Terms of service

1. General provisions

The service provider is the entity named in the table above. All matters concerning the service are handled by email at the address given there.

These terms are made available free of charge on this page in a form that allows them to be downloaded, reproduced and stored. Using the service means accepting them.

2. Definitions

• Service — the eCMR One websites together with the generator and the application.
• Generator — the public, free tool for filling in a CMR form and downloading it as a PDF, available without an account.
• Application — the part of the service at /app for managing transports, requiring an account and providing sync and a local copy of data.
• Account — the set of user resources linked to an email address, together with a separate data area.
• User — anyone using the service.
• Document — a CMR consignment note prepared in the service, as a draft, an issued version or a PDF file.
• e-CMR Protocol: the Additional Protocol to the CMR Convention concerning the electronic consignment note (Geneva, 2008; Polish Journal of Laws 2019 item 1487).
• e-CMR: a Document issued in the Application that is an electronic consignment note within the meaning of the e-CMR Protocol (section 7).
• Party: the sender, carrier or consignee named in a Document. Issuer: the User who issued a Document from an Account.
• e-CMR procedures: the procedures referred to in Article 5(1) of the e-CMR Protocol, published at ecmr-one.eu/legal/ecmr-procedures; they form part of these terms.
• Evidence package: the Application's record of one Document: the version and its SHA-256 digest, the event chain, the records of consents and signatures, the description of the version PDF with its digest, and time-stamps where issued.

3. Scope of the services

The provider supplies the following services electronically:

• access to the information pages — free of charge, without registration;
• the CMR PDF generator — free of charge, without registration; the form is filled in and processed entirely in the user's browser;
• the application in local mode — free of charge, without registration; data stays in the user's browser storage;
• running an Account, with document sync across devices, company details and signing links.
• issuing, signing and keeping e-CMR documents in the Application under the e-CMR procedures.

One-off services end when you leave the service. Running an Account is a continuous service concluded for an indefinite period.

4. Technical requirements

You need a device with internet access, a current browser with JavaScript, cookies and IndexedDB enabled, and a working email address if you create an Account.

After opening the app online and letting it save on the device, you can reopen it offline, edit local drafts and generate PDFs. Signing in and syncing require a connection.

The provider notes the usual risks of electronic services, in particular malicious software and attempts to capture sign-in credentials. Keep your software up to date and use a unique password.

5. Accounts

An Account is created with an email address and a password of 12 to 128 characters. One email address corresponds to one Account and one separate data area.

Depending on how the service is configured, registration may require email verification, be limited to test accounts, or be temporarily closed. The Account contract is concluded on the first successful sign-in.

Users keep their password confidential and do not share the Account with third parties. Report any suspected unauthorised access to the provider without delay; changing the password revokes every session.

6. Rules of use

Users undertake in particular to:

• use the service in accordance with the law, these terms and good practice;
• supply no unlawful content and no personal data they have no legal basis to process;
• take no action that disrupts the service, including large-scale automated scraping, circumventing request limits or attempting unauthorised access;
• not decompile the service or use it to build a competing product;
• be responsible for the accuracy and lawfulness of the data they enter into documents.

The provider may suspend or delete an Account that breaches these terms or the law, after first asking that the breach stop, unless the breach endangers the security of the service or of other users.

7. Nature of the documents: generator and e-CMR

The PDF from the Generator is a CMR consignment note form intended to be printed and signed by hand. It is neither an electronic consignment note within the meaning of the e-CMR Protocol nor an electronically signed document. A draft in the Application has the same nature until it is issued.

A Document issued in the Application is an e-CMR, that is an electronic consignment note within the meaning of the e-CMR Protocol, if the route meets the conditions in section 7b. Issuing and delivery, integrity, proof of entitlement, confirmation of delivery, additions and amendments, and replacement of the e-CMR by a consignment note in another form follow the e-CMR procedures.

Every e-CMR states the permanent address of the e-CMR procedures: ecmr-one.eu/legal/ecmr-procedures. The address is printed on the version PDF and stored in its metadata (Article 5(2) of the e-CMR Protocol). Parties who issue or sign an e-CMR in the Application accept the e-CMR procedures as the agreed procedures within the meaning of Article 5(1) of the e-CMR Protocol. An e-CMR is governed by the e-CMR procedures as worded on the day it was issued.

The e-CMR Protocol concerns carriage to which the CMR Convention applies. A Document issued in the Application for domestic carriage is not an e-CMR. The provider does not warrant that an inspecting authority in Poland will accept it instead of a paper document.

The service currently provides no connectivity to eFTI systems or national access points and holds no certification in that area. Trust-provider signing endpoints and eFTI gateways remain unavailable.

