Privacy Policy — Mamastops Radar

1. Who we are

Mamastops is a B2B cashless logistics platform for cross-border trucking across Southern and East Africa. Radar is the monitoring surface of that platform: it gives fleet operators, dispatchers, and managers a live view of the vehicles they are responsible for.

The platform is operated by multiple affiliated entities located in different countries. Depending on your country of residence or the services your organisation uses, your personal data may be collected, processed, and managed by the relevant local entity responsible for providing services in your jurisdiction. Our operating entities are:

• Zambia — MAMASTOP LOGISTICS SOLUTIONS LIMITED
• Tanzania — Mamastops Logistics Solutions Tanzania Ltd
• Rwanda — Mamastop Logistics Solutions Ltd
• South Africa — Mamastops Logistics Solutions South Africa (Pty) Ltd
• Mozambique — Mamastop Logistics Solutions LDA

• General contact: support@mamastops.com.
• Privacy / data-protection contact: support@mamastops.com (please use the subject line "Privacy"). If you are in Zambia and we cannot resolve your complaint, you may contact the Office of the Data Protection Commissioner under the Zambia Data Protection Act, 2021. Users in Tanzania, Rwanda, South Africa, or Mozambique should write to the same address and we will route the request to the relevant local entity.

2. Scope

This policy applies to:

• the Mamastops Radar app for Android and iOS, published under the identifier com.mamastops.radar; and
• the Mamastops APIs that the Radar app talks to.

It does not cover the Mamastops Driver app or the Mamastops web platform — those are covered by our main Privacy Policy — and it does not cover the websites or services of any partner, shipper, or other third party we link to.

Radar is a business application for authorised users of a subscribing organisation. It is not directed to children and we do not knowingly collect data from anyone under the age of 18.

3. What we process

What Radar shows you depends on your account and on how your organisation's fleet is configured. The application may process:

3.1 Account and sign-in information

• Your name and email address, as registered by your organisation.
• Email and password sign-in. Radar supports signing in with an email address and a password. Passwords are stored only as a salted cryptographic hash — we never store or display your password in readable form, and we cannot recover it for you.
• Microsoft single sign-on (SSO). If your organisation uses it, you can sign in with your Microsoft work or school account. In that case Microsoft authenticates you and returns your account identifier, name, and email address to us. We never see your Microsoft password. Your organisation's Microsoft administrator controls whether SSO is available and can revoke it.
• Session and authentication tokens issued after a successful sign-in, used to keep you signed in until you log out.
• Support correspondence — if you write to us, we keep the subject, body, and reply trail.

3.2 Fleet, vehicle, and operational information

Radar displays data belonging to your organisation, which may include:

• vehicle number, group, IMEI / device identifier, and device and firmware information for the tracking hardware;
• vehicle status, GPS coordinates and timestamps, speed, odometer, fuel level, and ignition state, as reported by that hardware;
• fleet events, alerts, reports, and other operational records.

Where a vehicle can be linked to an identifiable driver, this information is personal data about that driver. In that relationship your organisation is the data controller and Mamastops processes the data on its instructions. Your organisation is responsible for telling its drivers that their vehicles are tracked.

3.3 Technical information

• Device and app information — device model, operating system version, app version, language, and timezone, so we can answer "which build is this user on?" when troubleshooting.
• IP address, which our servers necessarily see on each request, used for security, abuse detection, and diagnostics.
• Diagnostic and error information — where the app fails, we may receive technical diagnostics describing the failure so we can fix it.

4. Device permissions

Mamastops Radar does not require sensitive device permissions and does not access your:

• device location / GPS;
• camera;
• microphone;
• contacts;
• photos or files;
• SMS or phone calls;
• Bluetooth;
• calendar or health data.

The maps in the application show vehicle and fleet locations received from our backend — that is, positions reported by tracking hardware fitted to your organisation's vehicles. The app does not use your phone's GPS and does not track you, the user.

Radar also does not send push notifications, and therefore does not register a push notification token for your device. If we add notifications in a future release, we will update this policy and the store listing before doing so.

5. How we use information

Information is used only to:

• authenticate authorised users and keep them signed in;
• display and manage fleet information;
• provide maps, dashboards, reports, and operational features;
• maintain application security and reliability, and detect abuse;
• provide technical support; and
• comply with legal and regulatory requirements.

We do not use your information for advertising, we do not sell, rent, or trade personal or fleet information, and Radar does not collect an advertising identifier or embed advertising SDKs.

