Privacy Policy

NexGen Cargo Pty Ltd (ABN: 75 686 648 108), located at 8/2 Ash Road, Prestons NSW 2170, Australia ("we", "us", "our"), is committed to protecting the privacy of your personal information.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website (nexgencargo.com.au), our freight forwarding services, or interact with us in any way. It applies to all customers, website visitors, and individuals whose information we handle in connection with our services.

We are bound by the 13 Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) and the Spam Act 2003 (Cth). This policy is intended to be read alongside our Terms & Conditions of Service, available at nexgencargo.com.au/terms-and-conditions.

We collect the following types of personal information, each of which is necessary for the purposes described in Section 3:

Personal details: Your full name, email address, phone number, and postal address (both sender and receiver addresses in Australia and Sri Lanka). We need this to process your shipment, contact you about your booking, and complete customs documentation.

Shipment information: Cargo descriptions, item dimensions, weight, declared value, customs clearance method, and delivery preferences. Required for shipping quotes, customs declarations, and freight calculations.

Payment information: Payment method selected, transaction amounts, and payment status. Card payments are processed securely by Stripe — we do not store credit card numbers, CVVs, or full card details on our servers at any time.

Account information: If you create an account, we store your login credentials (password is securely encrypted), booking history, saved receiver addresses, and communication preferences.

Technical information: IP address, browser type, device information, and session cookies collected automatically when you visit our website. Used for website functionality, security, and troubleshooting.

Government identifiers: Sri Lankan receiver National Identity Card (NIC) numbers and passport details (for UPB clearance) where required by customs authorities. These are collected solely for customs clearance purposes and are shared only with relevant government authorities. We do not use government identifiers for any other purpose, including identity verification for our own services.

Warehouse documentation: Our warehouse staff may photograph cargo during receiving and verification for quality assurance and dispute resolution purposes.

We use your personal information for the following purposes:

Processing and managing your shipments from Australia to Sri Lanka, including booking, collection, warehousing, weighing and measuring, shipping, customs clearance, and delivery.

Calculating shipping costs based on cargo dimensions, weight, freight type, collection method, and delivery destination.

Preparing customs clearance documentation required by Australian and Sri Lankan authorities, including bills of lading, air waybills, and customs declarations.

Communicating with you about your bookings, including confirmation emails, status updates, collection reminders, invoices, payment receipts, and delivery notifications. These are transactional communications necessary for the service you have requested and do not require separate consent.

Scheduling cargo pickups and coordinating with our drivers and collection point operators.

Verifying cargo contents and condition at our warehouse, including photographing items for quality assurance records.

Improving our services, website functionality, and customer experience.

Administering promotional offers, referral programs, and promo codes — only where you have voluntarily opted in or participated. You can opt out at any time (see Section 7).

Complying with legal and regulatory obligations, including tax reporting, customs regulations, and responding to lawful requests from government authorities.

Where practical, you have the option to interact with us without identifying yourself — for example, when browsing our website or using our Quick Quote tool to get a shipping estimate.

However, due to the nature of freight forwarding, we cannot provide our core shipping services anonymously. Australian and Sri Lankan customs regulations require accurate sender and receiver identification for all shipments. We are legally obligated to collect and verify this information before processing any booking.

We may share your personal information with the following parties, as necessary for the services you have requested or as required by law:

Australian government authorities: Including the Australian Border Force (ABF) and the Department of Agriculture, Fisheries and Forestry (DAFF) for customs and biosecurity clearance of exported goods, as required under the Customs Act 1901 (Cth).

Sri Lankan government authorities: Sri Lanka Customs and other relevant bodies, as required by Sri Lankan law for the import clearance of your cargo. This includes sender and receiver details, cargo descriptions, NIC numbers, and declared values.

Our Sri Lankan operations partner (Nexuscorp International Pvt Ltd): For customs clearance processing, bond warehousing, and delivery of your cargo within Sri Lanka.

Shipping lines and airlines: Names and cargo details as required for bills of lading and air waybills for the physical transport of your goods.

