1. Introduction

Welcome to WorldSkills Taiwan Cargo Tracking System ("we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you access or use our cargo tracking website.

Operator: Triumph Express Service Co., Ltd.
Purpose: Shipment tracking for WorldSkills Asia Taipei 2025 event

By using the Website, you consent to the collection and use of your information as described in this Privacy Policy.

2. Information We Collect

2.1 Public Tracking Information

When you use our public tracking service (no registration required):

• Tracking Numbers: The shipment tracking number you enter to search for cargo status
• IP Address: Your device's IP address for security and fraud prevention
• Device Information: Browser type, operating system, device type (mobile/desktop)
• Usage Data: Pages visited, time spent, clickstream data
• Cookies: Session cookies for website functionality

No Personal Information Required: You do NOT need to provide your name, email, or any personal details to track shipments.

2.2 Admin User Information

When you access our admin portal (IP-whitelisted authorized personnel only):

• Authentication Data: Username, password (hashed), session tokens
• IP Address: Your IP address for whitelist verification
• Admin Activity Logs: Login times, actions performed, data modifications
• Contact Information: Email address for admin account notifications

2.3 Shipment Data

Shipment information managed by admin users:

• Cargo Details: Tracking numbers, shipment descriptions, origin/destination
• Status Updates: 23-status lifecycle tracking (preparation → delivery)
• Timeline Data: Status change timestamps, handler information
• Notes: Internal shipment notes and comments

2.4 Automatically Collected Information

• Server Logs: Access times, pages viewed, HTTP response codes
• Analytics Data: Page views, session duration, user flow patterns (Google Analytics)
• Error Logs: Technical errors, application crashes, debugging information

3. How We Use Your Information

3.1 Primary Purposes

• Shipment Tracking: Provide real-time cargo status updates
• Service Operation: Maintain and improve the tracking system
• Security: Detect and prevent unauthorized access, fraud, abuse
• Admin Management: Authenticate authorized personnel, log admin activities

3.2 Analytics and Improvement

• Usage Analytics: Understand how users interact with the Website
• Performance Monitoring: Identify and fix technical issues
• Feature Development: Improve user experience based on usage patterns

4. Legal Basis for Processing

We process your information based on:

• Legitimate Interest: Operating the tracking service, security, fraud prevention
• Consent: When you voluntarily use the Website and accept cookies
• Contractual Necessity: Providing shipment tracking services
• Legal Obligation: Compliance with Taiwan and international data protection laws

5. Data Sharing and Disclosure

5.1 We DO NOT Sell Your Data

We never sell, rent, or trade your personal information to third parties.

5.2 Service Providers

We may share data with trusted service providers:

• Cloud Infrastructure: AWS (Amazon Web Services) for hosting and data storage
• Analytics: Google Analytics for usage statistics (anonymized where possible)
• Security: Cloudflare for DDoS protection and CDN services

Requirement: All service providers must comply with data protection standards.

5.3 Legal Disclosures

We may disclose information when required by law:

• Legal Requests: Court orders, subpoenas, government investigations
• Rights Protection: Enforce our Terms and Conditions, protect our rights
• Public Safety: Prevent harm, fraud, or illegal activity

6. Data Retention

6.1 Public Tracking Data

• Session Data: Deleted when you close your browser
• Server Logs: Retained for 90 days for security and troubleshooting

6.2 Shipment Data

• Active Shipments: Retained during WorldSkills Asia Taipei 2025 event period
• Historical Data: Retained for up to 2 years post-event for reference
• Data Deletion: Shipment data may be deleted after retention period expires

6.3 Admin User Data

• Active Accounts: Retained while admin access is active
• Inactive Accounts: Deleted 6 months after last login
• Activity Logs: Retained for 1 year for audit purposes

7. Data Security

7.1 Security Measures

We implement industry-standard security practices:

• Encryption: HTTPS/TLS encryption for all data transmission
• IP Whitelist: Admin portal access restricted by IP address
• Password Security: Bcrypt hashing for password storage
• Access Control: Role-based permissions for admin users
• Monitoring: Real-time security monitoring and intrusion detection

7.2 Limitations

No System is 100% Secure: Despite our efforts, no transmission over the internet is completely secure. We cannot guarantee absolute security.

7.3 Your Responsibility

• Tracking Numbers: Keep tracking numbers confidential to prevent unauthorized tracking
• Admin Credentials: Do not share login credentials, use strong passwords
• Suspicious Activity: Report security concerns immediately

8. Cookies and Tracking Technologies

8.1 Types of Cookies We Use

Essential Cookies (Required)

• Session Cookies: Maintain your login state, enable website functionality
• Security Cookies: Prevent fraud, verify IP whitelist access

Analytics Cookies (Optional)

• Google Analytics: Track usage patterns, page views, session duration
• Performance Monitoring: Identify technical issues and slow pages

8.2 Cookie Management

Browser Settings: You can disable cookies in your browser settings.

Impact of Disabling Cookies:
✅ Public tracking will still work
❌ Admin portal login may not function properly
❌ Analytics and performance tracking will be disabled

9. Your Privacy Rights

9.1 GDPR Rights (European Users)

If you are in the EU/EEA, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time

9.2 CCPA Rights (California Users)

If you are a California resident, you have the right to:

• Know: What personal information we collect and how we use it
• Delete: Request deletion of your personal information
• Opt-Out: Opt out of the sale of personal information (we do not sell data)
• Non-Discrimination: Not be discriminated against for exercising your rights

9.3 Taiwan PDPA Rights

If you are in Taiwan, you have the right to:

• Access and Review: View your personal data we hold
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data
• Data Processing Suspension: Stop or resume data processing

9.4 How to Exercise Your Rights

Verification: We may request proof of identity before fulfilling requests.

10. International Data Transfers

10.1 Data Location

• Primary Storage: Taiwan (data center location)
• Cloud Backup: AWS US-West-2 (Oregon, USA)
• CDN: Cloudflare global network

10.2 Data Protection

When transferring data internationally, we ensure:

• Standard Contractual Clauses: Use EU-approved data transfer agreements
• Adequate Protection: Service providers comply with GDPR/CCPA standards
• Encryption: All data transfers encrypted via HTTPS/TLS

11. Children's Privacy

11.1 Age Restriction

The Website is not intended for children under 13 years of age.

11.2 No Intentional Collection

We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child under 13, please contact us immediately at support@triumphexpress.com.

12. Changes to This Privacy Policy

12.1 Updates

• We may update this Privacy Policy at any time
• Changes will be posted on this page with a new "Last Updated" date
• Continued use of the Website constitutes acceptance of changes

12.2 Material Changes

For significant changes, we will:

• Display a prominent notice on the Website
• Notify admin users via email
• Allow 30 days for review before changes take effect

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us:

14. Consent

BY USING THE WEBSITE, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THIS PRIVACY POLICY.