1. Introduction
Pakashop is a Zambian B2B2C marketplace connecting buyers with independent vendors. We are committed to protecting your personal data in accordance with the Zambia Data Protection Act, 2021. This Privacy Policy explains how we collect, use, share, and safeguard your information when you use our platform.
2. Information We Collect
Personal Information
- Name, email address, phone number, and shipping/billing addresses.
- For vendors: business name, Taxpayer Identification Number (TPIN), bank account details, and contact information.
- For delivery agents: National Registration Card (NRC), vehicle details, driver's licence, and proof of identity.
Transaction & Payment Data
- Order history, product details, delivery addresses, and amounts paid.
- Payment method used (mobile money, card, etc.) but not full card numbers – all card data is handled directly by our PCI‑compliant payment partners.
- Delivery confirmation PIN and digital signature (if captured).
Technical & Usage Data
- IP address, browser type, device information, and platform interactions.
- Cookies (see our Cookie Policy for details).
3. How We Use Your Information
- To process and fulfil orders, including sharing necessary details with vendors and delivery agents.
- To facilitate payments through PawaPay (mobile money) and Flutterwave (cards).
- To comply with legal and regulatory requirements, including tax reporting to the Zambia Revenue Authority (ZRA) via the Smart Invoice system.
- To communicate order updates, support responses, and security alerts.
- To prevent fraud, detect suspicious activity, and ensure platform security.
- To improve the platform through analytics and performance monitoring.
4. Legal Basis for Processing
We process your data on one or more of the following legal grounds:
- Contract fulfilment: To provide the services you request (orders, deliveries, payments).
- Legal obligation: To comply with tax laws and regulatory requirements.
- Legitimate interest: To secure the platform, prevent fraud, and improve our service.
- Consent: For marketing communications (you may opt out at any time).
5. Information Sharing
We share your data only as necessary with trusted third parties:
Vendors
Name, delivery address, phone number – to fulfil your order.
Delivery Agents
Buyer name, address, phone – to deliver your order.
PawaPay / Flutterwave
Payment amounts, mobile money numbers, card references – to process payments.
ZRA
Transaction data for vendors who are VAT‑registered – for tax compliance.
Cloudinary
Images (product photos, vendor logos, delivery photos) – for content delivery.
Resend
Email addresses – to send transactional and service emails.
Sightengine
Uploaded images – for AI‑based content moderation (NSFW, violence).
We do not sell your personal data to third parties.
6. Data Retention
- Account data is retained while your account is active.
- Transaction data (order history, payments) is retained for a minimum of 7 years to comply with Zambian tax and financial regulations.
- Logs and security data may be retained for a reasonable period to ensure platform integrity and incident investigation.
- You may request deletion of your personal data, subject to these retention obligations.
7. Data Security
- All data transmitted between your device and Pakashop is encrypted using TLS/SSL.
- Card payments are processed through Flutterwave's PCI‑DSS Level 1 compliant infrastructure – we never store raw card data.
- Access to sensitive data is restricted via role‑based access control (RBAC) and mandatory multi‑factor authentication (MFA) for elevated roles.
- We employ rate limiting, input validation, and security headers to protect against common attacks.
8. Your Rights Under the Zambian Data Protection Act
You have the following rights regarding your personal data:
Access – know what data we hold about you
Rectification – correct inaccurate data
Erasure – request deletion (subject to legal retention)
Restriction – limit how we use your data
Data Portability – receive your data in a structured format
Objection – object to processing for legitimate interests or marketing
To exercise these rights, contact us at privacy@pakashop.store.
9. International Data Transfers
We use third‑party services (e.g., Cloudinary, Resend, Flutterwave) that may store or process data outside Zambia. We ensure that appropriate safeguards, such as standard contractual clauses, are in place to protect your data in accordance with the Data Protection Act.
10. Updates to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice on the platform. The latest version will always be available on this page.
Privacy & Data Protection
privacy@pakashop.store
Address: Zambia
11. Data Controller Registration
Pakashop is registered as a Data Controller with the Zambia Information and Communications Technology Authority (ZICTA) in accordance with Section 20 of the Data Protection Act, 2021. Our registration number is PENDING (registration in progress).
12. Data Localization & Cross-Border Transfers
Pakashop uses Amazon Web Services (AWS) for its cloud infrastructure. Your personal data is processed and stored on AWS servers located in Cape Town, South Africa (AWS af-south-1).
We rely on the following legal bases for this transfer:
- Explicit Consent: By creating an account, you consent to your data being stored and processed on our secure servers in South Africa.
- Standard Contractual Clauses (SCCs): We have adopted the Standard Contractual Clauses approved by the European Commission and recognized by the Zambian Data Protection Commissioner to ensure your data is protected to Zambian standards.
- Contractual Necessity: Processing your data outside Zambia is necessary for the performance of the contract (e.g., processing payments through Flutterwave/PawaPay, delivering images through Cloudinary).
For our full list of third-party processors and their locations, see Section 5 (Information Sharing) above.
13. Data Breach Notification
In the event of a data breach that poses a risk to your rights and freedoms, we will:
- Notify the Data Protection Commissioner within 72 hoursof becoming aware of the breach.
- Inform affected users without undue delay, describing the nature of the breach and recommended mitigation steps.
- Document the breach, its effects, and the remedial action taken.
14. Data Protection Officer (DPO)
We have appointed a Data Protection Officer to oversee our compliance with the Data Protection Act, 2021. You may contact our DPO at:
Data Protection Officer
dpo@pakashop.store
Response time: within 30 days
