AFRIKOMART

PRIVACY POLICY

Afrikomart Digital Limited

Effective Date: 20 August 2026 | Version 1.0

www.afrikomart.com/privacy-policy

This Privacy Policy is governed by the Zambia Data Protection Act, 2021 (Act No. 3 of 2021).

1. Introduction

Afrikomart Digital Limited ("Afrikomart", "we", "us", or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, share, retain, and protect your personal data when you use the Afrikomart B2B e-commerce platform, accessible at www.afrikomart.com (the "Platform").

This policy applies to all users of the Platform, including registered Buyers, Field Agents, Delivery Drivers, and Administrators. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy is prepared in compliance with the Zambia Data Protection Act, 2021 (Act No. 3 of 2021), and any subsidiary legislation made thereunder.

Data Controller: Afrikomart Digital Limited

Registered Address: Plot 255/609A Zambezi Road, Roma, Lusaka, Lusaka Province, 10101, Zambia

PACRA Registration No.: 120261045653

ZICTA Registration: Registration as a data controller with ZICTA is currently pending and will be completed prior to commercial launch

2. Definitions

In this Privacy Policy, the following terms have the meanings set out below:

1. "Personal Data" means any information relating to an identified or identifiable natural person, as defined under the Zambia Data Protection Act, 2021.
2. "Processing" means any operation or set of operations performed on personal data, including collection, recording, storage, retrieval, use, disclosure, or erasure.
3. "Data Subject" means any individual whose personal data is processed by Afrikomart.
4. "Platform" refers to the Afrikomart web and mobile application, accessible at www.afrikomart.com.
5. "B2B Users" means registered business entities including retailers, distributors, and wholesalers who use the Platform to place orders.
6. "Third-Party Processor" means any organisation that processes personal data on our behalf and under our instructions.
7. "ZRA" means the Zambia Revenue Authority.
8. "VSDC" means the Virtual Sales Data Controller, a ZRA-mandated system for digital tax invoice generation.

3. Information We Collect

We collect the following categories of personal data when you register for and use the Platform:

3.1 Account & Identity Information

1. Full name and public/trade name
2. Business or company name and type
3. Industry or business segment
4. Username and encrypted password

3.2 Contact Information

1. Mobile phone number (used for OTP-based authentication and notifications)
2. Email address (used for account communications and notifications)
3. Physical business address, city, province, and ZIP/postal code

3.3 Financial & Transaction Information

1. Preferred payment method (Cash on Delivery, Mobile Money, Business Credit Terms)
2. Assigned credit limit and credit settlement period
3. Order history and purchase records
4. Payment transaction references (no full card numbers are stored by Afrikomart)
5. Cash-on-delivery remittance records

3.4 Location Data

1. Delivery address and province (for order fulfilment and product availability)
2. Real-time GPS coordinates of delivery vehicles (for live delivery tracking) — applicable to registered Drivers only
3. Approximate location derived from province selection (for product catalogue filtering)

3.5 Device & Technical Information

1. Device identifiers and push notification tokens (for Firebase Cloud Messaging)
2. Browser type, operating system, and device type (collected automatically when you access the Platform)
3. IP address and session information
4. Cookies and locally stored data (see Section 11)

3.6 Usage & Behavioural Data

1. Order and browsing history, product views, and search queries
2. App interaction logs and session duration
3. Performance and crash reports (via Firebase Crashlytics)
4. Aggregate analytics data (via Google Analytics)

4. How We Collect Your Information

We collect personal data through the following means:

1. Directly from you: When you register for an account, complete your business profile, place an order, submit a delivery address, or contact our support team.
2. Automatically: When you use the Platform, we automatically collect device, session, and usage data through cookies, local storage, and app analytics tools.
3. From your employer or field agent: If your account is created by a Mount Meru Group Field Agent on your behalf during the onboarding process.
4. From third-party systems: Order and inventory data may be received from Odoo ERP to keep your account information accurate and up to date.