Whether a document in a given form satisfies a counterparty or an inspecting authority in a given country is for the User to assess.

7a. Authentication method (signature)

Parties authenticate an e-CMR in the Application with a simple electronic signature. It consists of: the name the signer types, a ticked statement that they have read the document, a line drawn with a finger or mouse or a signature set from the typed name, the role (sender, carrier or consignee), and the SHA-256 digests of the signed version and of its PDF. The whole is signed with an ECDSA P-256 key created in the signer's browser; the private key cannot be exported and never leaves the device.

The provider classifies a statement made this way as a simple electronic signature in documentary form (Article 77² of the Polish Civil Code) and as another electronic authentication method permitted by the law of the country of issue within the meaning of Article 3(2) of the e-CMR Protocol.

This signature is not an advanced or qualified electronic signature within the meaning of Regulation 910/2014 (eIDAS), is not in PAdES format, and does not benefit from the presumption of reliability in Article 3(1) of the e-CMR Protocol. The Application does not verify the signer's identity: the signer types their own name, and the key belongs to the browser, not to the person. In a dispute, the reliability of the signature is shown by evidence, in particular the Evidence package.

The Application can attach an RFC 3161 time-stamp from an external provider to each consent. Until a provider is connected, the time of signing comes from the signer's device clock and the time of receipt recorded by the server.

The Application will in future offer advanced or qualified signatures made with an external trust service provider. Until then, the method described in this section applies.

7b. Routes covered by the e-CMR Protocol

An e-CMR replaces the paper consignment note only when both the country where the goods are taken over and the country of delivery are parties to the e-CMR Protocol on the day the goods are taken over.

In all other cases the Parties also issue a paper CMR consignment note. The Document in the Application is then a digital copy and an evidential record, not a consignment note that replaces paper.

Of the European Union member states, the following are not parties to the e-CMR Protocol (as at 1 October 2026): Belgium, Croatia, Cyprus, Ireland and Malta. Some non-EU parties to the CMR Convention are not parties either, for example Bosnia and Herzegovina, Georgia and Kazakhstan. The current list of parties is published in the United Nations Treaty Collection (treaties.un.org).

The documents to be shown at a roadside inspection are governed by the law of the country where the inspection takes place. When driving through a country that is not a party to the e-CMR Protocol, we recommend keeping a printout of the Document in the vehicle.

Determining whether a route meets the conditions in this section is for the Issuer. Route information shown in the Application is for guidance only.

7c. Governing law, court and evidential value of the record

The e-CMR procedures, the use of e-CMR in the Application and the relations between Users in that respect are governed by Polish law, to the extent the parties may choose the applicable law. Poland has been a party to the e-CMR Protocol since 11 September 2019.

The parties to a contract of carriage may agree on a court of a country that is a party to the e-CMR Protocol; Article 31(1) of the CMR Convention allows a court designated by agreement between the parties. We recommend naming the court in the contract of carriage or in the “Special agreements” field of the e-CMR. Such an agreement does not exclude the courts of other countries that have jurisdiction under Article 31(1) of the CMR Convention.

This section applies between Users and Parties to the extent they may agree. It does not exclude the mandatory provisions of the CMR Convention or the protection a consumer enjoys under the mandatory rules of the country of their habitual residence.

Parties who use an e-CMR in the Application agree that the Evidence package is evidence of the content of the e-CMR, the order of events, and the giving of consents and signatures in the stated role, and that the SHA-256 digests of the version and the PDF make it possible to check that the document has not been changed. This agreement does not prevent proof that the facts were otherwise.

The Issuer has access to the Evidence package through their Account, and a Party within the scope of its signing link while the link is valid. At the Issuer's request the provider supplies the Evidence package as a file.

8. Availability and testing phase

The service is in a testing phase. The provider commits to no particular level of availability and may introduce maintenance windows, change the scope of features and withdraw individual features, informing Account holders of material changes.

When sync is unavailable the application continues to work locally, and unsent changes remain on the device until the connection is restored.

9. Fees

All services described here are currently provided free of charge. Charges would only be introduced for new billing periods, after informing users and obtaining their acceptance of the new terms. Using the service does not relieve the User of data transmission costs charged by their own operator.

First companies programme. The following terms apply to the first 10 businesses operating in road transport whose application sent to the Provider's e-mail address is accepted. Applications are accepted in the order received, and the Provider confirms acceptance by e-mail. The terms apply to the Account named in the application and are not transferable:

• the services remain free of charge until a price list is introduced, which the Provider will announce to participants at least 3 months in advance;
• for the first 3 months after the price list is introduced, the participant pays no fees;
• for the following 12 months, the participant pays 50% of the prices in the applicable price list.