We also use the following third-party service providers who may process your data on our behalf:

Stripe Inc. (payments): Processes card payments. PCI DSS Level 1 compliant. Privacy policy: stripe.com/privacy

Resend (email): Delivers transactional emails on our behalf (confirmations, invoices, status updates). Privacy policy: resend.com/legal/privacy-policy

Supabase / AWS (database hosting): Stores our database in the Sydney, Australia region. Privacy policy: supabase.com/privacy

Vercel Inc. (web hosting): Hosts our website from the Sydney region. Privacy policy: vercel.com/legal/privacy-policy

Google Maps Platform (address autocomplete): Used on our booking form for address suggestions. Privacy policy: policies.google.com/privacy

We do not sell, rent, or trade your personal information to any third party for marketing or advertising purposes.

If we receive personal information that we did not request and that is not reasonably necessary for our services, we will destroy or de-identify that information as soon as practicable, unless we are required by law to retain it.

For example, if a customer provides medical information or other sensitive details in a cargo description that is not relevant to shipping, we will remove it from our records.

We comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).

Transactional emails: Booking confirmations, shipment status updates, invoices, payment receipts, collection reminders, and delivery notifications are sent as part of the freight service you requested. These are not marketing communications and do not require separate consent.

Marketing communications: We will only send you promotional emails (such as special offers, new service announcements, or referral program invitations) if you have opted in or if you are an existing customer and the message relates to similar services. Every marketing email includes an unsubscribe link.

You can opt out of marketing communications at any time by: clicking the unsubscribe link in any marketing email, emailing us at info@nexgencargo.com.au, or calling 0416 247 725.

Opting out of marketing will not affect transactional communications about your active shipments.

Your data is stored on secure cloud servers located in Sydney, Australia, hosted by Supabase (built on Amazon Web Services infrastructure in the ap-southeast-2 region).

All data transmitted between your browser and our servers is encrypted using HTTPS/TLS encryption.

Access to personal information is restricted to authorised NexGen Cargo staff members who require it to perform their duties, enforced through role-based access controls with 13 distinct permission levels.

Payment card data is handled entirely by Stripe and is never stored, processed, or transmitted through our servers. Stripe is PCI DSS Level 1 compliant, the highest level of payment security certification.

Passwords are stored using bcrypt one-way hashing — we cannot see or retrieve your password.

User sessions are managed with secure, time-limited JWT tokens that expire after 4 hours of inactivity.

While we take reasonable steps to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

When personal information is no longer needed for the purposes for which it was collected and we are not required by law to retain it, we will take reasonable steps to destroy or permanently de-identify the information.

We take reasonable steps to ensure that the personal information we collect, use, and disclose is accurate, up-to-date, complete, and relevant.

You can help us keep your information accurate by updating your account details, notifying us of any changes to your contact information, and reviewing the details in your booking confirmations.

If you believe any information we hold about you is inaccurate, incomplete, or out of date, please contact us and we will correct it promptly.

Under the Privacy Act 1988 (Cth), you have the following rights:

Access (APP 12): You may request access to the personal information we hold about you. We will respond to your request within 30 days. There is no charge for making a request, but we may charge a reasonable fee for providing access if your request requires significant effort to fulfil.

Correction (APP 13): You may request that we correct any inaccurate, incomplete, or out-of-date personal information. We will respond within 30 days. If we refuse to correct the information, we will provide you with written reasons and information about how to make a complaint.

Deletion: You may request deletion of your personal information, subject to our legal obligations to retain certain records for 7 years (see Section 12).

Opt-out: You may opt out of receiving marketing communications at any time (see Section 7).

To exercise any of these rights, please contact us at info@nexgencargo.com.au or call 0416 247 725.

Under the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act 1988, we are required to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to result in serious harm.

If we become aware of a data breach involving your personal information, we will: assess the breach to determine if it is likely to result in serious harm; notify the OAIC and affected individuals as soon as practicable if the breach meets the notification threshold; provide you with details about what information was involved, what we are doing to address the breach, and what steps you can take to protect yourself.

We maintain internal procedures for detecting, assessing, and responding to data breaches in accordance with the OAIC's guidance.

Booking and shipment records: Retained for a minimum of 7 years from the date of the shipment, as required for Australian tax compliance (Income Tax Assessment Act 1997) and customs record-keeping obligations (Customs Act 1901).

