Privacy Policy

1. Who we are

Sahel Supply & Logistics (SSL) is a logistics and freight-forwarding company registered in Mali, with its head office at Missira, Rue 20, Bamako, Mali. SSL is the data controller for the personal data described in this policy — it decides why and how that data is processed.

For any question about this policy or to exercise your rights: [email protected].

2. Data you give us

This website has three forms. Each collects only what it needs:

• Quick quote (homepage): first name, email, phone, departure and destination, transport mode, and an optional weight.
• Contact form: full name, email, phone, company name, subject and the content of your message.
• Detailed quote request: the above, plus shipment details (goods type, Incoterm, weight, dimensions, number of packages, declared value, desired shipping date) and any additional information you choose to add.

We do not ask for and do not want sensitive data (health, religion, political opinions, biometric or judicial data). Please do not include any in a free-text field or an attachment.

3. File attachments

The detailed quote form lets you attach up to 5 documents (PDF, JPEG, PNG, Word or Excel), typically a packing list, a proforma invoice or a photograph of the goods. Attachments are checked for type and size on our server, then uploaded to our Notion workspace and attached to the record for your request. They are visible to SSL staff handling your file and are kept for as long as that record is kept (see section 8).

Only send documents you are entitled to share. If an attachment contains someone else’s personal data, you are responsible for having a lawful basis to pass it on to us.

4. Data collected automatically

• IP address — processed when you submit a form, for two reasons: rate limiting (to stop a single source flooding our inbox) and anti-bot verification. It is used at the moment of the request and is not stored alongside your submission in our CRM.
• Approximate country — our hosting provider adds a country code to incoming requests. We use it only to pre-select the right dialling code in phone fields. No city, no coordinates, no storage on our side.
• Aggregate usage counts — we count how many times a page was viewed and how many times a form was completed, as daily totals. There is no cookie, no visitor ID and no fingerprinting, so these counts cannot be traced back to you. The site honours your browser’s "Do Not Track" setting.

5. Why we process it, and on what legal basis

• Responding to your quote or contact request, and managing the commercial relationship that may follow — your consent, given when you tick the box before submitting, and thereafter the performance of, or steps taken before entering into, a contract.
• Protecting the site against spam, abuse and duplicate submissions (IP-based rate limiting, anti-bot check, idempotency keys) — our legitimate interest in keeping the service available and our inbox usable.
• Understanding, in aggregate, which pages and forms are used — our legitimate interest in improving the site. This uses no personal data.
• Meeting accounting, customs and other legal obligations where a request becomes an actual shipment — compliance with a legal obligation.

We do not sell your data, we do not share it with advertisers, and we do not carry out automated decision-making or profiling.

6. Service providers we use

We do not share your data with third parties for their own purposes. We do rely on the following providers to operate this site; each processes data on our instructions, under its own published data-protection terms:

• Netlify (United States) — hosting, the serverless functions that receive your submissions, and the storage used for rate-limit counters, duplicate-submission keys and the aggregate usage counts.
• Notion Labs (United States) — our CRM. Your submission and any attachments are stored here.
• Resend (United States) — delivers the notification email to our sales team and the confirmation email to you. It processes your email address and the content of the message.
• Cloudflare Turnstile (United States / global network) — the anti-bot check on each form. It receives your IP address and a verification token. It is not an advertising cookie and does not track you across sites.
• OpenStreetMap / Nominatim (European Union) — used to look up city and country names in the location fields. The lookup is made by our server, so Nominatim receives the text you typed but never your IP address.

We may also disclose data where we are legally required to — for example to a customs authority, a court, or a regulator acting within its powers.

7. International transfers

All of the providers listed above are established outside Mali, so your data is transferred out of Mali and stored on servers in the United States and the European Union. We rely on the contractual data-protection commitments each provider publishes, which for transfers from the EU/EEA and the United Kingdom include the European Commission’s Standard Contractual Clauses.

If you would rather not have your details processed this way, contact us at [email protected] or on WhatsApp and we will take your request without the online form.

8. How long we keep it

• Quote and contact requests, including attachments: 3 years from our last contact with you, then deleted or anonymised.
• Records relating to an actual shipment: for the longer period required by applicable accounting, tax and customs rules.
• Rate-limit counters: 1 minute. Duplicate-submission keys: 10 minutes.
• Aggregate usage counts: kept indefinitely — they contain no personal data.
• Form drafts and the country code held in your browser: see section 10 — these never leave your device and we cannot read them.

9. Security

The site is served over HTTPS only. Form submissions are validated and size-limited on the server as well as in the browser, protected by an anti-bot check and by per-IP rate limiting, and de-duplicated so a retry cannot create a second record. Uploaded files are checked against an allow-list of types before being stored. Access to our CRM and mailbox is restricted to the SSL staff who need it.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the competent authority as required by applicable law.

10. Cookies and browser storage

This site sets no advertising cookies, no analytics cookies and no third-party tracking cookies — which is why you see no cookie banner. It does use two browser storage mechanisms, both of which stay on your device:

• localStorage — your language choice (French or English), so the site opens in the same language next time.
• sessionStorage — a draft of whatever you have typed into a form, plus the country code used to pre-select a dialling code. The draft is what lets you leave the quote wizard and come back without losing your work. It is cleared when you submit and when you close the tab.

You can clear both at any time from your browser’s settings. Clearing them only means the site forgets your language and any unsent draft.

11. Your rights

You have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to object to or restrict its processing, and to receive it in a portable format. Where our processing rests on your consent, you may withdraw that consent at any time — this does not affect processing already carried out.

To exercise any of these rights, write to [email protected]. We will respond within 30 days. We may ask for enough information to confirm who you are before acting on a request.

If you are not satisfied with our response, you may lodge a complaint with the Autorité de Protection des Données à caractère Personnel (APDP) in Mali. If you are in the European Union, the EEA or the United Kingdom, you may instead complain to your local supervisory authority.

12. Children

This site is a business-to-business service and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, write to [email protected] and we will delete it.

13. Applicable law

This policy is governed by Malian law, in particular Law No. 2013-015 of 21 May 2013 on the protection of personal data in the Republic of Mali. Where we offer services to clients established in the European Union or the United Kingdom, we also apply the corresponding standards of the General Data Protection Regulation (GDPR).

14. Changes to this policy

We may update this policy as the site and our services evolve. The date at the top of this page always shows the current version. If a change materially affects how we use data you have already given us, we will tell you by email at the address you provided before that change takes effect.

15. Contact

Sahel Supply & Logistics — Missira, Rue 20, Bamako, Mali. [email protected].

See also our Terms & Conditions and our General Terms of Sale.