Privacy Policy — SC Tracker

This Privacy Policy explains how Stanley Holdings Limited, trading as Thanthwe Technologies ("Thanthwe", "we", "us"), collects, uses, discloses, and safeguards information when you use SC Tracker (the "Service"). We are committed to compliance with the Malawi Data Protection Act, 2024, and — where applicable — the EU General Data Protection Regulation (GDPR) and South Africa's Protection of Personal Information Act (POPIA).

1. Who we are

Thanthwe Technologies is a Malawian technology company building fraud-prevention and supply-chain trust infrastructure. For privacy matters, contact us at legal@thanthwe.africa.

2. Information we collect

Account data: name, email address, role, and organisation when you register.
Operational data: handover records, chain-of-custody signoffs, quantities, locations (GPS), photo evidence, and counterparty details that you enter into the Service.
Authentication data: hashed passwords (we never store passwords in plain text) and session tokens.
Technical data: IP address, browser type, device information, and usage logs collected automatically.
Communications: messages you send us via contact forms or email.

3. How we use your information

To provide, operate, and maintain the Service.
To detect, investigate, and prevent fraud — the core purpose of the Service.
To generate audit trails, forensic evidence bundles, and reports you request.
To authenticate users and secure accounts.
To communicate with you about your account, security, and service updates.
To comply with legal obligations and respond to lawful requests.

4. Legal bases for processing

Where the GDPR or the Malawi Data Protection Act applies, we process personal data on the bases of: (a) performance of a contract with you; (b) your consent; (c) our legitimate interests in preventing fraud and securing the Service; and (d) compliance with legal obligations.

5. How we share information

We do not sell your personal data. We share information only:

With sub-processors that host and operate the Service (e.g. cloud database and hosting providers), bound by data-processing agreements.
Within the federated fraud network — and even then, only salted cryptographic commitments of banned-actor identifiers are exchanged, never personal data itself.
When required by law, court order, or to protect rights, safety, and property.
In connection with a merger, acquisition, or sale of assets, subject to this Policy.

6. Data security

We apply industry-standard safeguards: encryption in transit (TLS), hashed passwords (scrypt), cryptographically signed audit ledgers, role-based access control, and a tamper-evident hash chain. No method of transmission or storage is 100% secure, but we work continuously to protect your data.

7. Data retention

We retain operational and audit data for as long as your organisation maintains an account and as required to provide the Service, resolve disputes, and comply with legal obligations. Audit-ledger entries are append-only by design and are retained for the integrity of the chain of custody.

8. Your rights

Subject to applicable law, you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion, subject to our legal and audit-integrity obligations.
Object to or restrict certain processing.
Request data portability where applicable.
Withdraw consent at any time, without affecting prior lawful processing.

To exercise these rights, email legal@thanthwe.africa.

9. International transfers

The Service is hosted on infrastructure that may process data outside Malawi (currently within the European Union). Where data is transferred internationally, we rely on appropriate safeguards consistent with the Malawi Data Protection Act and GDPR.

10. Children

The Service is intended for business use and is not directed at children under 18.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here with a revised "Last updated" date.

12. Contact

Stanley Holdings Limited, trading as Thanthwe Technologies · Lilongwe, Malawi · legal@thanthwe.africa

This document is provided for transparency and does not constitute legal advice. We recommend consulting a qualified legal practitioner before relying on it for regulatory compliance.