Privacy Policy

This Privacy Policy covers the AfroPacific mobile app for Android, the website at afropacific.co.zw, and the services we provide through them (together, the platform). It applies to everyone who uses the platform: customers, artisans, project managers, administrators and suppliers, as well as people who send us an enquiry or a job application through the website.

It should be read together with our Terms and Conditions, which govern your use of the platform.

We have written it to meet the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe. Where we use a word such as "personal data", "data controller" or "data subject", it has the meaning given in that Act.

The platform is operated by AfroPacific Investments (Private) Limited, a company registered in Zimbabwe under registration number 134859A0582026, whose registered address is 6626 Zimre Way, Zimre Park, Ruwa (AfroPacific, we, us).

AfroPacific is the data controller for the personal data described in this policy. That means we decide why and how it is used, and we are responsible for protecting it.

• Privacy contact: support@afropacific.co.zw

What we collect depends on how you use the platform. We collect it from you directly, from AfroPacific staff working on your project, and from the systems that run the platform.

Your account

• Your name, email address and phone number.
• Your sign-in credentials. Passwords are handled by our authentication provider; we do not see or store them in readable form.
• Your role on the platform (customer, artisan, project manager, administrator or supplier).
• A profile photo, if you choose to upload one.

Artisan profiles

If you are an artisan, we also hold your trades, years of experience, a short bio, your availability, and a rating based on your work. We use these to assign work to you.

Addresses and site locations

• Addresses you give us for a building site or a delivery.
• Map coordinates for those addresses. These come from the address you type in or the place you pick using Google's address search. They are not taken from your phone's GPS, and the app does not track your location.

We use these to locate your project and to calculate delivery fees.

Quotation requests and WhatsApp

When you ask for a quotation in the app, we collect a description of the job and a contact phone number. You can also tick a box to agree that your project manager may contact you on WhatsApp about that enquiry. That consent applies only to that enquiry. If you do not tick it, we will not contact you on WhatsApp about it.

Photos and videos of construction sites

Project managers and artisans upload photos and videos of the site before, during and after the work, as proof that each stage was done. Customers can upload photos when reporting a defect. These can sometimes show people, vehicles, neighbouring property or the inside of your home.

Identity verification

We may ask customers and artisans to verify their identity. If we do, we collect your legal name, ID number, date of birth and photos of a government-issued identity document. AfroPacific staff review these by hand. We do not use an automated verification service. Artisans must be verified before they can be assigned work.

Payments

• The type of payment method you used (for example card, EcoCash or OneMoney), amounts, dates, and receipt and statement records.
• If you choose to save a card, a token that our payment provider, Paynow, gives us in place of the card. We store only that token, and we encrypt it. We never receive or store your full card number or CVV.

Messages

The messages you send to and receive from your project manager in the app's project chat.

Notifications and your device

• A push notification token for your device, so we can send notifications to it.
• Your notification preferences, quiet hours and time zone.

Activity records

A record of who did what on the platform and when: for example, who submitted a milestone, who confirmed it, who signed it off and who changed a quotation. We keep these to protect the platform, resolve disputes and keep people accountable.

Website forms

This website has three forms. They collect:

• Project enquiry: your name, email, phone or WhatsApp number, project location, project type, estimated budget and timeline, a description of the work, and any plans, documents or site photos you attach.
• Artisan registration: your name, phone or WhatsApp number, email (optional), where you are based, the areas you can work in, your trades and years of experience, a note, and photos of your previous work.
• Partner or supplier registration: your company name, contact person, phone, email, location, website or social media page, business category, what you offer, the areas you operate in, and anything else you tell us.

We use these details to reply to you. An enquiry may become a quotation, and a registration may become an application to work with us. What you send is stored by our website database provider and passed to the AfroPacific platform so our team is notified.

Website technical data

• When you send a website form, we pass your IP address to the AfroPacific platform. The platform uses it only to limit repeated or automated submissions.
• Our website host keeps standard server logs. These contain your IP address, browser type, the page requested and the time. See How long we keep it.
• The website does not use analytics, advertising or tracking cookies. It does not load third-party tracking scripts, and its fonts are served from our own domain.
• If you tap a WhatsApp button on the website, WhatsApp opens with a pre-written message. Nothing is sent until you send it yourself. After that, WhatsApp's own privacy policy also applies.

• We do not sell your personal data or rent it to anyone.
• We do not use your data for advertising, and the app shows no ads.
• The app contains no third-party analytics or advertising software.
• We do not track your device's location.
• We do not store full card numbers or CVVs.
• We do not use automated decision-making to verify your identity. A member of our staff reviews every identity document.

The law requires us to have a valid reason (a "lawful basis") for each use of personal data. The table below sets out ours.

