Legal

Privacy Policy

This policy explains what personal information we collect, why we collect it, how we keep it safe and the rights you have. We follow the Cyber and Data Protection Act [Chapter 12:07] and its regulations.

1. Who we are

SaniDesign Solutions (Pvt) Ltd ("SaniDesign", "we", "us" or "our") is the data controller for the personal information described in this policy. This means we decide how and why it is used.

  • Location: Harare, Zimbabwe
  • Company registration number: 2818A0242024
  • Data protection questions: info@sani.design (mark your message "Data protection")

This policy applies to sani.design, sanidesign.co.zw, our former address marketplace.sani.design, and to our services by WhatsApp, phone and email. The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is the Data Protection Authority that oversees how we handle personal information.

2. What we collect

From visitors to our websites:

  • basic usage information, such as the pages you view, the website that sent you, and your approximate country;
  • device information, such as your browser, operating system and screen size; and
  • the details you type into our order form. The form saves a draft only in your own browser, so that you do not lose it, and sends nothing to us until you choose to send it on WhatsApp.

From our clients and people who contact us:

  • your name, phone and WhatsApp number, and email address;
  • your WhatsApp messages, call notes and emails with us;
  • your business information, such as your business name, address, opening hours, products, prices, logo and photos, which may include photos of people;
  • domain registration details that registries require, such as the registrant’s name, address and contact details; and
  • payment information, such as the amount, date, payment method and reference (for example your EcoCash number or bank reference). We do not store full bank card details.

Through the websites we host for our clients: the information that our clients’ customers send through those websites, such as names, phone numbers, order details or messages, and basic technical information. See section 5 for how we handle this.

We do not knowingly collect sensitive personal information (such as health, religious or political information) and we ask you not to send it to us.

3. How we collect it

  • Directly from you, when you fill in our order form, message us on WhatsApp, call us or email us.
  • Automatically, when you visit our websites, through our hosting and analytics services.
  • From others, such as a person who orders a website on behalf of your business, domain registries, and payment providers confirming your payment.

4. Why we use it and our legal basis

We only use personal information when we have a lawful reason. We use it to:

  • reply to your questions and give you quotes. Legal basis: taking steps you ask for before entering a contract.
  • build, host, update and support your website, and register and renew your domain. Legal basis: performing our contract with you.
  • take payments, keep financial records and meet tax and company law duties. Legal basis: performing our contract, and complying with the law.
  • run, protect and improve our websites, and understand which pages and templates are popular. Legal basis: our legitimate interests in running a secure and useful business, balanced against your rights.
  • show finished client websites in our portfolio. Legal basis: our legitimate interests. You can opt out at any time.
  • send you news or offers about our services. Legal basis: your consent. You can withdraw it at any time by replying "STOP" or telling us.
  • protect our rights, prevent fraud and respond to lawful requests from authorities. Legal basis: complying with the law, and our legitimate interests.

Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.

5. When we act for our clients

When we host a website for a client, the client is the data controller for the personal information their own customers and visitors send through it. We act as a data processor: we handle that information only to host, secure, back up and support the website, and only on the client’s instructions.

  • We do not use our clients’ customer information for our own purposes, and we do not sell it.
  • We keep it confidential and protect it with the security measures described in section 8.
  • We help our clients respond to requests from their customers about their information.
  • We tell the client without undue delay if we become aware of a breach affecting their website.
  • When the client’s plan ends, we delete or return that information, unless the law requires us to keep it.

Clients are responsible for having a lawful reason to collect their customers’ information, for telling their customers how it is used (for example in their own privacy notice), and for any registration or licence with POTRAZ that their own business needs. Orders placed through a WhatsApp Shop website go straight to the client’s own WhatsApp and are handled by the client, not by us.

If you are a customer of one of our clients, please contact that business first about your information. We will pass on any request you send us.

6. Who we share it with

We do not sell or rent your personal information. We share it only when we need to, with:

  • service providers who help us run our business, such as website hosting and analytics providers, email providers, and WhatsApp (run by Meta) for our messages with you;
  • domain registries and registrars, which publish or keep registrant details as their rules require;
  • payment providers and banks, to process your payments;
  • our professional advisers, such as accountants and lawyers; and
  • POTRAZ, the police, the courts, the tax authority or other authorities when the law requires it.

Our service providers may only use your information to provide their services to us, and must keep it secure.

7. Sending information outside Zimbabwe

Some of our service providers, including our hosting, analytics and messaging providers, store information on servers outside Zimbabwe. When we transfer personal information outside Zimbabwe, we do so only as the Cyber and Data Protection Act allows, for example where the country or provider gives an adequate level of protection, where the transfer is needed to perform our contract with you, where you have agreed, or where POTRAZ has authorised it.

8. How we keep it safe

We use reasonable technical and organisational measures to protect personal information from loss, misuse and unauthorised access. These include SSL encryption on our websites, strong passwords and two-step login on our accounts, limiting access to people who need it, and regular backups.

No system is completely secure. If a data breach is likely to harm you, we will notify POTRAZ as the law requires and tell you without undue delay, with advice on what you can do.

9. How long we keep it

  • Enquiries that do not lead to an order: up to 12 months after our last contact.
  • Client records and messages: for as long as you are a client, and up to 2 years after, so we can support you and restore your site if you return.
  • Website files and backups: at least 90 days after a plan ends, and then deleted within a further 12 months, unless you ask us to delete them sooner.
  • Payment and accounting records: as long as tax and company laws require (generally 6 years).
  • Website usage information: in summary form, for up to 2 years.

When we no longer need information, we delete it or make it anonymous.

10. Your rights

Under the Cyber and Data Protection Act, you have the right to:

  • be told how your personal information is collected and used (this policy);
  • ask for a copy of the personal information we hold about you;
  • ask us to correct information that is wrong, incomplete or out of date;
  • ask us to delete information that is false, misleading or no longer needed, or that we hold unlawfully;
  • object to us using your information, including for marketing;
  • withdraw your consent at any time, where we rely on it; and
  • complain to POTRAZ.

To use these rights, contact us using the data protection details in section 1. We may need to confirm your identity first. We will reply as soon as we can, and within 30 days. There is usually no charge.

If you are not happy with how we handle your information, please contact us first so we can try to put it right. You can also complain to POTRAZ, the Data Protection Authority, at www.potraz.gov.zw.

11. Cookies and analytics

Our websites use privacy-friendly analytics that count visits without using cookies to track you across other websites. Our order form saves your draft in your own browser’s storage, and you can clear it at any time in your browser settings.

We do not use advertising cookies. If we add any cookies that are not strictly necessary, we will update this policy and ask for your consent where the law requires it.

Websites we build for clients may use their own cookies or tools, depending on what each client chooses. Each client is responsible for explaining these to their own visitors.

12. Children

Our services are for businesses and adults. We do not knowingly collect personal information from children under 18 without the consent of a parent or guardian. If you think a child has given us their information, please contact us and we will delete it.

13. Changes and contact

We may update this policy from time to time. The latest version will always be on this page with the date it was updated. If we make important changes, we will tell our clients on WhatsApp or by email.

Questions about this policy or your information? Contact us: