Privacy Notice
1. Who we are
Cereal & Co. Grocers ("we", "us") runs this online grocery shop in Harare, Zimbabwe. We are the data controller for the personal information described here, and we follow the Cyber and Data Protection Act [Chapter 12:07].
To contact us about your privacy, send us a WhatsApp message on +263 71 334 0792, or speak to our delivery team in CBD Harare.
2. What we collect and why
| Information | Why we use it |
|---|---|
| Full name, WhatsApp number | To create and verify your account, log you in, and send your login details and order updates. |
| Employer, floor and where you sit | So we can meet you in person to verify you and sign the Pay on Pay Day terms, and to contact you about your orders. |
| Usual payday | To time Pay on Pay Day settlement to when your salary is paid. |
| Signed Pay on Pay Day terms (paper), which may include your national ID number | To confirm who you are before giving you credit, and as a record of our agreement. Kept securely, not online. |
| Orders, payments and unpaid balance | To pack and hand over your orders, apply your spending limit, and keep accurate business and tax records. |
| Notes you add to an order (for example, who a gift voucher is for) | To carry out your request. If you give us someone else's name and number, please make sure they're happy for you to share it. |
| Messages you send us | To answer your questions and resolve problems. |
We rely on your consent (which you give when you sign up), on what's needed to carry out our agreement with you (your account, orders and Pay on Pay Day), and on our legal obligations (for example, keeping financial records).
We do not collect your location, contacts, photos or any banking card details through this website.
3. Who we share it with
We never sell or rent your information, and we don't use it for advertising. We only share it with:
- Our website host, which stores the website and its database for us. Its servers may be outside Zimbabwe; where that's the case, we use a reputable provider with appropriate security measures in place.
- WhatsApp (Meta), when we message you or you message us. WhatsApp's own privacy policy applies to those messages.
- Authorities, only when the law requires us to.
We will not contact your employer about your account or your balance.
4. Cookies and your device
- When you log in, we set one small cookie that keeps you logged in. It's needed for the shop to work and is not used for tracking.
- Your basket is saved in your own browser, on your device, until you order or clear it.
- We don't use advertising or tracking cookies. The website loads its font from Google Fonts, which means Google can see your device's internet address when the page loads.
5. How long we keep it
- Account details: while your account is open, and for up to 12 months after it's closed, so we can resolve any questions or outstanding balance.
- Order and payment records: for as long as tax and accounting law requires us to keep business records.
- Sign-ups we don't verify or reject: deleted within 3 months.
6. How we protect it
- Passwords are stored in scrambled (hashed) form. We can't see your password.
- Only authorised Cereal & Co. staff can open the admin area, which is password-protected.
- The website uses a secure (HTTPS) connection.
- Signed paper terms are kept in a locked place.
If we ever discover a breach that affects your information, we'll tell you and the authorities as the law requires.
7. Your rights
Under the Cyber and Data Protection Act you can ask us to:
- tell you what information we hold about you and give you a copy;
- correct anything that's wrong or out of date;
- delete your information (we may need to keep order records the law requires, and any unpaid balance must be settled first);
- stop using your information for a particular purpose, or withdraw your consent.
Message us on WhatsApp to make a request. We'll reply within 30 days. If you're not happy with how we've handled your information, you can complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), which is the Data Protection Authority.
8. Age
Our shop is for adults aged 18 and over. We don't knowingly collect information about children.
9. Changes to this notice
If we change this notice, we'll update the date at the top and tell members about important changes on WhatsApp.
Draft for Cereal & Co. Grocers. Please have it reviewed by a legal adviser and complete your POTRAZ data-controller registration before relying on it.