Wyvern Freight (Pty) Ltd · Effective date: 24 July 2026 · Last reviewed: 24 July 2026
1. About this Privacy Notice
Wyvern Freight (Pty) Ltd respects your privacy and is committed to processing personal information lawfully, fairly, transparently and securely.
This Privacy Notice explains how Wyvern Freight (Pty) Ltd collects, uses, stores, shares, transfers, protects and disposes of personal information.
It applies when you:
- visit www.wyvernfreight.com;
- request a quotation;
- book a freight or courier service;
- send, receive, collect, return or track a parcel or shipment;
- apply for or use a business account;
- use a customer, vendor, booking, tracking or support portal;
- pay for a service or receive a refund;
- use cash on delivery where that service is offered;
- use our warehousing, customs or cross-border logistics services;
- contact customer support;
- submit a complaint or cargo claim;
- apply for employment;
- visit an operational facility;
- work for or represent a customer, supplier, carrier or business partner; or
- otherwise interact with Wyvern Freight (Pty) Ltd.
This Privacy Notice is governed primarily by Zimbabwe’s Cyber and Data Protection Act, Act 5 of 2021, the Cyber and Data Protection Regulations, including SI 155 of 2024, and other applicable Zimbabwean laws.
POTRAZ is Zimbabwe’s Data Protection Authority.
2. Who is responsible for your information?
Wyvern Freight (Pty) Ltd is the data controller responsible for the personal information described in this Privacy Notice.
Wyvern Freight (Pty) Ltd provides freight, courier, warehousing, customs and logistics services from Zimbabwe to customers and recipients across Southern Africa.
The Data Protection Officer monitors compliance, handles privacy requests, advises the company on its obligations and acts as the contact point between Wyvern Freight (Pty) Ltd, data subjects and POTRAZ.
3. Important definitions
In this Privacy Notice:
- Personal information means information relating to an identified or identifiable person.
- Processing includes collecting, receiving, recording, storing, organising, updating, using, sharing, transmitting, restricting, deleting or destroying personal information.
- Data subject means the person to whom personal information relates.
- Data controller means the person or organisation that determines why and how personal information is processed.
- Data processor means a person or organisation that processes information for the data controller under its instructions.
- Sensitive information includes information relating to racial or ethnic origin, political or religious beliefs, trade union or professional association membership, sex life, criminal, educational, financial or employment history, health, genetics, biometrics, and information that may present a major risk to the individual’s rights.
- Child means a person under 18 years of age.
- Courier includes local, same-day, scheduled, express and last-mile collection or delivery services.
- Shipment includes parcels, documents, freight, cargo, returns and other consignments handled by Wyvern Freight (Pty) Ltd.
- POTRAZ means the Postal and Telecommunications Regulatory Authority of Zimbabwe, acting as Zimbabwe’s Data Protection Authority.
4. Whose information we process
We may process information about:
- prospective and existing customers;
- senders, shippers, recipients and consignees;
- people collecting or accepting parcels;
- alternative recipients and authorised collection representatives;
- business account applicants;
- authorised account and portal users;
- directors, beneficial owners and authorised representatives where verification is necessary;
- billing, finance and operations contacts;
- merchants, retailers and online shops;
- suppliers, vendors, carriers, subcontractors, hauliers and drivers;
- customs agents, clearing agents, brokers and freight partners;
- visitors to our website, portals and operational facilities;
- job applicants and referees;
- people making enquiries, complaints or claims;
- witnesses and people involved in cargo, payment, safety, security or fraud incidents; and
- other people whose information is lawfully provided to us in connection with a shipment or service.
5. Personal information we collect
The information collected depends on the service and your relationship with Wyvern Freight (Pty) Ltd.
5.1 Identity and contact information
This may include:
- name and surname;
- business or organisation name;
- job title, department and authority;
- email address;
- telephone or mobile number;
- residential, business, collection and delivery addresses;
- national identity, passport or driver’s licence information where verification is necessary;
- date of birth or age confirmation where legally required;
- signature; and
- evidence that a person is authorised to act for a business or another person.
5.2 Business account information
This may include:
- company incorporation information;
- registered and trading details;
- tax, VAT and customs numbers;
- directors, beneficial owners and authorised representatives where verification is required;
- business activities and industry;
- cargo types, routes, volumes and service requirements;
- authorised users and permissions;
- account application and approval records;
- contracts, quotations, bookings and service records;
- insurance, licence, permit and compliance information;
- API, portal or e-commerce integration details; and
- support tickets and account correspondence.
5.3 Freight, parcel and courier information
This may include:
- sender, recipient and consignee details;
- collection and delivery addresses;
- booking, order, tracking, consignment and reference numbers;
- merchant or online order reference;
- description, quantity, weight, dimensions and declared value of goods;
- packaging and handling requirements;
- requested service level;
- scheduled collection or delivery time;
- delivery instructions and access information;
- route, border and transport information;
- vehicle, courier and driver details;
- shipment location and status;
- barcode, QR code and scan events;
- depot, warehouse, pickup point and delivery milestones;
- delivery attempts and exception reasons;
- proof of collection and delivery;
- recipient or authorised representative signature;
- delivery photographs where necessary;
- cargo photographs where operationally necessary;
- identity or age confirmation where required;
- alternative recipient or collection representative information;
- return, redelivery or failed-delivery information;
- customs declarations, permits and supporting documents;
- restricted or prohibited goods screening;
- loss, delay, damage and claim information; and
- communications concerning a shipment.
Do not include unnecessary personal, confidential, illegal or sensitive information in a cargo description.
5.4 Location and route information
Where necessary for collection, transport, tracking, security or proof of delivery, we may process:
- collection and delivery coordinates;
- route and journey information;
- courier or vehicle location;
- barcode or parcel scan location;
- arrival and departure times;
- estimated delivery time;
- delivery attempt location; and
- location connected with proof of delivery or a security incident.
Location information is used only for logistics, safety, security, billing, fraud prevention, service improvement and related operational purposes.
We do not use parcel or recipient location information for unrelated marketing.
5.5 Financial and payment information
This may include:
- payer and account-holder name;
- billing contact information;
- billing and invoice address;
- bank confirmation documents where required;
- invoice, receipt and statement information;
- payment method;
- payment amount and currency;
- transaction, bank, mobile money or gateway reference;
- payment date and time;
- payment status;
- partial or masked account or card information;
- mobile number linked to a payment, where provided by the payment service;
- refund and reversal information;
- chargeback and dispute information;
- account balances;
- credit limits and payment terms;
- turnover or spending bands;
- trade references;
- cash collection and reconciliation records;
- cash on delivery information;
- debt recovery records; and
- tax and accounting information.
Wyvern Freight (Pty) Ltd will not request your mobile money PIN, banking password, card PIN, full card security code or one-time password by email, telephone, social media or an ordinary support form.
5.6 Website, portal and technical information
This may include:
- IP address;
- browser, operating system and device information;
- cookie and session identifiers;
- pages visited and actions taken;
- referral source;
- account and portal identifiers;
- login attempts and authentication events;
- timestamps and audit logs;
- account, booking and profile changes;
- security, fraud and access events;
- API or system integration activity;
- error and diagnostic information; and
- communications submitted through forms or portals.
5.7 Recruitment information
This may include:
- CV and application information;
- qualifications and employment history;
- professional memberships;
- references;
- interview and assessment records;
- work eligibility information;
- identity information;
- relevant background checks where lawful; and
- communications concerning an application.
Wyvern Freight (Pty) Ltd does not charge applicants for applications, interviews, assessments, appointments, uniforms or training.
5.8 Facility, CCTV and security information
This may include:
- visitor names and contact details;
- identity and authority verification;
- company and vehicle information;
- arrival and departure times;
- collection and delivery references;
- CCTV footage;
- access control records; and
- safety, security and incident reports.
6. Where we obtain personal information
We may obtain personal information:
- directly from you;
- from your employer or organisation;
- from a sender, customer, merchant, online shop, recipient or consignee;
- from an account administrator or authorised user;
- from carriers, drivers, customs agents, warehouses and freight partners;
- from e-commerce, booking or merchant integrations;
- from banks, mobile money providers and payment gateways;
- from credit reference and verification providers where lawful;
- from insurers and claims administrators;
- from government, customs, tax, border and regulatory authorities;
- from referees during recruitment;
- from publicly available company registers and legitimate business sources; and
- automatically through our website, portals, tracking systems, cookies, security logs and operational systems.
Where information is received from another person, we will provide the affected data subject with the required information when recording it or before communicating it to another party, unless the person has already received the information or a lawful exception applies.
Customers, senders, merchants and account applicants who provide information about recipients, employees, trade references or other people must ensure they are authorised to provide it and should direct those people to this Privacy Notice.
7. Why we process personal information
We process personal information to:
- provide freight, courier, road transport, warehousing, customs and logistics services;
- calculate prices and prepare quotations;
- accept and manage bookings;
- create shipping labels and tracking references;
- collect, scan, route, transport, track and deliver shipments;
- provide estimated collection and delivery times;
- confirm delivery status;
- manage alternative recipients and collection representatives;
- obtain proof of collection or delivery;
- arrange returns, redelivery and failed-delivery services;
- send shipment and delivery updates;
- process cash on delivery where offered;
- reconcile payments collected by couriers or agents;
- create, assess, approve and administer accounts;
- verify businesses, representatives, couriers, drivers and authorised users;
- manage portal access, APIs and account permissions;
- process invoices, payments, refunds and statements;
- conduct lawful credit assessments;
- comply with customs, border, transport, tax and accounting requirements;
- screen restricted or prohibited goods;
- manage claims, losses, delays, damages and disputes;
- manage suppliers, carriers and subcontractors;
- protect cargo, people, vehicles, facilities, systems and accounts;
- prevent fraud, cargo theft, payment fraud, impersonation and cybercrime;
- maintain operational, security and audit records;
- recruit through official channels;
- send necessary service communications;
- send marketing where permitted;
- investigate complaints and incidents;
- cooperate with regulators and law enforcement;
- establish, exercise or defend legal claims; and
- comply with obligations imposed by law.
We will not process personal information for an incompatible purpose without providing further notice and obtaining consent where required.
8. Legal grounds for processing
8.1 Consent
We generally process non-sensitive personal information with express consent or, where Zimbabwean law permits, implied consent given by an adult or legally capable person.
Consent must be specific, informed, freely given and unequivocal.
Where we rely on consent, it may be withdrawn at any time and free of charge by contacting compliance@wyvernfreight.com.
Withdrawal does not affect processing already lawfully completed. After consent is withdrawn, we will stop the relevant processing unless another independent legal ground permits or requires it.
8.2 Processing without consent
Where permitted by Zimbabwean law, we may process non-sensitive information without consent when necessary to:
- use it as evidence in proving an offence;
- comply with an obligation imposed by law;
- protect a person’s vital interests;
- perform a task in the public interest or under lawful authority; or
- pursue our or a third party’s legitimate interests, unless those interests are overridden by the data subject’s fundamental rights and freedoms.
Legitimate interests may include:
- administering customer and supplier relationships;
- providing requested freight and courier services;
- managing collections, delivery and tracking;
- protecting cargo, facilities, accounts and systems;
- preventing payment and shipment fraud;
- maintaining operational and security records;
- improving logistics operations;
- recovering legitimate debts; and
- establishing, exercising or defending legal claims.
We assess and document legitimate interests before relying on them.
9. Required and optional information
Our forms and portals will identify required information where reasonably possible.
If required information is not provided, we may be unable to:
- process an application;
- provide a quotation;
- accept, collect or deliver a shipment;
- complete customs clearance;
- verify a recipient or collection representative;
- provide detailed tracking information;
- process payment or cash on delivery;
- meet a legal obligation; or
- open or administer an account.
Optional information may generally be omitted without preventing the requested service.
10. Business accounts, portals and integrations
When you apply for a business account, we may process information to:
- save and retrieve the application;
- verify an email address and authority;
- assess the business and requested services;
- verify company, tax and supporting documents;
- conduct a credit review where requested;
- contact authorised trade references;
- prevent duplicate or fraudulent applications;
- approve or decline the application;
- create authorised users and permissions;
- connect approved booking, API or e-commerce integrations; and
- administer the account after approval.
Submitting an application does not guarantee approval or create a service contract.
Where consent is required, Wyvern Freight (Pty) Ltd will request an affirmative action. Optional marketing consent will be separate.
