Privacy Policy

Inala is operated by [REGISTERED COMPANY NAME] (Private) Limited (registration number [COMPANY REGISTRATION NUMBER]), of [STREET ADDRESS], [CITY], Zimbabwe. We are the data controller for the personal information described in this policy, as that term is used in the Cyber and Data Protection Act [Chapter 12:07] (the “Act”).

Our Data Protection Officer is [NAME OF DATA PROTECTION OFFICER]. You can reach them at [privacy@inala.africa] or [+263 XX XXX XXXX].

We collect only what we need to run the platform:

• Account details — your name, email address and password (stored only as a one-way hash, never in readable form).
• Shopping activity — orders, cart and recurring cart contents, wishlist, favourite and followed stores, ratings you leave, and bids you place in auctions.
• Inala Pay records — your wallet balance and a ledger of top-ups, payments, transfers and cash-outs.
• Bill payment details — the meter, account or phone number you are paying for, and the amount.
• Seller information — if you open a store: business name, description, product listings, and the map pin you choose to publish.
• Interests — the shopping categories you pick during sign-up, used to personalise what you are shown.
• Technical data — basic information your browser sends when it connects to us, used to keep the service running and secure.

We do not collect special categories of personal information (such as health, biometric, genetic or political data) and ask that you do not submit any.

Section 11 of the Act requires a lawful basis for each use of your data. Ours are:

• Performance of a contract — creating your account, processing orders and payments, running recurring carts, and settling money to sellers.
• Your consent — marketing messages, and the personalisation of recommendations based on your interests and activity. You may withdraw this at any time.
• Legal obligation — keeping transaction records required by tax, exchange-control and financial-services law.
• Legitimate interests — preventing fraud and abuse, and keeping the platform secure and working, balanced against your rights and freedoms.

Where we rely on consent, it is freely given, specific and informed, as the Act requires. That is why:

• Accepting our Terms and this Policy is a separate tick from agreeing to receive marketing.
• The marketing box is never pre-ticked, and refusing it does not stop you using Inala.
• You can withdraw marketing consent at any time from your account, or by emailing [privacy@inala.africa]. Withdrawing does not affect processing carried out before you withdrew.

We record the date and time of each consent so we can demonstrate it if asked.

We do not sell your personal information. We share it only with:

• Sellers you buy from — the store receives your name, the items ordered and, for deliveries, your delivery address. Sellers may not use it for anything except fulfilling your order.
• Payment and delivery providers — only the data needed to complete a payment or a delivery.
• Service providers — hosting and infrastructure partners acting on our written instructions as data processors.
• Authorities — where we are legally required to disclose, such as a valid court order.

When you pay by mobile money, card or bank rail, the payment is handled by that provider under their own terms and privacy policy. We keep a record of the transaction — amount, method, date and what it was for — but we do not store your full card number or your mobile-money PIN.

Inala Pay keeps a ledger of your wallet activity. We retain these records for the period required by financial and tax law even if you close your account.

Store locations shown on our map are published deliberately by sellers. We do not track your device location in the background. Map tiles are served by OpenStreetMap, and requesting directions opens a third-party maps service under its own privacy policy.

• Account data — while your account is open, then up to 12 months after closure in case you return or a dispute arises.
• Order and payment records — retained for the period required by Zimbabwean tax and financial-record law.
• Marketing preferences — kept until you change them, plus a record of the withdrawal itself.

Under the Act you have the right to:

• be told what personal information we hold about you and why;
• get a copy of it;
• have inaccurate or incomplete information corrected;
• have information deleted where we no longer have a lawful reason to keep it;
• object to processing based on our legitimate interests;
• withdraw consent where consent is the basis we rely on;
• not be subject to a decision based solely on automated processing that significantly affects you. Our recommendations are suggestions only — they never decide prices, credit or access.

To exercise any of these, email [privacy@inala.africa]. We will respond within the period allowed by the Act. There is no charge unless a request is clearly excessive or repetitive.

We apply technical and organisational measures appropriate to the risk: passwords are stored using one-way bcrypt hashing, sessions use signed tokens that expire, wallet balances are changed only inside locked database transactions so a payment and its ledger entry cannot come apart, and access to production data is limited to staff who need it.

No system is perfectly secure. If a breach occurs that is likely to cause you harm, we will notify you and the Data Protection Authority as the Act requires.

Some of our infrastructure providers store data outside Zimbabwe. Where that happens we take steps to ensure the destination offers an adequate level of protection, or that appropriate safeguards are in place, in line with the cross-border transfer requirements of the Act.

Inala is not intended for children under 16. We do not knowingly collect their personal information. If you believe a child has given us data, contact [privacy@inala.africa] and we will delete it.

We keep your sign-in token and your shopping cart in your browser's local storage so you stay signed in and your basket survives a refresh. These are strictly necessary for the service to work. Clearing your browser storage signs you out and empties your cart.

Please raise any concern with us first at [privacy@inala.africa] — we would rather fix it directly. If you are not satisfied, you may complain to the Data Protection Authority. The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is designated as the Data Protection Authority under the Act.

If we make a material change we will publish the updated policy with a new version number and ask you to review and accept it the next time you sign in. Continued use after a change means you accept the updated policy.