Privacy Policy

1Introduction

Your privacy matters to us. This Privacy Policy explains how Stagie Freight Limited, trading as Stagie Freight Services ("Stagie Freight", "we", "us" or "our"), processes personal data when you register for, access or use the Stagie Freight Services Client Portal at app.stagiefreightservices.com, including its progressive web application (the "Portal").

We process personal data in accordance with the Constitution of the Republic of Malawi, the Data Protection Act, 2024 (Act No. 3 of 2024) (the "Act"), the Electronic Transactions and Cyber Security Act, 2016, and other applicable laws.

Please read this Policy together with our Terms & Conditions. By registering for or using the Portal, you acknowledge that you have read and understood this Policy.

2Who We Are

Stagie Freight Limited is a company incorporated in Malawi (registration number [Company Registration No.]) providing customs clearing, freight forwarding, logistics, haulage and sourcing services. For the purposes of the Act, Stagie Freight is the data controller of personal data processed through the Portal, meaning we decide why and how that data is processed.

3Scope of this Policy

This Policy applies to personal data of natural persons processed through the Portal, including:

• individuals who register for or use the Portal on behalf of a client business (for example, directors, owners, managers, accounts staff and authorised representatives);
• individual clients who use the Portal in their own name;
• consignees, consignors, suppliers and other individuals whose details appear in shipment, customs, sourcing or payment records submitted through the Portal; and
• visitors to the Portal's login and registration pages.

This Policy does not cover information about companies or other legal entities that does not identify a natural person, nor the services of third parties that may be linked from the Portal. Our physical freight and clearing services may be subject to additional notices provided at the time of service.

4Definitions

In this Policy, the terms "personal data", "sensitive personal data", "processing", "data controller", "data processor", "data subject" and "personal data breach" have the meanings given to them in the Act. In summary:

• Personal data means any information relating to an identified or identifiable natural person.
• Processing means any operation performed on personal data, such as collection, recording, storage, use, disclosure, transfer or deletion.
• Data subject or "you" means the natural person to whom the personal data relates.
• Authority means the Malawi Communications Regulatory Authority (MACRA), designated as the data protection authority under the Act.

5Personal Data We Collect

Depending on how you use the Portal, we may collect the following categories of data:

6How We Collect Data

• Directly from you — when you register, complete your profile, submit shipment or sourcing requests, upload documents, raise support tickets or otherwise communicate with us.
• Automatically — through server logs, session cookies and similar technologies when you use the Portal (see Section 17).
• From our operations and third parties — including shipping lines, airlines, haulage partners, overseas agents, suppliers, the Malawi Revenue Authority (MRA) and other customs or border authorities, banks and mobile-money operators confirming payments, and your own colleagues who add you as a contact on their company's account.

7Lawful Bases for Processing

We only process personal data where a lawful basis recognised by the Act applies. We rely on the following:

• Performance of a contract — to open and manage your account and to provide the freight, clearing, sourcing and related services you or your organisation request.
• Compliance with legal obligations — including customs, excise, taxation, anti-money-laundering, record-keeping and regulatory requirements under Malawian law.
• Legitimate interests — to secure the Portal, prevent fraud and duplicate or falsified payments, recover debts, improve our services and defend legal claims, provided these interests are not overridden by your rights and freedoms.
• Consent — where required, for example for optional communications. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

8How We Use Your Data

We use personal data for specified, explicit and legitimate purposes, namely to:

1. verify your identity and phone number and create, administer and secure your Portal account;
2. display shipments, container status, duty charges, invoices and payment history relating to your account;
3. prepare and lodge customs declarations and arrange clearance, transport, storage and delivery of goods;
4. receive, review and verify proof-of-payment documents, including automated checks to detect duplicate, altered or previously used payment evidence;
5. prepare and send sourcing quotations and manage orders placed with suppliers;
6. send service notifications, respond to support tickets and communicate with you about your account;
7. detect, prevent and investigate fraud, unauthorised access, misuse of the Portal and other unlawful activity;
8. keep financial and operational records, prepare reports and meet audit, tax and regulatory obligations;
9. maintain, troubleshoot, test and improve the Portal and our services; and
10. establish, exercise or defend legal claims.

We will not process your personal data for a purpose incompatible with those listed above without informing you and, where required, obtaining your consent.

9WhatsApp, SMS & Email Communications

Your mobile number is used to send a one-time verification code via WhatsApp (or SMS as a fallback) when you register and, where enabled, when you sign in or reset your password.

After registration, we use your phone number and email address to send service messages that are necessary for the services you use, such as shipment status updates, duty charge notices, payment confirmations or rejections, quotation updates, support ticket responses and security alerts. These are part of the service and cannot be switched off while your account remains active, although you may tell us your preferred channel.

We will only send marketing or promotional messages where you have given consent or where otherwise permitted by law, and every such message will tell you how to opt out. We do not sell or rent your phone number or email address to anyone.

