Draft. This page is a working draft and has not yet been reviewed by a lawyer. Details in [brackets] still need to be filled in.
Privacy notice.
Last updated 27 October 2026
This notice explains what personal information Munkoyo Marketplace (“Munkoyo”, “we”) collects when you use the marketplace, why, who we share it with, how long we keep it, and the choices and rights you have under Zambia’s Data Protection Act No. 3 of 2021. [Registered company name] is responsible for your information as the data controller.
1. What we collect
- Your account: your name, email address, mobile number (optional) and a password. We store only a scrambled (hashed) version of your password, never the password itself.
- Optional extras: your birthday (day and month only, no year) if you add it, and whether you want offers and birthday wishes by email.
- Orders: the name, phone number and delivery address you give at checkout, what you ordered, prices, delivery choice and payment status.
- Saved addresses, saved items and messages you send to sellers, and reviews you post.
- Selling: if you open a shop, its name, location, products, photos and orders.
- Payments: if you pay online, the payment provider (Flutterwave) handles your card or mobile-money details; we receive only the result, amount and a transaction reference.
- Technical information: your IP address and browser type when you sign in or make important changes (kept in our security activity log), and the country your connection appears to come from, used to suggest a delivery country and currency.
2. Why we use it
- To run the marketplace and fulfil orders: creating your account, passing your order to the seller and courier, showing your order history, and sending order and account messages. This is needed to provide the service you asked for.
- To keep the marketplace safe: preventing fraud and abuse, limiting repeated sign-in attempts, and keeping a record of important actions so problems can be investigated. This is in our legitimate interest and yours.
- Offers and birthday wishes: only if you said yes. You can stop them at any time (see “Your choices”).
- To meet legal duties, for example keeping records of sales and responding to lawful requests from authorities.
5. How long we keep it
- Account information: for as long as your account is open, and up to [12 months] after you ask us to close it.
- Orders and payment records: for [7 years], as needed for tax and accounting.
- Security activity log (sign-ins, admin and account changes): for [24 months].
- Password reset links expire after 60 minutes.
6. Your choices and rights
You can change your name, email, phone number, birthday and email preferences at any time in Your account → Edit details. Every offer email has an unsubscribe link.
Under the Data Protection Act you may also ask us to: give you a copy of your personal information; correct it; delete it (unless we must keep it by law, for example sales records); restrict or object to how we use it; or move it to another service. Contact us at [privacy contact email]. We will reply within [30 days]. If you are unhappy with our answer, you can complain to the Office of the Data Protection Commissioner of Zambia.
7. How we protect it
Passwords are stored hashed, sign-in sessions are protected cookies, repeated wrong passwords are slowed down, staff have personal logins with limited roles, and important actions are recorded in an activity log. No system is perfectly secure; if a breach puts your information at risk, we will tell you and the Data Protection Commissioner as the law requires.
8. Information stored outside Zambia
Our website host and email provider may store information on servers outside Zambia. Where that happens we use providers with appropriate safeguards, as required by the Data Protection Act. [Name the hosting and email providers and their countries before launch.]
9. Children
The marketplace is for people aged 18 and over. Accounts must not be created by or for children under 18.
10. Contact and changes
[Registered company name] ([PACRA registration number]), [Registered office address], Lusaka, Zambia. Email [privacy contact email] or [support email address]; phone [support phone / WhatsApp number]. If we change this notice in an important way, we will tell you on the website or by email before the change applies.