Privacy Policy
Last updated 26 October 2026
This Privacy Policy explains how MetaSTO Group Limited collects, uses, stores and protects personal data when you visit our website, contact our dispatch bay or use our courier dispatch services. MetaSTO is the developer and operator behind this website. The company is registered as MetaSTO Group Limited, with its office at 2203A 22/F Wu Chung House, 213 Queens Road East, Wanchai, Hong Kong (HK). We treat privacy as part of the same discipline we apply to a dispatch board: every record has a purpose, an owner and a clear end of life.
1. Who We Are
MetaSTO Group Limited is a computer systems design company that operates a dispatch bay for courier operations. Our team designs the boards, scheduling tools and audit trails that support same day runs, route planning, proof of delivery handling, fleet check ins, customs handovers and depot load reviews. This website is the public face of that bay, and the personal data we handle through the site is limited to what a real conversation with a dispatcher requires.
For the purposes of applicable data protection law, MetaSTO Group Limited is the data controller for the personal data described in this policy. The developer name used on this website is MetaSTO. Our office and the place where dispatch records are managed is 2203A 22/F Wu Chung House, 213 Queens Road East, Wanchai, Hong Kong (HK). When this policy refers to the Company, it means MetaSTO Group Limited.
We wrote this policy in plain English so that a reader can understand it without a legal dictionary. If any part is unclear, you can ask us directly using the contact details at the end of this document, and a member of the dispatch team will explain it.
2. Scope of This Policy
This policy applies to personal data that we collect through the MetaSTO Group Limited website at metasto.lol, through email and telephone contact with our bay, and through the delivery of our dispatch services to client organisations. It does not apply to websites that we do not control, even where we provide a link to them.
Our clients may operate their own privacy policies for the personal data they hold about their own customers. When we process data on behalf of a client as part of a dispatch engagement, we do so under that client direction and we refer the individuals involved to the client for the primary privacy notice. This policy still describes the safeguards we apply to every record that passes through the bay.
Where a client contract sets stricter rules than this policy, the stricter rules govern the specific engagement. This policy is the baseline and never a lower standard than the law requires.
3. Personal Data We Collect
We collect a small and deliberate set of personal data. The categories below describe what we may hold, and not every category applies to every person.
- Identity data, such as a name, a job title and the organisation a person represents.
- Contact data, such as an email address, a telephone number and a delivery or pickup address.
- Correspondence data, such as the content of a message sent through our contact form or an email exchange with the dispatch team.
- Dispatch data, such as run references, pickup and delivery windows, handling notes and the name of the person who signs for a parcel.
- Proof data, such as a signature image, a timestamp and a location note collected at the point of delivery.
- Technical data, such as the browser type, device type and general region that a device reports when it loads the website.
- Usage data, such as which pages were viewed and how a visitor moved through the site.
We do not collect sensitive categories of personal data, such as health details or biometric identifiers, through this website. If a dispatch engagement ever requires such data, we agree the handling rules with the client in writing before any record is created.
4. How We Collect Personal Data
Most of the data we hold arrives directly from you. You send it when you complete the contact form, write to dispatch@metasto.lol or call the bay. You also send it when you give a driver a delivery note that includes the name of a recipient or a signature.
Some data arrives automatically when a device loads our website. The web server records a request line that includes the page requested and a timestamp, and it may record a general region. This is ordinary server logging and is used to keep the site running and to investigate faults.
In a dispatch engagement, a client may provide us with a manifest that contains names and addresses of recipients. In that case the client is the source of the data, and we handle it under the client instruction. We confirm the permissible uses before the engagement begins.
5. Why We Use Personal Data
We use personal data for purposes that are tied directly to the dispatch bay and to the conversation that brought you to it. The main purposes are set out below.
- To reply to a message that you send through the contact form or by email.
- To plan a run, confirm a pickup window and give a driver the details needed to complete a delivery.
