Effective date: 05 October 2025
Zambia Farm To Market (“ZFTM”, “we”, “us”, “our”) operates a digital marketplace connecting farmers, buyers, transporters and input suppliers across Zambia. We respect your privacy and process personal data in line with Zambia’s Data Protection Act No. 3 of 2021 (“DPA”) and applicable e-commerce and cyber-security laws.
1) Who we are & how to contact us
-
Data Controller: Zambia Farm To Market (ZFTM)
-
Registered/Trading address: Lusaka, Zambia
-
Email: support@zamfarm2market.com
ZFTM will register with the Data Protection Commission/Commissioner (DPC) as a data controller where required and maintain such registration. You may contact the DPC at dataprotection.gov.zm for questions or complaints.
2) Scope & definitions
This policy covers all personal data we collect from website visitors, account holders (buyers, vendors/aggregators, transporters, input suppliers), and support contacts.
-
“Personal data”: information that identifies or can identify a person.
-
“Processing”: any operation performed on personal data.
-
“Controller/Processor”: as defined in the DPA.
3) What we collect
We collect the minimum data necessary to run the marketplace:
Account & identity
-
Name, email, phone, password, role (buyer/vendor/transporter/input supplier).
-
KYC (where required): NRC; for businesses, PACRA details and TPIN; for transporters, vehicle/insurance details. (Document images may be processed for verification.)
Trading & payout
-
Store profile, pickup province/district, bank or mobile money payout details.
-
Orders, invoices, quotes/RFQs, chat/dispute messages, ratings/reviews.
Payments
Device & usage
Optional AI features
4) Why we process your data (purposes & legal bases)
We process personal data only where a lawful basis applies:
-
Operate the marketplace & perform a contract
Account creation, listings, orders, transport bookings, payouts, support.
-
Legal obligations
KYC/verification, tax and accounting, security incident reporting.
-
Legitimate interests
Fraud prevention, platform security, service improvement, non-intrusive service notifications.
-
Consent
Certain marketing communications, optional analytics or cookies, and specific AI features if flagged as optional. You can withdraw consent at any time.
5) Sharing your data
We share only what is necessary:
-
Between trading parties (buyer ↔ vendor ↔ transporter): order/contact details needed to fulfil an order (e.g., phone, pickup location, delivery notes).
-
Payment gateway/MNOs: to process mobile money payments and refunds.
-
Verification & compliance providers: KYC validation, document checks when required by law.
-
Logistics & service providers: where you ask us to arrange transport or storage.
-
Hosting/IT & analytics: secure infrastructure and performance/usage analytics.
-
Regulators and law enforcement: where we must comply with the law.
6) International transfers
If we transfer personal data outside Zambia (for example, to cloud providers or support tools), we will use safeguards permitted by the DPA (e.g., standard contracts/intra-group schemes approved by the DPC, or transfers to jurisdictions the DPC deems adequate/necessary).
7) Security
We use administrative, technical and organisational measures appropriate to the risk, including encryption in transit, strict access controls, backups, monitoring, staff confidentiality, and vulnerability management. We maintain written security policies and review safeguards periodically as guided by the DPC.
Breach notification: If a personal-data breach occurs, we will notify the DPC within 24 hours, and affected individuals as soon as practicable, as required by the DPA.
8) Your rights
Under the DPA, you may have the right to:
-
Access your data and get a copy;
-
Rectify inaccurate data;
-
Erase data in certain cases;
-
Restrict processing;
-
Object to processing (including direct marketing);
-
Data portability; and
-
Not be subject to a decision based solely on automated processing that has legal or similarly significant effects, except where permitted by law.
To exercise your rights, contact support@zamfarm2market.com. We will respond within timelines set by law and may request proof of identity.
You may also lodge a complaint with the Data Protection Commission if you believe we have not handled your data lawfully.
9) Cookies & analytics
We use cookies and similar technologies to run the site and understand usage.
-
Essential cookies (strictly necessary): login, cart, security—cannot be switched off.
-
Functional/Performance cookies: improve features and speed.
-
Analytics/Measurement cookies (optional): help us improve content and UX.
You can manage cookies in your browser settings and (where available) via our cookie banner preferences.
10) Children’s data
Our services are not directed to children under 18. We do not knowingly collect children’s data. If you believe a child has provided personal data, contact us to delete it.
11) Data retention
We keep data only as long as needed for the purposes above or as required by law. For example:
-
Account data: for the life of the account.
-
KYC/transactions: for a period required by financial, tax or regulatory obligations after your last transaction.
-
Order, chat and dispute records: for the limitation period allowed by law.
We will delete or irreversibly anonymise data when retention periods expire.
12) Marketing
We may send service announcements (non-marketing). We send marketing only with your consent, and you can opt-out anytime (email footer link or account settings).
13) Third-party links & integrations
Our site may link to third-party sites or tools (e.g., payment gateway, mapping, AI advisory). Their privacy practices apply to your use of those services. Review their policies before sharing data.
14) Changes to this policy
We may update this policy to reflect legal, technical or business changes. We will post the new version with an updated “Effective date,” and, where appropriate, notify you through the site or email.
15) Contact us
For questions, requests, or complaints about this policy or your personal data:
Email: support@zamfarm2market.com
Address: Lusaka, Zambia
If you are not satisfied with our response, you can contact the Data Protection Commission via dataprotection.gov.zm or the contact details published there.
Legal references (plain-English)
-
Data Protection Act No. 3 of 2021 (rights, controller obligations, registration, breach notification).
-
Electronic Communications and Transactions Act, 2021 (e-commerce, e-signatures, online records).
-
Cyber Security and Cyber Crimes Act, 2021 (security and cyber-crime context).
Reviews
There are no reviews yet.