Privacy policy

Sila ("Sila", "we", "us" or "our") operates the Services defined in the General terms and conditions: the Sila website, the Sila platform, request links, the public verification page and Sila's interfaces for other systems. This Privacy policy explains how we collect, use, disclose and protect personal data when you use the Services, and the choices you have.

By using the Services you agree to the collection and use of information in accordance with this Policy. Terms not defined in this Policy have the meaning given to them in the General terms and conditions.

Personal data

Information about an identified or identifiable natural person.

Data controller

The person or body that decides the purposes and means of processing personal data.

Data processor, service provider

A person or body that processes personal data on behalf of a data controller.

Uploaded content

Documents, data entered into forms, messages and any other content submitted to the Services.

Usage data

Information on how the Services are accessed and used, collected automatically.

Security and audit data

Information recorded to secure the Services and to keep the record of each shipment file, such as sign-ins, IP addresses, signatures and the actions taken.

Ledger

Sila's tamper-evident record of actions, whose fingerprints are anchored to a public blockchain.

User, you

The natural person using the Services, or whose personal data is processed through them.

3.1 Data controller and data processor

For account, sign-in, security and audit data, Sila acts as data controller. For uploaded content, the organisation that submits it, and the importer that releases it to other parties on a shipment file, decide what is processed and for whom; Sila processes that content on their behalf to provide the Services. For questions about a specific case, contact us at sila.team.kw@gmail.com.

3.2 Personal data

While you use the Services we, or the administrator of your organisation's workspace, may ask for personal data that identifies or contacts you, including:

• name, position and role in your organisation;
• business e-mail address and phone number;
• for verifying an organisation: its commercial registration, licences and authorised signatories;
• IP address and browser details, for security.

Your e-mail address is used to notify you of events on the shipment files you are part of, such as a document waiting for you or a request link. Your name and role are shown to the other people working on those files and are recorded in each file's audit trail; this cannot be withdrawn while the record exists, because the record depends on it. We send marketing e-mail only if you opt in, and you may opt out at any time.

3.3 Uploaded content

Commercial and transport documents (such as invoices, packing lists, certificates, bills of lading, permits and letters of credit), data entered into forms, goods lines and messages. Uploaded content may contain personal data of other people, such as signatories and contact persons. It is processed in accordance with the General terms and conditions.

3.4 Usage data

Pages visited, the time and date of a visit, browser type and version, and diagnostic data from server logs. Usage data is used in aggregated or pseudonymised form to operate and improve the Services. Sila uses no third-party analytics or advertising trackers.

3.5 Security and audit data

Username, IP address, time, the action taken, the document concerned and its fingerprint, and the evidence of each signature (the method used, such as a passkey or a one-time code). This data is kept in the ledger.

Sila uses the data it collects to:

• provide and maintain the Services, including shipment files, checks, notifications and request links;
• read uploaded documents into fields for the sender to confirm (section 6);
• verify organisations, and screen the parties on a file against public sanctions lists and registries;
• keep a complete, tamper-evident record of each shipment file;
• provide support;
• detect, prevent and address security and technical issues;
• comply with legal obligations;
• produce anonymised, aggregated statistics.

Sila does not rent, sell, trade or lease personal data or uploaded content.

Sila processes personal data because:

• it is necessary to perform our agreement with you or your organisation;
• it is necessary to comply with the law, such as the duty to keep trade and customs records;
• it is in our legitimate interest to secure the Services and keep an accurate record, and that interest is not overridden by your rights;
• you have given your consent, which you may withdraw at any time.

Sila may use an automated reading service to read an uploaded document into fields. The result is shown to the sender, who confirms or corrects any field read with low confidence before it is used. Content sent to the reading service is used only for that reading, not to train models.

Every check, flag and suggestion in Sila is a fixed rule applied to codes and confirmed fields. Sila makes no decision about a person with legal or similarly significant effect by automated means: decisions on a shipment are made by the customs authority, government agencies, banks and carriers in their own systems.

