Privacy Policy

1. Data Controller Identity

Data Controller: ZimEstimate (Private) Limited
CIPA Registration: [To be inserted upon incorporation]
Registered address: [Physical address, Harare, Zimbabwe]
Data Protection Officer (DPO): privacy@zimestimate.co.zw
ZDPA Registration Number: [To be inserted upon registration with the Zimbabwe Data Protection Authority]

We are registered (or in the process of registering) as a data controller with the Zimbabwe Data Protection Authority (ZDPA) under the CDPA, as required before processing personal data at scale.

2. Personal Data We Collect

We collect the following categories of personal data:

• Identity data: Full name, job title, professional role.
• Contact data: Email address, phone number, WhatsApp number.
• Business data: Company name, CIPA registration number, ZIMRA TIN, business address, VAT number, material categories handled.
• KYC / verification documents: Certificate of Incorporation, director national IDs or passports, proof of business address. Collected for supplier verification and AML compliance.
• Financial and transaction data: Subscription plan, billing history, payment method type (we do not store raw card numbers — card processing is handled by Stripe). Payment reference numbers for Paynow/EcoCash transactions.
• Project and BOQ data: Estimates, bill-of-quantities records, site locations, materials lists, uploaded floor plans, and project documents you create on the Platform.
• Usage and technical data: IP address, browser type, device identifiers, session logs, pages visited, features used, error reports.
• Communications data: Email notification preferences, support tickets, and messages sent to our team.

We do not collect special category data (health, biometric, racial or ethnic origin, religious beliefs) unless voluntarily submitted — in which case we will obtain your explicit consent.

3. Purpose & Lawful Basis for Processing

We process your data for the following purposes and on the following lawful bases under the CDPA:

4. Data Retention

We retain personal data only for as long as necessary:

5. Third-Party Processors & Cross-Border Transfers

We share personal data with the following sub-processors to operate the Platform. Each is bound by a Data Processing Agreement (DPA) with ZimEstimate:

Cross-border transfers: Several processors are located outside Zimbabwe. The CDPA restricts transfers to countries not deemed adequate by the ZDPA unless appropriate safeguards are in place. We address this by executing Standard Contractual Clauses (SCCs) or equivalent contractual measures with each processor, and by disclosing the transfer in this Privacy Policy. By using the Platform, you acknowledge that your data may be transferred to and processed in the USA.

6. Your Data Subject Rights (CDPA Sections 20–30)

Under the CDPA, you have the right to:

• Access: Request a copy of the personal data we hold about you (we will respond within 30 days).
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”): Ask us to delete your data, subject to legal retention obligations (AML/ZIMRA data cannot be deleted ahead of schedule).
• Restriction: Ask us to restrict processing while a correction or objection is being considered.
• Data portability: Receive a copy of your data in a structured, commonly used, machine-readable format.
• Object: Object to processing based on legitimate interests, or to direct marketing at any time.
• Withdraw consent: Where processing is based on consent, withdraw it at any time (withdrawal does not affect lawfulness of prior processing).
• Not to be subject to automated decisions: Not to be subject to a decision based solely on automated processing that produces significant legal or similar effects, without human review.

To exercise any right, email privacy@zimestimate.co.zw with your name, account email, and the right you wish to exercise. We may request proof of identity before processing the request. If you are not satisfied with our response, you may lodge a complaint with the Zimbabwe Data Protection Authority (ZDPA).

7. Marketing Communications

We will only send you marketing emails or product update newsletters if you have given us explicit consent (opt-in checkbox at registration or via your account settings). You can unsubscribe at any time by clicking “Unsubscribe” in any marketing email, or by emailing privacy@zimestimate.co.zw. Transactional and service notifications (invoices, security alerts, subscription renewals) are sent as part of our contract with you and cannot be opted out of while your account is active.

8. Cookies & Tracking

We use the following categories of cookies:

• Strictly necessary: Authentication session tokens and security cookies. These cannot be disabled.
• Functional: User preferences (language, currency). These are set without separate consent as they are necessary for the service to work as intended.
• Analytics: Anonymised usage statistics (page views, feature engagement). We will request your consent before setting analytics cookies on your first visit.

We do not use third-party advertising or behavioural targeting cookies. You may manage cookie preferences in your browser settings at any time.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction, including:

• TLS encryption in transit for all Platform communications.
• Encryption at rest for database storage (Supabase AES-256).
• Row-Level Security (RLS) policies so users can only access their own data.
• Audit logs for all admin and sensitive actions.
• Access controls limiting personal data to staff with a need-to-know.

Data breach notification: If a personal data breach occurs that poses a risk to data subjects, we will notify the ZDPA within 72 hours of discovery, and notify affected users without undue delay where the risk is high, in accordance with CDPA Section 21.

10. Children’s Privacy

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a minor has registered, we will delete their account and associated data promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email and by displaying a prominent notice on the Platform at least 14 days before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

Contact & Data Requests

Data Protection Officer: privacy@zimestimate.co.zw
General support: support@zimestimate.co.zw
Postal: ZimEstimate (Private) Limited, [Registered address, Harare, Zimbabwe]

To exercise your data subject rights or raise a privacy concern, please email privacy@zimestimate.co.zw with “Privacy Request” in the subject line.