Carrier Verification — terms of use

Version of 4 October 2026 · Wersja polska

This document forms part of the NSRoute Terms of Service (section “Carrier Verification”). For users established or resident in Poland, the Polish version is binding.

1. Carrier Verification

1. Scope of the service. At the user's request, the Carrier Verification feature:
   1. retrieves, at the time of the query, data from the public registers and services listed in Annex 2 (including VIES, the Polish VAT taxpayer register, KRS, KREPTD and registers of other states) and compares the data with an index of the official EU, UK and US sanctions lists, updated daily;
   2. combines the results with the user's own declarations (e.g. about the carrier's liability insurance, a call-back, a vehicle check), clearly marking them as the user's declarations;
   3. evaluates the combined data under the published rules described in Annex 2 (the model version is stated in the report) and lists the items still missing from the checklist;
   4. generates a report (PDF, JSON) bearing an NSRoute electronic signature, which makes it possible to check that the content of the report has not been changed after it was generated;
   5. at the user's request, re-checks watched carriers periodically (about every 7 days) and reports changes.
2. Scope by plan. On the FREE plan the user may run 3 verifications per calendar month; the result is shown on screen, without the signed report (PDF, JSON), copies of registry responses or monitoring. A verification that fails because of an error does not count towards the limit. On the PRO and FLEET plans and during the trial, verification has no monthly limit (subject to technical request limits) and includes the signed report, copies of registry responses, monitoring and carrier list import. Carriers added to monitoring earlier remain watched.
3. Nature of the result. The report compiles information from public registers as at the time of the query and gives a rule-based recommendation. The report is not:
   1. a guarantee or assurance of the carrier's reliability, solvency, honesty or identity;
   2. a confirmation, opinion or acceptance by any insurer, broker or authority; only the insurer assesses whether the report meets the requirements of specific insurance terms;
   3. a confirmation of the existence, validity or scope of the carrier's liability insurance; this can only be confirmed with the carrier's insurer;
   4. a decision to start or refuse cooperation; the user makes that decision and is responsible for it.
4. Source data. NSRoute does not operate the registers and is not responsible for the accuracy, completeness or timeliness of the data they contain, or for their availability. If a register does not respond, the report marks the check as “no data”, which is not a positive result.
5. Sanctions check. The check compares the entity's name with the sanctions lists listed in Annex 2. It does not cover beneficial owners, shareholders, members of corporate bodies or other lists, in particular the Polish list kept by the minister responsible for internal affairs. A name match may be false (identical names), and the absence of a match does not mean that the entity is not subject to sanctions. Obligations under sanctions law rest with the user.
6. User obligations. The user:
   1. enters truthful data and, in the “your EU VAT number” field, only their own VAT number;
   2. uses the feature only to assess carriers and counterparties they intend to work with or already work with; it must not be used for bulk data retrieval, building databases or publishing results;
   3. is the controller of the carriers' personal data and fulfils the related GDPR obligations; the data processing terms are set out in Annex 1;
   4. keeps downloaded reports themselves; NSRoute does not store them and cannot recreate them.
7. Authenticity check. NSRoute provides a free service for checking a report's signature, also for people without an account. A positive result only means that NSRoute generated the report in this form and that it has not been changed. It does not confirm the accuracy of the source data. NSRoute makes reasonable efforts to keep the checking service available for as long as the service is operated, and does not retire the keys used to sign earlier reports.
8. Liability.
   1. NSRoute is liable for the proper performance of the service described in clause 1, in particular for correctly transferring the data received from registers into the report and for the rules operating as described.
   2. Towards users who are businesses and do not benefit from consumer protection (including under Art. 385⁵ of the Polish Civil Code), NSRoute's total liability in connection with the Carrier Verification feature is limited to the fees paid by the user for the last 12 months and covers only actual loss (excluding lost profits). NSRoute is not liable towards them for damage resulting from the content of source data, the unavailability of registers or the user's decision to choose a carrier.
   3. The limitations in point b do not apply to damage caused intentionally or through gross negligence, to personal injury, or to liability that cannot be excluded or limited under mandatory law, including consumer protection law and Art. 82 GDPR.
   4. Towards consumers and the persons referred to in Art. 385⁵ of the Polish Civil Code, NSRoute is liable under the general rules.
9. Changes to sources. NSRoute may add, change or disable data sources and rules, in particular when an authority changes or discontinues its service. The current list and rules version are given in Annex 2 and in every report.

Annex 1. Data processing agreement

This agreement is concluded electronically by accepting the Terms of Service and applies to the Carrier Verification feature.

1. Parties and subject matter

1. The controller is the NSRoute user who uses the Carrier Verification feature (the “Controller”).
2. The processor is Maciej Bryś, sole proprietor (brand NoStressStudio), ul. Ignacego Paderewskiego 1F/9, 35-328 Rzeszów, Poland, NIP (tax ID) 8133422595, operator of NSRoute (the “Processor”).
3. The Controller entrusts the Processor with processing personal data to the extent necessary to provide the Carrier Verification feature described in section 1 above.