- To record a proof of delivery and to reconcile it with the run note.
- To carry out a route planning session, a fleet check in or a depot load review for a client.
- To stage documents for a customs handover and to keep a reference that ties the handover to the delivery.
- To maintain the security of the website and to prevent misuse.
- To meet accounting, tax and record keeping obligations that apply to MetaSTO Group Limited.
- To improve our services by understanding which pages and which routines are most useful.
We do not sell personal data. We do not rent contact lists. We do not use personal data for a purpose that is unrelated to the reason it was collected without first telling you and, where required, obtaining your consent.
6. Legal Bases for Processing
Where data protection law requires a legal basis, we rely on one or more of the following. We rely on contract where processing is needed to provide a service that you or your organisation has asked us to deliver. We rely on legitimate interests where processing supports the safe and efficient running of the bay, provided those interests are not overridden by your rights. We rely on legal obligation where we must keep records for tax or regulatory reasons. We rely on consent where we ask for it explicitly, for example before sending optional marketing email.
You can withdraw consent at any time by writing to dispatch@metasto.lol. Withdrawal does not affect processing that took place before the withdrawal, and it does not affect processing that rests on another legal basis.
7. Dispatch and Delivery Records
A dispatch bay depends on records. Each run produces a ticket, a route note, a proof and, where relevant, a handover reference. These records may contain personal data, such as the name of a recipient, a signature and a delivery time.
We keep dispatch records because they answer three practical questions. First, did the run happen as planned. Second, who signed for the parcel. Third, what should change the next time the same route is planned. Without those answers a courier operation cannot resolve a dispute or improve a route.
Access to dispatch records is limited to the dispatchers and managers who need them for a live job or an audit. We do not publish dispatch records and we do not share them with a third party except as described in the sharing section of this policy. Where a client asks for a copy of a proof, we provide only the record for that client run.
10. International Transfers
MetaSTO Group Limited is based in Hong Kong (HK), and the dispatch bay operates from Wanchai. Some service providers may store data in another region. Where a transfer leaves Hong Kong, we take steps to ensure the data remains protected, such as using a provider with appropriate contractual safeguards or keeping the data within a region that offers comparable protection.
If you would like to know where a particular record is stored, you can ask us and we will explain the location and the safeguard that applies. We review transfer arrangements when a provider changes and when a client engagement requires a new data flow.
11. How Long We Keep Data
We keep personal data only as long as we need it for the purpose it was collected. A contact form message is kept while the conversation is active and for a short period afterwards so that we can follow up. A dispatch record is kept for the period needed to support an audit, resolve a dispute and meet accounting rules.
When a retention period ends, we delete the record or remove the personal details so that the remaining data no longer identifies a person. We review retention on a schedule and we do not keep data simply because storage is cheap.
If you ask us to delete data and we have no legal or contractual reason to keep it, we will delete it within a reasonable period and confirm the action in writing.
12. How We Protect Personal Data
Security at the bay is a routine, not an afterthought. We restrict access to records by role, we use strong authentication for accounts that reach dispatch data, and we keep a record of who changed a ticket and when. Paper or printed proof items are stored in a locked area at the office and are destroyed when the retention period ends.
We train the dispatch team to recognise a suspicious request, to verify a caller before sharing a run detail and to report a lost device at once. We review our systems when a new tool is introduced and when a client engagement brings a new data flow.
No system is perfectly secure. If a breach occurs, we act on the response plan described below and we tell the affected parties as required by law.
13. Your Privacy Rights
Subject to applicable law, you have the right to ask what personal data we hold about you, to ask for a copy, to ask for a correction, to ask for deletion and to object to certain uses. You also have the right to ask us to restrict a use while a question is resolved.
To exercise a right, write to dispatch@metasto.lol with enough detail for us to locate the record, such as your name, the organisation involved and a run reference if you have one. We may ask for proof of identity before we release a record, because we will not hand dispatch data to an unverified caller.
