Privacy Policy

1. Controller

The controller responsible for processing your data on this website and in the Routic app is:

SHAJKO GmbH
Hadikgasse 12/7, 1140 Wien, Österreich
FN 494865 v, VAT ID ATU73582125
Email: office@shajko.at
Phone: +43 1 521 13

2. This website

When you visit the website, our hosting provider processes technically necessary data: IP address, page requested, time, referrer, browser and operating system. This serves the secure and stable operation of the website (Art. 6(1)(f) GDPR). The logs are deleted automatically after a short time, usually after 14 days at most.

The website does not set cookies, does not use analytics or marketing services and loads fonts from our own server rather than from third parties.

3. The Routic app

The app has not launched yet. Once it is available, we will process the following data there:

• Account: name, email address, phone number and, for business customers, company details. If you sign in with Apple or Google, we receive your name and email address from them. As a guest, we create an anonymous account that is only linked to your account details when you submit a request.
• Transport requests: description and photos of the goods, dimensions and weight, pickup and delivery address, access and parking, preferred date, contact persons on site as well as questions, quotes and bookings.
• Execution: assigned vehicle, driver and transport status (on the way, picked up, delivered).
• Notifications: a device identifier for push notifications and your email address for status updates. You can turn off push notifications in the app and in your system settings.

The legal basis is the initiation and performance of the transport contract (Art. 6(1)(b) GDPR) and, for invoicing and retention obligations, compliance with a legal obligation (Art. 6(1)(c) GDPR).

4. AI-assisted capture of goods

If you describe your goods as text or by photo, we send the text and photos to OpenAI to identify items with their dimensions and weight. Under its terms for API customers, OpenAI does not use this data to train its models. Voice recordings are converted to text directly on your device; the recording itself never leaves your device.

The recognised details are suggestions that you review and edit. Prices and quotes are decided by a person on our team.

5. Data of contact persons and recipients

If you name contact persons at the pickup or delivery location, we do not receive their names and phone numbers from them directly (Art. 14 GDPR). We use this data solely to coordinate and carry out the transport. Please inform the persons concerned.

6. Recipients and processors

We use the following service providers, with whom data processing agreements under Art. 28 GDPR are in place or will be concluded before the app launches:

• Website hosting: Vercel Inc. (USA)
• Database, sign-in and file storage for the app: Supabase Inc. (USA), data centre in Frankfurt am Main
• AI-assisted capture of goods: OpenAI, L.L.C. (USA)
• Address search, distance calculation, push notifications, Sign in with Google: Google Ireland Ltd. or Google LLC (USA)
• Sign in with Apple: Apple Distribution International Ltd. (Ireland)
• Email communication: Microsoft Ireland Operations Ltd. (Microsoft 365)
• Tax advice and auditing: subject to statutory confidentiality obligations

For transfers to the USA, we rely, depending on the provider, on the EU-US Data Privacy Framework or on EU Standard Contractual Clauses. We disclose data to authorities and courts where legally required.

7. Retention periods

• Website server logs: usually 14 days at most
• Account: until you delete it; after that, only what must be retained by law
• Booking and invoice data: 7 years (§ 132 BAO, § 212 UGB)
• Requests without a booking: up to 3 years after the last contact

8. Your rights

You have the following rights. To exercise them, write to us at office@shajko.at.

• Access (Art. 15 GDPR): whether and which data we process about you, and a copy of it
• Rectification (Art. 16 GDPR): of incorrect or incomplete data
• Erasure (Art. 17 GDPR): unless a statutory retention obligation applies
• Restriction (Art. 18 GDPR): of processing under certain conditions
• Data portability (Art. 20 GDPR): in a common, machine-readable format
• Objection (Art. 21 GDPR): to processing based on legitimate interests
• Withdrawal (Art. 7(3) GDPR): of consent, at any time with effect for the future

You can also lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

9. Automated decision-making

The preliminary price estimate in the app is calculated automatically but is not binding. No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place: every fixed quote and every rejection is reviewed by a person.

10. Minors

Routic is not intended for persons under the age of 14. If we become aware of such data, we delete it.

11. Changes

We update this policy when legal or technical requirements change. The version published here applies.