10. Data, backups and responsibility for content

Data stored only in the browser, without an Account, is lost if site data is cleared, if you work in a private window, or if the device fails. The provider cannot restore it.

Users are responsible for keeping their own copies of documents. The application offers JSON export and import of a data copy.

Users retain all rights to the content they enter into documents. The provider acquires the right to process it only to the extent needed to deliver the service.

11. Data processing terms

Where a User enters third-party personal data into the Account (business partners, their own staff, drivers), they remain its controller and the provider processes it as a processor. This section is the processing agreement required by Article 28 GDPR and is concluded when the Account is created.

• Subject matter and purpose: storing and making available transport documents within the User's Account, sending signing links by text message and email, and optional shipment tracking.
• Duration: for as long as the Account contract is in force.
• Nature and type of data: identification and contact details of the parties to the transport, phone numbers and email addresses of signing link recipients, data about vehicles, the route and the cargo, and vehicle positions during tracking.
• Categories of data subjects: the User's business partners, their staff and associates, drivers, and signing link recipients.
• The provider processes data only on the User's documented instructions, which include the User's use of the service's features.
• The provider ensures that persons authorised to process the data are bound by confidentiality, and applies the security measures described in the Privacy policy.
• The provider uses the sub-processors listed in the Privacy policy; it gives advance notice of any intended change, and the User may then terminate the Account contract.
• The provider assists the User in meeting obligations towards data subjects and in handling personal data breaches, and reports any breach without undue delay.
• The provider makes available the information needed to demonstrate compliance and allows audits agreed in advance, conducted in a way that does not compromise other users' data.
• After the contract ends, data is deleted within the periods stated in the Privacy policy, unless the law requires it to be retained.

This processing agreement does not cover the document's evidence package, meaning the consent and signature records with their evidence data, including signatures made from a link by people outside the Account. The provider decides the scope of this data, how long it is kept and its immutability, and therefore processes it as a joint controller with the User who issued the document and sent the link (Article 26 GDPR). The Privacy policy (section 6a) sets out the essence of the arrangement: the provider informs signers and handles their requests concerning the evidence package, while the User is responsible for the document's content and for being entitled to share the link recipient's contact details, and forwards to the provider without undue delay any request it receives.

12. Liability

The provider is liable for non-performance or improper performance of the service on general terms. Towards Users who are neither consumers nor sole traders treated as consumers, liability is limited to actual damage and excludes lost profits, and during the period of free provision it is limited to cases of wilful misconduct.

The provider is not liable for the consequences of incorrect data entered by the User, for using a document in a form that does not meet the requirements of a given carriage, or for the loss of data held only in the browser.

13. Complaints

Complaints may be submitted by email to the provider's contact address. A complaint should describe the problem, give the Account email address if relevant, and state the outcome sought.

We reply to the email address the complaint came from within 14 days of receiving it.

14. Right of withdrawal

A consumer, and a sole trader using the service in a way that is not of a professional character for them, may withdraw from the Account contract within 14 days of concluding it, without giving a reason, by sending a statement to the provider's contact address.

The services are free of charge, so withdrawal involves no financial settlement. Independently of this right, an Account can be deleted at any time.

15. Termination

Users may give up their Account at any time by deleting it in the application settings after confirming with their password; the contract ends when the Account is deleted.

The provider may terminate the Account contract on 30 days' notice, in particular when the service is discontinued, and with immediate effect in the event of a gross breach of these terms. Users should download an export of their data before an Account is deleted.

16. Changes to these terms

The provider may amend these terms for important reasons, in particular a change in the law, in the scope or manner of providing the services, or the introduction of charges. Account holders are notified by email at least 14 days before changes take effect.

No objection within that period means the new wording is accepted. An objection is treated as termination of the Account contract. One-off services are governed by the terms in force when they are used.

17. Final provisions

Matters not covered here are governed by Polish law, which does not deprive a consumer of the protection of the mandatory rules of the country where they habitually reside.

Disputes with Users who are not consumers are settled by the court with jurisdiction over the provider's registered office. Consumers may use out-of-court complaint and redress procedures, through a competent ADR body. The European Commission lists these bodies at consumer-redress.ec.europa.eu/dispute-resolution-bodies.

Personal data handling is described in the Privacy policy, which supplements these terms.

The changes of 1 October 2026 (the e-CMR definitions in section 2, section 3, sections 7 to 7c and the e-CMR procedures) apply to Account holders from 15 October 2026. One-off services, including signing through a link without an Account, are governed by the terms in force when they are used.