5. How We Use Your Information

We use your personal data for the following purposes:

5.1 Account Management & Authentication

1. Creating and managing your Afrikomart account
2. Verifying your identity through OTP (One-Time Password) authentication via SMS
3. Enabling role-based access to features appropriate to your account type (Buyer, Field Agent, Driver, Administrator)
4. Processing your account registration and approval workflow

5.2 Order Processing & Fulfilment

1. Processing bulk and individual product orders
2. Validating Minimum Order Quantities (MOQ) and applying dynamic pricing
3. Coordinating delivery to your specified address
4. Providing real-time order tracking and status updates
5. Generating ZRA-compliant digital invoices for each transaction

5.3 Payment Processing

1. Processing payments via integrated payment gateways (Tingg, Airtel Money, FNB Bank)
2. Managing B2B credit allocations and settlement tracking
3. Reconciling Cash on Delivery (COD) payments
4. Synchronising financial records with Odoo ERP

5.4 Communications & Notifications

1. Sending order confirmation, dispatch, and delivery notifications via SMS and email
2. Delivering push notifications through Firebase Cloud Messaging
3. Sending promotional communications, product offers, and seasonal campaigns (with your consent)
4. Responding to your support enquiries and complaints

5.5 Regulatory Compliance

1. Reporting sales transactions to the Zambia Revenue Authority (ZRA) via the VSDC system
2. Generating ZRA-compliant tax invoices with digital signatures and QR codes
3. Maintaining transaction records as required by Zambian tax law
4. Complying with applicable Zambian laws and regulatory obligations

5.6 Platform Improvement & Analytics

1. Monitoring platform performance, stability, and availability
2. Analysing usage patterns to improve the user experience
3. Generating business intelligence reports and KPI dashboards for Afrikomart administrators
4. Diagnosing and resolving technical issues through crash reports

6. Legal Basis for Processing

Under the Zambia Data Protection Act, 2021, we process your personal data on the following lawful bases:

1. Contractual necessity: Processing required to fulfil our obligations under the Terms and Conditions you agreed to when creating your Afrikomart account, including order processing, payment, and delivery.
2. Legal obligation: Processing required to comply with Zambian laws, including ZRA tax reporting and invoice generation obligations.
3. Consent: Processing for marketing communications and non-essential cookies. You may withdraw your consent at any time by contacting us at contact@afrikomart.com.
4. Legitimate interests: Processing for platform security, fraud prevention, system monitoring, and business analytics — where such interests are not overridden by your data protection rights.

7. How We Share Your Information

We do not sell your personal data to any third party. We share your data only in the following circumstances:

7.1 Third-Party Service Providers (Data Processors)

We share data with the following service providers who process data on our behalf and are contractually bound to protect it:

7.2 Regulatory & Legal Disclosures

We may disclose your personal data when required to do so by law, regulation, court order, or at the direction of a competent authority in Zambia, including but not limited to the Zambia Revenue Authority and the Zambia Information and Communications Technology Authority (ZICTA).

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving Afrikomart Digital Limited, your personal data may be transferred to the successor entity, subject to the same privacy protections described in this policy. You will be notified of any such transfer in advance.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by applicable Zambian law. The following retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be linked to an identifiable individual.

9. Your Rights Under the Zambia Data Protection Act, 2021

As a data subject under the Zambia Data Protection Act, 2021, you have the following rights in relation to your personal data:

9.1 Right of Access

You have the right to request a copy of the personal data we hold about you. You may access your account data directly through the Platform, or request a full data export by contacting us at contact@afrikomart.com. We will respond within 48 hours of receiving your request.

9.2 Right to Rectification

You have the right to correct inaccurate or incomplete personal data. You may update your business name, contact details, and delivery address directly through the Platform. For other corrections, please contact contact@afrikomart.com.

9.3 Right to Erasure

You have the right to request the deletion of your personal data. To submit a deletion request, please contact us at contact@afrikomart.com with the subject line "Data Deletion Request". Please note that certain data may be retained to comply with legal obligations (e.g., ZRA transaction records must be retained for 7 years) and cannot be deleted at your request.

9.4 Right to Withdraw Consent

Where processing is based on your consent (e.g., marketing communications), you may withdraw your consent at any time by contacting us at contact@afrikomart.com with the subject line "Withdraw Marketing Consent". Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

9.5 Right to Data Portability

You may request your personal data in a structured, commonly used, and machine-readable format by contacting us at contact@afrikomart.com. This right applies to data you have provided to us under a contract or on the basis of consent.

9.6 Right to Object

You have the right to object to the processing of your personal data where we rely on legitimate interests as the legal basis. To exercise this right, please contact us at contact@afrikomart.com. We will assess your objection and respond within 48 hours.

9.7 Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Zambia Information and Communications Technology Authority (ZICTA), which is the supervisory authority for data protection in Zambia.

1. ZICTA Website: www.zicta.zm
2. ZICTA Address: ZICTA House, Lusaka, Zambia

10. Marketing Communications

With your consent, we may send you promotional communications including product offers, seasonal campaigns, new product announcements, and platform updates via SMS, email, and push notifications.

