Privacy Policy

1. Introduction

Digital Guild (also known as "Mhizha") ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our WhatsApp-based service matching platform that connects customers with verified local service providers.

This policy is designed to comply with Zimbabwe's Cyber and Data Protection Act, 2021, the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024, and Meta's WhatsApp Business Messaging Policy.

2. Data Controller Information

Company Name: Digital Guild
Operating Location: Zimbabwe
Contact: takudzwa.mombe@honeycomb.co.zw
POTRAZ Registration: [Registration Number - Pending/To Be Added]

Note: Digital Guild is registered with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as required under the Cyber and Data Protection Act, 2021.

3. WhatsApp Communication and Consent

3.1 Opt-In Consent

By using our WhatsApp service, you explicitly consent to:

• Receive messages and calls from Digital Guild via WhatsApp
• Share your WhatsApp phone number with our service
• Receive service notifications, job alerts, and platform updates
• Have your messages processed through Meta's WhatsApp Business API

3.2 How to Opt-Out

You can opt-out of communications at any time by:

• Sending "STOP" or "UNSUBSCRIBE" via WhatsApp
• Blocking our WhatsApp Business number
• Contacting us at takudzwa.mombe@honeycomb.co.zw

4. Information We Collect

4.1 Personal Information

• Contact Information: WhatsApp phone number, full name
• Location Data: GPS coordinates, location address (for service matching)
• Identity Verification: ID document photos, selfies with ID (for service providers)
• Service Information: Service category, job descriptions, photos of work required
• Transaction Data: Service quotes, payment amounts, job completion status
• Performance Data: Ratings, reviews, completed jobs, wallet balance

4.2 Automatically Collected Information

• WhatsApp message metadata (timestamps, message IDs)
• Device information and IP addresses
• Usage patterns and interaction data
• Clock-in/clock-out timestamps for service providers

5. How We Use Your Information

We use your personal data for the following purposes:

• Service Delivery: Match customers with nearby service providers, facilitate job assignments
• Communication: Send job alerts, quotes, confirmations, and updates via WhatsApp
• Verification: Verify service provider identities and qualifications
• Payment Processing: Track payments, manage wallet balances, generate receipts
• Quality Control: Monitor ratings, reviews, and service quality
• Platform Improvement: Analyze usage patterns to improve our services
• Legal Compliance: Meet regulatory requirements and resolve disputes

6. Legal Basis for Processing

Under Zimbabwe's Cyber and Data Protection Act, 2021, we process your data based on:

• Consent: You have explicitly opted in to use our service via WhatsApp
• Contract Performance: Processing is necessary to fulfill our service agreement
• Legal Obligation: Compliance with Zimbabwe's data protection laws
• Legitimate Interests: Platform security, fraud prevention, and service improvement

7. Data Sharing and Disclosure

7.1 Service Providers We Share With

• Meta/WhatsApp: Messages processed through WhatsApp Business API
• Supabase: Database hosting and authentication services
• Google (Gemini AI): AI-powered pricing suggestions and service matching
• Vercel: Application hosting and deployment

7.2 Data Shared Between Users

• Customers see: Provider name, category, rating, location (when job accepted)
• Providers see: Customer location, service required, photos of work (when job alert sent)

7.3 We Do Not Sell Your Data

Digital Guild does not sell, rent, or trade your personal information to third parties for marketing purposes.

8. Cross-Border Data Transfers

Your data may be transferred outside Zimbabwe to our service providers (Supabase, Meta, Google, Vercel). We have notified POTRAZ of these transfers as required. These providers have implemented adequate security measures to protect your data, including:

• Encryption in transit and at rest
• Compliance with international data protection standards (GDPR, SOC 2)
• Contractual data protection agreements

9. Data Security

We implement comprehensive security measures including:

• Encryption: All data encrypted in transit (TLS) and at rest (AES-256)
• Access Controls: Row Level Security (RLS) policies on database
• Authentication: Secure password hashing (bcrypt), session management
• Monitoring: Regular security audits and system testing
• Backup: Regular automated backups with point-in-time recovery

10. Data Retention

We retain your personal data for the following periods:

• Active Users: Data retained while your account is active
• Job Records: 7 years (for payment disputes and legal compliance)
• ID Documents: Deleted after provider verification or account closure
• WhatsApp Messages: Conversation state retained for 24 hours only
• After Account Deletion: Personal data deleted within 30 days

11. Your Rights Under Zimbabwe Law

Under the Cyber and Data Protection Act, 2021, you have the right to:

• Access: Request a copy of your personal data we hold
• Rectification: Correct inaccurate or incomplete information
• Erasure: Request deletion of your data (subject to legal obligations)
• Object: Object to processing for direct marketing purposes
• Data Portability: Receive your data in a portable format
• Withdraw Consent: Opt-out of communications at any time
• Lodge a Complaint: File a complaint with POTRAZ

To exercise these rights, contact us at takudzwa.mombe@honeycomb.co.zw. We will respond within 30 days.

12. Data Breach Notification

In the event of a data breach, we will notify POTRAZ within 24 hours as required by law. If the breach poses a high risk to your rights, we will notify you within 72 hours via WhatsApp or email.

13. Children's Privacy

Our service is not intended for individuals under 18 years of age. We do not knowingly collect data from minors. If we discover we have collected data from a minor, we will delete it immediately.

14. Data Protection Officer

As required by Zimbabwe's regulations, we have appointed a Data Protection Officer (DPO). You can contact our DPO regarding any privacy concerns:

Email: dpo@takudzwa.mombe@honeycomb.co.zw
Phone: [DPO Phone Number]

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes via WhatsApp. Your continued use of our service after such notification constitutes acceptance of the updated policy.

16. Contact Us

For any questions or concerns about this Privacy Policy or our data practices, please contact us:

17. Regulatory Authority

If you have concerns about how we handle your data, you may contact: