This document is a working commercial draft prepared for Stawi Labs Limited. Items shown as [to be confirmed] are pending owner confirmation and legal review.
Effective date: 2026-11-03
Who is responsible for your data
Stawi Labs Limited (trading as Stawi, “we”, “us”) is the data controller for personal data collected through https://stawi.org and our products. We are registered in [to be confirmed] with our registered office at [to be confirmed]. For privacy questions, contact [email protected].
Data we collect
We collect only what we need to run our services. Depending on how you interact with us, this may include:
- Account and contact information. Name, email address, phone number (optional), business name (optional), and login credentials (stored in hashed form).
- Enquiry form. Name, email, phone (optional), business name (optional), the enquiry category you select and your message. The form is handled by a serverless function that forwards your message to our business mailbox.
- Payment-related metadata. Transaction reference, amount, currency, date, payment status and the last four digits or card brand if our payment provider shares them. We never collect or store full card numbers, expiry dates or security codes. Card details are entered directly into the payment provider’s hosted checkout.
- Job Alert preferences. Saved searches, location, sector, seniority filters, chosen delivery channels (email, SMS or WhatsApp) and your subscription plan.
- Marketplace buyer information (once the Marketplace launches). Name, delivery address, contact details and order history, shared with the relevant Seller to fulfil your order.
- Marketplace seller information. Business name, registration details, contact person, product listings, bank or mobile-money details for settlement (handled through the payment partner once approved), and performance records such as dispute history.
- Partner programme information. Name, business details, referral codes and links, referral and commission records, payout details and tax information you provide.
- Website analytics. We may use privacy-conscious analytics that record aggregate page views, referrers, device type and approximate country. No personal data is sent to the analytics service and no cross-site tracking is performed.
- Cookies and similar technologies. See “Cookies and analytics” below.
- Support communications. Emails, messages and records of calls or chats you have with us, so we can resolve your issue and keep a record of what was agreed.
How and why we use it
| Purpose | Data used | Lawful basis (where applicable) |
|---|---|---|
| Respond to enquiries and quotations | Enquiry form data, support communications | Legitimate interests; steps prior to a contract |
| Provide and manage accounts and subscriptions | Account data, preferences, payment metadata | Performance of a contract |
| Deliver Job Alerts by your chosen channel | Preferences, contact details | Performance of a contract |
| Build, host and maintain your website | Account data, content you supply | Performance of a contract |
| Operate the Marketplace and pass orders to Sellers | Buyer and Seller information | Performance of a contract; legitimate interests |
| Track referrals and pay partner commissions | Partner programme information | Performance of a contract |
| Prevent fraud, spam and abuse | Technical data, spam-protection tokens, account activity | Legitimate interests; legal obligation |
| Keep accounting and tax records | Payment metadata, invoices | Legal obligation |
| Improve the website and services | Aggregate analytics | Legitimate interests |
| Send service notices (renewals, changes to terms) | Contact details | Performance of a contract; legal obligation |
| Send marketing about our products | Contact details | Consent, which you can withdraw at any time |
We do not sell personal data and do not use it for automated decision-making that has legal or similarly significant effects on you.
Cookies and analytics
- Essential cookies are used for login sessions, security and remembering your settings. They cannot be switched off without breaking the service.
- Spam protection. Our forms may use Cloudflare Turnstile, which sets a short-lived token to distinguish humans from bots. Turnstile is designed to work without tracking you across sites.
- Analytics. If enabled, we use privacy-conscious analytics that do not set tracking cookies and do not send personal data to the analytics provider.
- We do not use third-party advertising cookies on the website.
You can control cookies through your browser settings. Blocking essential cookies may stop parts of the website working.
Third-party processors
We share data only with service providers who process it on our instructions, and only as needed to deliver our services:
- Hosting and content delivery: Cloudflare, Inc. (website hosting, CDN, serverless functions and security).
- Email delivery: a transactional email provider (to be confirmed). Until a provider is confirmed, enquiry emails are forwarded directly to our business mailbox.
- Payment provider: [to be confirmed]. The provider processes payments on its own hosted pages and acts as an independent controller for the card data it collects. Its privacy policy applies to that data.
- Analytics: a privacy-conscious analytics service, if enabled (provider to be confirmed).
- Spam protection: Cloudflare Turnstile.
- Messaging channels: SMS and WhatsApp delivery providers for Job Alerts, where you choose those channels (providers to be confirmed).
- Marketplace Sellers: independent businesses who receive the buyer information needed to fulfil orders. Sellers are controllers of the data they receive and must handle it lawfully.
We may also disclose data where required by law, to protect our rights, or as part of a business sale or restructuring, in which case the recipient will be bound by this policy.
International transfers
Our hosting infrastructure is provided by Cloudflare and operates across a global network. This means your data may be stored or processed in countries other than your own. Where required, we rely on contractual safeguards with our providers to protect transferred data. If you need more detail about the safeguards used for a particular transfer, contact [email protected].
Retention
- Enquiry data: for as long as needed to handle the enquiry and for a reasonable period afterwards for legitimate business records.
- Account data: while your account is active, plus a reasonable period afterwards to handle queries, disputes and legal obligations.
- Transaction and payment records: for the period required by applicable tax and accounting law.
- Partner and Seller records: for the duration of the relationship plus the period required for tax, accounting and dispute purposes.
- Marketing preferences: until you withdraw consent or unsubscribe.
- Analytics: held in aggregate form only.
When data is no longer needed, we delete or anonymise it.
Security
We take reasonable technical and organisational steps to protect personal data, including encrypted connections (HTTPS), access controls, hashed passwords and the use of reputable infrastructure providers. Card payments are handled entirely by our payment provider’s hosted checkout, so card data never passes through our systems.
We do not claim PCI DSS certification or any other security certification. No system is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify you and any relevant authority where the law requires it.
Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you;
- Correct inaccurate or incomplete data;
- Delete your data, where we have no overriding reason to keep it;
- Object to or restrict processing based on legitimate interests, and object to marketing at any time;
- Portability — receive the data you gave us in a structured, machine-readable format;
- Withdraw consent where processing is based on consent;
- Complain to the data protection authority in your country if you are unhappy with how we handle your data.
To exercise a right, email [email protected]. We may need to verify your identity. We aim to respond within 30 days.
Children
Our services are intended for people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes
We may update this policy from time to time. The effective date at the top shows the current version. For significant changes we will notify you by email or through a notice on the website.
Contact for privacy requests
Stawi Labs Limited Email: [email protected] Registered office: [to be confirmed] Website: https://stawi.org