Privacy policy

Tokscetera International Limited is a clearing and forwarding company based in Lagos, Nigeria. We run this public website, a customer portal, and a staff operations portal.

We are the data controller for the personal data described here, which means we decide why and how it is processed. We process it in line with the Nigeria Data Protection Act 2023 and the internationally recognised data protection principles of lawfulness, fairness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

We collect the minimum needed to move cargo and to keep the portal secure. We do not sell personal data, and we do not use it for advertising.

Account details

When an account is created for the portal we hold your name, email address, company name, phone number, account role, and a hashed password. Passwords are never stored in readable form.

Shipment and consignment data

To move cargo we hold the file or reference number, origin, destination, transport mode, cargo type, description, estimated arrival date, status, and the history of progress updates against the shipment.

Supporting documents

You or our staff may attach documents to a shipment, such as invoices, packing lists, bills of lading, or photographs. These are stored with the shipment file. Each upload is limited to 20 files, and 10 MB per file. File names are sanitised and file contents are identified from their actual content rather than from the extension you supplied.

Website enquiries

If you submit a quote request on this website we hold your name, email address, phone number, company, the service you are interested in, the route, cargo details, and any message you send. Enquiries are visible to our operations staff inside the staff portal.

Consignment tracking

When you use the consignment tracker, the reference you enter (Bill of Lading, carrier booking reference, or container number) is sent to the shipping line's own tracking service, MSC or Maersk, to retrieve your shipment events. The reference itself is not retained in our database by the tracker.

Technical data

Our servers keep standard operational logs such as IP address, timestamp, requested URL and browser user agent for security and troubleshooting. On your device we store your light or dark colour preference, and your cookie choice, in local storage. These are not sent to us.

We process personal data on the following legal bases:

• To perform our contract with you — moving your cargo, clearing your consignment, and giving you access to the portal.
• For our legitimate interests — securing the portal, preventing fraud, diagnosing faults, and improving the website, balanced against your interests and rights.
• To meet a legal obligation — customs, tax, and statutory record-keeping requirements.
• With your consent — limited to optional technologies such as analytics, which are off until you allow them.

A cookie is a small text file placed on your device by a website. This website sets one cookie, and it is strictly necessary. We do not use advertising, remarketing or cross-site tracking cookies.

The session cookie is set with the HttpOnly, SameSite=Lax and, on production, Secure attributes, so it cannot be read by scripts and is not sent on cross-site requests. Portal sessions also end automatically after 15 minutes of inactivity, and the session record is deleted when you sign out.

Fonts are served from this site rather than from an external provider, so simply opening a page sends no request to a third party.

Optional cookie categories are offered through the consent banner and are denied by default. Because no analytics or marketing technology is currently in use, accepting them has no effect today; the choice is stored so it applies automatically if that changes. You can revisit your choice at any time using cookie preferences.

We share personal data only where it is necessary to deliver the service:

• Ocean carriers and customs authorities — to the extent needed to clear, move and release your cargo, including commercial documents you have supplied.
• MSC and Maersk — only when you use the consignment tracker, and only with the reference you enter.
• Infrastructure providers — the hosting provider and database operator that process data on our instructions under confidentiality obligations.
• Professional advisers and authorities — where we are legally required to disclose.

Staff of Tokscetera International Limited can see shipment records and the documents attached to them in order to do their work. Customers see only the shipments belonging to their own account.

Tokscetera International Limited is established in Nigeria. Clearing cargo and moving it necessarily involves disclosing commercial information to overseas carriers, agents and customs authorities, and the data you enter in the consignment tracker is sent to the relevant carrier outside Nigeria. Where personal data is transferred outside Nigeria we rely on an appropriate lawful mechanism and restrict the transfer to what the movement of the cargo requires.

Account and session records are kept while the account is active. Sessions are deleted on sign-out and after a period of inactivity.

Shipment records and supporting documents are kept for as long as is needed to satisfy customs, tax and contractual record-keeping obligations, and to resolve any dispute about a consignment. They are then deleted or anonymised.

Server logs are kept for a short operational period and then rotated. Quote requests that do not become shipments are reviewed and deleted or anonymised when they are no longer needed.

We apply technical and organisational measures appropriate to the risk, including:

• Passwords hashed with scrypt using a per-password random salt and a memory-hard cost factor, and verified in constant time. Passwords are never stored or logged in readable form.
• A session cookie that is inaccessible to scripts, and portal sessions that expire after 15 minutes of inactivity.
• Role-based access, so a customer can only reach their own shipments and documents.
• Upload validation based on real file content, rejecting disguised or executable files, and stripping path traversal from file names.
• A service worker that caches only the offline shell and static build assets. Portal pages and API responses are never written to the device cache, so shipment data does not survive a sign-out on a shared or lost device.
• TLS for all traffic in production.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority without undue delay.

Subject to the Nigeria Data Protection Act 2023, you have the right to:

• be informed about the personal data we hold about you;
• request access to that data and a copy of it;
• have inaccurate data corrected;
• have data erased, restricted or anonymised in certain circumstances;
• object to, or ask us to stop, a use we have based on legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time where processing relies on consent, without affecting processing carried out beforehand; and
• complain to the Nigeria Data Protection Commission about how we have handled your data.

To exercise any of these rights, email us at [email protected]. We will respond within a reasonable period, and we may ask you to verify your identity first so we do not disclose your records to the wrong person.

Our services are business services and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy as our services or legal obligations change. The date at the top of this page shows when it was last revised. Where a change materially affects how we use your data we will tell you, and where the change depends on consent we will ask you again rather than assume your previous answer still applies.

Tokscetera International Limited is responsible for the personal data described in this policy.