1. Data protection at a glance
The protection of personal data is important to us.
With this privacy policy, we inform you about which personal data are processed when using SeaFly.ai, for what purposes this is done, to whom data may be disclosed and what rights data subjects have.
Personal data are all information relating to an identified or identifiable natural person.
SeaFly.ai is not merely an intermediary platform. As a digital freight forwarder (e-forwarder), we organise transport and logistics services and use a network of freight forwarders, carriers, transport companies and other specialised service providers to perform them.
2. Controller
The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
KREATIVAGENTUR Subotic
SeaFly.ai is a service of KREATIVAGENTUR Subotic.
Stöberlstrasse 80
80686 München
Germany
Email for data protection enquiries:
privacy@seafly.ai
3. What SeaFly.ai is
SeaFly.ai operates a digital freight forwarding business (e-forwarding).
Via SeaFly, customers can request and book transport and logistics services, in particular in the areas of:
- road haulage
- transport of vehicles
- sea freight
- air freight
- combined or multimodal transportation
- supplementary logistics services
via the platform.
In doing so, SeaFly in particular takes care of:
- receiving transport requests,
- reviewing and structuring the requests,
- selecting suitable transport and logistics partners,
- obtaining and calculating offers,
- organising the performance of the transport,
- communicating with customers and partners,
- handling orders,
- exchanging documents,
- processing payments,
- accompanying the transport order through to completion.
SeaFly acts as the central point of contact for the customer for the booked transport service.
We may use independent partners and subcontractors to perform individual services.
4. Our partners and subcontractors
To perform transport and logistics orders, SeaFly works with independent companies and service providers.
Within our system, these are sometimes referred to as “partners”.
These can include in particular:
- freight forwarders
- carriers
- transport companies
- vehicle transporters
- freight brokers
- logistics companies
- shipping lines or their service providers
- air freight companies
- air freight agents
- handling companies
- warehousing and transhipment companies
- customs agents
- insurance companies
- insurance intermediaries
- other service providers required to perform a transport order
Suitable partners may receive transport requests and submit offers to SeaFly for the performance of individual services.
The customer pays SeaFly for the agreed transport service.
Partners or subcontractors commissioned by SeaFly invoice their services to SeaFly.
5. Which personal data we process
Depending on how SeaFly is used, different data may be processed.
5.1 Account and master data
These can include in particular:
- first and last name
- email address
- telephone number
- address
- user name
- user role
- registration date
- email verification status
- login and security information
6. Company data
For business users and partners, the following may also be processed:
- company name
- company address
- type of company
- website
- contact person
- services offered
- transport categories
- commercial register information
- VAT identification number
- proof of insurance
- permits
- certificates
- identity and verification data
- company documents
These data may also be used to review and approve partner companies.
7. Transport and freight data
When a transport request is made, the following information in particular may be processed:
- place of pickup
- destination
- pickup address
- delivery address
- desired transport period
- mode of transport
- information on the goods
- vehicle type
- vehicle model
- vehicle data
- dimensions
- weight
- number of pallets or packages
- container information
- information on sea or air freight
- special requirements
- loading information
- shipping and delivery information
We endeavour to request only information that is actually required for the respective mode of transport.
8. Communication and chat data
When users communicate via SeaFly, we process the content transmitted in the process.
This includes in particular:
- chat messages
- messages to SeaFly
- communication with partners
- questions and answers
- communication about offers
- queries about transports
- information on order handling
Communication may in part be supported, analysed, structured or translated by artificial intelligence.
9. Documents and files
Files and documents may be uploaded in connection with a transport order.
These can include in particular:
- vehicle papers
- transport documents
- CMR consignment notes
- bills of lading
- air waybills
- powers of attorney
- customs papers
- images
- insurance documents
- company papers
- invoices
- other order-related documents
Users should only transmit documents and personal data that are required for the respective transport or its handling.
10. Offer, booking and order data
Within the scope of our services, the following in particular may be processed:
- transport requests
- submitted offers
- offer prices
- accepted offers
- bookings
- order numbers
- transport status
- shipment history
- payment status
- document status
- pickup status
- delivery status
- information on drivers and vehicles
- order-related messages
11. Payment and invoice data
For chargeable transport services, we process data for payment and invoicing.
These may include:
- billing address
- invoice amount
- payment status
- time of payment
- transaction number
- payment method
- invoice data
- credit notes
- statements
The actual payment processing may be carried out by external payment service providers.
Payment data may be processed directly by the respective payment service provider.
SeaFly in principle only receives the information necessary to allocate and process the payment.
12. Technical data
When visiting our website or platform, technical data may be processed automatically.
These can include in particular:
- IP address
- date and time
- pages accessed
- browser type
- browser version
- operating system
- device information
- referrer URL
- session ID
- login information
- security logs
These data are required in particular for the technical operation and security of the platform.
