Effective Date: 1 January 2026  |  Last Updated: 28 June 2026

1. Introduction

XdEPOT is a cloud-based empty container depot management platform developed and operated by SWEAF® (Software Engineering & Automation Framework). XdEPOT provides depot operators with tools for gate-in/gate-out management, container tracking, EDI/CODECO messaging to shipping lines, billing, and operational reporting.

This Privacy Policy explains what personal and operational data we collect when you use XdEPOT, how we use and protect it, and the rights available to you under applicable data protection laws — including the General Data Protection Regulation (GDPR) where applicable.

2. Data Controller

SWEAF® acts as the data processor on behalf of each depot operator (tenant) who subscribes to XdEPOT. Each subscribing depot operator is the data controller for the operational and personnel data they enter into the platform. For platform-level account data (user registrations, billing contacts), SWEAF® is the data controller.

3. Data We Collect

3.1 Account & User Data

• Full name, username, and email address of registered platform users.
• Job role, assigned facility, and permission level (e.g., Operator, Manager, SuperAdmin).
• Password (stored as a salted cryptographic hash — never in plain text).
• Two-factor authentication (2FA) status and one-time password (OTP) delivery records.
• Account status, failed login timestamps, and lockout state for security purposes.
• Mobile API refresh tokens for authenticated mobile scanner access.

3.2 Operational & Container Data

• Container numbers, ISO type codes, container sizes, and condition grades at gate-in and gate-out.
• Vessel name, voyage number, port of loading/discharge, and booking references.
• Shipper, consignee, transporter, and third-party entity names and contact details.
• Seal numbers allocated and consumed during gate-out operations.
• Damage and survey records, including remarks entered by depot staff.
• Billing data: tariff rates, storage calculations, collection receipts, and payment method records.
• EDI/CODECO message content transmitted to or from shipping line partners.

3.3 Technical & Telemetry Data

• Login activity logs, including IP address, timestamp, and success/failure status.
• Session activity timestamps used for session timeout and security monitoring.
• Query telemetry: anonymised database query performance metrics per tenant, used for billing and platform optimisation. No container or personal data is captured in telemetry records.
• Audit logs recording which user performed which action (create, update, delete) and when.
• Browser type and device details collected by Google reCAPTCHA on the login page (see Section 8).

4. How We Use Your Data

• Platform operation: Authenticating users, enforcing role-based access control, and enabling core depot workflows (gate-in, gate-out, EDI transmission, billing).
• Security & fraud prevention: Detecting unauthorised access, rate-limiting login attempts, enforcing account lockout policies, and maintaining tamper-evident audit trails.
• Billing & subscription management: Calculating usage-based charges, generating collection receipts, and managing tenant subscription status.
• EDI integration: Generating and transmitting CODECO messages (Gate-In/Gate-Out confirmations) to shipping line EDI partners on behalf of the depot operator.
• Service communications: Sending daily operational summaries, OTP codes, and system notifications via email (AWS Simple Email Service).
• Platform improvement: Analysing anonymised telemetry to optimise query performance, identify bottlenecks, and improve system reliability.
• Legal & compliance obligations: Retaining audit logs and records as required by applicable law or contractual obligations with depot operators.

5. Legal Basis for Processing (GDPR)

Where GDPR applies, we process personal data under the following lawful bases:

• Contract performance: Processing necessary to deliver XdEPOT services to the subscribing depot operator and its authorised users.
• Legitimate interests: Security monitoring, fraud prevention, audit logging, and platform performance optimisation.
• Legal obligation: Retention of records where required by applicable law.
• Consent: For optional communications such as marketing updates, where separately obtained.

6. Data Sharing & Third Parties

Your data is never sold or rented to third parties. We share data only as described below:

• Amazon Web Services (AWS): Email delivery via AWS Simple Email Service (SES). AWS acts as a data processor under a Data Processing Agreement.
• Microsoft Azure: Cloud hosting, Azure SQL database, and Azure Key Vault for secrets management. All data at rest is encrypted. Data residency is configured per tenant region.
• Google reCAPTCHA: Used on the login page to prevent automated bot attacks. Google's Privacy Policy applies to reCAPTCHA data collection.
• Shipping line EDI partners: Container movement data (CODECO messages) is transmitted directly to shipping lines as designated by the depot operator. This is a core operational function, not a data sale.
• Law enforcement / regulators: Where legally required by a valid court order or regulatory authority request.

