Privacy Policy

ZimexDubai ("we", "us", "our") is committed to protecting your personal information. This policy explains what data we collect when you use zimexdubai.com, how we use it, who we share it with, how long we keep it, and the rights you have. It is written in plain English and aligned with Zimbabwe's Cyber and Data Protection Act (Chapter 12:07), the principles of the EU General Data Protection Regulation (GDPR), and Google's requirements for online merchants.

Who is responsible for your data

ZimexDubai is the data controller for personal information collected through zimexdubai.com. You can reach our data protection point of contact at orders@zimexdubai.com.

What we collect

Why we use it (lawful basis)

• Performance of contract — to fulfil your order, process payment, dispatch the device, and provide warranty service.
• Legal obligation — to comply with Zimbabwean tax, customs, and consumer protection law.
• Legitimate interest — to detect and prevent fraud, secure our infrastructure, improve our service, and send order-related notifications.
• Consent — for optional marketing communications. You can withdraw consent at any time.

Who we share it with

We share the minimum necessary data with the following categories of processors and partners:

• Payment providers — Paynow, Pesepay, PayPal, EcoCash, OneMoney, ZIPIT. They receive only the data required to process the transaction.
• Delivery couriers — your name, delivery address, contact number, and the parcel details. The courier does not see your payment information.
• Messaging providers — Meta (WhatsApp Cloud API) for order updates, and Resend for transactional email. They process the message contents to deliver them.
• Hosting and infrastructure — our website is hosted on a server in the United States and uses Cloudflare for DNS and CDN. Logs may be processed in those countries.
• Government authorities — only when required by law, such as a valid court order or tax investigation.

We do not sell your personal information to third parties. We do not share your data with advertisers.

International data transfers

Because our hosting, CDN, and messaging providers operate globally, some of your data is processed outside Zimbabwe — in the United States, the European Union, and the United Arab Emirates. We rely on the data protection standards of those providers and standard contractual clauses where applicable.

How long we keep it

• Account information — for as long as your account is active. Inactive accounts (no login for 36 months) are anonymised.
• Order and tax records — at least 6 years to comply with Zimbabwean tax and consumer protection law.
• Support correspondence — 24 months from the last interaction.
• Server access logs — 90 days.
• Marketing email subscriptions — until you unsubscribe, plus 30 days for processing the unsubscribe.

Your rights

You can request the following at any time by emailing orders@zimexdubai.com with "Data request" in the subject line:

• Access — a copy of the personal data we hold about you.
• Correction — fix inaccurate or incomplete data.
• Deletion — delete your account and personal data (we may keep transactional records that we are legally required to retain).
• Portability — receive your data in a machine-readable format.
• Restriction — restrict how we process your data while we resolve a dispute.
• Objection — object to processing based on legitimate interest (e.g. marketing emails).
• Withdraw consent — for any processing based on your consent.

We respond within 30 days. There is no charge for reasonable requests.

Cookies and similar technologies

We use cookies and localStorage for the following purposes:

• Essential — session, shopping cart, country preference, authentication. Without these the site does not function.
• Functional — language and currency selection, recently viewed items.
• Analytics — anonymised page view and traffic source data to help us improve the site.

We do not use third-party advertising cookies or cross-site tracking. You can clear cookies at any time via your browser settings.

Children

Our service is intended for adults. We do not knowingly collect personal information from children under 16. If you believe we have collected data from a child, contact us and we will delete it.

Security

We protect your data with HTTPS encryption in transit, hashed passwords (we cannot see your actual password), restricted internal access, and encrypted database storage. No system is perfectly secure, but we apply industry-standard controls.

Breach notification

If we discover a personal data breach that is likely to result in a risk to your rights, we will notify you within 72 hours of becoming aware, as required by Zimbabwe's Cyber and Data Protection Act.

Complaints

If you are not satisfied with how we handle your data, you can complain to:

• The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) — Zimbabwe's data protection authority under the Cyber and Data Protection Act.
• The Consumer Council of Zimbabwe for consumer-protection matters.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top tells you when. Material changes will also be notified by email to registered customers.

Contact

Questions about this privacy policy? Email orders@zimexdubai.com or message us on WhatsApp via the contact page.