13. Purposes of data processing
We process personal data in particular for the following purposes:
- operation of SeaFly.ai
- provision of user accounts
- receipt of transport requests
- review and processing of transport requests
- organisation of transport services
- selection of suitable partners and subcontractors
- obtaining and calculating offers
- conclusion of contracts
- performance of transport orders
- order management
- communication
- exchange of documents
- payment processing
- invoicing
- settlement with partners
- shipment tracking
- status information
- customer support
- partner verification
- prevention of fraud and misuse
- IT security
- fulfilment of legal obligations
- enforcement or defence of legal claims
14. Legal bases
Personal data are processed in particular on the basis of the following provisions.
Art. 6 (1) (b) GDPR
Processing is required where it is necessary for the performance of a contract or for pre-contractual measures.
This concerns in particular:
- transport requests
- preparation of offers
- bookings
- transport orders
- user accounts
- communication
- exchange of documents
- payment processing
- order handling
Art. 6 (1) (c) GDPR
Data are processed where we are legally obliged to do so.
This applies, for example, to:
- retention obligations under tax law
- retention obligations under commercial law
- statutory obligations to provide evidence
Art. 6 (1) (f) GDPR
Processing may take place if it is necessary to safeguard our legitimate interests and no overriding interests or fundamental rights of the data subject prevail.
These include in particular:
- security of our platform
- protection against fraud
- prevention of misuse
- stability of the systems
- protection against cyber attacks
- optimisation of operational processes
- enforcement of legal claims
Art. 6 (1) (a) GDPR
Where processing requires consent, it only takes place after corresponding consent has been given.
This may apply in particular to:
- optional analytics functions
- marketing
- certain cookies or tracking technologies
- newsletters
Consent can be withdrawn at any time with effect for the future.
15. AI freight assistant
SeaFly uses an AI-supported freight assistant.
In particular, it may be used to:
- understand transport requests,
- structure information from messages,
- identify modes of transport,
- request necessary information,
- assign data to a request,
- summarise messages,
- translate communication,
- support customers and partners in handling orders.
For this purpose, the messages entered by the user and the information necessary for the respective process may be processed automatically.
Users should not enter any personal or confidential information in the chat that is not required for the respective transport process.
Insofar as external AI service providers are used for this, processing takes place in compliance with the applicable data protection regulations and corresponding contractual agreements.
16. Disclosure of request data to potential partners
So that SeaFly can calculate and organise transport services, suitable partners may be given access to certain data of a transport request.
Before a partner is specifically commissioned, in principle only such information is provided as is necessary to review and calculate the order.
This may include in particular:
- mode of transport
- place or region of pickup
- destination or destination region
- type of goods to be transported
- vehicle type
- dimensions and weight, where necessary
- transport period
- special transport requirements
Potential partners are, in principle, not to receive unrestricted access to all of the customer's personal information.
In particular, full contact details, private documents or personal information that is not required are not automatically made available to all potential partners.
17. Disclosure after a partner has been commissioned
As soon as SeaFly commissions a partner or subcontractor to perform a transport order, further information may be provided.
This only happens insofar as the information is necessary for the specific performance of the order.
This may include in particular:
- full pickup address
- full delivery address
- name of the contact person
- telephone number
- email address
- vehicle data
- vehicle documents
- transport documents
- powers of attorney
- customs papers
- pickup information
- delivery information
- other information necessary for performance
Other partners who have not been commissioned do not receive access to these order-related data and documents.
18. Payment processing between customer, SeaFly and partner
The customer concludes the booked transport service via SeaFly.
The customer's payment is made to SeaFly.
SeaFly then commissions suitable partners and subcontractors, or does so in the course of handling the order.
The partners commissioned by SeaFly invoice their services to SeaFly.
In this context, personal data are only processed or disclosed insofar as this is necessary for:
- contract processing,
- payment processing,
- invoicing,
- accounting,
- performance of the transport
and only to the extent required.
19. Email communication
We use email addresses in particular for:
- account activation
- email verification
- login and security codes
- password reset
- transport requests
- offer information
- new offers
- queries
- booking confirmations
- payment information
- new messages
- document requests
- status changes
- reminders
- information on order handling
These messages may be necessary for the performance of the contract or the transport request.
Advertising and newsletters are only sent if there is a corresponding legal basis for this.
20. Recipients of personal data
Personal data may – where necessary – be disclosed in particular to the following categories of recipients:
- freight forwarders selected by SeaFly
- carriers
- transport companies
- freight brokers
- shipping lines and their service providers
- air freight companies
- handling companies
- customs and logistics service providers
- warehousing companies
- insurance companies
- payment service providers
- hosting providers
- IT service providers
- email service providers
- AI service providers
- accounting service providers
- tax advisors
- legal advisors
- authorities and public bodies, insofar as there is a legal obligation
Data are only disclosed if there is a legal basis for this or if the data are required to perform an order.
