt am Main, Germany (EU). Customer data is stored and processed within the EU and does not leave the EU during normal operation of the system.

The only exceptions are individual sub-processors outside the EEA: Resend, Inc. (USA) - delivery of transactional emails (notifications and sign-in links), Stripe, Inc. (USA) - payment processing once payments are activated, and Cloudflare, Inc. (USA) - the Turnstile check and aggregated Web Analytics statistics. Data transfers to them take place on the basis of Standard Contractual Clauses (SCC) under Art. 46 GDPR.

7. Retention periods

We keep data only for as long as needed for the purposes it was collected for, by category:

• operational data - bookings, time slots, gate check-ins (arrival/departure), waybills and notifications - a maximum of 1 year, after which it is deleted or anonymised;
• account data - user, company and tenant - for as long as the account is active and up to 30 days after it is closed;
• the audit log (records of security-relevant actions and events) - 24 months, after which it is deleted automatically; the period being longer than the operational one is needed to investigate security incidents and abuse;
• invoices and accounting documents - for the period required by accounting and tax legislation;
• data entered in the public demo environment (demo.faber-ramp.com) - are visible to other visitors of the demo, may be deleted or overwritten without notice and must not contain personal data;
• the cookie-consent record - 12 months;
• the partner code from a partner link (faber_ref cookie) - 30 days; the referrer recorded at registration - together with the account data.

8. Your rights

Regarding your personal data you have the right to: access; rectification; erasure (the "right to be forgotten"); restriction of processing; data portability; objection to processing based on legitimate interest; and withdrawal of consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, write to support@faber-ramp.com. We respond within one month. Where we act as a processor, we will forward your request to the relevant controller (the company that gave you access to the system) and notify it.

9. Right to complain to the supervisory authority

If you believe your rights have been infringed, you may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP/КЗЛД): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, website kzld.bg, email kzld@cpdp.bg.

10. Data security

We apply technical and organisational measures appropriate to the risk:

• encryption of data in transit (TLS/HTTPS);
• passwords stored solely as Argon2 hashes - never in plain text;
• strict data isolation between customers at the database level (PostgreSQL Row-Level Security);
• an audit log of security-relevant actions;
• access to data strictly on a need-to-know basis.

11. Automated decision-making and profiling

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you.

The smart slot-suggestion feature only proposes suitable slots - the booking decision is always made by a person. Waybill processing (OCR) runs entirely within our own infrastructure, without sending data to external AI services.

12. No visitor tracking

We use no ad networks, pixels, tracking cookies or scripts that follow individual visitors - neither on the public site nor in the application itself. For aggregated visit statistics we use only Cloudflare Web Analytics: no cookies, no local storage and no tracking of individual visitors; it records only page views, referrer, country and device type (see section 4 and the Cookie Policy). The cookies we use are the strictly necessary ones and the partner-programme cookie (faber_ref), both described in the Cookie Policy (/cookies).

13. Changes to this policy

Updates are published on this page with a new last-updated date. For material changes we will notify customers by email or via a message in the Service.