Introduction

This privacy notice for iot.EraX LLC ("we", "us", "our") describes how and why we collect, store, use, and share information when you use our platforms and services.

This notice applies to the website, Platform Hub, the Logistics, Talent Tech, and Customer Service modules, Findix, JustBox, and related services. When we process data solely for a business customer, that customer is the controller and iot.EraX acts as its processor under contract.

This notice describes our practices; it does not make consent the legal basis for every processing activity. Questions may be sent to info@ioterax.com.

1. WHAT INFORMATION DO WE COLLECT?

Personal and Account Information

• Name, email, telephone number, message, selected enquiry subject, proposal details and products selected in the cart
• User, company, job, candidate, and account identifiers
• CV, career history, assessment answers and results when Talent Tech is used
• Complaints, incidents, approvals, and communications in Customer Service
• Billing, plan, and transaction data; full payment-card data is handled by the payment provider

Device, Asset, and Transport Data

We may process location and tracking data relating to products, devices, assets, and transport when the feature is enabled and an appropriate legal basis exists, such as contract, a properly assessed legitimate interest, or consent where required.

• Precise geolocation data (latitude and longitude)
• Movement and route history
• Device identifiers associated with tracked assets
• Operational events related to logistics or device status

Geolocation data may relate to:

• Tracked products
• IoT or logistics devices
• Transport units or shipments

We do not continuously track individuals. Location tracking is limited to assets, devices, or transport, and only when enabled by the user or company.

Automatically Collected Data

• IP address
• Browser and device characteristics
• Last login timestamp
• Access logs and security events

Sensitive data: precise geolocation and some assessment information may receive enhanced protection. We apply minimisation, access controls and the required legal basis. We do not request GDPR special-category data unless this is necessary, disclosed and legally permitted.

2. HOW DO WE PROCESS YOUR INFORMATION?

• Answer contact and proposal enquiries, including products selected in the cart, and process newsletter requests
• Create accounts, perform contracts, provide support, and bill plans
• Operate logistics, tracking, returns, complaints, incidents, and approval workflows
• Maintain professional profiles, assessments, and compatibility recommendations in Talent Tech
• AI assists in comparing jobs, CVs, career history and assessments; hiring decisions should remain human, and we do not make solely automated decisions with legal effect on behalf of an employer
• Protect accounts, maintain audit records, prevent fraud, and meet legal duties
• Produce aggregated analytics and improve services without using customer data for an incompatible purpose

3. WHAT LEGAL BASES DO WE RELY ON?

• Contract or pre-contractual steps to provide accounts, modules, and support
• Legitimate interests for security, fraud prevention, improvement, and B2B communications after balancing impacts
• Consent where law requires it, including optional cookies or certain location uses
• Legal obligations for tax, accounting, security, and lawful authority requests
• Protection of legal rights and other grounds permitted by applicable law

4. WHEN AND WITH WHOM DO WE SHARE INFORMATION?

We share only what is necessary under contract and for a disclosed purpose. We do not sell personal data for money. Categories of recipients may include:

• Hosting, security, authentication, communications, support, analytics, and payment providers
• The business customer and authorised users in the same organisation
• Integrations, carriers, or partners selected by the customer
• Advisers and authorities where required by law or to protect rights
• An acquirer or successor in a corporate transaction, subject to confidentiality and notice where required
• For transfers outside the EEA, an adequacy decision, European Commission Standard Contractual Clauses, or another lawful mechanism, with supplementary measures where needed

5. COOKIES AND SIMILAR TECHNOLOGIES

We use necessary local storage for language, cart, privacy preferences and core operation. Google Analytics and Microsoft Clarity load only after you accept analytics technologies. You may reject them without losing essential functions and may withdraw consent at any time through Privacy settings; withdrawal stops future collection and removes accessible first-party analytics cookies.

• Necessary: operation, security, session, and language preference
• Analytics: usage and performance measurement when authorised
• Third-party integrations: the relevant provider's notice also applies

6. HOW LONG DO WE KEEP YOUR INFORMATION?

Account and service data is kept during the relationship and afterward only as necessary for legal duties, security, disputes and claims. Contact and proposal enquiries are generally kept for up to 24 months after the last interaction, unless a contract begins or a longer legal period applies. Newsletter details are kept until withdrawal, together with only the suppression record needed to honour it.

Operational, geolocation, candidate and incident data is retained for the contracted period or for as long as its purpose requires. It is then securely deleted or anonymised; backups expire through their technical cycle. Withdrawal of consent does not require deletion where another legal basis requires retention.

7. HOW DO WE PROTECT INFORMATION?

We use risk-appropriate technical and organisational measures, including access control, audit logs, protection in transit and at rest where applicable, backups, vulnerability management and incident response. No system is immune; relevant incidents will be assessed and reported to individuals and authorities where required by law.

8. CHILDREN'S DATA

The Services are business products and are not directed at children. Users must have the legal capacity and organisational authority required to use them. We do not knowingly seek children's data through this website; if we learn that it was submitted without valid authorisation, we will restrict or delete it as required. A parent or guardian may contact us.

9. WHAT ARE YOUR PRIVACY RIGHTS?

You may request:

• Confirmation and access
• Correction, deletion, and restriction
• Portability where applicable
• Objection and withdrawal of consent
• Information and human intervention for automated decisions where applicable
• Complaint to the relevant authority and freedom from discrimination for exercising rights

See the Privacy Rights page or send a request to info@ioterax.com. Rights depend on territory, our controller or processor role, and legal exceptions.

10. DO-NOT-TRACK AND GLOBAL CONTROLS

Browsers may send Do Not Track signals, for which no uniform standard exists. Where applicable law requires it, we recognise technically valid opt-out signals such as Global Privacy Control for the relevant browser or device.

11. UNITED KINGDOM PRIVACY NOTICE

Where UK law applies, processing is governed by the UK GDPR and Data Protection Act 2018, and storage technologies and electronic marketing by PECR as amended. You may exercise the rights in section 9 and complain to the Information Commissioner's Office. If UK Article 27 requires a representative, its details must be published here before the relevant activity begins.

12. UNITED STATES STATE PRIVACY NOTICES

Where a US state privacy law applies, residents may have rights to know or access, correct, delete and obtain a portable copy, and to opt out of sale, sharing, targeted advertising or certain profiling. We do not sell personal data for money. Applicable appeal, authorised-agent and non-discrimination rights are honoured; valid universal opt-out signals are recognised where legally required.

13. CHANGES TO THIS NOTICE

We may update this Notice for legal, technical, or Service changes. We will show the revision date and, for a material change, provide additional notice before it takes effect where required.

14. HOW CAN YOU CONTACT US?

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE YOUR DATA?

Use our Privacy Rights page or email info@ioterax.com. We may verify identity using only reasonably necessary information. If a business customer controls the data, we will route or assist the customer according to our contractual duties.