Privacy Notice

Effective 18 May 2026.

This Privacy Notice explains what personal information Shamarrway collects, why we collect it, how we keep it, and the choices you have. It applies to the Shamarrway website, dashboard, and shipping services (together, the "Services"). Shamarrway acts as a data controller for the personal information described here.

1. Information we collect

Information you give us

Account details: name, email address, phone number, password, account type (individual or business), and, for businesses, a company name.
Addresses: pickup and delivery addresses you save for shipping.
Shipment details: description of contents, HS code, declared value, weight, and dimensions of each parcel.
Identification: where customs requires it, government-issued identification of sender or recipient.
Support correspondence: the content of messages you send to our support, trust and safety, or claims teams.

Information collected automatically

Usage information: pages viewed, actions taken in the dashboard, and approximate times of activity.
Device information: browser type, operating system, language, and IP address.
Cookies and similar: see the Cookies section below.

Information from third parties

Payment processors: Stripe, Paystack, and Flutterwave send us payment status, the last four digits of the card, and the issuing country, but not the full card number.
Carriers and customs authorities: tracking events, customs assessments, and proof-of-delivery records.

2. How we use it

We use the personal information described above to:

Provide the Services you booked: produce quotes, accept payment, file customs declarations, move the parcel, and deliver it.
Operate your account: authentication, password recovery, billing, and dashboard analytics that show your own shipments.
Comply with import, export, and tax laws in the origin and destination countries, including the United States Export Administration Regulations and Nigerian customs requirements.
Detect and prevent fraud, payment disputes, money laundering, and abuse of the Services.
Improve the Services and develop new shipping lanes based on aggregated, non-identifying usage data.
Communicate with you about shipments, account activity, security, and (where you opt in) product updates.

3. Legal bases for processing

We process personal information under one or more of the following bases:

Performance of a contract: processing necessary to deliver the Services you booked.
Legal obligation: processing required by customs, tax, anti-money-laundering, and consumer-protection law.
Legitimate interests: fraud prevention, security, basic analytics, and protecting our staff and operations.
Consent: for optional communications such as product news. You can withdraw consent in your dashboard at any time.

4. Who we share information with

We share personal information only as needed to run the Services or as required by law. Specifically:

Payment processors (Stripe, Paystack, Flutterwave) to charge your selected payment method.
Carriers and drivers who move the parcel.
Customs authorities in the origin and destination countries.
Cloud infrastructure providers who host our systems.
Professional advisers (accountants, lawyers, auditors) where confidentiality applies.
Law enforcement or regulators where required by valid legal process.

We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not use it to train artificial-intelligence models for third parties.

5. International transfers

Personal information may be transferred to and processed in the United States, the European Union, the United Kingdom, and Nigeria. Where transfers leave the European Economic Area or the United Kingdom, we rely on Standard Contractual Clauses or other valid transfer mechanisms. Transfers to Nigeria are made for the purpose of operating the Services and clearing customs at destination.

6. How long we keep it

Account records: while your account is active, plus seven years after closure for tax and customs audit purposes.
Shipment records: seven years from the date of shipment.
Payment metadata: as required by our payment processors and tax authorities.
Support correspondence: three years from the date of the last message in the thread.
Marketing preferences: until you withdraw consent.

7. How we secure it

Traffic between your browser and our service is encrypted in transit using TLS 1.3. Authentication uses short-lived JSON Web Tokens that you can rotate. The database lives on a private network with no public port. Access by staff is scoped to the minimum required for their role and is logged. Payment card data is tokenised by the payment processors and never reaches our systems.

8. Your rights

Depending on where you live, you have some or all of the following rights regarding the personal information we hold about you:

Access: request a copy of the information.
Rectification: correct information that is wrong.
Erasure: ask us to delete information, subject to our legal retention obligations above.
Restriction: ask us to pause processing while a dispute is resolved.
Portability: receive your information in a structured, machine-readable format.
Objection: object to processing based on legitimate interests, and to direct marketing.
Withdrawal of consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of earlier processing.
Complaint: lodge a complaint with the Nigeria Data Protection Commission (NDPC), or your local supervisory authority in the European Economic Area or the United Kingdom.

To exercise these rights, write to privacy@shamarrway.com. We will respond within thirty days. Identity verification may be required before we act on a request.

9. Cookies

We use a small number of strictly necessary cookies for authentication, theme preference, and session security. We do not use third-party advertising cookies. If we add analytics or other optional cookies in the future, we will ask for your consent first.

10. Children

Shamarrway is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, write to privacy@shamarrway.com and we will delete it.

11. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be announced in the dashboard and on this page. The current version is always at shamarrway.com/legal/privacy.

12. Contact and complaints

Privacy enquiries: privacy@shamarrway.com.
Data Protection Officer: dpo@shamarrway.com.
Personal-data breach reporting (we report qualifying breaches to the Nigeria Data Protection Commission within seventy-two hours of becoming aware).