Account data: Retained for as long as your account remains active. You may request account deletion at any time, subject to our obligation to retain shipment records.

Payment records: Retained for 7 years for tax and audit purposes.

Government identifiers (NIC, passport): Retained only for the duration required for customs clearance, then securely deleted or de-identified within 12 months of shipment completion.

Warehouse photographs: Retained for 12 months after shipment delivery for dispute resolution, then deleted.

Marketing preferences: You may update your communication preferences at any time by contacting us.

Website logs and technical data: Retained for up to 12 months for security and troubleshooting purposes, then automatically purged.

Our website uses the following cookies and similar technologies:

Session cookies: Essential for maintaining your login session and preserving booking form state as you navigate between steps. These expire when you close your browser or after 4 hours.

Authentication cookies: Used to keep you signed in to your account (if you choose "Keep me signed in").

We do not use third-party advertising or tracking cookies. We do not run Google Analytics, Facebook Pixel, or similar tracking or retargeting services.

Google Maps API: Our booking form may use the Google Maps Places API for address autocomplete. When this feature is active, Google may collect usage data subject to Google's privacy policy at policies.google.com/privacy.

As a freight forwarder shipping cargo from Australia to Sri Lanka, we necessarily transfer personal information to Sri Lanka for customs clearance and delivery purposes.

The countries to which we transfer personal information are: Sri Lanka (customs clearance, warehousing, delivery via Nexuscorp International Pvt Ltd) and the United States (where some of our service providers — Stripe, Vercel, Resend — are headquartered, though data is processed in Australian data centres where available).

Information shared with Sri Lankan customs authorities is required by Sri Lankan law and is subject to Sri Lankan data protection regulations, including the Personal Data Protection Act No. 9 of 2022.

Our Sri Lankan operations partner, Nexuscorp International Pvt Ltd, handles your information in accordance with our data handling agreements and takes reasonable steps to protect your personal information in a manner consistent with the Australian Privacy Principles.

We acknowledge that Sri Lanka and the United States may not have data protection laws equivalent to Australia's. We take all reasonable steps to ensure that overseas recipients handle your personal information in accordance with the APPs, including through contractual obligations.

Prohibited items: By using our services, you declare that your cargo does not contain prohibited, restricted, or dangerous goods as defined by Australian export regulations, international shipping conventions, and Sri Lankan import regulations. We reserve the right to inspect cargo and report suspected prohibited items to relevant authorities.

Customs valuation: The declared value of your cargo will be shared with Australian and Sri Lankan customs authorities for duty assessment. Inaccurate declarations may result in penalties imposed by customs authorities — you are responsible for the accuracy of your declarations.

Insurance: NexGen Cargo does not provide cargo insurance. Goods are shipped at the customer's risk unless separate insurance arrangements have been made. We recommend customers arrange their own transit insurance.

Warehouse documentation: Our staff may weigh, measure, and photograph your cargo at our Prestons warehouse during the receiving and verification process. This documentation is used for invoicing accuracy, manifest preparation, and dispute resolution.

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children.

If we become aware that we have collected personal information from a child under 18 without parental consent, we will take steps to delete that information promptly. If you believe we hold information about a minor, please contact us immediately.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

Any updates will be posted on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

If we make material changes that significantly affect how we handle your personal information, we will notify you by email or through a prominent notice on our website before the changes take effect.

If you believe we have breached the Australian Privacy Principles or handled your personal information inappropriately, you may lodge a complaint with us:

Email: info@nexgencargo.com.au Phone: 0416 247 725 Post: Privacy Officer, NexGen Cargo Pty Ltd, 8/2 Ash Road, Prestons NSW 2170

We will acknowledge your complaint within 7 business days and provide a response within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

OAIC Website: www.oaic.gov.au OAIC Phone: 1300 363 992 OAIC Post: GPO Box 5218, Sydney NSW 2001

If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact us:

NexGen Cargo Pty Ltd 8/2 Ash Road, Prestons NSW 2170, Australia

Phone: 0416 247 725

Email: info@nexgencargo.com.au

Website: nexgencargo.com.au