Sila sends its e-mail, such as notifications and request links, from its own Google account through the Gmail API, with permission to send e-mail only. Sila does not request access to its users' Google accounts, and does not read, store or use the contents of any Gmail mailbox.

Sila's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8.1 Personal data

Personal data is kept while your account is open, and deleted within 30 days after the account is closed or after a valid request for deletion, except where it forms part of a record that must be kept (below). Copies in backups are deleted as those backups expire in their normal cycle.

8.2 Uploaded content

Uploaded content follows the life of the shipment file it belongs to, not the life of the account that uploaded it. It is kept while the file is in use and afterwards for the period that trade and customs records must be kept under applicable law, then deleted.

8.3 Usage data

Usage data is kept for one year after it is collected.

8.4 Security and audit data

Security and audit data follows the record it belongs to: the account, or the shipment file. The fingerprints anchored to a public blockchain are permanent and cannot be removed; they contain no personal data and no uploaded content.

8.5 Aggregated data

Anonymised, aggregated data that cannot identify an organisation or a person may be kept indefinitely.

Sila takes all steps reasonably necessary to ensure that data is treated securely and in accordance with this Policy. Data, including personal data, may be processed and stored on servers outside your country, including in the European Union, by Sila's service providers, under safeguards that protect it. Where the law requires an organisation's data to be held in a particular country, Sila agrees that with the organisation in writing.

10.1 Within the Services

Each organisation sees only the shipment files it is part of, and on each file only the documents the importer releases to it. The customs authority and approving agencies see a file only when it is shared with them. A bank sees only what the importer shares with it through its exchange space, until that space closes. The public verification page confirms whether a document presented to it matches Sila's record; it does not reveal any document that is not presented to it.

10.2 Business transaction

If Sila is involved in a merger, acquisition or sale of assets, data may be transferred. We will give notice before data is transferred and becomes subject to a different privacy policy.

10.3 Legal requirements

Sila may disclose data where required by law or in response to a valid request from a court or a public authority, or in the good-faith belief that disclosure is necessary to:

• comply with a legal obligation;
• protect and defend the rights or property of Sila;
• prevent or investigate possible wrongdoing in connection with the Services;
• protect the safety of users of the Services or the public.

Sila engages service providers to deliver the Services: cloud hosting, database and file storage; e-mail delivery; automated document reading; a public blockchain network, to which only fingerprints are written; and public registries and sanctions lists, against which the names of organisations are checked. Service providers have access to data only to perform these tasks on Sila's behalf, and are obliged not to disclose or use it for any other purpose.

Sila uses only the cookies the Services need: to keep you signed in securely and to remember your language. It uses no advertising or analytics cookies. Because Sila does not track users across other websites, it does not respond to "Do not track" signals.

Data is encrypted in transit; access follows each person's role; Sila's staff and customs officers sign in with a second factor; consequential acts are signed; and every action is recorded in the ledger. No method of transmission or storage is completely secure, and Sila cannot guarantee absolute security. How Sila keeps records secure.

Subject to applicable law, you have the right to:

• access the personal data Sila holds about you;
• have inaccurate or incomplete personal data rectified;
• have your personal data deleted, except where it forms part of a record Sila must keep;
• object to, or ask us to restrict, the processing of your personal data;
• receive your personal data in a structured, commonly used, machine-readable format;
• withdraw your consent at any time, where processing relies on it;
• complain to the data protection authority where you live.

Many details can be corrected in your account settings, or by your organisation's administrator. For anything else, contact us at sila.team.kw@gmail.com. We may ask you to verify your identity before responding.

The Services may contain links to sites that Sila does not operate. Sila has no control over, and assumes no responsibility for, the content, privacy policies or practices of any third-party site. We advise you to review the privacy policy of every site you visit.

The Services are for organisations and are not addressed to anyone under the age of 18. Sila does not knowingly collect personal data from anyone under 18; if we learn that we have, we delete it.

Sila may update this Policy from time to time. We will notify you of a material change, by e-mail or in the Services, at least 30 days before it takes effect, and the effective date above will change.

For questions about this Policy or your personal data, contact us at sila.team.kw@gmail.com.