Privacy Policy

• Account data: Name, email address, phone number, and password hash when you register.
• Identity verification: National Registration Card (NRC) or passport number and document image, and a selfie/liveness image, for KYC (sellers and riders only).
• Orders and payments: Products ordered, delivery address, mobile money transaction reference, and payment amounts.
• Location data: Delivery coordinates (buyers) and live GPS position (riders during active deliveries only).
• Device and usage: App version, device model, and event logs for bug diagnosis.
• Communications: Messages sent through the in-app chat feature and support correspondence.

We process personal data where:

• it is necessary to perform our contract with you (e.g. fulfilling and delivering orders);
• we have a legal obligation (e.g. KYC, AML, and financial record-keeping);
• it is in our legitimate interest (e.g. fraud prevention and service improvement); or
• you have given consent (e.g. optional marketing notifications), which you may withdraw at any time.

• Matching buyers, sellers, and riders to fulfil orders.
• Processing mobile money payments and maintaining payment records.
• Verifying seller and rider identities for platform safety and legal compliance.
• Sending order status notifications and delivery updates.
• Detecting, investigating, and preventing fraud and prohibited activity.
• Improving our products through aggregated analytics.

We do not sell personal data. We share data only as follows:

• Riders: A buyer's delivery address and contact are shared with the assigned rider to complete delivery.
• Sellers: A buyer's name and order details are shared with the relevant seller.
• Payment processors: Mobile money reference data is exchanged with MTN, Airtel, and Zamtel as needed.
• Service providers: Vetted processors (e.g. hosting, notifications) acting on our instructions under contract.
• Legal and regulatory: Where required by Zambian law, the Financial Intelligence Centre, Bank of Zambia, or a court order.

Where data is stored or processed outside Zambia (for example by cloud hosting providers), we take steps to ensure it receives a level of protection consistent with the Data Protection Act No. 3 of 2021, including contractual safeguards with those providers.

Account data is retained while your account is active. Payment, order, and KYC records are retained for the periods required by Zambian financial and AML law (see our AML/CTF Policy). You may request deletion of non-mandatory data by emailing support@lupasphere.com.

We store passwords as bcrypt hashes and transmit all data over TLS. Payment references are never stored in plain text. Access to production systems is restricted to authorised Lupasphere personnel only. We maintain procedures to detect and respond to personal data breaches.

Under the Data Protection Act No. 3 of 2021 you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of data we are not legally required to keep;
• object to or restrict certain processing; and
• withdraw consent where processing is based on consent.

To exercise any right, contact support@lupasphere.com. We respond within the period required by law.

Our Services are intended for users aged 18 and over. We do not knowingly collect personal data from children. If we learn that we have done so, we delete it.

If you are not satisfied with how we handle your data, you may contact us first at support@lupasphere.com, and you have the right to lodge a complaint with the Data Protection Commissioner of Zambia.

Lupasphere Integrated Platforms Limited
Plot 1193/B, Ibex, Chongwe, Zambia
PACRA: 120261046351
General: info@lupasphere.com · Support: support@lupasphere.com