1 Quick Summary
- We collect information you give us (name, phone/email, photos, location, product details) so you can register, list products, and be contacted by buyers/sellers.
- We show contact details on listings so buyers and sellers can contact each other (via WhatsApp/phone). Those communications happen outside the Platform.
- We use secure measures to protect your data, and we will register with the national Data Protection Authority and appoint a Data Protection Officer as required by law.
- If we have a data breach we will notify POTRAZ within 24 hours and affected people as required by law.
2 Legal Basis & How This Policy Relates to Zimbabwean Law
Musikawedu processes personal data in line with the Cyber and Data Protection Act [Chapter 12:07] (2021) and the Licensing / DPO Regulations (SI 155 of 2024). The Act establishes duties for data controllers and data subject rights; SI 155 sets out licensing, breach-notification and Data Protection Officer rules that apply to private-sector platforms like Musikawedu. Where the law requires it we will register with the Authority and comply with the Act and SI 155.
We respect constitutionally protected rights including the right to privacy and the right to engage in trade, quoted later in this policy.
3 What Personal Data We Collect
We collect the following categories of personal data:
A. Account & Identity Data
- Name, username, phone number, email address.
- OTP verification records, password hashes (we never store passwords in plain text).
- Purpose: account creation, login, identity confirmation, security.
B. Profile & Listing Data
- Profile photo, farm or business name, location (text address and optional GPS coordinates).
- Product listings: product name, description, quantity/units, price, photos, pick-up location and any documents you attach.
- Purpose: to enable display of listings and let buyers find and contact sellers.
C. Communications & Logs
- Contact attempts (clicks on "Call" or "WhatsApp" links), time stamps, message metadata.
- Note: messages sent via WhatsApp or phone are outside our servers.
- Purpose: to provide Platform features, troubleshoot issues, combat abuse.
D. Technical & Usage Data
- IP address, browser / device type, pages visited, search queries, cookies, crash logs and analytics data.
- Purpose: security, Platform performance, analytics and improvement.
E. Transaction-Related Records
- Payment confirmations, invoices, settlement metadata (if/when we introduce payments).
- We will only process payments via RBZ-regulated providers.
- Until then you arrange payments outside the Platform.
F. Sensitive or Special Categories
- We do not generally seek health data, racial/ethnic origin, or other "special category" data.
- If you voluntarily upload images or content that reveal sensitive data, you remain responsible for having lawful grounds to share it.
- We will treat such data with enhanced security.
4 How and Why We Use Your Personal Data
We use your personal data for these principal purposes:
- Account setup and authentication — to verify you (OTP), create and secure accounts. Lawful basis: consent and contractual necessity.
- Platform operation (listings & display) — to store and show listings and to enable contact between buyers and sellers. Lawful basis: contract performance and legitimate interest.
- Communication & support — to respond to enquiries, enforce terms and handle disputes. Lawful basis: contractual necessity / legitimate interest.
- Security & fraud prevention — to detect and prevent abuse, fraud, or illegal activity. Lawful basis: legitimate interest and legal compliance.
- Legal compliance & record retention — to comply with statutory obligations (AMA registration checks, ZIMRA tax retention rules, export record retention, law enforcement requests). Lawful basis: compliance with legal obligations.
- Analytics & product improvement — to measure and improve the Platform experience. Lawful basis: legitimate interest (we will anonymize or aggregate where feasible).
- Marketing & advertising (only with consent) — to send product updates and promotional communications if you opt in. You may withdraw consent anytime.
5 Cookies, Tracking and Third-Party Services
- We use cookies and analytics (standard web cookies, session cookies) to operate the site. You can control cookies via your browser or our cookie banner.
- We use third-party services such as an SMS/OTP provider, email service provider, cloud storage/CDN (for images), web analytics, map providers and payment processors (if/when enabled).
- Clicking a WhatsApp link launches WhatsApp (a third-party service). WhatsApp communications are governed by WhatsApp's policies and are outside our control.
6 Disclosure & Sharing of Data
We may share personal data with:
- Service providers / processors (SMS gateway, email provider, cloud storage/CDN, analytics, payment service providers) under written processor agreements.
- Law enforcement, regulators, courts where required by law (e.g., POTRAZ, ZIMRA, AMA or police) or to respond to legal process.
- Other Users: your contact details (phone number, WhatsApp) and listing information are shown to other Users so they can contact you — this is an essential feature of the Platform.
- Business partners / advertisers: aggregated or pseudonymized data may be used to inform advertisers.
- Potential acquirers / funders: if Musikawedu is sold we may transfer personal data as part of a business transfer under appropriate safeguards.
We do not sell personal data.
7 International / Cross-Border Transfers
If we transfer personal data outside Zimbabwe (e.g., to cloud provider datacentres or analytics services), we will only do so where: (a) the destination provides adequate protection; (b) you have given explicit consent; or (c) other lawful conditions permitted by the Act are satisfied. Where required by POTRAZ we will notify or seek approval for transfers and implement appropriate safeguards (e.g., standard contractual clauses, encryption).
