e-CMR procedures

1. What these procedures cover

The e-CMR procedures describe how an electronic consignment note (e-CMR) is issued, signed, checked, amended and replaced in the eCMR One application at /app. They are the procedures the parties to a contract of carriage agree under Article 5(1) of the Additional Protocol to the CMR Convention concerning the electronic consignment note (Polish Journal of Laws 2019 item 1487, the e-CMR Protocol).

These procedures form part of the Terms of service. Capitalised terms (Application, Account, Party, Issuer, e-CMR, Evidence package) have the meaning given in section 2 of the Terms. When a document from the Application is an e-CMR, and when it is a copy alongside a paper note, is set out in sections 7 and 7b of the Terms; the signing method is described in section 7a.

Every e-CMR states the address of these procedures: ecmr-one.eu/legal/ecmr-procedures. The address is printed below the form in the version PDF and stored in its metadata, as Article 5(2) of the e-CMR Protocol requires. An e-CMR is governed by the procedures as worded on the day it was issued.

2. Issuing and delivering an e-CMR (Article 5(1)(a))

An e-CMR is issued by the Issuer: a User signed in to a company Account, as its owner or a member. The Issuer completes the form and chooses “Issue”. The server checks that the data is complete and records one immutable version of the document with its SHA-256 digest, the issuing event, and the PDF of that version with its SHA-256 digest. No version is created without its PDF.

The Issuer delivers the e-CMR to a Party by creating a signing link for it. A link is bound to one document and one role (sender, carrier or consignee), is valid for 7 days, and only a digest of its token is stored. The Issuer passes the link on by SMS, email or otherwise, and can revoke it or replace it with a new one at any time; a new link revokes the previous one.

The Party opens the link without an Account. The Party's device downloads the version PDF and computes its SHA-256 digest itself. The signing form appears only when the digest matches the one recorded on the server. From that moment the e-CMR is deemed delivered to that Party. While the link is valid, the Party can download the PDF it signs.

A carrier using the Issuer's Account can sign the e-CMR directly in the Application, without a link.

3. Integrity of the e-CMR (Article 5(1)(b))

Integrity is ensured by the following mechanisms:

• an issued version is immutable: the database denies every role, including the service role, the right to change or delete versions, events, consents and version PDFs;
• the SHA-256 digest of a version covers its data in canonical form, and the SHA-256 digest of the PDF covers exactly the bytes every signer of that version sees;
• events form a chain: each contains the digest of the previous one, and the database allows neither a fork in the chain nor a second initial event;
• every signature covers the version digest and the PDF digest; the server rejects a signature when either does not match the record;
• every signature can receive an RFC 3161 time-stamp from an external provider; until a provider is connected, the device time and the server's time of receipt are recorded;
• a PDF copy downloaded from the Application carries the original version PDF byte for byte as an attachment, and its SHA-256 digest is printed on every page of the copy.

Together this data makes up the document's Evidence package. A copy is checked against the e-CMR by comparing the SHA-256 digest of the attached PDF with the digest in the Evidence package.

4. Proof of entitlement under the e-CMR (Article 5(1)(c))

A Party demonstrates its entitlement in one of the following ways:

• the Issuer and people in its company: by access to the e-CMR through the Account of the company that issued it; the company's owner and members have the same access to documents;
• a Party without an Account: by the signing link bound to this document and its role; the link can neither change the role nor open another document, and each role signs a document only once;
• after signing: by the consent record in the Evidence package, which states the role, the name given, the time, and the digests of the signed version and PDF.

The Application does not verify the signer's identity or their authority to act for a Party. The Issuer is responsible for sending a link to an entitled person, and the Party on whose behalf a person signs is responsible for that person's authority.

5. Confirmation of delivery to the consignee (Article 5(1)(d))

Delivery is confirmed by the consignee signing the e-CMR in the consignee role through the signing link. The link may also be opened on a device the driver presents. The consignee's signature confirms receipt: the Application marks the document as delivered and ends location sharing for the transport, if it was on.

When signing, the consignee may enter reservations about the condition of the goods (loss, damage), up to 150 characters. The reservations are part of the consignee's signed consent, cannot be changed afterwards and are printed in box 24 of the PDF. Reservations made after delivery, within the periods in Article 30 of the CMR Convention, are sent by the consignee to the carrier outside the Application; the Parties may also replace the e-CMR with a paper note under section 7.

6. Additions and amendments (Article 5(1)(e))

Until it is issued, a document is a draft and the Issuer may change it freely. An issued e-CMR can be neither changed nor deleted: the Application and the server reject any change to the content of an issued version.

If the content of an e-CMR needs an addition or amendment, the Issuer issues a new e-CMR (the “Repeat” function creates a draft with the previous document's data) and the Parties sign it again. In the new e-CMR the Issuer states the number of the document it replaces, for example in the “Special agreements” field, and revokes the active signing links of the previous document.

The previous e-CMR stays in the Application unchanged, with its Evidence package, as the record of the original content. The Application does not currently mark automatically that a document has been replaced.

7. Replacing the e-CMR with a consignment note in another form (Article 5(1)(f))

Any Party, and an inspecting authority during an inspection, may require the e-CMR to be replaced with a paper note. The Issuer also replaces the e-CMR when the route does not meet the conditions in section 7b of the Terms, or when the Application is unavailable in a way that prevents further use.

Procedure:

• the Issuer, or a carrier with access to the Issuer's Account, prints a PDF copy of the e-CMR from the Application (“Print” or “Download PDF”); the copy contains the version data, the signatures given so far, the address of these procedures and the SHA-256 digest of the approved PDF;
• on the printout the Issuer writes by hand: “Replaces e-CMR no. … of …; further handling on paper”, with the date, place and signature;
• missing signatures are given by hand on the printout in boxes 22 to 24, and further steps (reservations, confirmation of delivery) take place on paper;
• the Issuer revokes the active signing links of this e-CMR in the Application, so that nobody gives an electronic signature after the replacement.

From the replacement onwards, the paper document is the consignment note. The e-CMR stays in the Application unchanged as the evidential record of the state before the replacement and is not deleted. To an inspecting authority that only asks to see the document, the driver may show the PDF on screen or a printout without replacing the e-CMR.

8. Retention and access

An e-CMR, its versions, events, consent records, version PDFs and time-stamps are kept for as long as the document exists. Deleting an Account does not delete issued documents or signature records (see the Privacy policy and the “Delete account” page).

A Party without an Account has access to the e-CMR through the signing link while the link is valid. After that, the Issuer supplies it with a copy of the e-CMR and the Evidence package.

9. Changes to these procedures

These procedures are changed in the same way as the Terms of service (section 16 of the Terms). An e-CMR issued before a change is governed by the procedures as worded on the day it was issued.