Privacy notice

Malheight Logistics is the data controller for personal information used to run this website and our delivery services. This notice covers customers, senders, recipients, business account members, riders and people who contact us. It explains our processing under the Nigeria Data Protection Act 2023.

Contact Malheight Logistics at [email protected], or write to 24 Seriki Aro Street, Ikeja, Lagos, Nigeria.

For privacy requests, use the subject line “Privacy request” so we can route your message to the person responsible.

• Contact and account details: name, email, phone number, addresses, password credentials, account verification and sign-in records.
• Booking and delivery details: sender and recipient contacts, pickup instructions, parcel description, weight, declared value where supplied, waybill, delivery status, handovers and delivery evidence, including the receiving person's name and relationship.
• Business details: business name, team membership, saved addresses, registration and verification records, and shipment information uploaded or entered by authorised members.
• Payment records: amount, payment method, payer details, transaction references, payment status, refunds and disputes. Paystack handles online payment credentials; our booking form does not collect your full card number, card PIN or banking password.
• Rider records: contact and vehicle details, account invitations, assigned jobs, delivery evidence, earnings, bank account details and payout history.
• Communications and technical records: enquiries, email and SMS delivery records, IP address, browser or device information, session cookies and security logs.

We collect information from you when you book, create an account or contact us. We also receive information from senders, business account members, recipients, riders, staff and payment or communications providers.

If someone books a delivery for you, they provide the details we need to contact you and deliver the parcel. If you provide another person's information, make sure you have a lawful basis to share it and give them this notice. Avoid putting sensitive personal information in parcel descriptions or delivery instructions.

• Contract: to create and manage your account, arrange bookings, collect and deliver parcels, take payments, administer rider earnings and payouts, provide updates and handle service enquiries.
• Legitimate interests: to deliver parcels to recipients who did not make the booking, maintain delivery evidence, prevent fraud, protect accounts, manage business team access and resolve disputes. We must balance these purposes against your rights and interests.
• Legal obligations: to keep records required by law and respond to lawful regulatory or court requests.
• Consent: where a separate optional use requires it, we will explain the use and ask first. You can withdraw consent for that use. Booking is not consent to unrelated marketing.

Authorised staff and riders receive the details needed for their work. Business account owners, managers and members can access shipment information according to their role.

We use Cloudflare for website and API hosting and security, Supabase for hosted database storage, Paystack for payments, Resend for service emails, and BulkSMS Nigeria for SMS notifications when enabled. If you choose WhatsApp support, your messages and contact details are processed through WhatsApp (Meta) under its own privacy terms. These providers receive the information needed to provide their services. Payment providers may also process information for their own legal and fraud prevention duties.

Anyone with a waybill can see limited tracking information, including route, schedule, delivery and payment status, charges and, after delivery, the receiving person's first name and relationship. Full contact details and addresses are not shown on public tracking. Treat waybills and payment links as private.

We may disclose relevant records to authorities where legally required or to professional advisers for a dispute. We do not sell personal information.

Our database is hosted in Ireland. Hosting, payment and communications providers may also process information in other countries, including through their global infrastructure.

Transfers outside Nigeria are subject to the Nigeria Data Protection Act's requirements for adequate protection or another permitted transfer basis. Contact us for information about the destinations and safeguards applicable to your data, or to request details of the relevant transfer arrangements.

Retention depends on the record and its purpose. Account and saved-address information supports your ongoing account; shipment, payment and delivery evidence supports fulfilment, accounting, complaints and legal claims. Security and communications records support fraud prevention and delivery troubleshooting.

We assess whether records are still needed by considering outstanding deliveries or refunds, applicable accounting and legal requirements, and unresolved disputes. Deletion requests are reviewed against those needs. Financial and custody histories may need to be retained, with corrections recorded as additional entries. Closing an account does not automatically erase those records. Ask us about the retention period applicable to a particular record.

We use first-party session cookies to keep you signed in and protect account access. Your light or dark theme preference is stored in your browser. The website also loads fonts from Google Fonts, which receives technical request information such as your IP address.

We do not currently use advertising cookies or optional analytics trackers. You can clear cookies and browser storage in your browser settings; blocking session cookies can prevent sign-in. External payment pages have their own privacy and cookie notices.

Subject to the conditions and exceptions in Nigerian law, you can request access to your personal data and information about its use, correction, erasure, restriction of processing and a portable copy. You may object to processing based on legitimate interests and to direct marketing, withdraw consent where processing relies on it, and challenge decisions based solely on automated processing that have legal or similarly significant effects.

We do not use solely automated decisions with legal or similarly significant effects. Booking prices and capacity checks use service rules; contact us if you need a booking or payment decision reviewed.

Email a privacy request using the contact above. Describe the information or booking involved and the action you want. We may ask for proportionate proof of identity or authority before disclosing or changing records. Do not email passwords, card PINs or one-time passwords. We will respond within the applicable legal timeframe and explain any lawful limitation.

You can complain directly to the Nigeria Data Protection Commission, whether or not you first contact us.

We need accurate sender and recipient contact details, addresses and parcel information to fulfil a delivery. Without required information, we may be unable to book, deliver or verify a payment. Optional fields are marked in the relevant form.

Accounts and bookings are intended for adults aged 18 or over. If a child's details are needed for a delivery, an authorised adult should arrange it and provide only what is necessary. Contact us if you believe a child has supplied information without appropriate authority.

We use encrypted connections, restricted staff access and account security controls to protect information. No system is completely secure. Report suspected misuse to us promptly; we will assess incidents and notify affected people and the regulator where required by law.

We will publish updates here with a revised effective date and provide further notice of material changes where required.