POPIA privacy notice

1. Who we are

CARGOPULSE is a cargo visibility and data-sharing platform operated by STERNMARK (“we”, “us”). For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), STERNMARK is the responsible party for personal information processed through the platform, except where we act as an operator on behalf of a customer organisation that uploads its own records.

Our Information Officer can be reached at the contact details in section 10.

2. What personal information we process

We deliberately keep personal information to the minimum required to move a container:

• Account data — name, work email address, company, role and password credentials held in hashed form.
• Operational contact data — work phone number and WhatsApp number where you enable alerts.
• Transport data — driver name, truck registration and collection slot activity, used for gate access and chain of custody.
• Shipment data — container, bill of lading and consignment references, which may indirectly identify a party.
• Technical data — log and audit records of platform and API activity, retained for security.

3. Why we process it, and on what lawful basis

We process personal information to give the parties in a logistics chain a shared, accurate view of a shipment and to notify the party who must act. Our lawful bases under section 11 of POPIA are performance of a contract with you or your employer, compliance with a legal obligation such as customs record-keeping, and the legitimate interests of the parties to a shipment in accurate and timely cargo information.

We do not sell personal information, and we do not use it for advertising.

4. Who we share it with

Shipment information is shared with the parties to that specific shipment: the shipping line, port terminal, clearing agent, cargo owner and appointed transporter. Access is enforced technically — an organisation can only see its own shipments, and operational partners only see the shipments they are engaged on.

We also use service providers (operators) for hosting, database, messaging and email delivery. Each is bound by a written operator agreement under section 21 of POPIA and may process personal information only on our documented instructions.

5. Cross-border transfers

Some of our hosting and messaging providers process data outside South Africa. Where this happens we rely on section 72 of POPIA: the recipient is subject to a law, binding agreement or corporate rules providing an adequate level of protection substantially similar to POPIA. Customers with a contractual data-residency requirement can request deployment in a South African region.

6. How we protect it

Our safeguards under section 19 of POPIA include:

• Encryption in transit over HTTPS and encryption of data at rest.
• Row-level access control in the database so tenant data is isolated by default.
• Role-based authorisation verified on the server for every request; client-side role claims are never trusted.
• Signed inbound integrations using HMAC-SHA256 with constant-time verification, and keyed read APIs.
• Secrets held in a managed secret store, never in source code, and rotated on partner offboarding or suspected exposure.
• Audit logging of every inbound integration event and every milestone, with the acting role recorded.

7. How long we keep it

Shipment and event records are retained for five years, aligned with customs and tax record-keeping obligations. Personal information of individual contacts and drivers is deleted twelve months after their last activity, unless a contract or law requires a longer period. Backups are cycled out on a rolling basis.

8. Your rights

Under sections 23, 24 and 25 of POPIA you may:

• Ask what personal information we hold about you and request a copy.
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive or obtained unlawfully.
• Object to processing based on legitimate interest.
• Withdraw consent to WhatsApp or email alerts at any time in Settings.
• Lodge a complaint with the Information Regulator (South Africa).

9. Security breaches

If personal information is accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible after establishing the breach, as required by section 22 of POPIA, and we will describe what happened and what to do about it.

10. Contact

Information Officer, STERNMARK — privacy@cargopulse.co.za. We respond to data subject requests within 30 days.

Information Regulator (South Africa) — inforeg.org.za, complaints.IR@justice.gov.za.