Limu Trade Agency

Privacy Policy

How we collect, use, keep and delete your personal information when you use the Limu Mobile app or the Limu client portal.

Last updated: 22 September 2026
Effective: 22 September 2026
Applies to: Limu Mobile (iOS and Android) and portal.limu.co.mw

The short version

We collect what we need to move your cargo and keep your account working — your contact details, your KYC information, and the consignments themselves.
We do not track you, advertise to you, sell your information, or run any analytics or advertising software in our app.
You can delete your account from inside the app at any time: Profile → Delete Account.
Some records — customs declarations, invoices, accounting — we are required by law to keep even after you delete your account. We explain exactly which, in section 8.

This summary is for convenience. The sections below are the policy.

1. Who we are

Limu Trade Agency (“Limu”, “we”, “us”) is a freight forwarding and customs clearing company based in Malawi. We are the data controller for the personal information described in this policy.

This policy covers the Limu Mobile app for iOS and Android, and the Limu client portal at portal.limu.co.mw. Both are for existing Limu Trade clients; you need an account with us to use them.

Limu Trade Agency Ltd · Area 6, Songwe Road, Plot 280, Lilongwe, Malawi.

2. What we collect

Everything below is information you give us, or that is created as a result of the freight services we provide to you. We do not buy personal information from anyone else.

Information we hold, and where it comes from
Category	What it includes	Where it comes from
Account details	First and last name, email address, phone number, and your password. Your password is stored only as a cryptographic hash — we cannot read it.	You, when you register or update your profile
KYC information	Gender, date of birth, district, whether you are an individual or business client, business name, business category, business size, a description of what your business does, whether you import or export, the categories of goods you trade in, and your acceptance of our terms.	You, when you complete your KYC profile
Consignment records	Your cargo, shipments, packages, order forms, invoices, payments and the timeline of checkpoints each consignment passes through.	Created by us as we handle your freight
Documents you send us	Proof-of-payment files and any supporting documents you upload, together with the payment amount and reference you enter alongside them.	You, when you submit them
Device and notification data	A push notification token for your device, an identifier generated by the app for your installation, and whether the device is iOS or Android. Used only to deliver notifications to the right phone.	Your device, if you allow notifications
Sign-in and security records	IP address, browser or app version, device identifier, sign-in times, failed sign-in attempts, and one-time verification codes.	Recorded automatically when you use the service
Messages between us	Support enquiries and any correspondence you send us.	You

3. What we don’t collect

This list matters as much as the one above, so we are explicit about it. The Limu Mobile app does not:

read your location — the district on your profile is one you choose from a list, not something we detect from your phone;
access your photo library, camera, microphone, contacts, calendar, or health data;
read your messages, call history, or what you do in other apps;
track you across other companies’ apps or websites, for advertising or anything else;
contain any advertising, analytics, or third-party tracking software. The app has no third-party software development kits in it at all.

We do not sell personal information, and we do not share it with anyone for their own marketing.

4. How we use it

To run your account — registering you, verifying your email address, signing you in, resetting your password, and keeping your session secure.
To meet customs and regulatory requirements — KYC information is collected because clearing goods through customs requires us to know who our clients are.
To deliver the service — booking, tracking and clearing your cargo, producing order forms and invoices, and recording payments.
To keep you informed — notifying you when a consignment changes status or something needs your attention.
To support you — answering your questions and investigating problems.
To keep the service safe — detecting suspicious sign-ins, limiting repeated failed attempts, and preventing fraud.
To meet our legal obligations — tax, customs and accounting records.

We do not use your information to make automated decisions that produce legal or similarly significant effects about you.

5. Why we’re allowed to

We process your personal information on these grounds:

Performing our contract with you — account details and consignment records; we cannot ship your goods without them.
Complying with a legal obligation — KYC, customs declarations, tax and accounting records.
Your consent — push notifications, which you can turn off at any time in your device settings without losing access to anything else.
Our legitimate interests — keeping the service secure and preventing fraud, balanced against your rights.

6. Who we share it with

We share personal information only where it is needed to deliver the service or where the law requires it. We have no advertising or analytics partners.

Categories of recipient
Recipient	What they receive, and why
Customs and government authorities	Malawi Revenue Authority and equivalent authorities in transit and origin countries receive the declarations and supporting documents required to clear your goods.
Shipping, airline and handling partners	Carriers, port and warehouse operators, and clearing agents receive the consignment details and the contact information needed to move and release your cargo.
Apple and Google	Push notifications are delivered through Apple Push Notification service and Google’s Firebase Cloud Messaging. They receive the notification and your device token, not your account details.
Messaging providers	Our email provider, our SMS provider, and the WhatsApp Business platform handle verification codes and service messages. They receive your email address or phone number and the message content.
Our hosting provider	Hostinger International Ltd stores the data on our behalf under contract, on servers in Lithuania, in the European Union.
Professional advisers and authorities	Our auditors, accountants and lawyers, and any authority we are legally required to disclose to.
A buyer of our business	If Limu Trade is sold or reorganised, client records may transfer as part of that. This policy would continue to apply until you are told otherwise.

