🔒 Privacy Policy

How ZiBuy Uganda collects, uses, shares and protects your personal data

Last updated: 15 October 2026 · Applies to the ZiBuy website and the ZiBuy mobile app

1. Introduction

ZiBuy Uganda ("ZiBuy", "we", "us") runs an online marketplace at zibuy.ziteche.com and the ZiBuy mobile app. This Privacy Policy explains what personal data we collect, why we collect it, who can see it, how long we keep it, how we protect it, and the choices and rights you have.

We handle personal data in line with the Data Protection and Privacy Act, 2019 of Uganda, and we create and keep electronic records in line with the Electronic Transactions Act, 2011 and the Electronic Signatures Act, 2011. ZiBuy is the data controller for the personal data described in this policy.

      In short: we collect only what we need to run a safe marketplace. We never sell your personal data. When you buy through ZiBuy, the order creates delivery, payment and signature records that protect buyers, sellers and ZiBuy, and we keep those records as evidence.
    

By creating an account or using ZiBuy you confirm that you have read this policy. If you do not agree with it, please do not use the platform.

2. Information We Collect

Data type	What we collect	Why
Account data	Email address, sign-in method (email and password, or Google). Passwords are handled by Google Firebase Authentication and are never visible to us.	Creating your account and keeping it secure
Profile data	Name, phone number, location, bio, profile photo, notification preferences	Your public profile, seller trust and contact
Verification documents	ID and business licence images you upload for seller or business verification	Verifying sellers and issuing verification badges
Listing data	Product or service name, description, photos, videos, price, bulk price levels, delivery areas and fees, category, location	Showing your ads to buyers
Order and payment data	Items, quantities, amounts, delivery name, phone and address, mobile-money transaction ID, plan and boost payment references	Processing orders, verifying payments, resolving disputes
Delivery and handover records	Tracking steps and times, delivery code checks, the handover photo, and the seller's phone location at handover (if allowed)	Proving that an order was delivered
Electronic signatures	Name shown on your account, time of signing, sign-in method used to sign, a document fingerprint; your IP address and device details are stored privately for admins	Handover notes and payout confirmations
Payout records	Amount sent to a seller, method (MTN, Airtel or bank), payout transaction ID, payment screenshot, the seller's confirmation	Paying sellers and proving that they received payment
Communications	Messages between users and with ZiBuy, reviews, ratings, reports, disputes	Chat, trust and safety
Usage and preferences	Wishlist, saved searches, alerts, cart, and the categories you view (kept on your device to personalise your homepage)	Personalisation and alerts
Device and technical data	Push-notification token, browser and operating system, IP address, error logs	Notifications, security and fixing problems

3. How We Use Your Information

To create and manage your account and show your listings to buyers.
To process orders placed through ZiBuy: verifying payments, splitting an order between sellers, tracking delivery, releasing payment to sellers, and handling disputes.
To send notifications and emails about orders, delivery steps, messages, payouts and account activity.
To verify sellers and businesses and issue verification and trust badges.
To create permanent records and signed documents that can be used as evidence of what happened in an order.
To prevent fraud, abuse and illegal activity, including automated checks that flag suspicious listings for review.
To personalise what you see, such as showing categories you often view first, price-drop and saved-search alerts.
To send promotional emails and deals. You can unsubscribe at any time.
To improve, test and secure the platform, and to comply with the law.

Our legal bases are: your consent; performing the contract between you and ZiBuy (including orders); our legal obligations; and our legitimate interests in security, fraud prevention and improving the service.

4. Orders Paid Through ZiBuy: What Is Recorded and Who Sees It

When you use Buy Now or Add to Cart, you pay ZiBuy, and ZiBuy releases the money to the seller after delivery is confirmed. To do this fairly and safely, each order has a delivery and payment record. Here is who can see what:

Information	Buyer	Seller	ZiBuy staff
Buyer's name, phone and delivery address	Yes	Yes (to deliver)	Yes
Payment transaction ID	Yes	Not shown	Yes
Delivery code	Yes (only the buyer sees it)	No (the seller enters what the buyer tells them)	No, except through the database
Handover photo	Told that one was recorded	Yes (the seller who took it)	Yes
Seller's location at handover	Yes	Yes	Yes
Signatures: name and time	Yes	Yes	Yes
Signatures: IP address and device	No	No	Yes
Payout amount, method, transaction ID and screenshot	No (only told that the seller was paid)	Yes	Yes

Permanent records. Important moments in an order (order placed, payment confirmed, packed, on the way, arrived, delivery code verified, received, handover note signed, payout sent and confirmed) are saved in a permanent log with the server's time. Each entry carries a digital fingerprint linked to the one before it, so any change can be detected. Buyers and sellers cannot edit or delete these records.

Daily seal. Each night we email ourselves a file containing only order reference numbers and the latest fingerprint of each record that changed that day. It contains no names or contact details. It gives ZiBuy an independent, time-stamped copy that proves what was recorded and when.

5. Electronic Signatures and Records

ZiBuy uses electronic signatures for handover notes and for sellers confirming they received their payment. A signature is made by confirming your own account, either by re-entering your account password (or confirming with Google), or by entering a one-time code sent to your account email. We store the time, your account name, how you signed, a fingerprint of the document, and, privately for admins, your IP address and device details.

Under the Electronic Transactions Act, 2011 and the Electronic Signatures Act, 2011, these electronic records and signatures can be accepted as evidence. We may produce them to courts, regulators and law enforcement when the law requires, and to the other party in an order or dispute.