2. Nature, purpose, types of data, categories of data subjects, duration

1. Purpose: verifying the identity and the registration, tax, licence and sanctions status of carriers or counterparties indicated by the Controller and, at the Controller's request, periodic monitoring of changes.
2. Nature: retrieving data from public registers and sanctions lists, compiling it, evaluating it under published rules, generating and signing a report and, for monitoring, storing identifiers and hashes of values and comparing them.
3. Categories of data subjects: carriers and counterparties who are natural persons running a business; transport managers, members of corporate bodies and representatives of carriers; beneficial owners of carriers (Polish CRBR); contact persons indicated by the Controller.
4. Types of data: identification numbers (VAT, NIP, REGON, KRS, licence number), business name, registered address, register status, names of transport managers and representatives, citizenship and country of residence of beneficial owners (CRBR — PESEL numbers and dates of birth are removed from the response copy, and the report contains only counts and country codes), bank account numbers submitted for checking, contact data (domain, telephone) submitted by the Controller. No special categories of data or data referred to in Art. 10 GDPR are processed.
5. Duration: the verification result is processed only for the duration of the query and is not stored. Monitoring data (VAT number, optionally company registration or licence number, check dates, result and SHA-256 hashes of register values) is kept until deleted by the Controller or until the account is deleted; change alerts are kept for up to 180 days.

3. Processor obligations

1. The Processor processes data only on documented instructions from the Controller. Instructions include, in particular, starting a verification, adding a carrier to monitoring and accepting the Terms of Service. If processing is required by EU or Polish law, the Processor informs the Controller before processing, unless that law prohibits it.
2. The Processor does not use the data for its own purposes; in particular, it does not combine verification results of different Controllers and does not create datasets, statistics or ratings from them for third parties.
3. The Processor ensures that persons authorised to process the data have committed themselves to confidentiality.
4. The Processor applies the measures required by Art. 32 GDPR, in particular: encryption in transit (TLS), no storage of verification results, pseudonymisation of monitoring data (SHA-256 hashes instead of values), per-account isolation of monitoring data, access control, rate limits and mutual authentication with the KREPTD register.
5. The Processor assists the Controller, where possible, in fulfilling data subject rights and the obligations under Art. 32–36 GDPR, taking into account the nature of processing and the information available to it.
6. The Processor notifies the Controller of a personal data breach without undue delay after becoming aware of it, at the e-mail address of the account.
7. When the service ends (account deletion, monitoring switched off), the Processor deletes monitoring data. The Controller can review it in the app beforehand. Deletion takes place without delay upon request; technical copies held by the infrastructure provider expire under its retention cycle.
8. The Processor makes available to the Controller the information necessary to demonstrate compliance with Art. 28 GDPR and allows audits — primarily by providing documentation and written answers; on-site audits require 14 days' notice, take place during business hours and are at the Controller's cost. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR.

4. Sub-processors

1. The Controller gives general authorisation for the following sub-processors: Cloudflare, Inc. (hosting, storage of monitoring data in the European Union) and Oracle (relay server for queries to the KREPTD register, Frankfurt region, EU).
2. The Processor gives at least 14 days' notice (by e-mail or in-app message) of an intended addition or replacement of a sub-processor. The Controller may object and, if no agreement is reached, switch off monitoring or terminate the agreement without additional cost.
3. The Processor imposes the same data protection obligations on sub-processors and is liable for their actions as for its own.
4. Transfers outside the European Economic Area take place only under the mechanisms of Chapter V GDPR (an adequacy decision, including the EU-US Data Privacy Framework, or standard contractual clauses).

5. Register authorities

Authorities operating public registers and sanctions lists (e.g. the European Commission, the Polish Ministry of Finance, the Polish Chief Inspector of Road Transport) are not sub-processors; they are separate controllers of the data published in the registers. The Processor sends them only the data needed for the query (the identifier of the checked entity and, for VIES, the Controller's VAT number as the requester).

6. Controller obligations

1. The Controller declares that it has a legal basis for processing the carriers' data (e.g. Art. 6(1)(f) GDPR) and that it will inform them as required by Art. 14 GDPR.
2. The Controller enters only its own VAT number in the “your EU VAT number” field.
3. The Controller is responsible for storing and further using the reports (PDF, JSON) downloaded from NSRoute.

7. Final provisions

This agreement applies for as long as the feature is used. Matters not covered are governed by the GDPR, the Terms of Service and Polish law. The parties' liability for infringements of data protection law follows from Art. 82 GDPR. Limitations of liability in the Terms of Service do not apply to the extent they would conflict with Art. 82 GDPR.

