Spedo

Spedo terms of service

Version 2026-10-22, effective from 2026-10-22.

Draft for legal review. The operator’s details will be filled in before the service is made available.

This is a translation provided for convenience. The Polish version is binding.

§ 1. General

  1. These terms set out the rules for using Spedo — an online service at https://spedo.doner.cloud that helps freight forwarders turn customer requests into quote requests sent to the right carriers.
  2. The service is provided by [OPERATOR: name, address, tax ID (NIP), e-mail] (the Operator).
  3. The service is intended for businesses and people acting on their behalf.
  4. The service is currently free of charge.
  5. The service runs as a demo: quote requests are not sent to carriers, only saved in the history.
  6. Access to the service requires an access password that the Operator gives to invited people.
  7. How Users’ data is processed is described in the Privacy policy. Annex 1 to these terms is the Data processing agreement.

§ 2. Definitions

  • User — a person with an account in the service.
  • Company — a business whose profile (identified by its tax ID, NIP) a User has created in the service.
  • Owner — the User who created the Company profile or to whom it was handed over; Team — Users assigned to the Company.
  • Carriers — companies and people on the list uploaded by the Company.
  • Company Data — the carrier list, sent quote requests and loads stored in the service by the Company.

§ 3. Technical requirements

You need an up-to-date browser with JavaScript and cookies enabled, and an e-mail address.

§ 4. Account

  1. An account is created with an e-mail address and a password (at least 10 characters). Creating an account requires accepting these terms and the Privacy policy; at that moment the service agreement is concluded.
  2. In the demo the service does not send e-mails, and the address given at sign-up is treated as confirmed straight away.
  3. Users keep their password safe and do not share the account. One account belongs to one person.
  4. A sign-in is valid for 30 days. Changing the password signs out all devices.
  5. Users can download their data and delete the account at any time (Settings → Account). The Owner of a Company with other people in it must first hand the Company over to one of them or delete the Company.
  6. An account without a confirmed e-mail address and without a Company is deleted 30 days after it was created.

§ 5. Company and Team

  1. A User with a confirmed e-mail address creates a Company profile by entering the NIP. The name, address, REGON and VAT status are taken from the Ministry of Finance VAT taxpayer register (White List).
  2. By creating a profile the User declares that they are authorised to act on behalf of the Company.
  3. A new profile waits for confirmation by the Operator (e.g. by phone, using the number from a public register). A profile not confirmed within 14 days is deleted together with the Company Data and the NIP becomes free again; the Owner gets an e-mail warning beforehand.
  4. If a Company profile with a given NIP already exists, a User can report that they represent that Company. The Operator reviews the report and may hand the profile over to another person.
  5. The Owner invites people to the Team, removes them, hands the Company over to another Team member and may delete the Company with all Company Data. Team members see and use the Company Data; only the Owner changes the carrier list, the Company profile and the mailbox.

§ 6. Features

  1. Carrier list: the Owner uploads an .xlsx or .csv file; a new file replaces the previous list.
  2. AI inquiry analysis is switched off.
  3. Carrier matching: the service ranks carriers based on the load history in the Company’s list. The ranking is a suggestion; the User makes the choice.
  4. Sending: in the demo quote requests are not sent to carriers, only saved in the history.
  5. Loads and reports: the Company records orders, costs and revenue and downloads summaries.
  6. Limits: 200 AI analyses and 300 messages to carriers per Company per day, up to 30 recipients in one send; the day follows Polish time.

§ 7. Obligations of Users and Companies

  1. Users use the service lawfully and in line with these terms, do not enter unlawful content and do not send unsolicited commercial communications through the service.
  2. The Company is responsible for having a legal basis to process the data it uploads (carrier list, inquiry texts, loads) and to send quote requests to carriers.
  3. Users paste and send only the data needed to price the transport and remove personal data the carrier does not need (e.g. signatures and private phone numbers).
  4. It is forbidden to circumvent limits and security measures, impersonate other people or companies, or upload files containing malware.

§ 8. Liability

  1. The Operator takes care to keep the service running but, as a free demo, does not guarantee its availability; technical breaks may happen.
  2. The Operator does not currently make database backups. The Company should download its data regularly (Settings → Company profile → “Download company data”).
  3. The Operator is not responsible for the content of quote requests and carriers’ replies, for contracts between the Company and carriers or customers, for errors in AI results or White List data, or for the consequences of sharing a password with third parties.
  4. To the extent permitted by law, the Operator’s liability does not cover lost profits.

§ 9. Complaints

Complaints about the service can be sent to the Operator’s e-mail address. The Operator replies within 14 days of receiving a complaint.

§ 10. Termination

  1. Users may terminate the agreement at any time by deleting their account.
  2. The Operator may terminate the agreement with 14 days’ notice or, in the event of a serious breach of these terms, with immediate effect, informing the User by e-mail.
  3. The Operator may stop providing the service with at least 30 days’ notice to Users; during that time Companies can download their data.

