Privacy Notice
Date of publication: 21 May 2025 | Zambia
Bunzo provides a mobile and web-based quick commerce application offering delivery of groceries, household goods, electronics, personal care products, and other items across Zambia.
1. What is this privacy notice for?
You entrust us with your personal data, and we take this responsibility seriously. We are committed to protecting your privacy and being transparent about how we handle your information.
This Privacy Notice explains what personal data we collect, how and why we use and share it, and the rights you have as a data subject. It is prepared in accordance with the Data Protection Act No. 3 of 2021 of Zambia.
2. Who processes your personal data?
Your personal data is processed by Bunzo Limited, the company that provides the Bunzo service in Zambia. Bunzo Limited acts as the data controller and determines the purposes and means of processing your personal data.
Bunzo Limited[Registered Address], Lusaka, Zambia
Company Registration No: [PACRA Number]
Email: support@bunzodelivery.com | privacy@bunzodelivery.com
3. What personal data is processed, how, and why?
The table below sets out every category of personal data we collect, the specific data points within each category, the purposes for which we use it, and the legal basis under the Data Protection Act No. 3 of 2021.
Providing your name, phone number, and delivery address is mandatory to use Bunzo. All other data marked as consent-based is optional and will not affect your ability to use the app if you decline. You may withdraw consent at any time via the app settings or by contacting us.
| Category | Personal data collected | Purpose | Legal basis |
|---|---|---|---|
| Account & identity |
|
|
|
| Delivery information |
|
|
|
| Payment data |
|
|
|
| Location data |
|
|
|
| Device & technical data |
|
|
|
| Usage & behavioural data |
|
|
|
| Order & transaction history |
|
|
|
| Customer support data |
|
|
|
4. How is your personal data protected?
We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised, accidental, or unlawful destruction, loss, modification, misuse, disclosure, or access. These include:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- Access controls limiting data to employees who need it to carry out their duties
- Multi-factor authentication options for user accounts
- Regular security assessments and penetration testing
- Incident response procedures compliant with Zambian data breach notification requirements
Personal data is processed automatically without access by our staff in most cases. Where staff access is necessary, employees are bound by internal data handling rules and confidentiality obligations.
5. Who do we share your personal data with?
We do not sell your personal data. We share it only with parties necessary for the provision of our services:
- Merchants & delivery riders — Your name, phone, delivery address, and order details are shared to fulfil and deliver your order. Riders see your location during active delivery only.
- Payment processors — Mobile money operators and card payment providers receive only the minimum data needed to authorise transactions.
- Cloud & infrastructure providers — Hosting, push notifications, mapping, and related technical services, bound by data processing agreements.
- Customer support partners — Third-party support tools used to handle your queries, under strict confidentiality obligations.
- Analytics & advertising partners — Aggregated or pseudonymised data only. We do not share identifiable data for third-party marketing.
- Law enforcement & regulators — Where required by Zambian law, court order, or to protect the safety of users or the public.
- Business successors — In a merger, acquisition, or asset sale. You will be notified before any such transfer.
6. Where is your personal data transferred to?
Some of the parties we work with may be located outside Zambia. Where personal data is transferred internationally, we take the necessary steps to ensure your data remains protected, including through contractual safeguards and assessment of the laws of the destination country. You may contact us to request information about the countries to which your data may be transferred and the safeguards in place.
7. How long will your personal data be retained?
We retain your personal data only for as long as necessary for the purposes described in this notice, or as required by Zambian law:
- Account data — Duration of account + 3 years after closure
- Order and transaction records — 7 years (tax and regulatory compliance)
- Location history — 12 months from each completed delivery
- Customer support records — 3 years from last interaction
- Fraud and security logs — Up to 5 years
After retention periods expire, data is securely deleted or anonymised. We may retain data beyond these periods where required by law or to protect our rights in legal proceedings.
8. What are your rights?
Under the Data Protection Act No. 3 of 2021, you have the following rights:
8.1 Right of access
You have the right to request a copy of the personal data we hold about you.
8.2 Right to rectification
You have the right to ask us to correct information that is inaccurate, outdated, or incomplete.
8.3 Right to withdraw consent
Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
8.4 Right to erasure
You have the right to ask us to delete your personal data where it is no longer needed, consent is withdrawn, or processing is unlawful.
8.5 Right to restriction of processing
You have the right to ask us to restrict processing in certain circumstances, for example while a rectification request is being resolved.
8.6 Right to data portability
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, machine-readable format.
8.7 Right to object
You have the right to object to processing based on legitimate interests, and the right not to be subject to decisions made solely by automated processing, including profiling.
8.8 Right to lodge a complaint
If you believe your rights have been violated, you may lodge a complaint with the Zambia Information and Communications Technology Authority (ZICTA):
ZICTA — www.zicta.zm
Stand No. 2986, Corner Addis Ababa / Great East Road, Lusaka, Zambia
9. How to contact us
If you need assistance, you can contact our support team through the Bunzo app after logging in, or by email:
- Customer support: support@bunzodelivery.com
- Data Protection Officer: privacy@bunzodelivery.com
Please include the phone number linked to your Bunzo account so we can identify and assist you efficiently.
10. How is this document modified?
In the event of material changes to this Privacy Notice, we will notify you through any available means — push notification, SMS, or email — at least 14 days before changes take effect. The updated notice will always carry the publication date at the top of this document.