How we handle personal data
Privacy Policy
1Who we are
This Policy applies to www.tessadesk.com and to enquiries, quotations, bookings, transport assignments and related communications under the TESSA brand.
| Legal name | SIA “TESSA ONE” |
| Registration no. | 40203791725 |
| Register | Latvian Register of Enterprises (Uzņēmumu reģistrs) |
| Registered office | Augusta Deglava iela 122 - 63, Rīga, LV-1082, Latvia |
| Contact | desk@tessadesk.com | +371 20 95 5002 |
| Privacy requests | desk@tessadesk.com |
The entity above is the controller for the processing described here. A customer may also be an independent controller for personal data it gives us about passengers, recipients, employees, couriers, site contacts or other individuals.
2Principles
We process personal data lawfully, fairly and transparently, for specified purposes only. We collect only what is adequate, relevant and necessary, keep it accurate, retain it no longer than needed and protect it in proportion to the risk. This Policy does not cover third-party websites linked from our site.
3Personal data we collect
| Category | What it includes |
| Identity and contact | Name, organisation, role, email, telephone or messaging number, billing address, collection and delivery contacts, signature. |
| Quote and booking | Service sector, message, route, timing, item description, dimensions, weight, declared value, handling instructions, authorisations, supporting documents. |
| Operational and custody records | Pickup and delivery locations and times, itinerary, flight or transport details, identity checks, photographs of the shipment where necessary and lawful, proof of collection and delivery, incident records, communications. |
| Compliance | Information needed for customs, aviation, sanctions, export-control, security, dangerous-goods, anti-fraud, anti-money-laundering, insurance or other legal checks. Identity checks at handover record the document type only; we request copies of identity documents only where a legal or contractual requirement applies. |
| Commercial | Quotations, contracts, invoices, payments, refunds, account history, business correspondence. We do not intentionally collect payment-card details through this website. |
| Technical | IP address, browser and device information, timestamps, pages requested, referral information, security logs, data generated by hosting and form-delivery infrastructure. |
| From others | Information from customers, recipients, collection contacts, partner couriers, carriers, FBOs, site operators, customs agents, insurers, public authorities or public business sources. |
Please do not submit special-category data, criminal-offence data, identity documents, payment-card data or other sensitive details through the website form unless we ask for them through an appropriate channel. Shipment contents may reveal sensitive information; tell us only what is operationally and legally necessary.
4Why we use personal data and our legal bases
| Purpose | Typical data | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Respond to enquiries and prepare quotes | Contact, request, route and item details | Steps requested before a contract (b); legitimate interests in answering business enquiries (f). |
| Accept, plan and perform services | Identity, contacts, itinerary, authorisations, custody records | Contract (b); legitimate interests (f) where the data concerns another person. |
| Coordinate third parties | Contact, route, shipment and recipient data | Contract (b); legitimate interests in reliable delivery (f). |
| Identity, security and compliance checks | Identity, shipment, authorisation and screening data | Legal obligation (c); legitimate interests in preventing unlawful or unsafe carriage (f). |
| Billing, accounting and tax | Contract, invoice, payment and customer data | Contract (b); legal obligation (c). |
| Claims, disputes, insurance and legal rights | Contract, custody, incident and communications data | Legitimate interests in establishing, exercising or defending legal claims (f); legal obligation (c). |
| Website operation and security | Technical logs and form-submission metadata | Legitimate interests in secure, reliable operation (f); consent (a) for any non-essential cookies. |
| Service quality and administration | Feedback, communications, transaction history | Legitimate interests in improving service and managing the business (f). |
| Direct marketing, if introduced | Contact details and preferences | Consent (a) where required; otherwise legitimate interests (f), subject to e-marketing rules and the right to object. |
Where we rely on legitimate interests, we balance them against your rights and reasonable expectations, and you may ask for information about that assessment. Where we rely on consent, you may withdraw it at any time without affecting earlier processing.
5Data about other people; required information
If you give us data about another person, you must have a lawful basis to do so, provide this Policy to them where appropriate, and keep the data accurate and limited to what is needed. Fields marked as required are needed to respond to a quote request; further operational information may be required to contract, perform the service or meet legal obligations. Without it we may be unable to quote, accept or complete an assignment. We do not make decisions with legal or similarly significant effects solely by automated means.
6Who receives personal data
Operational partners: airlines, charter operators, airports, FBOs, rail or road carriers, hotels, partner couriers, freight or customs agents, site operators, OEMs, and collection or delivery contacts — strictly as needed for the assignment.