You may opt out of marketing communications at any time by contacting us at contact@afrikomart.com with the subject line "Withdraw Marketing Consent". We will process your request within 48 hours. Please note that opting out of marketing communications will not affect transactional communications related to your orders (e.g., order confirmations, delivery notifications, OTP messages).

11. Cookies and Local Storage

The Afrikomart Platform uses cookies and browser local storage to provide and improve the service. As a Progressive Web Application (PWA), the Platform may store data locally on your device to enable offline functionality and enhance performance.

11.1 Types of Cookies and Local Storage Used

1. Essential / Functional: Required for the Platform to operate correctly — session management, authentication tokens, and user preferences. These cannot be disabled without affecting Platform functionality.
2. Performance / Analytics: Used to collect anonymised data about how users interact with the Platform (via Google Analytics). This data helps us improve the user experience.
3. PWA Cache: Service worker caches are used to enable offline access and faster loading. These store product catalogue data and UI assets locally on your device.

11.2 Managing Cookies

You may control cookie settings through your browser settings. Please note that disabling essential cookies may impair your ability to use the Platform. For PWA cache data, you may clear it through your browser or device settings under "Clear Site Data".

12. Security Measures

We implement robust technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

12.1 Technical Measures

1. HTTPS / TLS encryption enforced for all data in transit between your device and our servers
2. At-rest encryption of all personal data stored in our databases (PostgreSQL and Redis)
3. JSON Web Token (JWT) authentication with short-lived access tokens and secure refresh tokens
4. OTP-based two-factor authentication (2FA) for all login events via SMS
5. Role-Based Access Control (RBAC) ensuring users can only access data appropriate to their role
6. Automated, encrypted database backups with point-in-time recovery capabilities
7. SSL/TLS certificates managed via industry-standard certificate authorities

12.2 Organisational Measures

1. Comprehensive audit trails for all administrative actions on user data
2. Granular access permissions — staff access to personal data is restricted to those with a legitimate business need
3. Vulnerability Assessment and Penetration Testing (VAPT) conducted prior to platform launch
4. Periodic security reviews aligned to business and regulatory changes

12.3 Data Breach Response

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority (ZICTA) in accordance with our obligations under the Zambia Data Protection Act, 2021, without undue delay.

13. Children's Privacy

The Afrikomart Platform is designed exclusively for registered business entities and is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a person under 18 has registered on the Platform, please contact us immediately at contact@afrikomart.com so we can take appropriate action.

14. Zambia Revenue Authority (ZRA) Compliance

As a tax-registered business operating in Zambia, Afrikomart Digital Limited is legally required to submit sales transaction data to the Zambia Revenue Authority (ZRA) through the Virtual Sales Data Controller (VSDC) system. This includes:

1. Customer Tax Identification Number (TIN) where applicable
2. Product descriptions, quantities, and values
3. Tax calculations (VAT, Sales Tax, IPL, Tourist Tax as applicable)
4. Digital invoice details with ZRA-mandated QR codes and digital signatures

This data processing is carried out under our legal obligation and cannot be opted out of by users. All data submitted to ZRA is handled in accordance with ZRA's own data governance and security requirements.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or Platform functionality. When we make material changes, we will:

1. Update the "Effective Date" at the top of this policy
2. Notify registered users via email or in-app notification at least 14 days before the changes take effect
3. Require renewed consent where the changes affect processing based on consent

Your continued use of the Platform after the updated policy takes effect constitutes your acknowledgement of the changes. We encourage you to review this policy periodically.

16. Contact Us & Grievance Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

Afrikomart Digital Limited — Privacy / Grievance Contact

Email: contact@afrikomart.com

Phone: +260 769 669 696

Registered Address: Plot 255/609A Zambezi Road, Roma, Lusaka, Lusaka Province, 10101, Zambia

Response Commitment: We will acknowledge your request within 48 hours and resolve it within 30 days as required by the Zambia Data Protection Act, 2021

If you are not satisfied with our response, you have the right to escalate your complaint to the Zambia Information and Communications Technology Authority (ZICTA) at www.zicta.zm.

Afrikomart Digital Limited | Privacy Policy | Version 1.0 | Effective 20 August 2026

www.afrikomart.com/privacy-policy | contact@afrikomart.com | +260 769 669 696

PACRA Registration: 120261045653 | Governed by Zambia Data Protection Act, 2021 (Act No. 3 of 2021)