7. Data Retention

• Audit logs: Retained for 90 days from the date of each event, then automatically purged.
• Query telemetry: Retained for 30 days from the date of capture, then automatically purged.
• Operational data (gate-in/gate-out records, billing records, container history): Retained for the duration of the depot operator's active subscription plus any contractually agreed archive period.
• User accounts: Retained while the account is active. Deleted or anonymised within 30 days of a verified deletion request.
• Inactive accounts: Accounts not accessed for 12 consecutive months may be deactivated. The operator is notified before deactivation.

8. Data Security

• All data in transit is protected by TLS 1.2 or higher. HTTPS is enforced with HTTP Strict Transport Security (HSTS) including preload.
• Passwords are stored as salted hashes using industry-standard algorithms — plain-text passwords are never stored or transmitted.
• Authentication cookies are flagged HttpOnly, Secure, and SameSite=Lax to prevent cross-site attacks.
• Rate limiting and account lockout policies protect against brute-force login attempts.
• Role-based access control (RBAC) ensures users can only access data relevant to their assigned facility and role.
• Database credentials and API keys are stored in Azure Key Vault — not in application code or source repositories.
• Security events are logged to a tamper-evident audit trail with IP address, user, and timestamp.

9. Cookies

XdEPOT uses the following cookies:

• XdEPOT (session cookie): An encrypted authentication cookie required to maintain your logged-in session. This cookie expires after 30 minutes of inactivity. It is strictly necessary and cannot be disabled.
• Google reCAPTCHA cookies: Set by Google on the login page for bot detection. Governed by Google's Privacy Policy.
• XdEPOT does not use advertising cookies, tracking pixels, or third-party analytics cookies.

10. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): Request deletion of your personal data, subject to legal retention obligations.
• Restriction: Request that we limit how we process your data in certain circumstances.
• Portability: Request your personal data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us via the enquiry form below. We will respond within 30 days.

11. Children's Privacy

XdEPOT is a business-to-business (B2B) platform designed exclusively for commercial depot operations. It is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors.

12. International Data Transfers

XdEPOT is hosted on Microsoft Azure infrastructure. Data may be processed in regions outside your country of residence. Where applicable, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses for transfers from the EEA) in accordance with GDPR Chapter V.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the Last Updated date at the top of this policy and, where required, notify active users by email. Continued use of XdEPOT after such changes constitutes acceptance of the updated policy.

14. Contact Us

For privacy enquiries, data subject requests, or questions about this policy, please contact the SWEAF® Data Privacy team:

• Email: connect@sweaf.biz
• Platform: Use the Enquiry Form accessible from this page.

SWEAF® — Software Engineering & Automation Framework  |  XdEPOT v2  |  © 2026 All rights reserved.

Effective Date: 1 January 2026  |  Last Updated: 28 June 2026

1. Introduction & Acceptance

These Terms & Conditions ("Terms") constitute a legally binding agreement between SWEAF® (Software Engineering & Automation Framework, the platform provider) and the subscribing depot operator ("Operator") and all authorised users accessing XdEPOT — a cloud-based empty container depot management platform.

By registering for, accessing, or using XdEPOT in any capacity, you confirm that you have read, understood, and agree to be bound by these Terms and our Privacy Policy. If you do not agree, you must not access or use the platform.

2. Definitions

• "Platform" / "XdEPOT" — the XdEPOT software-as-a-service application, including all modules, APIs, mobile scanner interfaces, and EDI integrations.
• "Operator" — the company or entity that has entered into a subscription agreement with SWEAF® to manage one or more container depot facilities.
• "Facility" — a physical container depot location configured within XdEPOT under an Operator account.
• "User" — any individual (employee, contractor, or agent) granted login access to XdEPOT by an Operator.
• "Operational Data" — container records, gate-in/gate-out transactions, billing entries, EDI messages, and related depot workflow data entered into the Platform.
• "EDI / CODECO" — Electronic Data Interchange messages (CODECO format) transmitted to or from shipping line partners via the Platform.

