Privacy Policy

Last updated: 6 September 2026

1. Introduction and who we are

This Privacy Policy explains, in plain language, what personal data Afroshift Packaging ("we", "us", "our") collects, why we collect it, how we use and protect it, and the rights you have over it.

We are a wholesale supplier of packaging and disposable products, operating an online shop and a physical store in Harare, Graniteside, Zimbabwe. We buy our stock in consignments from our headquarters in China and sell to businesses and individuals in Zimbabwe.

We are committed to processing personal data lawfully, fairly and transparently, in line with the Constitution of Zimbabwe, the Cyber and Data Protection Act [Chapter 12:07] of 2021 (the "Act") and good privacy practice. This policy applies to everyone who visits our online shop, creates an account, places an order, contacts us, or works with us.

For the purposes of the Act, we are the "data controller" for the personal data described in this policy. This means we decide why and how your personal data is processed. If you have any questions about this policy, please contact us using the details in Section 19.

2. What is personal data?

Personal data means any information relating to an identified or identifiable living person. It includes obvious things such as your name, phone number and email address, and can also include less obvious things such as an order reference, an IP address, or a record of when you contacted us.

We do not collect "sensitive" personal data (such as health, genetic, biometric or religious information) and we ask you never to send us such information.

3. What personal data we collect

We practise data minimisation: we collect only the personal data we genuinely need, and no more. The data we collect depends on how you use our services:

• Account data — if you create a customer account: your full name, phone number, email address, and a password (stored only in a hashed, non-readable form). We do not ask for your physical address unless you choose to provide it.

• Order data — when you place an order (as a guest or with an account): your name, phone number, optional email, the products and quantities ordered, the order total, the date, and a 4-digit pickup code we generate so our staff can hand your order to you safely.

• Communication data — if you contact us by phone, email, WhatsApp, Instagram or Facebook: your contact details and the content of your enquiry, which we keep so we can help you and follow up.

• Staff data — for people who work in our business and use the management system: name, username, contact details, role and access permissions. This is kept strictly internal.

• Technical data — our online shop uses a single essential session cookie to keep you signed in and to remember your shopping cart. We do not use tracking, advertising or analytics cookies, and we do not collect browsing histories.

We never collect payment card details: we do not take online or card payments. All payment is cash on pickup or delivery.

4. How we collect your data

We collect personal data in three ways:

• Directly from you — when you fill in the account registration form, place an order, contact us, or ask us a question through the assistant on the website.

• Automatically while you use the website — our essential session cookie is placed on your device so the shop functions (keeping your cart and sign-in working). Your browser's local storage is used only for interface preferences such as your theme choice and this notice; that data stays on your own device.

• From your device when you call or write to us — your phone number appears when you call, and your email address when you email. We treat these as you having contacted us directly.

We do not buy personal data from third parties, and we do not collect data from social media or other public sources about you.

5. Why we process your data and the legal bases

We process personal data only for specific, legitimate purposes and only where the Act allows us to. The main purposes and their legal bases are:

• To provide our service and fulfil orders — we need your name, phone number and order details to prepare, confirm and hand over your order, and to verify your identity at pickup using the 4-digit code. Legal basis: performance of the contract you enter into with us when you place an order.

• To manage your customer account — so you can track your orders, re-order easily and keep your details correct. Legal basis: your consent, given when you create the account (withdrawable at any time).

• To respond to your enquiries and provide customer support. Legal basis: our legitimate interest in helping our customers, and steps you ask us to take before entering a contract.

• To run and secure our business — including staff access to the management system, keeping records required by law (such as for tax), and protecting the website against abuse or fraud. Legal basis: our legitimate interests and legal obligations.

• To send you order updates (for example to confirm your order or tell you it is ready). Legal basis: performance of the contract. We do not send marketing messages unless you separately opt in.

We will not use your personal data for purposes that are incompatible with those listed above. If we ever wish to use your data for a new purpose, we will update this policy and, where the law requires, ask for your consent.

6. Consent and how you can withdraw it

Where we rely on your consent (for example, when you create an account or choose to receive communications), we obtain it freely, specifically, and clearly — such as by ticking a consent box. You are never forced to give consent.

You may withdraw your consent at any time, in whole or in part, without giving a reason and without penalty. Withdrawing consent will not affect the lawfulness of processing we carried out before you withdrew it, and it will not prevent us from processing data where we rely on another legal basis, such as fulfilling an order you have already placed.

To withdraw consent, simply contact us using the details in Section 19, or use any "unsubscribe" link we provide in messages.

7. Data minimisation and why we do not collect more

The Act requires that personal data be "adequate, relevant and limited to what is necessary" for the purposes for which it is processed. We take this seriously:

• We collect your name, phone and email because we cannot prepare, confirm and hand over an order without knowing who it is for and how to reach them.

• We do not collect your physical address, ID numbers, date of birth, marital status, or any financial information, because we do not need them.

• We do not process payment cards, bank accounts or mobile-money details, because you pay in cash at the store.

• We do not run advertising or analytics on the website, so there is no data for those systems to collect.

If you choose not to provide data that is genuinely needed, we may not be able to provide that particular service (for example, we cannot place an order without a phone number to reach you on). You can always browse the shop without creating an account.

8. Sharing and disclosure

We do not sell, rent, trade or otherwise disclose your personal data to any third party for their own marketing or commercial purposes. Period.

We share personal data only in the following limited circumstances:

• With our hosting provider — our website and database are hosted by a third-party provider that processes data on our instructions and under our control, purely to keep the site running. They are contractually bound to keep data confidential and secure.