Account administrators are responsible for:
- adding only authorised users;
- maintaining accurate user information;
- assigning appropriate permissions;
- removing access when a user leaves or changes role; and
- ensuring that users understand this Privacy Notice.
Users must keep login credentials confidential and report suspected unauthorised access to compliance@wyvernfreight.com.
11. Courier collection, delivery and proof of delivery
When providing courier and last-mile services, we may:
- contact the sender or recipient;
- provide collection and delivery updates;
- verify the person presenting or collecting a parcel;
- scan a parcel at operational milestones;
- record collection and delivery times;
- record a courier, vehicle or delivery route;
- capture a signature;
- photograph the parcel or delivery location where necessary;
- record the name of an alternative recipient;
- confirm age where the shipment legally requires it;
- record a failed-delivery reason;
- arrange redelivery or return; and
- share delivery status with the sender, merchant or authorised account user.
Tracking pages should display only the information necessary to provide shipment status. Detailed recipient, address or delivery information may require additional verification.
Delivery photographs should focus on the parcel and delivery evidence. They should avoid capturing people, home interiors, unrelated documents or neighbouring property unless necessary for a claim, security incident or delivery dispute.
We do not use information concerning the contents of a parcel for unrelated purposes. A parcel may be inspected or disclosed where required for customs, safety, security, restricted-goods screening, legal compliance or our service terms.
12. Shipment recipients and indirect collection
A sender, merchant or customer may provide a recipient’s information without the recipient contacting us directly.
We process this information to:
- arrange and complete delivery;
- provide shipment updates;
- verify delivery or collection;
- obtain proof of delivery;
- manage failed deliveries and returns;
- process cash on delivery where offered;
- investigate a claim or complaint; and
- comply with customs and legal requirements.
Recipient information will not be used for unrelated marketing without the required consent.
13. Zimbabwe payment methods
Depending on the service, customer type and payment channel, Wyvern Freight (Pty) Ltd may accept one or more of the following:
- cash through an authorised office, collection point or courier;
- cash on delivery where offered;
- bank transfer or electronic funds transfer;
- RTGS or another approved bank payment channel;
- ZIPIT or another supported instant bank transfer;
- debit or credit card through an approved point-of-sale device or payment gateway;
- mobile money;
- an approved digital wallet;
- an online payment link or payment gateway;
- prepaid account credit;
- invoiced business account payments; or
- approved credit terms.
The available methods and currencies will be shown on the quotation, invoice, payment page or other official payment instruction.
Do not make payment to an account or mobile number supplied through an unverified message. Confirm payment instructions through an official Wyvern Freight channel.
13.1 Electronic and mobile payments
Banks, card networks, mobile money providers and payment gateways may process payment credentials under their own privacy notices and security requirements.
Wyvern Freight may receive:
- payer name;
- mobile or account identifier;
- payment amount and currency;
- transaction reference;
- approval or decline status;
- payment date and time;
- masked payment details; and
- refund or reversal status.
Wyvern Freight should not receive or store your payment PIN, mobile money PIN, banking password, one-time password or full card security code.
13.2 Cash payments
For cash payments, we may record:
- payer name;
- invoice or shipment reference;
- amount and currency;
- date and time;
- authorised employee, courier or agent;
- receipt number;
- collection location; and
- reconciliation and deposit information.
13.3 Cash on delivery
Where cash on delivery is offered, we may process:
- merchant or sender details;
- recipient contact and delivery information;
- amount and currency due;
- permitted payment method;
- payment status;
- receipt or transaction reference;
- courier or agent information;
- delivery and payment timestamp;
- failed-payment or refusal reason;
- refund, return or dispute information; and
- reconciliation and remittance records.
Payment and delivery confirmation may be disclosed to the sender, merchant or authorised account user.
13.4 Refunds and disputes
We may process information to:
- verify the original payment;
- assess refund eligibility;
- issue a refund;
- investigate duplicate or disputed payments;
- handle chargebacks;
- reconcile cash or electronic payments; and
- prevent fraud.
14. Sensitive information
We process sensitive information only where:
- the data subject has provided written consent; or
- a specific exception under Zimbabwean law permits processing.
