Privacy policy
This policy explains how Soda ZW (“Soda ZW”, “we”, “our” or “us”) handles personal information collected through sodazw.co.zw, the Soda ZW billing and order-management system, WhatsApp, email, telephone and in-person customer service (together, the “Services”). It is written with reference to Zimbabwe’s Cyber and Data Protection Act [Chapter 12:07] and applicable regulations.
1. Personal information we collect
Information you provide. This may include your name, telephone or WhatsApp number, optional email address, delivery area or address, products selected, cylinder or machine compatibility information, fulfilment choice, preferred payment method, order notes, support messages and any photograph you choose to send for product compatibility or condition checks.
Order, billing and payment records. We create order references and may keep quotations, invoices, credit notes, payment status, transaction references, delivery or collection information, refill or exchange records and communications relating to the transaction. Payments offered through Paynow are completed on Paynow’s hosted service. Soda ZW does not ask you to enter your card PIN, mobile-wallet PIN or one-time password into our website.
Information from use of the Services. Our systems and hosting providers may process IP address, browser and device type, request time, pages or features used, security events and similar technical information needed to deliver and protect the Services. If you consent to optional Google measurement, Google may also process device, browser, page-view and interaction information for website analytics and advertising measurement.
Information stored on your device. The website stores your basket locally. If you choose “Remember my details”, your name, telephone number, optional email address and preferred payment method are stored in that browser for up to 30 days. Your measurement choice is also stored locally so the website can respect it.
We do not need sensitive personal information to sell our products or provide normal refill services. Please do not send health information, identity documents, financial credentials or other sensitive information unless we specifically explain why it is required and the lawful basis for processing it.
2. How and why we use personal information
We process personal information only where it is necessary, fair and lawful. Depending on the circumstances, processing is based on your consent or implied consent, compliance with a legal obligation, protection of vital interests, or Soda ZW’s legitimate interests where those interests are not overridden by your rights and freedoms.
- receive, verify and confirm orders, quotations, refills and cylinder exchanges;
- check stock, product and cylinder compatibility, delivery area and collection arrangements;
- create invoices, record payments, reconcile accounts and maintain customer service records;
- communicate order status, payment links, reminders, delivery information and support responses;
- detect duplicate submissions, prevent fraud, secure the website and investigate misuse;
- comply with accounting, tax, regulatory, court or other lawful obligations;
- understand and improve the website where optional measurement has been accepted; and
- establish, exercise or defend legal rights and resolve complaints or disputes.
Optional promotional communication and optional measurement depend on your choice. You may withdraw consent without affecting processing that was lawful before withdrawal.
3. Disclosure of personal information
We disclose only what is reasonably necessary to:
- authorised Soda ZW personnel who need the information for orders, billing, support, stock, delivery or administration;
- service providers supporting hosting, information technology, email, communications, backup, security, accounting or delivery under appropriate confidentiality and security arrangements;
- Paynow and payment providers when you choose an available hosted payment method;
- WhatsApp/Meta when you choose to communicate through WhatsApp;
- Google for optional analytics or advertising measurement only in accordance with your measurement choice;
- professional advisers, insurers or transaction counterparties where reasonably necessary and subject to appropriate confidentiality; or
- regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law.
We do not sell or rent customer personal information. Third-party services operate under their own terms and privacy notices when you leave Soda ZW’s website or use their hosted service.
4. Retention
We keep identifiable personal information no longer than necessary for the purpose for which it was collected. Retention depends on the nature and sensitivity of the information, the order or customer relationship, security and dispute risks, and applicable accounting, tax, regulatory and legal requirements.
- Browser basket information remains until it is cleared or replaced.
- Remembered checkout details expire after 30 days unless cleared sooner.
- Measurement choices remain until changed or browser storage is cleared.
- Order, invoice, payment and accounting records are retained for the applicable statutory and business-record period.
- Support and operational records are deleted, anonymised or restricted when no longer reasonably needed.
Information may be retained longer where required by law, necessary to investigate fraud or a security incident, resolve a dispute, collect an amount due, or establish, exercise or defend legal rights. Backup copies are removed through the normal backup lifecycle.
5. Data controls and cookies
Essential browser storage supports the basket, checkout safety, duplicate-order prevention and your privacy choice. Optional Google analytics and advertising storage is denied unless you select “Allow measurement”. Choosing “Essential only” does not prevent you from browsing, ordering, tracking an order or using WhatsApp.
You can also clear Soda ZW site data through your browser settings. Clearing site data removes the local basket, remembered checkout details and saved measurement choice on that browser.
6. Your rights
Subject to the Cyber and Data Protection Act and any lawful limitations, you may ask Soda ZW to:
- inform you how your personal information is being used;
- provide access to personal information held about you;
- correct inaccurate, false or misleading personal information;
- delete false or misleading personal information;
- consider an objection to all or part of the processing; or
- withdraw consent where processing depends on consent.
Send a request using the contact details below and describe what you need. We may take proportionate steps to verify your identity and authority before disclosing or changing records. Some information cannot be deleted immediately where retention or processing is required by law, necessary for accounting or payment records, or needed to protect legal rights. We will explain the applicable reason.
7. Children
The Services are intended for customers who can lawfully place an order. Under Zimbabwe’s Act, a child is a person under 18. We do not knowingly request personal information directly from a child without the consent or involvement of a parent, guardian or other competent person. Contact us if you believe a child has provided information without appropriate authority so we can investigate and take suitable action.
8. Security and breach response
We use proportionate technical and organisational measures intended to protect the confidentiality, integrity and availability of personal information. These include HTTPS encryption in transit, restricted billing-system access, role-based permissions, private configuration, logging, backups and service-provider controls. No internet, email or messaging service can be guaranteed completely secure.
If Soda ZW becomes aware of a security breach affecting personal information it processes, we will contain and assess the incident, preserve appropriate records and notify Zimbabwe’s Data Protection Authority within 24 hours as required by section 19 of the Act. We will also communicate with affected people where required by law or reasonably necessary to reduce a serious risk of harm.
9. Processing outside Zimbabwe
Some hosting, communications, analytics and payment providers may process or store information outside Zimbabwe. Soda ZW will use such providers only where the transfer is permitted under applicable law and an adequate level of protection or another lawful safeguard applies. The protections described in this policy continue to apply to information under Soda ZW’s control.
10. Changes to this policy
We may update this policy when our Services, providers or legal obligations change. The latest version will be published on this page with a revised effective date. If a change materially affects how we use previously collected information, we will provide an appropriate notice or request consent where required.
11. Data controller
Data controller: Soda ZW
Physical address: 100 Livingstone Avenue, Harare, Zimbabwe
Telephone/WhatsApp: +263 77 173 9696
Email: billing@sodazw.co.zw
12. Contact and complaints
Contact Soda ZW first if you wish to exercise a right or raise a privacy concern. We will review the request and respond as soon as reasonably practicable. You may also lodge a complaint with Zimbabwe’s Data Protection Authority, which is the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).
Make a privacy request