• With our staff — only authorised staff who need the data to do their job (for example, to prepare your order) can access it, and their access is role-based and logged.

• Where required by law — we may disclose data to courts, regulators (including POTRAZ, the Data Protection Authority), tax authorities or law enforcement where the law obliges us to, and only to the extent required.

We never publish or share customer lists, and we never disclose data in response to informal requests.

9. International transfers

Our business model involves stock shipped from China, but personal data is a separate matter: your personal data is stored on our own servers in Zimbabwe, hosted with our hosting provider, and is not routinely transferred outside Zimbabwe.

Where any transfer of personal data outside Zimbabwe occurs (for example, if our hosting provider operates data centres in another country, or we use an international support service), we ensure appropriate safeguards are in place to protect your data in line with the Act, including data-processing agreements that require equivalent protection.

10. How long we keep your data

We keep personal data only for as long as necessary for the purposes for which it was collected, and for any legal, accounting or reporting obligations that require us to keep records longer. Our retention approach:

• Customer accounts — kept for as long as your account is active, and for a reasonable period after you stop using it. You may ask us to delete your account and its data at any time.

• Orders — order records are kept for business and tax record-keeping (generally required for several years under Zimbabwe tax law), after which they are deleted or anonymised.

• Enquiries and support messages — kept while we are helping you and for a short period afterwards so we can follow up consistently.

• Staff records — kept for the duration of the working relationship and afterwards as required by employment and tax law.

• Logs and technical records — kept only as long as needed for security and troubleshooting, and then deleted.

When data is no longer needed, we delete it securely or anonymise it so it can no longer identify you.

11. How we protect your data

We use reasonable and appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and disclosure. These include:

• Encryption in transit — the website is served over HTTPS so data travelling between your browser and our servers is encrypted.

• Password security — account and staff passwords are stored only as salted, one-way hashes (bcrypt), never in plain text. We encourage strong passwords.

• Access control — the management system uses role-based permissions, so each staff member can only see and do what their role allows. Every action is recorded in an activity log.

• Backups — we keep regular encrypted backups of the database to protect against loss, and access to backups is restricted.

• Good practices — we keep software updated, restrict physical and logical access to servers, and review our security from time to time.

No system is completely secure. In the unlikely event of a data breach that creates a risk to your rights and freedoms, we will notify you and the Data Protection Authority as required by the Act.

12. Your rights under the Act

You have the following rights regarding your personal data. You may exercise any of them free of charge by contacting us (Section 19):

• Right of access — to obtain confirmation of whether we process your personal data, and a copy of the data we hold about you, together with information about how and why we process it.

• Right to rectification — to have inaccurate or incomplete personal data corrected without undue delay.

• Right to erasure ("right to be forgotten") — to ask us to delete your personal data, where the legal conditions are met (for example, where consent is withdrawn and there is no other lawful basis to keep it).

• Right to restriction of processing — to ask us to pause processing in certain circumstances, for example while a dispute about accuracy is resolved.

• Right to withdraw consent — as described in Section 6.

• Right to object — to object to processing based on our legitimate interests, on grounds relating to your particular situation.

• Right to data portability — to receive the personal data you provided to us, in a structured, commonly used and machine-readable format, and to transmit it to another controller where technically feasible.

• Right to complain — to lodge a complaint with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the designated Data Protection Authority, at POTRAZ House, Sam Nujoma Street, Harare, or through their website.

To protect your privacy and the security of your data, we may need to verify your identity before acting on a request (for example, by confirming details only you would know). We will respond within the timeframes set by the Act, and in any event without undue delay.

13. Automated decision-making and profiling

We do not use automated decision-making that produces legal or similarly significant effects, and we do not profile you for marketing. Simple automated logic is used only where it is part of the service itself (for example, generating a unique 4-digit pickup code, or calculating order totals) — these do not make decisions about you as a person.

14. Children's privacy

Our services and products are intended for businesses and adults. We do not knowingly collect personal data from children under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it as soon as practicable.

15. Cookies and similar technologies

We use one essential session cookie to make the online shop work (keeping your sign-in and shopping cart active). This cookie is strictly necessary — without it the shop cannot function. We do not use advertising, analytics, tracking or third-party cookies.

Your browser's local storage is used only for interface preferences (theme choice, cookie-notice preference), which never leaves your device.

For full details, including how to manage cookies in your browser, please see our separate Cookie Policy (linked in the footer).

16. Third-party links

Our website or shop may link to third-party websites (such as Instagram, Facebook or WhatsApp). We are not responsible for the privacy practices of those websites. We encourage you to read the privacy policies of any third-party site you visit from our links.

17. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The current version will always be available on this page, with the "Last updated" date shown at the top. If we make significant changes that affect your rights, we will take reasonable steps to bring them to your attention, for example by a notice on the shop.

18. Complaints

If you are unhappy with how we handle your personal data, please contact us first — most concerns can be resolved quickly and we will always take your complaint seriously.

If we cannot resolve the matter to your satisfaction, you have the right to complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the Data Protection Authority under the Cyber and Data Protection Act [Chapter 12:07].

19. Contact us

To exercise any of your rights, withdraw consent, ask a question about this policy, or report a concern, please contact us at:

• Email: afroshift2020@gmail.com or +263 77 824 7543 or +263 77 439 0012 or +8613259030158

• In person: our store in Harare, Graniteside, Zimbabwe (see the footer for the address).

We aim to respond to all privacy requests within a reasonable time and in line with the Act.