Privacy Policy
Version 1.0-draft · effective 1 November 2026 · Ayoun FreightLink is operated by Ayoun Technologies Limited
1. Who we are and what this covers
Ayoun FreightLink ("the Platform") is operated by Ayoun Technologies Limited, Zimindo Plaza, Lusaka, Zambia ("we", "us"). We are the data controller for the personal data processed on the Platform. This policy explains what we collect from shippers, transporters, their staff and drivers, consignees who receive tracking links, and businesses we contact about the Platform; why; who sees it; how long we keep it; and your rights under the Data Protection Act No. 3 of 2021 of Zambia. Contact for anything in this policy: [email protected].
2. What we collect, why, and on what basis
| Data | Source | Purpose | Lawful basis |
|---|---|---|---|
| Company details: name, registration and tax numbers, address, contact phone and email, capabilities | You, at registration | Create and verify the account; show your public profile to other members | Contract; legitimate interest |
| User details: name, email, mobile, password (hashed), two-factor secret, linked WhatsApp number | You | Sign-in, security, notifications you asked for | Contract; consent (WhatsApp) |
| Verification documents: PACRA, TPIN, RTSA licence, goods-in-transit insurance, COMESA Yellow Card, dangerous-goods permit, with expiry dates | You | Verify that members are lawfully trading and insured | Legitimate interest; legal obligation |
| Fleet and driver details: registrations, capacities, fitness and insurance expiries, driver names, licence and passport numbers, DG training | Transporter | Match trucks to loads; record who carried a job; cross-border documentation | Contract |
| Loads, quotes, jobs, prices, payment references, payout accounts | Both parties | Run the marketplace, hold and release funds, calculate commission, issue invoices | Contract; legal obligation (tax records) |
| Job evidence: status events, GPS positions from the phone that posts an update, photos, seal numbers, weighbridge tickets, proof of delivery, consignee name and phone | Transporter, customer, consignee | Prove loading, transit and delivery; resolve disputes; insurance claims | Contract; legitimate interest |
| Messages between parties, WhatsApp messages to and from the Platform number | You | Operational record of instructions | Contract |
| Ratings and dispute records | Both parties, administrators | Trust signals shown to members; dispute resolution | Legitimate interest |
| Technical data: IP address, browser, pages requested, sign-in attempts, actions taken (audit trail) | Automatic | Security, fraud prevention, accountability | Legitimate interest; legal obligation |
| Prospect data: business name, contact details, corridor, instant-estimate enquiries, public Facebook Page details | You (estimator), public listings | Offer the Platform to businesses on relevant corridors | Legitimate interest; consent for ongoing marketing |
We do not collect card numbers, mobile-money PINs or bank passwords. Trust tiers and load matching are computed automatically from your documents and track record; any such outcome can be reviewed by an administrator on request.
3. Who sees your data
- The other party to a job sees what it needs to execute it: company name and contact phone, the truck and driver on the job, status updates, photos, the POD and the consignment note. The transporter does not see the customer's budget or other quotes; the customer does not see the transporter's payout after commission.
- Other members and the public see your public profile: company name, city, capabilities, rating, completed jobs, trust tier and any Facebook Page you link. Verification documents, tax numbers, prices and messages are never public.
- A consignee with a tracking link sees movement status, truck registration and transporter name only.
- Service providers that process data on our instructions: our hosting provider, our email provider, Meta Platforms (WhatsApp messages you exchange with the Platform number) and an AI service that drafts outreach text and interprets free-text messages when enabled. Each is bound by its own data-processing terms.
- Authorities when the law requires it (for example ZRA, RTSA, ZEMA or a court order), and insurers or the Data Protection Commissioner in a dispute or claim, limited to the data relevant to that matter.
We do not sell personal data and do not share it with advertisers.
4. Cross-border transfer
The Platform is hosted on servers outside Zambia, and our messaging and email providers operate globally. These transfers are made under the providers' standard contractual protections and in accordance with the Data Protection Act's requirements for transfer of personal data outside Zambia.
5. How long we keep it
| Record | Kept for | Why |
|---|---|---|
| Jobs, quotes, payments, PODs, consignment notes, evidence photos | 7 years after the job | Accounting and tax records; insurance and dispute limitation periods |
| Verification documents and licence details | While you are a member and 12 months after closure | Re-verification and regulatory enquiries |
| Audit trail | 7 years | Security investigations; regulatory accountability |
| WhatsApp and in-platform messages | 12 months | Operational record of instructions |
| Instant-estimate enquiries and prospect records | 12 months from last contact, or at once on request | Follow-up only |
| Closed accounts | Anonymised after the periods above | — |
6. Security
All traffic is encrypted (TLS). Passwords are stored as salted hashes. Every account can enable two-factor sign-in; administrators must. Access is restricted so that a company can see only its own records, enforced both in the application and in the database. Uploaded documents are stored outside the web root and served only to the owning company and administrators. Sign-ins and actions are recorded in a tamper-evident audit trail. Backups are taken nightly and kept for 14 days, and an automated security self-test runs after every release. No system is perfectly secure: if we discover a breach likely to harm you we will notify you and the Data Protection Commissioner without undue delay. More detail is on our Security page.
7. Your rights
You may ask us to tell you what personal data we hold about you and give you a copy; correct inaccurate data; delete data we no longer need (we must keep job, payment and audit records for the periods above); stop processing for direct marketing (every outreach message and digest has an opt-out, and replying STOP on WhatsApp ends messages); have a person review any decision made purely by automated means, such as a trust-tier assignment; and receive the data you gave us in a portable format. Write to [email protected]. We answer within 30 days and do not charge for the first request in a year.
8. Cookies
The Platform sets one session cookie so that you stay signed in and one short-lived token that protects forms against forgery. Neither is used for tracking or advertising, and there are no third-party cookies. If you tick "remember me", a cookie keeps you signed in for up to 30 days.
9. WhatsApp and location
If you link a WhatsApp number we send you job alerts and accept instructions (quotes, status updates, location pins, photos) from that number. Messages travel through Meta's WhatsApp Business platform under Meta's own privacy terms. Free-text messages may be interpreted by an AI service to extract the instruction; the text is not used to train any model. You can unlink the number at any time from Account → WhatsApp, and we never send marketing by WhatsApp without your opt-in. When you update a job status from a phone we ask the browser for its GPS position and record it against that event so the customer and consignee can see where the truck was; you may refuse the browser prompt and the update still goes through.
10. Prospects and estimates
If you use the instant estimator without an account, or we find your public business listing or Facebook Page while looking for transporters and shippers on a corridor, we may hold your business name, contact details and the enquiry for up to 12 months and contact you once about the Platform. Reply or write to us to be removed and we will not contact you again.
11. Children
The Platform is for businesses and is not directed at anyone under 18.
12. Complaints and changes
If you believe we have handled your data unlawfully, contact us first at [email protected]. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner, Zambia. We will post any change to this policy on the Platform and, for material changes, notify account holders by email or in-app notice at least 14 days before it takes effect; continued use after that date is acceptance of the updated policy.
Questions about this document: [email protected] · Zimindo Plaza, Lusaka, Zambia