We will respond within the period required by law. If we cannot meet a request, we will explain the reason and the remedy available to you.
14. Access and Correction Requests
An access request asks us to confirm whether we hold data about you and to provide a copy. A correction request asks us to fix data that is inaccurate. Both requests are handled by the same team, and both are logged so that we can show the request was answered.
When we receive an access request, we search the systems that could hold the record, including the contact inbox, the dispatch ledger and the proof archive. We then prepare a response that describes the data and, where relevant, the purpose of the processing.
When we receive a correction request, we check the source of the data. If the record came from a client, we may need to confirm the correction with that client before we change the entry. We will keep you informed of the step we are taking.
15. Privacy for Children
Our services are intended for businesses and professional clients. This website is not directed at children, and we do not knowingly collect personal data from a child through the site. If a dispatch engagement ever involves a delivery to a school or a family address, the data we handle is limited to the delivery details needed to complete the run.
If you believe that a child has sent personal data to us through the contact form, please write to dispatch@metasto.lol and we will delete the record promptly. We will confirm the deletion in writing.
16. Marketing Communications
We do not send marketing email to a person who has not asked to receive it. If you ask to hear about a new service or a seasonal handover window, we will use the contact details you provide for that purpose. Every marketing message includes a simple way to stop receiving further messages.
Stopping marketing does not affect the messages we must send to deliver a service you have requested, such as a run confirmation or a proof reference. Those service messages are part of the engagement and are not marketing.
17. Third Party Links and Services
This website may link to a third party site, such as a mapping service or a client portal. We do not control those sites and we are not responsible for their privacy practices. We encourage you to read the privacy notice of any site you visit before you share personal data with it.
Where a client uses a portal that we operate on the client behalf, the portal is covered by the client agreement and by this policy to the extent that we process the data. The client remains responsible for the notice it gives to its own customers.
18. Automated Processing
A dispatch bay uses rules to sort and route work. A rule might flag a run as urgent because the pickup window is short, or place a ticket in a queue because a document is missing. These rules support a dispatcher, and a person reviews the outcome before a run is confirmed or a record is closed.
We do not make a decision with a legal or similarly significant effect about an individual solely by automated means. If that changes in a future service, we will describe the logic, the role of a human reviewer and the way to ask for a review in an update to this policy.
19. Data Breach Response
If we discover a breach that affects personal data, we contain it first. We isolate the affected system, preserve the evidence and call in the team that can restore service safely. We then assess the risk to the people whose data is involved.
Where the law requires notification, we tell the relevant authority within the required period and we tell the affected individuals without undue delay. Our notice describes what happened, what data was involved and what we are doing to reduce the risk.
After the incident we write a short review that records the cause and the change we have made. The review is shared with the dispatch team so that the same fault is less likely to recur.
20. Changes to This Policy
We update this policy when our practice changes or when the law requires it. The date at the top of the page shows the most recent revision. If a change is material, we will place a clear notice on the website and, where we hold a contact address, we will send a short message describing the change.
We encourage you to read this page occasionally so that you know how the bay handles personal data. A copy of any earlier version can be requested from dispatch@metasto.lol.
21. How to Contact Us
If you have a question about this policy, a request about your data or a concern about the way the bay has handled a record, please contact MetaSTO Group Limited using the details below. A member of the dispatch team will read your message and route it to the person who can answer it.
MetaSTO Group Limited
2203A 22/F Wu Chung House
213 Queens Road East, Wanchai, Hong Kong (HK)
Email: dispatch@metasto.lol
Phone: +19894172958
We aim to answer a privacy question within a few working days and to resolve a formal request within the period set by law. If you are not satisfied with our response, you may contact the privacy authority in your region, and we will cooperate with any review that follows.
This policy is part of the public record of MetaSTO Group Limited and applies alongside our Terms of Service. Reading the two together gives a full picture of how the bay operates and how we protect the people who deal with it.