7. Push notifications

If you allow notifications, we send you alerts when a consignment changes status, when an order form needs your review, or when an invoice is issued. To do that we store a push token for your device and an identifier for your app installation.

You can turn notifications off at any time in your phone’s settings. Everything else in the app keeps working. When you sign out or delete your account, we remove the token for that device.

8. How long we keep it

Different records have different lifetimes, and some of them we cannot shorten.

Record	Kept for
Account details and KYC information	While your account is open. Removed when you delete your account.
Sign-in sessions and device tokens	Until they expire, you sign out, or you delete your account.
Verification and password-reset codes	Minutes. They expire automatically and are then unusable.
Customs declarations, invoices, payment and accounting records	At least six years from the end of the tax year they relate to, as section 39 of the Tax Administration Act, 2021 requires, and longer while a tax objection, appeal, refund claim or investigation is still open. These are kept even after you delete your account, because we are legally required to hold them.
Support correspondence	Two years after the enquiry is closed.
Record that an account was deleted	Kept indefinitely, but only as a one-way cryptographic hash of the email address and phone number, so we can confirm a deletion happened without keeping the details themselves.

9. Deleting your account

You can delete your Limu account yourself, from inside the app, at any time. You do not need to ask us or wait for approval.

In the Limu Mobile app

Open the app and go to the Profile tab.
Tap Delete Account.
Enter your password and type DELETE to confirm.
Tap Delete My Account. This happens immediately and cannot be undone.

If you cannot get into the app, email management@limu.co.mw from the address on your account and we will delete it for you without undue delay, and in any case within 30 days.

What is deleted

Your sign-in credentials, so the account can no longer be used.
All active sessions, on every device.
Your push notification tokens, so notifications stop.
Any outstanding verification or password-reset codes.
Your KYC submission.
Your name, email address, phone number, gender, date of birth, district and business details, which are erased from your client record.

What is kept, and why

Your customs declarations, invoices, payment records and the consignment history attached to them are not deleted. We are required by Malawi tax and customs law to keep those records for a fixed period, and they cannot lawfully be destroyed on request.

What we do instead is sever the link to you: the client record those documents point at is stripped of your name and contact details, so what remains is a commercial record that no longer identifies you. Once the retention period in section 8 expires, the records are destroyed in the ordinary course.

If you have a consignment in progress, please talk to us before deleting your account — we will not be able to contact you about it afterwards.

10. Your rights

Under the Data Protection Act, 2024 (Act No. 3 of 2024) and other applicable law, you have the right to:

Access the personal information we hold about you, and get a copy.
Correct anything inaccurate — most of it you can edit yourself under Profile.
Delete your account and personal information, subject to the retention rules in section 8.
Object to or restrict certain processing.
Withdraw consent where we rely on it, such as push notifications.
Receive your data in a portable, machine-readable format.
Complain to the Malawi Data Protection Authority, run by the Malawi Communications Regulatory Authority (MACRA): info@dpa.mw, +265 991 80 21 80, or www.dpa.mw/lodge-a-complaint.

To exercise any of these, contact us using the details in section 15. We will respond within 30 days, and correct inaccurate information within 14 days, as the Act requires. We may ask you to confirm your identity first, so that we don’t disclose your information to someone else.

11. How we protect it

All traffic between the app or portal and our servers is encrypted with HTTPS.
Passwords are stored as one-way hashes. Nobody at Limu can read your password.
On your phone, sign-in tokens are held in the device’s secure Keychain or Keystore, not in ordinary app storage.
Sessions expire and their tokens rotate; you can end them by signing out.
Repeated failed sign-in attempts are rate-limited and accounts are temporarily locked.
Access to client records inside Limu is limited to staff who need it for their work.

No system is perfectly secure. If a breach affects your personal information and is likely to put you at risk, we will tell you and the Data Protection Authority within 72 hours, as the Act requires.

12. Children

Limu Mobile and the client portal are business services for account holders aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will remove it.

13. Where your data is held

The client portal, and the data behind the Limu Mobile app, are hosted by Hostinger International on servers in Lithuania, in the European Union. Our public website, limu.co.mw, is hosted separately in South Africa. Some of the providers in section 6 — push notification and messaging providers in particular — also operate internationally. Your information is therefore stored and processed outside Malawi.

Where that happens, we require those providers to protect your information to a standard consistent with this policy and with applicable law.

14. Changes to this policy

We update this policy when our practices change. The date at the top always shows the current version. If a change materially affects how we handle your information, we will tell you in the app or by email before it takes effect.

15. Contact us

For any question about this policy, or to exercise your rights:

Limu Trade Agency

Email: management@limu.co.mw

Phone: +265 887 369 105

Address: Area 6, Songwe Road, Plot 280, Lilongwe, Malawi