Privacy information
Last updated: 18 September 2026
Who handles your information
Caraway Trade is a trading brand of Allfoods, s. r. o., Company ID 46888055, Kukučínova 7270/47, 911 01 Trenčín, Slovakia. Allfoods is responsible for the personal information described here.
Your enquiry
When you select Send enquiry, your name, business email, company and enquiry details are transmitted to our server and sent to our team by email. We use them to respond and discuss a possible supply. Required fields are needed to submit the form; optional notes are voluntary. Please do not include sensitive personal information.
For business representatives, we rely on our legitimate interest in handling business enquiries. If you are personally a prospective contracting party, processing supports steps you request before a contract. Security processing serves our legitimate interest in protecting this service.
How long we keep enquiries
For enquiries that do not lead to a transaction, our retention period is 12 months after the last communication. We then delete the correspondence from active mailboxes and working copies, including forwarded copies. This is separate from the retention of records needed for an actual transaction, applicable accounting obligations or a specific legal claim; those records are kept for the relevant obligation or claim.
Website operation
The website does not use analytics, advertising trackers, cookies or browser storage. Preparing a draft takes place in your browser. Copying it places the text on your clipboard. The form requests a short-lived security token before submission.
To prevent abuse and duplicate messages, the server retains hashed network identifiers, request fingerprints, timestamps and submission status. These security records do not contain the enquiry body or email address. Rate-limit counters use a one-hour window; request records expire after 24 hours. An hourly cleanup is scheduled to remove expired records, normally within 25 hours.
Hosting, email and backups
Websupport provides our website hosting and the mailboxes on carawaytrade.com and allfoods.eu. Enquiries sent to sales@carawaytrade.com are forwarded to the two team members handling them. One team member also manages a copy in Gmail, provided by Google.
Websupport’s published hosting documentation describes a 14-day backup history for website files and email. Its access and error log backups are available for the preceding 14 days. Access logs can include IP addresses and request times; error logs help diagnose technical failures. Deleted information may remain in backup copies until the backup cycle replaces them. Google’s handling and retention of its service data are described in its privacy policy linked below.
Caraway Drive integration
Caraway Drive is operated by Allfoods, s. r. o. for the Caraway Trade team. It helps authorised team members organise catalogues, supplier and customer records, logistics comparisons and trade documents in Google Drive, Docs and Sheets. We use business contact information for handling enquiries and managing business relationships based on our legitimate interest in handling business relationships, or steps requested before a contract when the individual is a prospective contracting party; authorising Google access is a separate account permission.
Google access and information used
The integration requests the limited Google permission drive.file. It can create files and read or update files created by or specifically authorised for the application, subject to the account holder’s permissions. This does not give it unrestricted access to the whole Drive. It does not request Gmail access. Uploading a file to a Caraway folder alone does not necessarily authorise the application to access that file.
Information used includes the connected account’s name and email to identify the account; file names, identifiers, links and access information; and the contents of authorised documents and spreadsheets. Those contents may include business contacts, enquiries, product information, prices and delivery details. Google handles sign-in; the integration does not receive your Google password. It stores authorisation tokens so that the team can continue using the connection until it is revoked or expires.
Storage, assistance and sharing
Working documents are stored in Google Drive. The team’s integration environment also keeps connection tokens, file references, imported or exported working files and technical verification records. These are kept outside the public website, with access restricted to authorised operators. Access tokens are sent to Google over HTTPS.
When an authorised team member asks an AI assistant to work with these files, relevant content and tool results may be processed in the assistant environment, including by OpenAI as the assistant provider. This processing supports the requested document or spreadsheet task. The integration is operated on team instructions; it does not automatically synchronise the whole Drive. Do not authorise files unrelated to the requested business task.
Documents are available to people granted access through their sharing settings. Connecting Google does not itself publish documents or invite colleagues. We do not sell Google user data or use it for advertising. We do not use it to develop or train general-purpose AI models. Google and providers supporting the integration or assistant process information as needed to provide those services. Contact us for details of the service arrangements applicable to your information.
Retention, disconnection and deletion
We keep the connection tokens while the connection is needed. You can revoke Caraway Drive access in your Google Account connections. Revocation stops future authorised API access; it does not delete existing Drive documents, downloaded copies or assistant records.
To request removal of connection records or business information held by us, contact sales@carawaytrade.com. When the connection is discontinued, we remove its locally held tokens. Working copies concerning enquiries without a transaction are kept for 12 months after the last communication. Other business records are kept while needed for the business purpose or an applicable obligation or claim. Deletion must cover relevant Drive and local working copies; service backups and assistant records follow the applicable provider retention arrangements.
Processing outside the EEA
Our use of Google services and the AI assistant means correspondence and relevant working data may be processed outside the European Economic Area, including in the United States. Google describes reliance on adequacy decisions, the EU–US Data Privacy Framework and standard contractual clauses where applicable in its data transfer information. See also Google’s privacy policy. Contact us for information about the safeguards relevant to your correspondence.
Your rights
You may request access, correction, deletion, restriction or portability where applicable, and object to processing based on legitimate interests. Write to our contact address above. You may complain to the Slovak Office for Personal Data Protection or another competent supervisory authority. We do not use enquiries for automated decisions or profiling.