Privacy Policy

Last updated: 11 October 2026

This policy explains how 389 Group Ltd and the companies in the 389 group ("we", "us") collect, use, share and protect personal information when you use any of our websites, apps, platforms, APIs and systems (the "services"). It is written for the Data Protection Act, 2024 and the Electronic Transactions and Cyber Security Act, 2016 of Malawi. Our Data Protection notice sets out your rights in more detail.

1. Who we are and what this covers

389 Group Ltd, Area 47/5, Malingunde Close, Lilongwe, Malawi, is the data controller for all of our services. This policy applies to every service we operate, including new services from the day they launch, whether or not they are named here. Examples:

Licensed payment partners, event organisers, clubs, bus operators and other third parties who use our platforms are separate controllers for the data they collect and use for their own purposes. Their own notices apply to that use.

A service only collects the data it needs. The list in section 2 is the full set across all services, so not every item applies to every service.

2. What we collect

  • Contact and enquiry data: name, email, phone, organisation and the message you send through forms, WhatsApp or email.
  • Account data: name, business name, email, phone, role, password hash, verification codes, authenticator secrets and passkeys.
  • Content you give us: files, documents, images, text and settings you upload, enter or generate in a service, and the results we produce from them.
  • Careers data: details and documents you send when you apply for a role or tell us why you want to join.
  • Order and ticket data: orders, tickets, seat and passenger details, and payment status. For bus trips this includes the name and phone number of each passenger. If you give us someone else's details, you confirm they agreed.
  • Payment data: amount, method, wallet type, merchant reference, status, timestamps and a masked mobile number. We never collect or store full card numbers, CVVs or PINs.
  • Business verification data: where a service needs it, such as TPIN, director name and bank account details for merchants and organisers who receive payouts.
  • Support data: tickets, chat or WhatsApp messages and attachments you send us.
  • Technical data: IP address, device and browser type, pages viewed, approximate location from IP, API keys (stored hashed), webhook URLs and security and audit logs.

We do not knowingly collect special category data such as health or biometric data, or data about children. Do not upload that kind of data to a service unless the service says it is designed for it.

3. Why we use it

  • To provide the service: run accounts, process your content, take orders, confirm payments, issue tickets, send webhooks, deliver work for clients, respond to enquiries and provide support.
  • To meet legal duties: tax, accounting, record keeping, and anti-money-laundering checks our partners or the law require.
  • To protect the service: prevent fraud and abuse, keep security and audit logs, and fix faults.
  • To improve the service: understand how our sites are used and make them more reliable.
  • With consent: optional marketing or non-essential cookies. You can withdraw consent at any time.

We do not sell personal information and we do not share it for third party advertising.

4. Who we share it with

  • Licensed payment partners such as mobile money operators, banks and card processors, only what they need to take or confirm a payment.
  • Event organisers, clubs and bus operators, for tickets you buy from them: ticket holder details and, for trips, the passenger list.
  • Service providers under contract: hosting, storage, email and SMS delivery, WhatsApp messaging, spam protection and analytics.
  • Group companies, where needed to run a shared system you use.
  • Professional advisers, regulators, the Malawi Revenue Authority, the Malawi Police Service or the courts, where the law requires it.
  • A buyer or successor, if the business is sold or restructured, with the same protections for your data.

5. Where it is stored and transfers outside Malawi

We aim to keep production data in Malawi or in a location that meets the Data Protection Act, 2024. Some providers, and some partners, operate outside Malawi. We only transfer personal data abroad where the Act allows it: adequate protection, appropriate safeguards such as contracts, or another permitted ground.

6. How long we keep it

  • Payment, ledger, order, ticket and audit records: at least seven years, to meet financial record keeping duties.
  • Uploaded files and generated outputs: only as long as the service needs them to work for you, normally deleted within the period the service states, or when you delete them or close your account.
  • Enquiries and support messages: as long as needed to handle the matter, then deleted or anonymised, normally within 24 months.
  • Job applications: up to 12 months after the role closes, unless you ask us to keep you on file longer.
  • Closed accounts: the same retention as above, then deletion or irreversible anonymisation.
  • Logs and analytics: kept for a limited period needed for security and reliability.

7. Cookies and analytics

We use essential cookies and local storage for sign-in, security, theme and your cookie choice. These are needed for the services to work. With your consent, we may use analytics such as Google Analytics on public pages to understand how visitors use them. Analytics does not run in admin, portal or checkout areas. You can decline non-essential cookies in our cookie banner or through your browser settings.

Our forms may use Google reCAPTCHA to block spam. Google's own privacy policy and terms apply to that check.

8. Security

We use industry standard safeguards: encryption in transit, hashed passwords, encrypted provider secrets, access controls so one customer cannot see another's data, masked phone numbers in logs and tickets, and logged staff access. No system is perfectly secure. If a breach is likely to pose a high risk to you, we will notify the Malawi Data Protection Authority and affected people as the law requires.

9. Your rights

You can ask to access, correct, erase, restrict or object to our use of your personal data, withdraw consent, and request a portable copy of data you gave us. We cannot erase records we must keep by law, such as payment and ledger entries. See the Data Protection notice for how to make a request and how to complain.

10. Children

Our services are not for anyone under 18 and we do not knowingly collect their data. If you think we have, email us and we will delete it.

11. Changes to this policy

We may update this policy. Changes are posted here with a new date. For material changes affecting account holders we will also notify you by email or in the service where we can.

12. Contact

Privacy questions: gilson@389group.ltd, or our contact page.