3. Licence & Permitted Use

Subject to timely payment and compliance with these Terms, SWEAF® grants the Operator a non-exclusive, non-transferable, revocable licence to access and use XdEPOT solely for the Operator's internal depot management operations during the subscription period.

The Operator and its Users must not:

• Copy, modify, adapt, translate, decompile, reverse-engineer, or create derivative works from the Platform or any part thereof.
• Sublicense, resell, or make the Platform available to any third party outside the Operator's authorised personnel.
• Remove or obscure any proprietary notices, branding, or watermarks within the Platform.
• Use the Platform to provide depot management services on behalf of competing operators without prior written consent from SWEAF®.
• Attempt to access any system, database, or account not assigned to the Operator's tenancy.

4. Subscription, Billing & Payment

• Access to XdEPOT requires an active paid subscription. Subscription plans, pricing, and billing cycles are agreed upon at the time of onboarding.
• Invoices are issued in advance of each billing period. Payment is due within the period stated on each invoice.
• Failure to make timely payment may result in access suspension after a 7-day grace period notice. Persistent non-payment beyond 30 days may result in account termination.
• All fees are exclusive of applicable taxes (including VAT, GST, or equivalent). The Operator is responsible for all applicable taxes in their jurisdiction.
• Refunds: Subscription fees are non-refundable except where required by applicable consumer protection law or where SWEAF® fails to meet the SLA commitments in Section 8.
• SWEAF® reserves the right to adjust pricing with 30 days' written notice. Continued use after the notice period constitutes acceptance of the revised pricing.

5. User Accounts & Access Control

• The Operator is responsible for all User accounts created under its tenancy, including the actions performed by those Users within the Platform.
• Users must provide accurate, current, and complete information during registration. Accounts created with false identity or fraudulent details will be immediately terminated.
• Each User account is personal and must not be shared with other individuals. The Operator must promptly deactivate accounts of Users who leave the organisation or change roles.
• Users are responsible for maintaining the confidentiality of their login credentials. Any suspected unauthorised access must be reported to SWEAF® immediately via the enquiry channel.
• Two-factor authentication (2FA) is available and strongly recommended. SWEAF® may require 2FA for certain roles or access levels.
• Accounts with 3 consecutive failed login attempts will be automatically locked. An Operator administrator can unlock accounts via the user management panel, or accounts are automatically unlocked after the configured lockout period.

6. Operator Responsibilities & Operational Compliance

• Data accuracy: The Operator is solely responsible for the accuracy, completeness, and legality of all Operational Data entered into the Platform, including container numbers, ISO codes, seal numbers, shipper/consignee details, and weight declarations.
• EDI / CODECO compliance: The Operator is responsible for configuring correct EDI partner credentials, facility codes, and message settings. SWEAF® transmits CODECO messages as configured by the Operator and is not liable for EDI rejections arising from incorrect configuration or inaccurate operational data.
• Regulatory compliance: The Operator must ensure that use of XdEPOT complies with all applicable customs, port authority, shipping line, and local regulatory requirements in the jurisdictions where their facilities operate.
• Dangerous goods: The Operator is responsible for accurate declaration of dangerous goods (DG) container codes and compliance with IMDG/SOLAS requirements. XdEPOT provides fields to record DG data but does not independently validate DG compliance.
• Seal integrity: The Operator is responsible for physical seal management procedures. XdEPOT tracks seal allocation and usage digitally but does not replace physical seal custody procedures.

7. Intellectual Property

XdEPOT, including all software code, algorithms, UI designs, logos, trademarks, CODECO generation logic, EDI templates, and documentation, is the exclusive intellectual property of SWEAF® and is protected by copyright, trade secret, and applicable intellectual property laws.

Operational Data ownership: All Operational Data entered into XdEPOT by the Operator remains the property of the Operator. SWEAF® claims no ownership over container records, billing data, or any other Operational Data. Upon termination, the Operator may request an export of their data in a standard format within 30 days.

8. Service Availability & SLA

• SWEAF® targets 99.5% monthly uptime for the XdEPOT platform, excluding scheduled maintenance windows.
• Scheduled maintenance will be communicated with at least 24 hours' advance notice via in-platform marquee notification or email, and will be performed during off-peak hours wherever practicable.
• Unplanned outages will be communicated as soon as practicable. SWEAF® will make reasonable efforts to restore service within 4 hours of a critical outage being identified.
• SWEAF® does not guarantee uninterrupted access in circumstances beyond its reasonable control, including third-party infrastructure failures (Azure, AWS), internet outages, force majeure events, or actions of regulatory authorities.
• SLA credits, where applicable, will be detailed in the Operator's subscription agreement.