6. Personalisation and Automated Processing

Homepage personalisation: the categories you open are remembered on your own device so that products you are likely to want appear first. You can clear this by clearing your browser or app data.
Ranking and trust: listings are ordered using factors such as plan, verification, freshness and promotion. Trust scores and badges are partly calculated automatically.
Safety checks: keyword and pattern checks may flag listings or messages for human review.

We do not make decisions with legal effect about you based only on automated processing. Suspending an account or removing content is reviewed by a person, and you can contact us to challenge it.

7. Information Sharing

We do not sell your personal data. We share it only as follows:

Other users: your public profile and listings are visible on ZiBuy. For an order, the seller receives the buyer's name, phone and delivery address, and the buyer sees the seller's name and phone, so delivery can happen.
Google (Firebase): sign-in, database, file storage, hosting, cloud functions and push notifications run on Google Firebase. Emails from ZiBuy are sent through Google's mail service. If you choose Google sign-in, Google confirms your identity to us.
Africa's Talking: sends SMS messages such as phone verification codes and order alerts to eligible sellers.
Mobile-money providers (MTN and Airtel): you pay through their own services. We receive only the transaction reference you give us.
Authorities and legal claims: when required by Ugandan law or valid legal process, or to establish, exercise or defend legal claims.
Business changes: if ZiBuy is reorganised or sold, your data may transfer to the new owner, who must honour this policy.

When you tap a WhatsApp, call or email link, you leave ZiBuy and that service's own privacy policy applies.

8. Where Your Data Is Stored

Your data is stored on Google Firebase servers, which may be located outside Uganda. Where data is transferred abroad, we rely on the security measures of our service providers and take steps to make sure it stays protected to a level consistent with the Data Protection and Privacy Act, 2019.

9. How Long We Keep Data

Account, profile and listings: while your account is active, until you delete them or delete your account.
Verification documents: while needed to keep your verified status, and deleted when you delete your account.
Messages: until you or the other person delete them, or your account is deleted (see section 12).
Order, delivery, signature and payout records: kept for as long as the law requires and as long as needed to resolve disputes and protect legal claims, because they are evidence for buyers, sellers and ZiBuy.
Technical and error logs: kept for a limited time for security and troubleshooting.
Backups: we keep encrypted backups of our database for up to 4 weeks to protect against data loss. Data you delete may remain in these backups until they expire, and is not used for any other purpose.

10. Security

All traffic uses HTTPS. Data is stored with Google's industry-standard protection.
Passwords are managed by Google Firebase Authentication. We cannot see them.
Database rules limit who can read what. Staff access is role-based, restricted and logged.
Delivery codes are generated and checked on our servers, with a limited number of attempts.
Delivery and payment records are written by our servers only and are tamper-evident.

No system is perfectly secure. Please protect your password and never share your delivery code with anyone until you are holding your item.

11. Your Rights

Under the Data Protection and Privacy Act, 2019 you have the right to:

Access the personal data we hold about you.
Correct inaccurate data, mostly yourself from your dashboard.
Delete your data, subject to section 12.
Object to or restrict certain processing, and withdraw consent where we rely on it (for example, marketing emails).
Portability: ask for your data in a portable format.
Complain to the Personal Data Protection Office in Uganda if you believe your data has been mishandled.

To use these rights, contact zitechnologies3@gmail.com. We normally respond within 30 days.

12. Deleting Your Account

You can delete your account yourself at any time from Dashboard → Account Settings → Delete My Account, or use our account deletion page, which also works if you can't log in. Deletion is permanent and cannot be undone. When you delete your account:

Your account and login, ads, uploaded photos and videos, ID and business licence documents, wishlist, saved searches, alerts, shop follows, reviews you wrote, and messages you sent are permanently deleted.
Any remaining plan, boost or pin time on your account is lost.
Order records you took part in are kept, but your name, phone number, delivery location and email are removed from the order itself, so the other person and any dispute can still be handled.
Delivery proof records, signed handover notes and payout confirmations for completed orders are kept as legal evidence. They can contain your name, phone number and delivery location. We keep them for as long as the law requires or as needed to protect legal claims, and access to them is restricted.
Messages that other users sent to you stay in their own conversation history.
If you have an open ZiBuy Protect dispute, you will be asked to wait until it is resolved before deleting your account.

13. Cookies, Local Storage, Permissions and Notifications

Local storage: we keep your cart, preferences, the categories you view, and your place on the homepage on your own device so the site works quickly and returns you to where you were.
Cached files: the app saves some pages and files on your device so it opens faster and can show some content offline.
Camera and photos: used only when you choose to upload photos or videos, or when a seller takes the handover photo.
Location: used only when a seller completes a handover and your phone asks permission. You can refuse, and the handover can still be completed, but the record will show that location was not shared.
Notifications: if you allow them, we store a push-notification token for your device. You can turn them off in your device or browser settings.

You can clear local data or disable cookies in your browser settings, though some features may stop working.

14. Children's Privacy

ZiBuy is not for anyone under 18. We do not knowingly collect personal data from minors. If we learn that a minor has given us personal data, we will delete the account and the data promptly.

15. Changes to This Policy

We may update this policy as ZiBuy grows or the law changes. The "last updated" date above always shows the current version. For significant changes we will notify you by email or in the app. Continuing to use ZiBuy after a change means you accept the updated policy.

16. Contact Us

For privacy questions, requests or complaints:

📧 Email: zitechnologies3@gmail.com
📱 WhatsApp: +256 705 816 160
🌐 Website: zibuy.ziteche.com