Written consent may be withdrawn at any time, without explanation and free of charge.
Sensitive information may arise in:
- credit and financial assessments;
- recruitment and employment verification;
- courier, driver and vendor verification;
- insurance and legal claims;
- accidents, emergencies and health and safety records;
- fraud and criminal investigations; and
- customs or regulatory documentation.
Genetic, biometric and health information will be processed only with written consent or under a statutory exception.
We will notify POTRAZ of biometric or genetic processing where required.
15. Children’s information
Wyvern Freight (Pty) Ltd does not offer customer or portal accounts to children.
Where processing a child’s information is necessary, for example because a child is a shipment recipient, we will:
- obtain consent from a parent or legal guardian;
- make reasonable efforts to verify the parent or guardian’s authority;
- collect only necessary information;
- apply data protection by design and default;
- assess and mitigate privacy risks; and
- not subject the child to automated decisions that affect the child’s rights.
16. Cookies and similar technologies
We may use:
- Strictly necessary cookies for security, authentication, navigation, forms and portal operation;
- Preference cookies to remember selected settings;
- Analytics cookies to understand and improve website usage; and
- Marketing cookies to measure or deliver advertising where permitted.
Non-essential cookies will be used only after the required consent has been obtained.
You can manage non-essential cookies through the website’s cookie preference control or your browser settings.
17. Service and marketing communications
We may send necessary communications concerning:
- quotations and bookings;
- parcel collection;
- shipment tracking;
- delivery attempts;
- customs requirements;
- account applications;
- invoices and payments;
- cash on delivery;
- refunds;
- support requests;
- safety and security;
- fraud warnings;
- legal or service changes; and
- portal administration.
These communications are operational and are not marketing.
Marketing will be sent only where permitted or where you have consented. You may unsubscribe at any time and free of charge.
18. Recruitment
Recruitment information should be submitted only through an official careers page, recruitment portal or authorised company email.
Recruitment enquiries may be sent to hr@wyvernfreight.com.
Wyvern Freight may use recruitment information to:
- assess applications;
- verify qualifications and employment history;
- contact referees;
- conduct lawful checks;
- arrange interviews or assessments;
- communicate decisions;
- maintain recruitment records; and
- prevent recruitment fraud.
19. CCTV and facility access
CCTV, visitor records and access controls may operate at offices, warehouses, depots, yards and other operational facilities.
They may be used to:
- protect people, parcels, cargo, vehicles and property;
- control access;
- prevent and investigate theft, fraud and safety incidents;
- reconcile collection and delivery events;
- support insurance and legal claims; and
- meet legal and security requirements.
Appropriate signs should be displayed where CCTV operates.
20. Who receives personal information
Where lawful and necessary, we may disclose personal information to:
- senders, merchants, customers, recipients and consignees;
- alternative recipients and authorised collection representatives;
- authorised account users;
- couriers, drivers, carriers and subcontracted transporters;
- warehouse, fulfilment and collection-point providers;
- customs agents, clearing agents and brokers;
- border, customs, tax, transport and regulatory authorities;
- banks, mobile money providers, payment gateways and card networks;
- insurers, loss adjusters and claims administrators;
- hosting, cloud, portal, CRM and software providers;
- cybersecurity, identity verification and fraud prevention providers;
- communications and customer support providers;
- auditors, accountants, lawyers and professional advisers;
- recruitment and background-check providers;
- courts, law enforcement and government authorities; and
- purchasers or advisers involved in a lawful business transaction.
We disclose only the information reasonably necessary for the relevant purpose.
21. Service providers and data processors
A provider processing information for Wyvern Freight must:
- act only under lawful instructions;
- use appropriate security measures;
- restrict access to authorised people;
- maintain confidentiality;
- assist with privacy requests and breach response;
- notify us promptly of security incidents;
- delete or return information when required; and
- comply with applicable law.
These obligations must be established through a written data-processing contract or other legal instrument.
22. Transfers outside Zimbabwe
Cross-border freight may require information to be transferred to South Africa, Zambia, Botswana, Mozambique, Malawi, Namibia, the Democratic Republic of Congo or another country connected with a shipment.
Before transferring information, we assess whether the recipient provides adequate protection.