8 Retention Periods
We retain personal data only for as long as necessary for the purposes described and to meet legal obligations. Indicative retention rules:
- Account data & listings: retained while your account is active and for a reasonable period thereafter (to allow reactivation or disputes).
- Contact & communications logs: retained for a limited period (e.g., 12–36 months) for fraud prevention, dispute resolution and analytics.
- Tax / financial / export records: retained for at least the period mandated by ZIMRA and other regulators (typically six (6) years).
If you request deletion we will delete or anonymize your data unless we need to retain it to comply with legal obligations, resolve disputes, enforce agreements, or meet tax/audit requirements.
9 Your Rights as a Data Subject
Under Zimbabwe law and the Cyber & Data Protection Act you have rights including:
- Access — request copies of personal data we hold about you.
- Rectification — request correction of inaccurate or incomplete data.
- Erasure (deletion) — request deletion where we no longer need the data or you withdraw consent (subject to legal retention limits).
- Restriction of processing — ask us to limit processing in certain circumstances.
- Objection — object to processing based on legitimate interests.
- Data portability — where technically feasible, request a copy of your data in a machine-readable format.
- Withdraw consent — where processing is based on consent you may withdraw it.
To exercise any right email:
info@nessosystems.co.zw
Subject line: "Data Subject Request — Musikawedu"
Please include: your name, account email/phone and the request type.
10 Data Security
We implement administrative, technical and physical safeguards appropriate to the risk, including:
- Encrypted connections (HTTPS/TLS) for data in transit.
- Password hashing and secure credential storage.
- Role-based access control on our systems and staff training.
- Secure cloud storage (for images) and regular backups.
- Vendor due diligence and written processor agreements.
Despite our efforts no system is 100% secure. If a breach occurs we will follow SI 155 / DPA rules and report to POTRAZ within 24 hours of becoming aware of the breach and notify affected data subjects where the breach is likely to pose a high risk to rights and freedoms (typically within 72 hours).
11 Children & Minors
The Platform is for Adults (18+). We do not knowingly collect personal information from children. If you are a parent or guardian and become aware that a child has provided us personal data without your consent, contact info@nessosystems.co.zw and we will take steps to remove that data.
12 Processing by Third Parties (Processors)
We use third parties to send OTPs, host images, provide analytics, and (if enabled later) process payments. We enter contracts requiring them to maintain confidentiality and security and to act only on our instructions. Where a processor is located outside Zimbabwe we ensure adequate protections and compliance with cross-border transfer requirements.
13 WhatsApp, Phone Calls and Off-Platform Communications
Musikawedu provides "click-to-chat" links (WhatsApp) and phone links for buyer/seller contact. These interactions occur on third-party platforms and are not routed through Musikawedu. We do not control third-party messaging apps' privacy policies; those apps may collect and retain metadata or message content. We recommend users avoid sharing sensitive personal data over third-party messaging services.
14 Complaints and Supervisory Authority
If you have a complaint about our handling of your personal data:
- Contact Musikawedu at info@nessosystems.co.zw (we will investigate and aim to resolve issues promptly).
- If you are not satisfied you may lodge a complaint with the Data Protection Authority (POTRAZ / DPA) — see POTRAZ for complaint procedures and contact details.
15 Relationship with Other Legal Obligations
Processing for Platform operation does not remove your responsibility to comply with Zimbabwe's sectoral laws (e.g., Agricultural Marketing Authority registration, export permits, phytosanitary certificates and ZIMRA tax record retention). Where we collect documents you upload for export or compliance purposes we will process those documents solely to assist with the export/transaction and will retain copies only to the extent necessary for legal or contractual reasons.
16 Changes to This Policy
We may update this Privacy Policy to reflect changes in the law (e.g., the Act or SI 155), how we operate, or new features (such as in-app payments or escrow). Material changes will be published on the Platform and communicated to registered Users in advance where required by law.
17 Constitutionally Protected Rights
We respect your constitutional rights under the Constitution of Zimbabwe. For transparency we quote key passages below:
Section 57 — Right to privacy
"Every person has the right to privacy, which includes the right not to have — (a) their home, premises or property entered without their permission; (b) their person, home, premises or property searched; (c) their possessions seized; (d) the privacy of their communications infringed; or (e) their health condition disclosed."
Section 62 — Right of access to information
"Every person … has the right of access to any information held by any person, including the State, in so far as the information is required for the exercise or protection of a right. … Every person has a right to the correction of information, or the deletion of untrue, erroneous or misleading information …"
Section 64 — Freedom of profession, trade or occupation
"Every person has the right to choose and carry on any profession, trade or occupation, but the practice of a profession, trade or occupation may be regulated by law."