Privacy Policy

Certin Technologies Limited is a company registered in England and Wales under company number 17345390. Our registered office is at 205 Regent Street, London, W1B 4HB, United Kingdom. In this policy, Certin, we, us and our mean Certin Technologies Limited.

We build software that helps distributors and logistics teams understand and act on what is happening in their operations. This policy explains what we do with personal information, why, and what rights you have.

You can reach us about anything in this policy at privacy@getcertin.ai.

This matters because it decides who you should talk to about your information.

When we decide how information is used, the law calls us a controller. That applies to people who visit our website, people who use the Certin application, and people we contact about our product. This policy tells you what we do, and you can contact us directly.

When one of our customers uses Certin to handle their own operational information, they decide what happens to it and we act on their instructions. The law calls them the controller and us a processor. This covers delivery records, consignee contact details, driver information and similar records held inside a customer account. If your information is in a customer account, that customer is responsible for it and their own privacy policy applies. Section 5 explains what we do with it, and if you contact us we will pass your request to that customer and help them answer it.

4.1 If you visit our website

We collect basic technical information such as your internet protocol address, the pages you looked at, the type of device and browser you used, and where you came from. Some of this comes from cookies and similar technologies, which you control. See section 13.

4.2 If you request access to the platform, or use it

Certin does not have an open sign up. People ask for access and accounts are set up for them. When that happens we collect and hold:

• Your name, your work email address, the organisation you work for and your role.
• Authentication information, including your password in a hashed form that we cannot read, and your multi-factor authentication enrolment.
• Records of your sessions and the devices you sign in from, so that you and your administrator can see and end them.
• What you do in the platform: messages you send to the assistant, actions you approve or decline, settings you change, and security events on your account.

We give you this policy when you ask for access, and we keep a record that we did. That record is how we show we told you. It is not a permission we are asking for, and you are not being asked to consent.

4.3 If we contact you about Certin

We may hold your name, your work contact details, your role and the organisation you work for, together with a record of our correspondence. We collect this from public professional sources, from your organisation’s website, from events, or from someone who introduced us. If we contact you and you did not give us your details yourself, we will tell you where we got them. You can ask us to stop at any time and we will, permanently.

Most of the personal information on the platform is not about our own users. It is information our customers hold about the people they deliver to and work with, and they decide what goes in. It can include:

• Names, delivery addresses, telephone numbers and email addresses of people receiving deliveries.
• Names and assignment records of drivers, couriers and contractors.
• Notes written by staff about why something went wrong with a delivery.
• Email correspondence, where a customer has connected a mailbox so that it can be read and organised automatically.
• Location and route information relating to deliveries.

We handle this on the customer’s instructions. We do not use it for our own purposes, we do not sell it, and we do not use it to build a picture of you outside that customer account.

If you think your information is in a Certin customer account and you want to see it, correct it or have it deleted, the quickest route is to contact the company that delivers to you or works with you. If you contact us instead, we will identify the customer, pass your request to them, and help them answer it.

Where we are the controller, we rely on the following.

Where we rely on legitimate interests, we have written down why we think our reasons do not override your interests and rights. You can ask us for that reasoning, and you can object at any time under section 12.

Certin uses artificial intelligence to classify records, forecast problems, answer questions about operations and, in some cases, place calls or send messages. You are entitled to a plain account of what that means for your information.

7.1 What is sent to specialist providers

To do this work, some information is sent to specialist providers, processed, and sent back. That can include the content of operational records, the questions our customers ask the assistant, and audio from calls the platform places.

We limit what is sent to what the task requires, and we reduce or replace identifying details wherever the task allows. Nothing is stored outside the European Union.

7.2 Training

We do not permit these providers to use our customers’ information to train or improve their models. That is a term of our agreements with them and, where a provider offers a setting for it, we use it.

We do improve our own forecasting and classification models. We do that using information with identifying details removed, so that what we learn is about routes, carriers and timings rather than about individual people.

7.3 Automatic actions and human review

The platform can take some actions on its own, such as raising an alert, notifying a customer team or updating a record. Every proposed action passes through a control that checks it against the settings the customer has chosen, and can hold it back for a person to approve or block it entirely.

