Privacy Notice

Who we are

AWBack is a service of Lambda Twelve PC / Lambda Twelve ΙΚΕ, trading as Lambda Twelve ("we", "us"). AWBack is a product name, not a separate company: Lambda Twelve is the legal entity responsible for your data. This notice explains how we process personal data when you visit this website, apply to become a client, use the client area, or when your organisation uses AWBack.

Our two roles

We process personal data in two different roles.

• As controller, for our own purposes: running this website, handling applications to become a client, running client-area accounts, and managing our business relationship with each client.
• As processor, on our clients' instructions: the shipment data a client sends through AWBack to its airlines. Shipment data names people, such as the contacts of a shipper or consignee. For that data the client is the controller. Our processing of it is governed by our contract with the client and a data processing agreement under Article 28 GDPR, not by this notice. If your details appear in a shipment, please contact the forwarder that sent it.

What we process

Visitors to this website

• Connection and log data: IP address, time, the page or file requested, browser user agent, and response status. Our web servers and our content delivery network record these to deliver the site and keep it secure.
• Analytics: page views counted with Lambda Twelve's own Umami deployment, which runs on our infrastructure in the EU and works without cookies. Your browser never contacts it: our server relays each page view, and the collector is not reachable from the internet. A page view holds the page address (stripped of anything not on a short allowlist), the referring site (reduced to its domain), screen size and browser language. Umami derives a visitor identifier by hashing the IP address and browser with a secret salt; it does not store the IP address. Its own reporting to its developers is switched off. TODO: retention of analytics records (Umami keeps them until deleted; set a period, e.g. 25 months).

People applying to become a client

• Your name, work email address, role, and the company you apply for.
• Company details and documents you upload during onboarding, such as your company registration, IATA cargo agent code, evidence of the IATA Multilateral e-AWB Agreement, airline account details and e-AWB activation notices, and signed contracts. These are mostly about the company, but can name people, such as signatories.

Client-area users

• Account data: name, email address, the client organisation, role and account status.
• Sign-in data: your password (stored only as a one-way hash), your two-factor secret (stored encrypted), your recovery codes (stored only as hashes), and the time and IP address of sign-ins and sessions.
• Security data: failed sign-in attempts and the temporary limits they trigger, per account and per IP address, to stop password guessing.
• What you do in the client area, such as documents you upload and onboarding steps you complete.

Contacts at our clients

Names, work contact details and correspondence of the people we deal with at each client, and the commercial records of the relationship: agreements, invoices and support requests.

We do not ask for special-category data, and ask you not to upload any.

Why, and on what legal basis

TODO: counsel to confirm the bases, in particular (b) for individual users who act for a client company rather than as a party to the contract.

Who receives it

We share personal data only where needed for the purposes above, with providers bound by contract, and with authorities where the law requires it.

Our analytics and our error tracking run on infrastructure we operate ourselves. Error reports carry no user identities, IP addresses or request bodies, so shipment data never reaches them.

Transfers outside the EEA

AWBack runs entirely in the EU/EEA: the application, its databases and backups, email, analytics and the content delivery network. Shipment data sent to an airline established outside the EEA leaves it, because the client has instructed us to send it there. That transfer is made for the client as controller. TODO: counsel to confirm the transfer mechanism for shipment data to non-EEA airlines (e.g. Art. 49(1)(b)/(c) necessity for the contract of carriage, or SCCs via the messaging network), and how it is set out in the client DPA.

If we make a transfer outside the EEA for our own purposes, we will use a lawful transfer mechanism and tell you which.

How long we keep it

• Web server and edge logs: 6 months, as for Lambda Twelve's other services.
• Applications that do not lead to a contract: 24 months from the last contact. TODO: confirm, or shorten.
• Client-area accounts: for as long as the account exists. Session records, which hold the IP address the session was opened from, are deleted within an hour of the session ending or expiring. Unused one-time links (invitations, email verification, password reset) are cleared within an hour of expiring. Sign-in limits reset after one hour.
• Client records, agreements and onboarding documents: for the life of the relationship and 5 years after it ends, for legal, tax and limitation purposes.
• Invoices and accounting records: for the period Greek law requires.
• Shipment data and the message log (as processor): as set in the client's agreement. TODO: set a default, e.g. the life of the agreement plus a period covering airline disputes and the limitation period for claims under the contract of carriage.
• Backups: a nightly copy kept for 30 days, after which it is deleted in the normal cycle.

Where a record falls under more than one period, the longer applies. We may keep data longer if the law requires it or to deal with a legal claim.

How we protect it

• Two-factor sign-in is required for every client-area account, without exception.
• Passwords and recovery codes are stored only as hashes; two-factor secrets are encrypted.
• Each client's data is kept separate, and a client's API access can be limited to its own IP addresses.
• Connections are encrypted, and the operator tools are reachable only from our own addresses.
• Every message sent to or received from an airline is kept unchanged, so its handling can be checked later.

No system is perfectly secure. If we become aware of a breach affecting your data, we will act as the law requires.

Your rights

Subject to the conditions in data-protection law, you can ask us to:

• give you access to your personal data;
• correct it if it is inaccurate or incomplete;
• erase it;
• restrict how we use it;
• give it to you in a portable format, where that right applies.

You can also object to processing based on our legitimate interests. Send requests to legal@lambda-twelve.com. We may ask you to confirm your identity first. For shipment data, we will pass your request to the client that controls it.

You can complain to a supervisory authority. In Greece that is the Hellenic Data Protection Authority (HDPA), www.dpa.gr.

Automated decisions

We make no decisions about you by automated means alone that have legal or similarly significant effects. Temporary sign-in limits after repeated failed attempts are a security measure and lift on their own.

Children

AWBack is a business service and is not meant for children.

Cookies

The client area uses one strictly necessary cookie; the rest of the site uses none. See the Cookie Policy.

Changes to this notice

We update this notice when what we process, who we use or the law changes. The date at the top says when it last changed.

Contact

Privacy: legal@lambda-twelve.com
General: hello@awback.com