9. Prohibited Activities

The following activities are strictly prohibited and will result in immediate account suspension and potential legal action:

• Attempting to gain unauthorised access to other Operators' tenancy data, systems, or user accounts.
• Introducing malware, ransomware, or any malicious code into the Platform or its infrastructure.
• Conducting denial-of-service attacks, automated scraping, or excessive API calls that degrade Platform performance for other users.
• Using the Platform to process, store, or transmit any data that is illegal, fraudulent, or in violation of third-party rights.
• Falsifying container records, seal numbers, or weight declarations in furtherance of smuggling, fraud, or any other illegal activity.
• Circumventing security controls including rate limiters, account lockout policies, or multi-factor authentication requirements.

10. Confidentiality

Each party agrees to treat the other party's non-public information as confidential and to use it only for the purposes of performing under these Terms. This obligation does not apply to information that is publicly available, independently developed, or required to be disclosed by law. SWEAF® will not disclose an Operator's Operational Data to other Operators or third parties except as set out in the Privacy Policy.

11. Limitation of Liability

To the maximum extent permitted by applicable law:

• SWEAF® shall not be liable for any indirect, incidental, consequential, or punitive damages arising from the use of or inability to use XdEPOT, including loss of revenue, business interruption, or data loss.
• SWEAF®'s total aggregate liability for any claim arising under or in connection with these Terms shall not exceed the total subscription fees paid by the Operator in the 3 months preceding the event giving rise to the claim.
• SWEAF® is not liable for EDI transmission failures, shipping line rejections, or operational disruptions caused by incorrect data entered by the Operator.
• SWEAF® is not liable for losses arising from the Operator's failure to comply with applicable customs, port, or shipping line regulations.

12. Indemnification

The Operator agrees to indemnify and hold harmless SWEAF®, its officers, employees, and agents from and against any claims, damages, penalties, or legal costs arising from: (a) the Operator's breach of these Terms; (b) inaccurate or fraudulent Operational Data entered into the Platform; (c) the Operator's non-compliance with applicable regulations; or (d) unauthorised use of the Platform by Users under the Operator's account.

13. Termination

• By the Operator: The Operator may terminate their subscription with written notice as specified in their subscription agreement. No refund of prepaid fees applies unless separately agreed.
• By SWEAF®: SWEAF® may suspend or terminate the Operator's access immediately upon: material breach of these Terms (including non-payment after the grace period), illegal use, or actions that pose a security risk to the Platform or other users.
• Effect of termination: Upon termination, the Operator's licence to use XdEPOT ceases immediately. The Operator may request an export of their Operational Data within 30 days of termination. After 30 days, SWEAF® may permanently delete all Operator data.
• Sections 7 (Intellectual Property), 10 (Confidentiality), 11 (Limitation of Liability), and 12 (Indemnification) survive termination.

14. Governing Law & Dispute Resolution

These Terms are governed by and construed in accordance with applicable commercial law. Any disputes arising under these Terms shall first be attempted to be resolved through good-faith negotiation between the parties. If unresolved within 30 days, disputes shall be referred to binding arbitration or the courts of competent jurisdiction as specified in the Operator's subscription agreement.

15. Changes to These Terms

SWEAF® may update these Terms from time to time to reflect changes in the Platform, legal requirements, or business practices. When material changes are made, SWEAF® will update the Last Updated date above and notify active Operators by email and/or in-platform notification with at least 14 days' advance notice. Continued use of XdEPOT after the effective date of the revised Terms constitutes acceptance. If the Operator does not agree to the revised Terms, they may terminate their subscription before the effective date.

16. Contact Us

For questions regarding these Terms, subscription agreements, or legal enquiries, please contact the SWEAF® team:

• Email: connect@sweaf.biz
• Platform: Use the Enquiry Form accessible from this page.

SWEAF® — Software Engineering & Automation Framework  |  XdEPOT v2  |  © 2026 All rights reserved.