Any action capable of having a legal effect on someone, or of significantly affecting them in a similar way, always requires a person to approve it. That cannot be switched off. If a decision has been made about you in this way, you can ask for a person to look at it again, tell us what you think we got wrong, and challenge the outcome. Write to privacy@getcertin.ai.

Where the platform speaks or writes to you directly, including on a call, it will tell you that you are dealing with an automated system.

Artificial intelligence can be wrong. Where the platform generates something rather than reading it from a record, we mark it as generated so that it is not confused with a fact you gave us. If you think something we hold about you is wrong, tell us and we will correct it.

We do not sell personal information and we do not share it for anyone else’s marketing. We use a small number of service providers to run the platform. They act on our instructions, are bound by written agreements, and may only use the information to provide their service to us.

We name each provider, and keep the list current, at getcertin.ai/subprocessors. Customers can ask to be told when it changes.

Everything we store, we store in the European Union. Our application, database, cache and file storage all run in the European Union region of our hosting provider. We do not keep a copy of personal information outside Europe.

Some information travels outside Europe to be processed and then comes back. That happens when a question is answered by an artificial intelligence model, when a document is indexed so it can be searched, when a call is placed, and when a message or email is sent. The providers who do that work are mostly in the United States.

Where information goes to a country that United Kingdom or European Union law does not treat as offering equivalent protection, we put safeguards in place before it goes. We use the Standard Contractual Clauses approved by the European Commission, together with the International Data Transfer Addendum issued by the Information Commissioner for information coming from the United Kingdom. We have assessed the laws of the destination country and the measures that reduce the risk, and we have written that assessment down.

We rely on those contractual safeguards rather than on any adequacy arrangement that could change, so our protection does not depend on a political decision.

You can ask us for a copy of the safeguards we rely on by writing to privacy@getcertin.ai.

When we delete an account, we remove the linked personal information in one operation and record that we did it.

• Everything we store sits in the European Union.
• Connections to the platform are encrypted.
• Passwords are stored hashed, so we cannot read them.
• Multi-factor authentication is required for customer organisations and cannot be avoided by reusing an old sign in.
• Access inside the platform is controlled by role, and administrators can end any session remotely.
• Access to customer information by Certin staff is limited to a small named group and is recorded.
• Security and deletion events are logged, and serious ones alert an administrator automatically.
• Our staff sign a security policy and an artificial intelligence use policy before they get access to anything.
• We keep a written record of the security measures we have in place, and we share it with customers who ask.

No system is perfectly secure. If something goes wrong that affects your information, we will tell the customer concerned without undue delay, and we will notify the relevant authority and affected individuals where the law requires it.

You have the following rights over your personal information. They are free to exercise and we will answer within one month, or tell you if we need longer and why.

To exercise any of these, write to privacy@getcertin.ai. We may need to check who you are before we answer, which protects you as much as us.

If your information sits inside a customer account, see section 2. We will pass your request to that customer and help them answer it.

If you are not happy with our answer

Please tell us first, because most things are quicker to fix directly. You also have the right to complain to a data protection authority.

• In the United Kingdom: the Information Commissioner’s Office, at ico.org.uk.
• In the European Union: the data protection authority in the country where you live, where you work, or where the problem happened.

Our representative in the European Union, appointed so that people in Europe have someone local to contact, is Barbara Okoro, based in France, reachable at barbara@getcertin.ai.

We use a small number of cookies. Some are strictly necessary to make the site and the application work, and those do not need your permission. Anything else only runs if you agree.

When you first visit you will see a banner giving you a genuine choice to accept or reject, and nothing beyond the strictly necessary cookies runs before you choose. You can change your mind at any time using the link in the footer. Our Cookie Policy explains this in full.

Certin is a business tool. It is not intended for children and we do not knowingly collect information about them. If you think we hold information about a child, tell us at privacy@getcertin.ai and we will delete it.

We will update this policy when what we do changes. The date at the top tells you when we last changed it. If a change is significant, for example if we add a new type of processing or a new provider that receives personal information, we will tell customers directly rather than relying on you noticing.

Certin Technologies Limited, 205 Regent Street, London, W1B 4HB, United Kingdom. Email privacy@getcertin.ai.

Responsibility for privacy at Certin is held by Barbara Okoro, Chief Executive Officer, who you can reach at barbara@getcertin.ai or at the address above.