6. Who we share it with

We share data only with the service providers we need in order to run Radar:

• Microsoft — identity and single sign-on, where your organisation has enabled it;
• Map and geocoding providers — to render the map tiles and place names behind the vehicle positions;
• Cloud hosting, database, and infrastructure providers — who store and serve the platform data;
• Security, monitoring, and diagnostics providers — who help us keep the service available and detect misuse.

These providers process only the data needed for their service, under their own privacy policies and under appropriate confidentiality and data-protection terms. Details of a specific provider are available on request.

We also share fleet data with your own organisation — that is the point of the product. We may share data when we are legally required to (a court order or a lawful request from a regulator, or to defend our legal rights), and with a successor entity in the event of a merger or acquisition (we will tell you before that happens).

7. International transfers

Mamastops operates across multiple African jurisdictions through the entities listed in Section 1. Some of our processors operate data centres outside the country where your data is collected. When we send your data to them, we rely on the processor's contractual safeguards and on the lawful-transfer mechanisms permitted by the data-protection law of your local operating entity (for example, the Zambia Data Protection Act, 2021, or the South African Protection of Personal Information Act (POPIA)). Where local law requires data to remain in-country — as it does in Rwanda — we host and process that data accordingly. If you are in a jurisdiction with stricter transfer rules (for example the EU/EEA under the GDPR), the same contractual safeguards apply and you keep the rights described in Section 9.

8. Lawful basis

We process your data on the following bases:

• Contract — to deliver the Radar service under the agreement between Mamastops and your organisation.
• Legal obligation — to comply with transport, logistics, tax, and accounting record-keeping requirements.
• Legitimate interest — fraud prevention, application security, and product improvement, balanced against your privacy.
• Consent — for anything optional we may introduce in the future. You can withdraw consent at any time without affecting the service we deliver.

9. Your rights

You have the right to:

• Access the personal data we hold about you and obtain a copy of it;
• Correct data that is wrong or incomplete;
• Delete your account and the personal data tied to it (see Section 10).

To exercise any of these rights, email support@mamastops.com with the subject line "Privacy". We will respond within 30 days of receiving your request.

Where the request concerns fleet or vehicle data belonging to your organisation rather than your own account, we will forward it to your organisation, which controls that data.

10. Account and data deletion

Radar access is managed by your organisation. Your organisation's administrator can disable your access at any time, and doing so immediately stops you from signing in.

To have your account and the personal data tied to it deleted, email support@mamastops.com from the address tied to your account, with the subject "Delete my Radar account". We will confirm the request with you and, where required, with your organisation, and complete it within 30 days.

When we delete your account we:

• revoke your access and invalidate your authentication tokens;
• delete or anonymise your name, email address, and sign-in identifiers;
• delete your support correspondence, subject to any legal hold; and
• retain vehicle, telemetry, and operational records, which belong to your organisation rather than to you and are kept for as long as your organisation's agreement and applicable law require (see Section 11).

Uninstalling the app removes it and its locally stored session from your device, but does not by itself delete your account on our servers — use the email route above for that.

11. How long we keep your data

• Account data is kept while your account is active and removed after closure, subject to any legal hold.
• Authentication tokens on your device are kept until you log out, your session expires, or the account is deleted.
• Vehicle, telemetry, and operational records are kept for as long as your organisation's service agreement requires, and for as long as commercial-logistics, tax, and accounting record-keeping law requires.
• Support correspondence is kept for a reasonable period after our last reply.
• Diagnostic and security logs are kept for a short, rolling period and then discarded.

12. How we protect your data

• All traffic between the application and our servers is over HTTPS / TLS.
• Authentication tokens are held in the platform's secure credential store — Android EncryptedSharedPreferences and the iOS Keychain.
• Passwords are stored only as salted cryptographic hashes, never in readable form.
• On our servers, data is encrypted at rest and access is restricted to the engineering and operations staff who need it for their job.
• We review our security posture regularly and require the same of our processors.

No system is perfectly secure. If we ever discover a breach affecting your data, we will notify you and the relevant authorities as required by law.

13. Children

Mamastops Radar is a business application for authorised users of a subscribing organisation. It is not directed to anyone under 18 and we do not knowingly collect personal information from a child. If you believe a child has used the app, please contact support@mamastops.com and we will delete the account.

14. Changes to this policy

We may update this Privacy Policy when our services or data practices change. The latest version will always be available at https://www.mamastops.com/privacy/radar. The Last updated date at the top of this page tells you when the current version took effect.

15. Contact