PRIVACY
POLICY

This policy applies to all personal data processed by Golden Wave Cargo LLC, a company registered in Dubai, United Arab Emirates under Trade License No. 123456, with registered address at Cargo Village, Dubai International Airport, Dubai, UAE.

This policy covers data collected through our:

• Website: goldenwavecargo.com and all subdomains
• Customer Portal: Shipment tracking, booking, and account management systems
• Services: Air freight, ocean freight, ground transport, customs brokerage, and warehousing
• Communications: Email, phone, WhatsApp, and live chat interactions
• Marketing: Newsletters, event registrations, and GWC Insights subscriptions

We collect only the personal data necessary to provide our logistics services and improve your experience. The categories of data we collect are:

Personal Identification Data

• Identity: Full name, date of birth, passport or ID number (for customs purposes)
• Contact: Email address, phone number, WhatsApp number, mailing address
• Business: Company name, trade license number, VAT/Tax ID, job title

Shipment & Transaction Data

• Cargo Details: Description, weight, dimensions, commodity type, HS codes
• Route Information: Origin, destination, port of entry/exit, delivery address
• Financial: Invoice amounts, payment records, bank details for refunds (not stored in full)
• Documents: Commercial invoices, packing lists, certificates of origin, bills of lading

Technical & Usage Data

Data We Do NOT Collect

We process your personal data only on a lawful basis. The purposes and legal bases for our processing activities are:

We share your personal data only as necessary to deliver our services, meet legal obligations, or with your explicit consent. We never sell your data. Recipients of your data include:

• Airline & Carrier Partners: Emirates SkyCargo, Cathay Pacific Cargo, Lufthansa Cargo, Qatar Airways Cargo, and other partners — necessary for freight booking and manifests. See our Network page for the full list.
• Customs & Government Authorities: UAE Federal Customs Authority, destination country customs agencies, OFAC, and other regulatory bodies — legally required for all international shipments.
• Ground Transport Partners: Last-mile delivery and trucking partners to whom we transfer shipment and delivery address data.
• Technology Service Providers: Cloud infrastructure (AWS/Azure), CRM, shipment tracking, and IT support providers — all bound by data processing agreements (DPAs).
• Payment Processors: Our PCI-DSS compliant payment gateway processes card transactions. We do not store full card data.
• Professional Advisors: Legal counsel, auditors, and insurers — under strict confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale, data may transfer to the successor entity — you will be notified in advance.

All third-party data processors are contractually bound to process data only on our instructions, maintain appropriate security, and not use data for their own purposes.

Our website uses cookies and similar tracking technologies to ensure core functionality, analyse usage, and (with your consent) deliver personalised content. Manage your preferences below:

Cookie Details

We retain personal data only as long as necessary for the purposes it was collected, or as required by applicable law. Our standard retention periods are:

Once the retention period expires, data is securely deleted or anonymised. You may request early deletion subject to legal retention obligations — see Section 8.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. Our security measures include:

• Encryption in Transit: All data transmitted via our website and systems uses TLS 1.2+ (HTTPS). Our SSL certificate is maintained and renewed automatically.
• Encryption at Rest: Sensitive data stored in our systems is encrypted using AES-256 encryption.
• Access Controls: Role-based access control (RBAC) ensures staff access only the data they need. Multi-factor authentication (MFA) is required for all internal systems.
• Regular Audits: We conduct annual security audits, penetration testing, and vulnerability assessments on all systems holding personal data.
• Incident Response: We maintain a documented data breach response plan. In the event of a breach affecting your rights, we will notify you and the relevant authority within 72 hours as required by applicable law.
• Staff Training: All GWC employees undergo mandatory annual data protection and security awareness training.
• Third-Party Vetting: All data processors are assessed for security compliance before engagement and are required to maintain equivalent security standards.

Depending on your location, you have the following rights over your personal data. We will respond to all requests within 30 days (extendable to 90 days for complex requests).

As a global logistics provider, we operate across 150+ destinations on 6 continents. To deliver our services, your data may be transferred to and processed in countries outside the UAE or your country of residence.

Where we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Adequacy Decisions: Transfers to countries recognised by the UAE Data Office or European Commission as providing adequate protection are made without additional safeguards.
• Standard Contractual Clauses (SCCs): For transfers to countries without adequacy decisions, we use EU-approved SCCs or equivalent contractual mechanisms.
• Mandatory Customs Disclosures: Certain data transfers are mandatory under international customs law (e.g. Advance Cargo Information to US CBP, EU Import Control System). These are legal obligations, not discretionary.
• Binding Corporate Rules: Where applicable, internal transfers within GWC’s operational network follow documented and audited binding data protection standards.

Golden Wave Cargo’s services are designed for business and commercial use and are not directed at children under the age of 18. We do not knowingly collect personal data from minors.

If we become aware that we have inadvertently collected personal data from a child under 18, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@goldenwavecargo.com.

Our website and communications may contain links to third-party websites, tools, or services — such as airline partner portals, tracking platforms, regulatory authority websites, and industry publications featured in GWC Insights.

We are not responsible for the privacy practices or content of third-party sites. We encourage you to review the privacy policy of any external website you visit. Our inclusion of a link does not constitute endorsement of that site’s data practices.

Specifically, our website may integrate with:

• Google Services: Maps (for office location), Analytics (GA4), and reCAPTCHA — governed by Google’s Privacy Policy
• LinkedIn: Insight Tag for B2B advertising — governed by LinkedIn’s Privacy Policy
• WhatsApp Business: For customer support — governed by WhatsApp/Meta’s Privacy Policy

We review and update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or services. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page
• Post a prominent notice on our homepage for at least 30 days
• Send an email notification to registered customers (for significant changes)
• Where required by law, seek fresh consent before processing data under the new terms

Your continued use of our services after changes take effect constitutes acceptance of the updated policy. We recommend reviewing this page periodically. Previous versions are available on request by emailing info@goldenwavecargo.com.

Version History

For any questions, requests, or concerns relating to this Privacy Policy or your personal data, please contact our Data Protection Officer (DPO) or our main office:

This Privacy Policy was last reviewed by our legal team on 1 January 2025. This policy is governed by the laws of the United Arab Emirates. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the Dubai Courts.