Privacy Policy

This website, www.cargolink.in, is operated by CargoLink Express Logistics LLP(“CargoLink”, “we”, “us”), a limited liability partnership registered in India. For the purposes of India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary, and under the EU/UK General Data Protection Regulation (“GDPR”) we are the controller of your personal data.

This policy applies to our website, our shipment-tracking service, the CargoLink client portal, our Android app, and our communications with you by WhatsApp, phone and email. It does not cover third-party websites that we link to.

We only collect what we need to provide logistics services to you.

We process personal data only for clear, specific purposes. Under the DPDP Act we rely on your consent or on a legitimate use (section 7 — for example when you voluntarily share data to get a service, or to comply with law). Under the GDPR the matching legal bases are shown below.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not build advertising profiles.

Cookies are small files stored by your browser. We also use similar technologies such as local and session storage. Strictly necessary items are always active because the site cannot work without them. Everything else is off until you opt in through our cookie banner, and you can change your choice at any time — withdrawing consent is as easy as giving it.

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop sign-in and tracking from working. We do not use advertising or cross-site tracking cookies.

We do not sell or rent personal data. We share it only where needed to provide our services, and only with parties bound by confidentiality and data protection obligations:

If CargoLink is involved in a merger, acquisition or restructuring, personal data may be transferred to the successor, who will remain bound by this policy.

Our primary systems are in India. Some service providers (for example Vercel and Meta) may process data on servers outside India, including in the United States and the European Union. We transfer data abroad only as permitted by section 16 of the DPDP Act and never to a country restricted by the Government of India. For data relating to people in the EEA or UK, we rely on adequacy decisions or Standard Contractual Clauses with appropriate safeguards.

We keep personal data only as long as needed for the purpose it was collected, or as required by law, and then delete or anonymise it.

We use reasonable security practices, in line with the DPDP Rules 2025 and the IT (Reasonable Security Practices) Rules 2011, including:

• HTTPS / TLS encryption for all traffic, with HSTS
• Signed, short-lived, HTTP-only session cookies
• Strict Content Security Policy and anti-clickjacking headers
• Rate limiting and bot protection on public services
• Access limited to staff and partners who need it
• Separate, isolated access for each client company

If a personal data breach occurs, we will inform the Data Protection Board of India and affected individuals as required by law, and take steps to contain it.

You can exercise the following rights free of charge by writing to our Grievance Officer (section 12). We may need to verify your identity first.

Our services are meant for businesses and adults. We do not knowingly collect personal data from anyone under 18 without verifiable consent from a parent or lawful guardian, and we do not track or target advertising at children. If you believe a child has shared data with us, contact us and we will delete it.

We may update this policy when our services or the law change. The “Effective” date at the top shows when it was last revised. If we make significant changes, we will tell you on this website and, where appropriate, by email or WhatsApp — and ask for fresh consent where the law requires it.

See also: Contact us · Track a shipment