Identity documents and ID numbers are among the most sensitive information we hold. We collect them only when verification is needed, keep them in private storage, and allow only administrators to view them. We treat them with the extra care the law requires for sensitive information.

Access depends on each person's role:

• Project managers see the customers, sites and project records for the projects they manage.
• Administrators review identity documents and payments and sign off completed milestones.
• Artisans see only the milestones they are assigned to, and only the details they need to do that work (for example, the site location and the scope of the job).
• Customers never see an artisan's personal details beyond what the job requires.

We use trusted service providers to run the platform, for example for sign-in and secure storage, payments, sending email and push notifications, address search, hosting this website, and WhatsApp messaging. They process personal data on our behalf and only for the purpose we give them.

We may also share personal data:

• with the Zimbabwe Revenue Authority (ZIMRA) and other authorities, when the law requires it;
• with courts, the police or regulators, if we are legally required to, or to establish or defend a legal claim;
• with our professional advisers, such as lawyers and auditors, who are bound to keep it confidential.

We do not share your data with anyone for their own marketing.

• All data travels over encrypted connections (HTTPS).
• Saved-card tokens are encrypted when stored.
• Photos, videos and identity documents uploaded in the app are kept in private storage. They are shown only through temporary links that expire after about 10 minutes.
• Each part of the platform keeps its data in a separate database.
• Staff access depends on their role, as described in Who can see your information.
• Activity records cannot be edited after they are written, so changes to the platform can be traced.

Files attached to website forms are stored with randomly generated file names and are not linked from any page of the website.

No system is perfectly secure. If a breach puts your personal data at risk, we will notify the relevant authorities and the people affected as soon as reasonably possible, and in any case where the law requires us to.

We keep personal data only for as long as we need it for the purposes above, or as long as the law requires.

You can ask us to delete your AfroPacific account and the personal data linked to it at any time.

In the app

1. Open Profile, then tap Delete account.
2. Re-enter your password to confirm it is you.
3. We email you to confirm we have received your request.

Without the app

If you no longer have the app, email support@afropacific.co.zw with the subject line "Delete my account". Please include:

• your full name;
• the email address and phone number registered to your account;
• whether you are a customer, artisan or supplier.

You must send the email from the address registered to your account, and that account must have passed our identity verification. This makes sure we do not delete someone else's account. If your account has not been verified, we will ask you to verify your identity before we act on the request. General questions about privacy can be sent from any email address.

What happens next

We delete your account and personal data within 30 days of receiving your request and email you when it is done.

What we delete: your profile, contact details, profile photo, identity documents, the site photos you uploaded, your saved cards, and your ability to sign in.

What we keep, and why:

• Financial and tax records (payments, receipts, accounting and VAT records), for the period in How long we keep it, because tax law requires us to.
• Records of a project still in progress, until that project is closed out.

If we are holding money for you, or you have a job in progress, your project manager will contact you to settle or wind it down before deletion is completed.

Under the Cyber and Data Protection Act you have the right to:

• Access your personal data: ask what we hold about you and get a copy.
• Correct it, if it is wrong or incomplete. You can update most details in the app yourself.
• Delete it, subject to what the law requires us to keep. See Deleting your account.
• Object to our use of it, including where we rely on our legitimate interests.
• Withdraw your consent at any time where we rely on it. For example, you can unsubscribe from marketing email using the link in any marketing email, and you can ask your project manager or email us to stop WhatsApp contact. Withdrawing consent does not affect anything we did before you withdrew it.
• Complain to POTRAZ, the Data Protection Authority in Zimbabwe, on (024) 2333032.

To use any of these rights, email support@afropacific.co.zw. We may need to confirm your identity first. We will respond within 24 to 48 hours. We will not charge you for a reasonable request.

We would appreciate the chance to deal with your concern before you approach POTRAZ, but you are free to complain to them at any time.

We send notifications in the app, by email and by push notification.

• Service and security notices, such as payment confirmations, identity verification updates and account matters, are part of the service and cannot be switched off.
• Other notifications, such as project updates, can be turned on or off by category in the app. You can also set quiet hours.
• Marketing email is sent only if you opt in. Every marketing email has a one-click unsubscribe link.

The platform is for adults aged 18 and over and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email support@afropacific.co.zw and we will delete it.

Site photos may occasionally show children who are present on a property. We use those photos for the project record, and we never use photos showing children in our marketing.

We may update this policy when the platform or the law changes. When we do, we will change the "Last updated" date at the top of this page. If a change significantly affects how we use your personal data, we will tell you in the app or by email at least 5 days before it takes effect.

For any question about this policy or your personal data:

• Email: support@afropacific.co.zw
• Post: AfroPacific Investments (Private) Limited, 6626 Zimre Way, Zimre Park, Ruwa, Zimbabwe