10Who We Share Data With

We share personal data only where necessary for the purposes described in this Policy, and only with:

• Government and regulatory bodies — the Malawi Revenue Authority, customs and border authorities in Malawi and transit countries, port authorities, and other public bodies where required to clear goods or by law;
• Logistics partners — shipping lines, airlines, freight agents, transporters, warehouses, container depots and delivery partners involved in moving your goods;
• Suppliers — overseas suppliers and sourcing agents, to the extent needed to fulfil a sourcing request you have accepted;
• Financial institutions — banks and mobile-money operators, to verify payments and reconcile accounts;
• Service providers (data processors) acting on our instructions, such as web hosting and database providers, email delivery services, the WhatsApp Business Platform (Meta), SMS gateways, and Google reCAPTCHA for bot protection. These providers are bound by contractual obligations of confidentiality and security and may not use your data for their own purposes;
• Professional advisers — auditors, lawyers, accountants and insurers under duties of confidentiality;
• Your own organisation — other authorised users of the client account you belong to, who may see shipments, invoices and payments for that account; and
• Others where required or permitted by law — to comply with a court order or lawful request, to protect the rights, property or safety of Stagie Freight, our clients or others, or in connection with a merger, acquisition or sale of all or part of our business, subject to equivalent confidentiality protections.

We do not sell personal data.

11Transfers Outside Malawi

Because international freight and sourcing involve parties in other countries, and some of our service providers operate servers abroad, your personal data may be transferred to or accessed from countries outside Malawi (including the countries of origin, transit and supply of your goods).

We will transfer personal data outside Malawi only in accordance with the Act, that is, where the recipient is subject to a law, binding corporate rules, contractual clauses, code of conduct or certification mechanism that affords an adequate level of protection, or where another lawful ground under the Act applies — for example, where the transfer is necessary for the performance of a contract with you or for the implementation of pre-contractual measures taken at your request, such as shipping your goods.

12Data Retention

We keep personal data only for as long as necessary for the purpose for which it was collected, or as required by law. Our standard retention periods are:

Where data is subject to a legal hold, ongoing dispute or investigation, we may retain it until the matter is resolved. When data is no longer required, we securely delete it or anonymise it so that it can no longer identify you.

13Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage, including:

• encrypted connections (HTTPS/TLS) between your device and the Portal;
• passwords stored only as salted one-way hashes, never in readable form;
• phone-number verification and bot protection at registration;
• role-based access controls restricting administrative systems to authorised staff on a need-to-know basis;
• restricted storage of uploaded documents outside the public web directory;
• logging and monitoring of access and activity; and
• staff confidentiality obligations and regular backups.

No system connected to the internet can be guaranteed to be completely secure. You are responsible for keeping your login credentials confidential and for notifying us immediately if you suspect unauthorised access to your account.

14Personal Data Breaches

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Authority as required by the Act and, where the breach is likely to result in a high risk to you, we will inform you without undue delay, describing the nature of the breach, its likely consequences, the measures we have taken, and steps you can take to protect yourself.

15Your Rights

Subject to the conditions and exceptions in the Act, you have the right to:

• Be informed about how your personal data is processed, as set out in this Policy;
• Access your personal data and obtain a copy of it;
• Rectification — have inaccurate or incomplete data corrected;
• Erasure — have your data deleted where it is no longer necessary or is being processed unlawfully;
• Restriction — ask us to limit processing in certain circumstances, for example while accuracy is contested;
• Object to processing based on legitimate interests, and at any time to processing for direct marketing;
• Data portability — receive data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
• Withdraw consent at any time, where processing is based on consent;
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you; and
• Lodge a complaint with the Malawi Communications Regulatory Authority.

16Exercising Your Rights

You can update most profile details directly in the Profile page of the Portal. To exercise any other right, email support@stagiefreightservices.com or raise a support ticket in the Portal, stating the right you wish to exercise.

To protect your data, we may need to verify your identity before acting on a request. We will respond within the period required by the Act and, in any event, without undue delay. Requests are free of charge unless they are manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable fee or decline the request and explain why.

17Cookies & Device Storage

The Portal uses a limited number of technologies that store information on your device:

• Essential session cookies — keep you signed in and protect forms against cross-site request forgery. The Portal cannot work without them.
• Preference storage — remembers settings such as your light or dark theme.
• App cache (service worker) — stores parts of the Portal on your device so the progressive web app loads quickly and can display basic pages when your connection is poor.
• Bot protection — Google reCAPTCHA may set cookies and collect device and interaction data to distinguish people from automated programs, subject to Google's privacy policy and terms.

We do not use advertising or cross-site tracking cookies. You can clear cookies and site data through your browser settings, but doing so will sign you out and may affect how the Portal works.

18Automated Checks & Decisions

When you upload proof of payment, the Portal runs automated checks (for example, comparing file fingerprints, reference numbers and amounts) to flag possible duplicate or altered documents. These checks assist our finance team; a payment is not finally rejected, and no account is suspended, solely on the basis of an automated flag without review by a member of staff. You may contact us to request human review of any outcome.

19Data About Your Staff & Third Parties

If you provide personal data about other people — such as colleagues added as users, consignees, suppliers or contact persons — you confirm that you are authorised to do so and that you have informed them that their data will be processed by Stagie Freight in accordance with this Policy.

20Children

The Portal is a business service intended for persons aged 18 years or older. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

21Third-Party Links & Services

The Portal may link to websites or services operated by others, such as shipping-line tracking pages or supplier websites. We are not responsible for the privacy practices of those third parties and encourage you to read their privacy policies.

22Changes to this Policy

We may update this Policy from time to time to reflect changes in law, our services or our practices. The "Effective" date at the top shows when it was last revised. Where changes are material, we will notify you through the Portal, by email or by WhatsApp before they take effect. We encourage you to review this Policy periodically.

23Contact Us & Complaints

If you have questions about this Policy or how we handle your personal data, or wish to make a complaint, please contact us first so we can try to resolve it:

If you are not satisfied with our response, you have the right to lodge a complaint with the data protection authority: