Data Protection

Last updated: 11 October 2026

This is our public statement under the Data Protection Act, 2024 of Malawi and Part VIII of the Electronic Transactions and Cyber Security Act, 2016. It applies to every website, app, platform, API and system operated by 389 Group Ltd and the companies in the 389 group, including new services from the day they launch. It sits next to the Privacy Policy. If the two differ on a data subject right, this notice wins.

Controller

389 Group Ltd, Area 47/5, Malingunde Close, Lilongwe, Malawi, is the data controller for our websites, apps, accounts, portals, support and client systems. Write to gilson@389group.ltd with the subject "Data protection".

Where we build or run a system for a client and the client decides why and how personal data is used, the client is the controller and we act as processor under a written agreement.

Lawful bases

  • Contract: creating an account, processing your content, taking orders, issuing tickets, running checkout, delivering client work.
  • Legal obligation: tax invoices, seven year financial records, lawful requests from Malawian authorities.
  • Legitimate interests, balanced against your rights: security, fraud prevention, service logs, improving reliability.
  • Consent: optional marketing and non-essential cookies. You can withdraw it as easily as you gave it.

We treat national ID numbers, TPIN, full bank account numbers and precise location as data that needs extra care, and only collect them where a service genuinely needs them.

Your rights under Malawian law

Subject to the limits in the Data Protection Act, 2024, you may:

  • be told whether we hold personal data about you, and receive a copy;
  • have inaccurate or incomplete data corrected;
  • request erasure where the Act allows (not where we must keep a payment, ledger or audit record);
  • restrict, or object to, processing that relies on legitimate interests or is for direct marketing;
  • withdraw consent where consent is the basis;
  • ask for a portable copy of data you gave us, in a common machine readable form;
  • not be subject to a decision based only on automated processing that significantly affects you, where the Act gives that right;
  • complain to us and to the Malawi Data Protection Authority.

How to make a request

  1. Email gilson@389group.ltd with the subject "Data protection", or open a ticket in the app you use.
  2. Tell us which service you use and what you want us to do.
  3. We may ask you to verify who you are before we act, to protect your data.
  4. We reply within the time the Act requires. We do not charge a fee unless a request is clearly excessive or repeated, as the Act allows.

If your request is about an event organiser, club, bus operator or payment partner, we will point you to them or pass it on where we can, because they decide how they use the data they hold.

Records we cannot erase

We cannot erase a ledger entry, a confirmed payment, an order record or an audit row. Those are kept for at least seven years. We can close your account so it is no longer used, and we anonymise personal details once the retention period ends. Uploaded files and generated outputs can be deleted on request, apart from copies we must keep by law.

Security

Passwords are hashed. Provider secrets are encrypted at rest and write only. Sessions use a server side store. Staff access is logged. Phone numbers are masked in logs and tickets. Card data never touches our servers. We apply access controls so one customer cannot see another customer's data, and we limit staff access to what they need for their role.

Personal data breaches

If a breach is likely to pose a high risk to your rights, we will tell the Malawi Data Protection Authority and the people affected without undue delay and within the time the Act sets. We will say what happened, what data is involved, and what you can do.

Transfers outside Malawi

Personal data stays in Malawi unless a transfer is allowed under the Act: an adequacy finding, appropriate safeguards, or another permitted ground. Payment partners may process a transaction in the country where they are licensed, and some partners operate abroad. We do not send personal data abroad for advertising.

Processors and partners

Hosting, storage, email and SMS delivery, messaging, spam protection, analytics and payment partners act on documented instructions or, for licensed partners, under their own licence. They may not use our users' personal data for their own marketing.

Children

Our services are not for children. We do not knowingly create accounts for anyone under 18. If you think we have, email us and we will close the account and delete the data we are allowed to delete.

Complaints

Start with gilson@389group.ltd or a ticket in the app. You may also complain to the Malawi Data Protection Authority. You keep any rights you have under the Consumer Protection Act and the Electronic Transactions and Cyber Security Act, 2016.