Privacy Notice
Última actualización 2026-10-27
This notice explains how SAMJAKE LOGISTICS LTD ("we") handles personal data, under the UK GDPR and the Data Protection Act 2018 and, wherever it applies, the EU GDPR. Nucra acts in two different roles, described below. Change of 21 October 2026: for companies outside the United States, the controller is now SAMJAKE LOGISTICS LTD (see “Controller” below).
Two roles: controller and processor
Nucra is a controller for data it decides the purposes of, and a processor for data a customer enters about other people. • As controller — registration data, subscription contracts and invoices, security and logs, communication with the customer, account management, and our own product analytics if used. • As processor — data a customer company enters about its staff, drivers, counterparty contacts, recipients, GPS positions, transport documents and request communications. For the processor role a separate Data Processing Agreement (DPA) applies. This notice covers the controller role.
Controller
The controller is SAMJAKE LOGISTICS LTD, a company registered in England and Wales under number 15603172, registered office 3rd Floor, 45 Albemarle Street, Mayfair, London W1S 4JL, United Kingdom. For privacy questions or to exercise your rights, contact support@nucra.io.
What we process
Data you submit through our forms (name, company, work e-mail, phone, company ID/VAT for access requests, and any message); technical data needed to serve the site (chosen language, a coarse country signal derived from your IP for language routing, and standard server logs including IP address and browser type kept for security); and, for customers, the account and billing data needed to provide the platform.
Purposes and legal bases
To respond to demo and access requests and take pre-contractual steps at your request (Art. 6(1)(b); consent where applicable, Art. 6(1)(a)); to operate, secure and improve the website and platform (legitimate interest, Art. 6(1)(f)); and to meet legal obligations, including accounting and tax duties (Art. 6(1)(c)). We do not carry out advertising profiling or automated decision-making that produces legal effects concerning you.
Recipients and processors
We share data only with processors acting on our instructions to run the service — in particular cloud hosting/infrastructure and an e-mail delivery provider. They are bound by data-processing agreements. Our current subprocessors are listed on the Subprocessor List. We do not sell personal data or share it for third-party marketing.
AI-assisted features
Some features use a large-language-model provider to READ what you give them — nothing is decided without you: • what is sent — only the item being processed: an uploaded invoice or scan, a pasted request text, a bank statement, an inbound enquiry e-mail, an import file, or your question in the in-app assistant; • what is never sent — passwords, two-factor secrets, API keys, GPS traces, your document archive, or any data belonging to another customer; • the provider processes it to return the extracted fields or the answer, does not use it to train its models, and does not retain it for its own purposes; • the result is a suggestion: extracted fields are shown for you to check and edit, imports are created as drafts, and nothing reaches an accounting export until a person marks it verified; • you can see every AI call your company has made — feature, model and cost — in Settings.
International transfers
The platform is hosted in the European Union; we are established in the United Kingdom, and some of our providers are elsewhere (including in the United States), so personal data may be transferred outside the EEA/UK. Each transfer relies on an adequacy decision or adequacy regulations where they apply (including the EU–US Data Privacy Framework and its UK Extension where the recipient is certified) or on the EU Standard Contractual Clauses / UK IDTA, with appropriate additional safeguards, and we maintain the corresponding contractual chain with the provider concerned.
Retention
Enquiry and access-request data is kept only as long as needed to follow up and for a reasonable period afterwards, then deleted. Customer and accounting records are kept for the periods required by applicable law (in particular UK company-law and tax record-keeping rules) and then deleted or anonymised. See the Security & Data Retention summary for details.
Your rights
You have the right to access, rectification, erasure, restriction, portability and objection (for processing based on legitimate interest); where processing is based on consent you may withdraw it at any time without affecting prior processing. Write to support@nucra.io. You may also complain to the supervisory authority: the data protection authority of the EU/EEA country where you live or work, or, in the United Kingdom, the Information Commissioner’s Office (ICO, www.ico.org.uk).
Information about data not obtained from you
Where a customer provides us with personal data about its staff, drivers or counterparties (the processor role), the customer is responsible for informing those individuals under Art. 14 GDPR. We assist the customer with such requests as set out in the DPA.
Changes
We may update this notice; the "Last updated" date reflects the current version and material changes will be highlighted.