21. Hosting and server log files
SeaFly is operated on IT systems or servers of a hosting service provider.
When our platform is accessed, technical information may be stored automatically in server log files.
This may include in particular:
- IP address
- time of access
- page accessed
- browser
- operating system
- referrer URL
- technical status information
Processing takes place in particular for:
- ensuring technical operation
- error analysis
- IT security
- defence against attacks
The legal basis is in particular Art. 6 (1) (f) GDPR.
Our legitimate interest lies in the secure and reliable operation of our platform.
The specific hosting provider and, where applicable, its server location will be added here.
22. Cookies and similar technologies
SeaFly may use cookies and comparable technologies.
Technically necessary cookies
Technically necessary cookies are required, for example, for:
- login
- session management
- security functions
- language settings
- user accounts
- booking processes
They enable basic functions of the platform.
Optional cookies
Insofar as analytics, marketing or other non-essential technologies are used and consent is legally required for them, they are only activated after corresponding consent has been given.
Consent given can be changed or withdrawn at any time via the cookie settings.
23. Storage period
Personal data are only stored for as long as is necessary for the respective purpose.
Account data are, in principle, stored for as long as the user account exists.
Transport and order data may be stored for as long as this is necessary for:
- order handling,
- providing evidence,
- processing complaints,
- asserting or defending claims
in the individual case.
Invoice, booking and payment data may be stored for longer due to statutory retention obligations under commercial and tax law.
Documents are deleted as soon as they are no longer needed for handling the order or due to legal requirements.
Technical log data are only stored for as long as they are needed for security and evidential purposes.
If a user requests the deletion of their account, data are deleted unless statutory retention obligations or other legal reasons prevent deletion.
The GDPR generally requires that personal data are not stored for longer than necessary for the respective purpose.
24. Data transfers outside the EU or the EEA
Some service providers used may be based outside the European Union or the European Economic Area or process data there.
Personal data are only transferred to so-called third countries if the legal requirements are met.
These may include in particular:
- adequacy decisions of the European Commission
- EU standard contractual clauses
- other appropriate safeguards pursuant to Art. 46 GDPR
- other legally provided requirements
Insofar as individual service providers process data outside the EU or the EEA, we provide information about this in the respective section of this privacy policy.
25. Automated processing and AI
SeaFly uses automated systems and artificial intelligence to support internal processes.
These may include in particular:
- identification of the mode of transport
- analysis of transport requests
- structuring of information
- assignment to transport categories
- selection of generally suitable partner groups
- translation of messages
- preparation of suggested replies
- summarising information
The systems are generally used to support our processes.
Should an exclusively automated decision within the meaning of Art. 22 GDPR be used that produces legal effects concerning a person or similarly significantly affects them, the data subjects will be informed about this separately.
26. Data security
We use appropriate technical and organisational security measures to protect personal data.
These include measures to protect against:
- unauthorised access
- manipulation
- loss
- destruction
- unauthorised disclosure
- abusive use
Data transmission between the browser and SeaFly is, in principle, encrypted via TLS/SSL.
27. Rights of data subjects
Subject to the statutory requirements, data subjects have in particular the following rights:
- right of access pursuant to Art. 15 GDPR
- right to rectification pursuant to Art. 16 GDPR
- right to erasure pursuant to Art. 17 GDPR
- right to restriction of processing pursuant to Art. 18 GDPR
- right to data portability pursuant to Art. 20 GDPR
- right to object pursuant to Art. 21 GDPR
- right to withdraw consent given
- right to lodge a complaint with a data protection supervisory authority
The GDPR also requires that data subjects are informed about the purposes, legal bases, recipients or categories of recipients and the storage period.
Data protection enquiries can be sent to:
28. Withdrawal of consent
Where processing is based on consent, it can be withdrawn at any time with effect for the future.
The lawfulness of the processing carried out until the withdrawal remains unaffected.
29. Right to object
Where personal data are processed on the basis of Art. 6 (1) (f) GDPR, there is a right to object under the statutory conditions.
In the case of direct marketing, you can object at any time to the processing of personal data for advertising purposes.
30. Right to lodge a complaint
Data subjects have the right to lodge a complaint with a competent data protection supervisory authority.
In particular, a complaint may be lodged with the data protection supervisory authority of the place of habitual residence, the place of work or the place of the alleged data protection infringement.
31. Necessity of certain information
Certain data are required so that we can process transport requests or perform contracts.
These can include, for example:
- contact details
- place of pickup
- destination
- information on the goods
- information relevant to invoicing
Without this information, a transport may not be able to be offered or performed.
Other information is voluntary.
32. Changes to this privacy policy
We may adapt this privacy policy if any of the following change:
- our services,
- technical processes,
- service providers used,
- legal requirements
in a relevant way.
The current version published on SeaFly.ai applies.
As of: October 2026