§ 11. Changes to these terms

  1. The Operator may change these terms, the Privacy policy or the list of sub-processors (e.g. when switching on a new external service). Every change gets a new version number.
  2. After a change, Users are asked to accept the new version when they open the app. Until they accept it they can only download their data (and the Company’s data, if they are the Owner) and delete their account.
  3. The accepted version and the date of acceptance are stored with the account.

§ 12. Final provisions

  1. Polish law applies to matters not covered here. Disputes are settled by the court competent for the Operator’s registered office.
  2. These terms are available in Polish and English; in case of discrepancies the Polish version prevails.

Annex 1. Data processing agreement

§ 1. Parties and subject matter

  1. This agreement is concluded between the Company (controller) and the Operator (processor) when a User who has accepted the terms creates the Company profile, and lasts until the Company profile is deleted.
  2. The Company entrusts the Operator with processing the personal data contained in the Company Data solely to provide the service described in the terms (Article 28 GDPR).

§ 2. Nature and scope of processing

  1. Processing covers: storing, organising, searching and displaying data, matching carriers based on load history, saving quote requests in the history, exporting and deleting data.
  2. Categories of people and data: (a) carriers and their contact persons — name (for sole traders this includes a first and last name), e-mail address, phone, region, load history and rates; (b) the Company’s customers and their staff — data contained in inquiry texts and loads (e.g. customer name, loading and unloading places, notes); (c) recipients of quote requests — e-mail address and sending result.
  3. The Company does not entrust special categories of data (Article 9 GDPR) or data on criminal convictions (Article 10 GDPR).

§ 3. Obligations of the Operator

  1. The Operator processes data only on the Company’s documented instructions. The instructions are the terms with this agreement and the actions taken in the app by the Company’s Users. If the law requires other processing, the Operator informs the Company before it starts, unless the law prohibits this.
  2. Only people authorised by the Operator and bound by confidentiality have access to the data.
  3. The Operator applies the security measures described in § 5.
  4. The Operator helps the Company respond to requests from data subjects. The app provides tools for this: searching carriers, uploading a new list in place of the old one, deleting loads, downloading Company Data and deleting the Company. A request received by the Operator is forwarded to the Company without undue delay.
  5. The Operator helps the Company meet its obligations under Articles 32–36 GDPR, as far as the information available to the Operator allows.
  6. When the agreement ends, the data is deleted: deleting the Company (by the Owner, or after 14 days without confirmation) immediately erases the Company Data from the database; the Operator does not currently make database backups. Before deletion the Owner can download the Company Data. Independently of this, sent quote requests are deleted after 12 months.
  7. The Operator gives the Company the information needed to demonstrate compliance with Article 28 GDPR and allows audits — at the Company’s expense, with at least 14 days’ notice, no more than once a year unless the audit follows a personal data breach.

§ 4. Sub-processors

  1. The Company gives general authorisation for the Operator to use sub-processors. Currently these are:
    • OVH SAS (OVHcloud), France — the server that runs the service and stores the database (data centre in France).
    • Cloudflare, Inc., USA — sits in front of all traffic to the service (encrypted connection, attack protection). It sees the IP address, the browser and the data sent.
  2. The Operator announces an intended addition or replacement of a sub-processor through a new version of the terms, which Users accept when they open the app. The Company may object by not accepting the change and deleting the Company profile (after downloading the Company Data).
  3. The Operator imposes data protection obligations on sub-processors equivalent to this agreement. Data goes to countries outside the European Economic Area only under the mechanisms of Chapter V GDPR (an adequacy decision, including the EU-US Data Privacy Framework, or standard contractual clauses).
  4. A Company that sets up its own SMTP mailbox chooses its provider itself; that provider is not the Operator’s sub-processor.

§ 5. Security measures

  • encrypted connection (HTTPS) between the browser and the service;
  • server in a data centre in France; only the Operator has administrative access;
  • the app runs in an isolated container with a read-only file system and without administrator privileges;
  • Users’ passwords stored only as hashes (scrypt); Companies’ SMTP passwords encrypted (AES-256-GCM);
  • sign-in cookie not readable by page scripts; protection against cross-site requests (CSRF); limits on sign-in and sign-up attempts;
  • separation of Companies’ data — every request checks which Company the User belongs to;
  • automatic deletion of data after the periods described in the Privacy policy;
  • an access password for the whole service.

§ 6. Personal data breaches

The Operator notifies the Company of a personal data breach without undue delay, no later than 48 hours after becoming aware of it, and provides the information listed in Article 33(3) GDPR that it has.

§ 7. Final provisions

Matters not covered by this agreement are governed by the terms. In matters of personal data protection this agreement takes precedence over the terms.