What we hold, why, and for how long

Khalz Swift Lyft Logistics and Hardware Industry LLC is the controller of the personal data described here. For data protection questions, including access requests, write to [email protected].

This notice covers our website, our tracking pages, our payment pages and the accounts our customers and staff sign in to.

• Contact and account data — name, company, email address, telephone number, and the sign-in credentials of account holders. Passwords are stored only as a one-way hash.
• Consignment data — shipper and consignee names, collection and delivery addresses, the commodity description, pieces and weight, the service booked, and the status and location events that make up a tracking history.
• Order data — what was bought from our shop, the amount, and the delivery details given at checkout.
• Payment data — the amount, currency, payment reference, the email address a receipt goes to, whether the payment was made by card or in cryptocurrency, and the settlement records our payment partner sends us. For cryptocurrency payments that includes the deposit address, transaction hash and confirmation count, which are public on the relevant blockchain.
• Technical data — the IP address and browser user agent recorded against a payment, kept to investigate fraud and to resolve disputed transactions.

We do not collect card numbers, expiry dates or security codes. Card payments are completed on our payment partner's own hosted page, and those details are never entered on, transmitted through or stored by our systems.

We do not ask for special category data, and you should not send it to us. Where a customs formality requires an identity document, we handle it only for that formality and keep it no longer than the law requires.

• To quote, book, carry, clear and deliver consignments, to fulfil shop orders, and to take payment for them — because it is necessary to perform our contract with you.
• To meet customs, tax, aviation security and sanctions obligations, and to keep accounting records — because the law requires it.
• To investigate claims and chargebacks, prevent fraud, secure our systems and recover debts — for our legitimate interests in running the business safely, balanced against your interests.
• To send service updates about a consignment or order you are party to — a booking confirmation, a delivery notification, a receipt. These are not marketing and you cannot opt out of them while a consignment is live.
• To send marketing, where you have asked for it. You can withdraw consent at any time, and every marketing email carries an unsubscribe link.

• Airlines, shipping lines, hauliers, handling agents and last-mile carriers, so the consignment can move.
• Customs brokers and the customs, border and security authorities at origin, transit and destination, where the law requires the declaration.
• Our payment partner, which processes card and cryptocurrency payments and sends us settlement notifications.
• Our hosting, database, email and error-monitoring providers, under contracts restricting them to our instructions.
• Insurers, loss adjusters and professional advisers where a claim or dispute requires it.
• A buyer or successor, if the business or part of it is sold or reorganised.

We do not sell personal data, we do not rent mailing lists, and we do not share consignment data for anyone else's marketing.

Freight crosses borders, so consignment and contact data is disclosed in the countries a shipment touches, which may be outside your own. Where we transfer data internationally we rely on an adequacy decision where one exists, and otherwise on standard contractual clauses with appropriate safeguards. Ask us and we will tell you which applies to a particular route.

• Consignment and tracking records: 6 years from delivery, which is the customs and carriage record-keeping period in most of the markets we serve.
• Payment, invoice and accounting records: 7 years from the end of the financial year, as tax law requires.
• Account and sign-in records: while the account is open, then 12 months.
• Technical data recorded against a payment: 13 months, which covers the chargeback window.
• Marketing consents: until you withdraw them, then a suppression record so we do not contact you again by mistake.

Cryptocurrency transactions are recorded on a public blockchain by design. We cannot delete, alter or recall an onchain record, and neither can anyone else.

Our pages set one cookie, and only after you sign in: a session cookie that keeps you signed in to your account. It is strictly necessary, so we do not ask for consent for it, and it carries no profile of you. Your shopping cart is kept in your own browser's storage and never leaves it until you check out.

We run no advertising cookies, no third-party analytics and no cross-site trackers on our payment or tracking pages. Our payment partner's own hosted card page is governed by its notice, not this one.

Subject to the exemptions the law provides, you can ask us to:

• Confirm what we hold about you, and give you a copy.
• Correct anything inaccurate or incomplete.
• Delete data we no longer need — though we must keep customs, carriage and accounting records for the periods above.
• Restrict or object to a use that relies on our legitimate interests.
• Give you, or another provider, a portable copy of data you supplied under a contract.
• Withdraw a consent you gave for marketing.

Write to [email protected]. We answer within one month and we will tell you if we need longer. Where we cannot do what you ask, we will say why. You can also complain to your local data protection authority, though we would rather you came to us first.

We do not make decisions about you by automated means alone, and we do not profile you for marketing. Payments are screened for fraud indicators, and a flagged payment is reviewed by a person before any action is taken on it.

Traffic to our site is encrypted in transit. Passwords are hashed, access to consignment and payment records is limited to staff who need it, and payment notifications from our partner are verified cryptographically before we act on them. No system is perfect; if a breach affects your rights we will notify you and the relevant authority as the law requires.

We update this notice when what we do changes. The effective date above tells you which version is current, and we will tell account holders directly before a material change takes effect. Our terms of carriage sit alongside this notice.