Privacy policy

This policy explains how 389 Group Ltd, trading as Steadi Pay, collects and uses personal information. It is written for the Electronic Transactions and Cyber Security Act, 2016 and the Data Protection Act, 2024 of Malawi. The data protection notice sets out your rights in more detail.

Steadi Pay is the data controller for merchant accounts, staff accounts, support tickets and website use. Licensed payment partners are controllers or processors for the payment itself. We do not hold your customer's money and we do not see card numbers, CVVs or PINs.

Who we are

389 Group Ltd, Lilongwe, Malawi. Contact support@steadipay.ltd or the data protection contact on the data protection page.

What we collect

• Account data: name, business name, email, phone, role, password hash, authenticator secret for staff.
• Know-your-customer data where you submit it: TPIN, director name, bank name, account name, account number (we store a masked form after setup).
• Payment metadata: amount in tambala, method, wallet, merchant reference, status, timestamps, masked MSISDN. Never a PAN, CVV or PIN.
• Technical data: API keys (hashed), webhook URLs, IP address on sign-in and admin actions, audit logs.
• Support data: ticket text, attachments you send, payment snapshots linked to a ticket.
• Website data: pages you open on steadipay.ltd. We do not sell this.

Why we use it

We use personal information only where the law allows, usually to:

• perform the contract: run checkout, confirm payments, show the portal, send webhooks;
• meet a legal duty: tax, five-year record keeping, anti-money-laundering checks our partners require;
• protect the service: fraud, abuse, security logs;
• with consent, where we ask for it (for example optional marketing, which we do not run today).

Who we share it with

Licensed partners who collect the payment (for example Airtel Money Malawi, Standard Bank N-Genius, OneKhusa), only what they need to take or confirm the payment. 389 Group apps that you connect with an API key. Our hosting and email providers, under contract. The Reserve Bank of Malawi, the Malawi Revenue Authority, the Malawi Police Service or the courts, if the law requires it.

We do not sell personal information. We do not share it for advertising.

Where it is stored

We aim to keep production data in Malawi or in a location that meets the Data Protection Act, 2024 rules on cross-border transfer. If a processor is outside Malawi, we only use them where the Act allows: adequate protection, a lawful transfer tool, or another permitted ground.

How long we keep it

Payment, ledger, ticket and audit records: five years from the relevant event. Closed merchant accounts: the same five-year hold, then deletion or irreversible anonymisation except where a longer legal hold applies. Session cookies last for the login session. Support mail is kept as long as the related ticket.

Cookies

Sign-in uses a session cookie that is necessary for the portal to work. We do not use third-party advertising cookies on the marketing site.

Your choices

You can correct account details in Settings, close the account, and open a ticket. Access, correction, erasure and objection are described in the data protection notice. Email support@steadipay.ltd.