Privacy Policy

Limu Mobile is developed and published on the Apple App Store by Worketech Limited ("Worketech"), Area 18A, Gomani Street, Plot 1, Lilongwe, Malawi, on behalf of Limu Trade Agency ("Limu", "we", "us").

Limu Trade Agency is a freight forwarding and customs clearing company based in Malawi. Limu is the data controller for the personal information collected through Limu Mobile and the client portal. Limu decides what information is collected and why, and provides the freight, customs, and invoicing services the app gives you access to.

• Limu Trade Agency: Area 6, Songwe Road, Plot 280, Lilongwe, Malawi. Email: management@limu.co.mw. Phone: +265 887 369 105
• App developer and publisher: Worketech Limited, Area 18A, Gomani Street, Plot 1, Lilongwe, Malawi. Email: info@worketech.co.mw. Website: worketech.co.mw

This policy explains what information the app collects, how it is used and shared, how long it is kept, and the choices and rights you have.

We collect information you give us and information created when we provide freight services to you:

• Account details: name, email address, phone number, and password. Passwords are stored only as a one-way cryptographic hash.
• Know-your-customer (KYC) information: gender, date of birth, district, client type (individual or business), and business name, category, and description.
• Consignment records: cargo details, shipments, order forms, invoices, payments, and checkpoint timelines.
• Documents: proof-of-payment files and other supporting documents you upload.
• Device data: push notification token, an app installation identifier, and device type.
• Security records: IP address, app or browser version, sign-in times, and failed sign-in attempts.
• Correspondence: support enquiries and messages you send us.

The Limu Mobile app does not:

• track your location, or access your camera, microphone, contacts, calendar, or health data;
• read your messages or call history, or monitor what you do in other apps;
• track you across other companies' apps or websites;
• contain advertising, analytics, or third-party tracking software.

We do not sell your personal information, and we do not share it for advertising or marketing.

We use personal information to:

• register and verify your account, including sending verification codes by SMS, WhatsApp, or email;
• meet customs and regulatory requirements;
• deliver freight forwarding and customs clearing services;
• send status notifications about your consignments, order forms, and invoices;
• provide customer support;
• keep the service secure and prevent fraud;
• meet our legal, accounting, and tax obligations.

We do not use your information to make automated decisions that have legal or similarly significant effects on you.

We process personal information on these grounds:

• Performance of a contract: account details and consignment records needed to provide our services.
• Legal obligation: KYC information, customs declarations, and accounting records.
• Consent: push notifications. These are optional and you can turn them off at any time.
• Legitimate interests: keeping the service secure and preventing fraud.

We share information only when it is necessary, and only with parties bound to protect it at a standard consistent with this policy:

• Customs authorities: the Malawi Revenue Authority receives declarations and supporting documents.
• Shipping partners: carriers, port operators, and clearing agents receive the consignment details needed to move your goods.
• App developer: Worketech Limited (see Section 7).
• Push notification services: Apple Push Notification service (iOS) and Google Firebase Cloud Messaging (Android) receive device tokens and notification content to deliver notifications.
• Messaging providers: email, SMS, and WhatsApp Business platforms deliver verification codes and service messages.
• Hosting provider: Hostinger International Ltd hosts the client portal and app data on servers in Lithuania (European Union).
• Professional advisers: auditors, accountants, and lawyers, when needed.
• Business transfers: records may transfer to a successor if Limu is sold, merged, or reorganised. The successor remains bound by this policy.

We may also disclose information when the law requires it, for example in response to a valid court order.

Worketech Limiteddevelops, publishes, and maintains the Limu Mobile app and its supporting systems on Limu's behalf. To do that, Worketech may access personal information stored on Limu's systems, but only to build, maintain, secure, and support the service, and only on Limu's documented instructions. Worketech acts as a data processor for Limu. It does not use your information for its own purposes, does not sell it, and does not share it with anyone except as described in this policy. Questions about your information should go to Limu at management@limu.co.mw. Worketech will pass any request it receives on to Limu.

Push notifications tell you when a consignment's status changes, when an order form has been reviewed, and when an invoice is issued. The app asks for permission before sending any. You can turn notifications off at any time in your device's Settings and still use the app. Notification tokens are removed when you sign out or delete your account.

Customs and accounting records are kept even after you delete your account, as required by Malawi tax law.

You can delete your account from inside the app:

1. Open Limu Mobile and go to the Profile tab.
2. Tap Delete Account.
3. Enter your password and type DELETE to confirm.
4. Tap Delete My Account. Deletion takes effect immediately and cannot be undone.

You can also email management@limu.co.mw from the email address on your account and ask us to delete it. We will do so within 30 days.

What is deleted

• your sign-in credentials;
• active sessions on all your devices;
• push notification tokens;
• verification codes;
• your KYC submission;
• personal identifiers: name, email, phone number, date of birth, and business details.

What is kept

Customs declarations, invoices, payment records, and consignment history are kept to meet legal obligations, but they are disconnected from your personal identifiers. These commercial records are destroyed when their retention period ends.

Under Malawi's Data Protection Act, 2024 (Act No. 3 of 2024), you have the right to:

• access your personal information and get a copy of it;
• correct inaccurate information;
• delete your account and personal information, subject to the retention rules above;
• object to or restrict processing;
• withdraw consent for optional processing, such as push notifications;
• receive your information in a portable, machine-readable format;
• complain to the Malawi Data Protection Authority.

To exercise any of these rights, contact management@limu.co.mw. We respond to most requests within 30 days, and to correction requests within 14 days.

• All traffic between the app and our servers is encrypted with HTTPS.
• Passwords are stored as one-way hashes that staff cannot read.
• Sign-in tokens are stored in the device's secure Keychain (iOS) or Keystore (Android).
• Sessions expire, and sign-in tokens are rotated.
• Repeated failed sign-in attempts are rate-limited.
• Access controls limit staff to the records they need for their work.

If a data breach is likely to put you at risk, we will notify you and the relevant authorities within 72 hours of becoming aware of it.

Limu Mobile is for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.

Client portal and Limu Mobile app data are hosted by Hostinger International Ltd on servers in Lithuania (European Union). Limu's public website (limu.co.mw) is hosted in South Africa. Some of the service providers listed in Section 6 operate internationally. Any international transfer of personal information follows this policy and applicable law.

When we update this policy, we change the "Last updated" date at the top of this page. We will tell you about material changes in the app or by email before they take effect.