Privacy Policy

1. Data Controller

WEGO EXPRESS, an international transport and logistics company headquartered in Médina, Dakar, Senegal, with an agency in Serekunda, Gambia, is the controller of your personal data.

Contact: expresswego@gmail.com or expresswego@gmail.com

2. Data Collected

2.1 Data you provide to us

• First and last name
• Email address
• Phone number
• Shipping and delivery addresses
• Package information (nature, weight, value)

2.2 Data collected via Google (OAuth 2.0 authentication)

• Google email address: used as your unique account identifier on the WEGO EXPRESS platform
• Full name (first and last name): displayed in your profile and used to personalize the interface
• Google profile photo: displayed in the dashboard to visually identify your account
• Google unique identifier (sub): used to securely associate your session with your account

We do not access your Gmail messages, contacts, calendar, Drive, or any other Google service. Access is strictly limited to basic identity information (scopes: openid, profile, email).

2.3 Technical data

• IP address and browsing data (server logs)
• Browser type and operating system
• Session data (authentication tokens, connection duration)

3. Use of Google Data

Data obtained from your Google account is used exclusively for the following purposes:

• Authentication and access control: your Google email address is used to verify your identity and grant you access to your customer or agency space on the WEGO EXPRESS platform
• Interface personalization: your name and profile photo are displayed in the dashboard to improve the user experience
• Role and permission management: your Google identifier is used to assign you roles (agency, manager, administrator) in our rights management system
• Session security: the Google identity token is used to maintain and securely renew your session

Your Google data is never used for marketing, commercial profiling, behavioral analysis, or training artificial intelligence models.

4. Data Sharing

WEGO EXPRESS does not sell, rent, or transfer your personal data to third parties for commercial purposes.

4.1 Sharing of Google data

Data from your Google account is not shared with any third party. It remains within our internal system and is not transmitted to our logistics partners, payment providers, or third parties for advertising purposes.

4.2 Technical service providers

We may share technical data (logs, session identifiers) with:

• Keycloak (Red Hat): our identity provider (IdP) that manages OAuth authentication, hosted on our own servers
• Server host: strictly limited to what is necessary for infrastructure operation

These providers are contractually required to process your data only for the defined purposes and to maintain an adequate level of security.

4.3 Legal obligations

Your data may be disclosed if required by law (competent authorities in Senegal or Gambia) or to defend our legal rights.

5. Data Storage and Protection

5.1 Data location

Your data is stored on secure servers. Google authentication tokens are kept in server-side sessions (PHP sessions) and are never stored in the browser (no localStorage or insecure cookies).

5.2 Security measures

• HTTPS encryption (TLS 1.2+) for all communications
• OAuth tokens stored only in server sessions, not exposed client-side
• Authentication delegated to Keycloak (zero-trust architecture for credentials)
• Role-based access control (RBAC) — one agency's data is not accessible by another
• Logging of access and sensitive actions (audit logs)
• Database encrypted at rest

5.3 Google session retention

Google access tokens expire according to OAuth parameters (typically 1 hour). The refresh token is invalidated upon logout. Sessions are automatically destroyed on closure or after expiration.

6. Data Retention and Deletion

6.1 Retention periods

• Account data: retained for the duration of the business relationship and 3 years after the last activity
• Google data (email, name, photo): retained only for the duration of the active account. Upon logout, tokens are immediately destroyed
• Delivery data: retained for 5 years to meet accounting and legal obligations
• Technical logs: retained for a maximum of 12 months

6.2 Deletion of your data

You may request the deletion of your personal data, including information from your Google account, at any time by contacting us at expresswego@gmail.com.

Following your request, we will proceed with deletion within 30 days, unless there is a legal obligation to retain it. You will receive an email confirmation upon completion.

Deleting your account results in the immediate revocation of all associated Google authentication tokens.

7. Your Rights

In accordance with applicable data protection regulations, you have the following rights:

• Right of access: obtain a copy of the personal data we hold about you
• Right of rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your data (see section 6.2)
• Right to portability: receive your data in a structured, machine-readable format
• Right to object: object to certain processing of your data
• Right to restriction: request restriction of processing in certain cases

To exercise these rights, send your request to expresswego@gmail.com with proof of your identity. We will process your request within 30 days.

8. Compliance with Google Policies

Our use of Google APIs complies with the Google API Services User Data Policy and the Google APIs Terms of Service.

In particular:

• We only request the minimum necessary scopes (openid, profile, email)
• We do not use Google data for purposes not disclosed to the user
• We do not sell or share Google data with third parties for advertising purposes
• We do not use Google data to train AI models

9. Cookies

We only use strictly necessary cookies for platform operation (PHP session). We do not use advertising or third-party tracking cookies.

10. Changes to this Policy

We may update this privacy policy. In case of substantial changes, we will notify you by email or through a visible notification on the platform. The current version is always accessible at https://wegoexpress.net/privacy-policy.