Where adequate protection is not assured, we transfer information only where permitted by Zimbabwean law, including where:
- the data subject has given unambiguous consent;
- the transfer is necessary for a requested shipment or service;
- the transfer is necessary for a contract made in the data subject’s interest;
- the transfer is necessary for public interest purposes or legal claims;
- the transfer is necessary to protect vital interests; or
- another lawful exception applies.
We will notify POTRAZ of intended transfers outside Zimbabwe where required.
23. Security
We use appropriate physical, technical and organisational security measures.
Depending on the risk, these may include:
- role-based access;
- authentication and password controls;
- least-privilege access;
- encryption;
- secure portals and payment channels;
- network and endpoint security;
- security logging and monitoring;
- backups and recovery procedures;
- physical security and CCTV;
- staff confidentiality obligations;
- staff training;
- supplier checks;
- incident-response procedures;
- risk assessments; and
- testing and improvement of security controls.
No electronic system can be guaranteed to be completely secure. This does not reduce our responsibility to use appropriate safeguards.
24. Personal data breaches
Where a reportable personal data breach occurs, we will:
- notify POTRAZ within 24 hours of becoming aware of it;
- notify affected individuals within 72 hours where the breach is likely to present a high risk;
- contain and mitigate the breach;
- maintain a breach record;
- cooperate with POTRAZ; and
- complete the required investigation and reporting.
Report suspected breaches immediately to compliance@wyvernfreight.com.
25. Retention
We retain identifiable information only for as long as necessary or legally required.
Retention depends on:
- shipment and delivery requirements;
- account and customer relationships;
- payment and refund requirements;
- cash on delivery reconciliation;
- tax, accounting and customs obligations;
- claims, disputes and insurance;
- fraud and security risks;
- regulatory instructions; and
- legal claim periods.
Tax, payment, invoice and relevant business records are normally retained for at least six years under Zimbabwean record-keeping requirements.
CCTV, incomplete applications, delivery photographs and unsuccessful recruitment records are retained only for a limited period unless required for an incident, claim, investigation or legal obligation.
When information is no longer required, it will be securely deleted, destroyed, anonymised or de-identified where reasonably possible.
26. Your rights
Subject to applicable law, you have the right to:
- be informed about how information is used;
- request access;
- object to processing;
- request correction of false, misleading, inaccurate or outdated information;
- request deletion of false or misleading information;
- withdraw consent;
- object to direct marketing free of charge;
- ask how indirectly obtained information is used;
- complain to Wyvern Freight or POTRAZ; and
- not be subject to a solely automated decision producing legal or similarly significant effects, unless you consented or it is authorised by law.
27. Exercising your rights
Contact:
Include your name, relationship with Wyvern, the relevant information and any applicable shipment, account or tracking reference.
We may request reasonable identity or authority verification.
Do not send passwords, PINs, payment credentials or unnecessary identity documents by email.
28. Automated decisions
Wyvern Freight does not currently make decisions about individuals based solely on automated processing that produces legal or similarly significant effects.
Technology may assist with:
- route planning;
- delivery estimates;
- shipment prioritisation;
- security monitoring;
- fraud indicators;
- duplicate application detection; or
- preliminary credit and risk review.
A person will review any legally or similarly significant decision unless automated processing is consented to or authorised by law.
29. Fraud, phishing and impersonation
We may process information to detect and investigate:
- fraudulent shipments and claims;
- cargo theft;
- payment diversion;
- false cash on delivery records;
- recruitment scams;
- false account applications;
- phishing;
- unauthorised portal access; and
- other criminal or security activity.
Never make payment using instructions supplied through an unverified message.
Report suspicious activity through the Wyvern Integrity Line or compliance@wyvernfreight.com.
30. Complaints
Privacy complaints:
compliance@wyvernfreight.com
Service complaints:
complaints@wyvernfreight.com
Cargo claims:
claims@wyvernfreight.com
Payment enquiries:
accounts@wyvernfreight.com
You may also complain to POTRAZ at www.potraz.gov.zw.
31. Changes to this Privacy Notice
We may update this Privacy Notice when our services, payment methods, systems, legal obligations or business practices change.
The latest version will be published with its effective date.
32. Contact us
Wyvern Freight (Pty) Ltd