Service providers: website hosting and form handling (Netlify); protection of the quote form against automated abuse (Cloudflare Turnstile); email (Spacemail); email, communications, IT, document-storage, accounting and professional-service providers.
WhatsApp (Meta): if you choose to contact us through the WhatsApp link, under that provider’s own terms and privacy information.
Financial and legal: banks, payment providers, insurers, auditors, legal advisers, debt-recovery providers and fraud-prevention services where relevant.
Authorities: police, customs, aviation or transport authorities, regulators, courts, sanctions authorities and other public bodies where required or lawfully requested.
Corporate transactions: a buyer, investor, lender or adviser in a genuine corporate transaction, under confidentiality and legal safeguards.
We do not sell personal data. Processors act only on our documented instructions, under contract and confidentiality, unless independently required by law.
7International transfers
Time-critical logistics can require sharing data with recipients and providers outside the European Economic Area (EEA). We rely on an adequacy decision where available, or on safeguards such as European Commission standard contractual clauses with supplementary measures where needed. A limited transfer may rely on a lawful derogation, for example where necessary to perform a contract requested by you or to establish or defend legal claims. You may ask for information about the safeguard used and, where available, a copy.
8Retention
| Record | Typical retention |
| Unsuccessful enquiries and quotes | Up to 24 months after the last meaningful contact, unless a shorter period is requested or a dispute requires longer. |
| Customer, contract and operational records | For the engagement and generally up to 10 years afterwards where needed for Latvian accounting, tax, contractual, insurance or legal-claim requirements. |
| Chain-of-custody and delivery evidence | Normally 6 years after delivery; longer for declared high-value items, claims, regulatory requirements or agreed customer protocols. |
| Identity and compliance checks | Only as long as necessary for the check and applicable legal or limitation periods; copies are avoided or deleted earlier where feasible. |
| Website and security logs | Normally up to 12 months, unless needed to investigate an incident or comply with law. |
| Marketing preferences | Until withdrawal or objection; suppression records may be kept to respect the preference. |
These are default periods. They may be shortened or extended by legal duties, limitation periods, an active dispute, an authority request, customer instructions, backup cycles, or the sensitivity of the record. Data is then deleted, anonymised or securely archived with restricted access.
9Security and confidentiality
Confidentiality is part of our service. Staff, couriers and partners with access are bound by confidentiality, and NDAs are available as standard practice. We use proportionate organisational and technical measures, including access controls, supplier review, secure communications where appropriate, data minimisation, backups and incident-response procedures. No online transmission or storage system is completely secure: please use an agreed secure channel for identity documents, valuable-asset details or confidential legal material, and avoid unnecessary sensitive information in the website form.
10Your rights
Access: confirmation and a copy of your personal data and related information.
Rectification and erasure: correct inaccurate data; delete data where no lawful reason requires continued processing.
Restriction and portability: limit processing in the cases set by law; receive data you provided in a structured, machine-readable format.
Objection: to processing based on legitimate interests, and at any time to direct marketing.
Consent and automated decisions: withdraw consent at any time; obtain safeguards if solely automated decisions are ever used.
Complaint: to the Latvian Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Rīga, LV-1050, pasts@dvi.gov.lv, or another competent EEA supervisory authority.
To exercise a right, email desk@tessadesk.com. We may verify your identity and clarify the request, and normally respond within one month, subject to lawful extensions. Rights are not absolute; if an exception applies, we will explain it.
11Children
The website and services are not directed to children. A person booking must be at least 18 and legally capable of contracting. Data about a minor recipient or passenger is processed only when necessary for a lawful engagement and supplied by an authorised adult or organisation.
12Cookies and linked services
Cookies and similar technologies are described in our separate Cookie Policy. Choosing an email, telephone or WhatsApp link may open a third-party service that processes data under its own policies. Embedded media or externally hosted resources may disclose technical connection data to their providers.
13Data breaches
We assess suspected personal-data breaches and notify the competent supervisory authority and affected individuals where the GDPR requires. Customers must promptly tell us of any suspected compromise involving assignment data and cooperate with containment and investigation.
14Changes and contact
We may update this Policy to reflect service, supplier or legal changes; the effective date above identifies the current version, and material changes will be highlighted on the website or communicated where appropriate. Questions and complaints: desk@tessadesk.com, or by post to the registered office above.