Annex 2. Data sources and rules

As at 3 October 2026. Rating model version: nsroute-carrier-risk-2026.10.3 (stated in every report).

Registers checked automatically

For other countries, the report marks the check as “no data” and links to the official search page; the user can attach a manual confirmation, which is marked as the user's declaration.

Sanctions lists

• EU — Consolidated list of persons, groups and entities subject to EU financial sanctions (FSF);
• United Kingdom — UK Sanctions List (FCDO);
• USA — OFAC Specially Designated Nationals (SDN), including alternative names.

The index is refreshed daily. If the EU list index is more than 2 days old (UK and US: 7 days), the sanctions result is marked “no data”. The entity's name is compared: an exact match on the EU or UK list means the order should be put on hold until identifiers are compared; a match on the US list only, and a match without the legal form, are warnings requiring a manual check (US sanctions do not always bind EU businesses).

STOP rules

A report gets a “STOP” decision when, among other things: the name exactly matches an entry on the EU or UK sanctions list; VIES or a register shows an inactive VAT number, liquidation, insolvency or deregistration; the carrier is an unreliable VAT payer (CZ); the register does not confirm a valid goods transport licence; the bank account is not on the White List (PL) or in ADIS (CZ); the carrier's liability insurance does not cover the loading date; the call-back did not confirm the contact; the vehicle does not match the order; the undertaking is established in Russia or Belarus (EU ban on road haulage: Reg. 833/2014 as amended by 2022/576; Reg. 765/2006 as amended by 2022/577). A STOP decision is a recommendation requiring the user's decision.

Contact-channel signals

The report compares the contact channel with independent data: the e-mail domain against the company website (including look-alike domains) and its age (RDAP), the type and country of the phone number (offline classification based on numbering plans — internet VoIP, premium-rate and service numbers lower the rating), the country of the bank account against the carrier's country, and the source of the number used for the call-back.

Beneficial owners

For companies registered in the Polish KRS, the report checks the citizenship and country of residence of beneficial owners in the CRBR. A beneficial owner holding shares who is a Russian or Belarusian citizen results in a STOP if the company was established after 8 April 2022 (or its establishment date is unknown) — Article 3l of Council Regulation (EU) No 833/2014 and the corresponding provision of Council Regulation (EC) No 765/2006 prohibit such undertakings from transporting goods by road in the EU. For an older company, a link without shares, or a link only through the country of residence, the report gives a warning. A missing CRBR filing gives a warning. For Ukrainian carriers the same information comes from the ЄДР register; since Article 3l concerns undertakings established in the EU, a Russian or Belarusian beneficial owner gives a warning there, not a STOP.

From the full KRS extract the report shows the current management board, shareholders and changes from the last 12 months. The KRS API masks names and PESEL numbers of natural persons — the report shows them in the same masked form. A management change in the last 6 months combined with a change of shareholders, address or name gives a warning (the typical pattern of a hijacked company), not a STOP. The report also compares the company name (and, in Poland, the postal code of the registered office) across register responses; a clear mismatch gives a warning. Absence from the VAT White List does not mean the company does not exist: VAT-exempt sole traders are not on that list, so the report checks them in CEIDG and, when CEIDG is not available, asks the user to confirm the status in CEIDG.

Heightened mode

For high-value cargo, theft-prone goods, time pressure or a new carrier (no order history), the report additionally requires: confirmation of the policy directly with the insurer, a vehicle and driver check at loading, and approval by a second person.

Minimum checks before an order

Identity confirmed in a register · active VAT number · valid goods transport licence or authorisation · carrier's liability insurance valid, with a sum insured not lower than the cargo value and covering the route · contact confirmed by a call-back to a number from an independent source · sanctions check without matches.

Signature and time-stamp

The report is signed with an NSRoute key (HMAC-SHA256) and with an Ed25519 public-key signature. Public keys are published at api.nsroute.com/.well-known/nsroute-report-keys.json and are never removed, so the signature can be checked without NSRoute (the signed text is nsroute-carrier-report-v1: + the report's SHA-256 hash). If an RFC 3161 time-stamp is enabled, the report contains a token issued by the trust service provider over the report hash (only the hash is sent to the provider).

Monitoring

Watched carriers are re-checked about every 7 days (up to 50 carriers per account); monitoring data is stored in the European Union. The shared KREPTD query budget (GITD: 120 per hour) gives priority to manual checks — when it is used up, the licence check is marked “no data”. Only the identifiers entered by the user, dates, the result and SHA-256 hashes of register values are stored; alerts contain the names of changed fields (no values) and are kept for 180 days.

Maciej Bryś (sole proprietor), brand NoStressStudio · ul. Ignacego Paderewskiego 1F/9, 35-328 Rzeszów, Poland · NIP 8133422595 · [email protected]