Privacy Policy

1. Who we are

ZimTravelBook (Pvt) Ltd ("ZimTravelBook", "we", "us", "our") is a peer-to-peer car hire platform registered in Zimbabwe and based in Harare. We operate the website at zimtravelbook.com and associated services.

We are committed to protecting your personal data and handling it responsibly. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights in relation to it.

If you have any questions about this policy or how we handle your data, contact us at [email protected].

2. Data we collect

We collect the following categories of personal data depending on how you interact with ZimTravelBook:

Category	Data collected	When collected
Account data	Full name, email address, phone number, password (hashed)	When you create an account
Identity data	Driver's licence number, licence country, licence expiry, national ID or passport number	When you complete a booking or owner verification
Booking data	Booking dates, vehicle selected, pricing, payment reference, booking status	When you make or receive a booking
Payment data	Payment method type, transaction reference, amount. We do not store full card numbers — payment processing is handled by Paynow and Remitly	When you make a payment
Vehicle data (owners)	Vehicle make, model, year, registration number, insurance details, photos	When you list a vehicle
Checklist data	Vehicle condition photos, damage notes, odometer readings, digital signatures, geolocation at time of signing	At pickup and return of each booking
Communication data	Messages sent through the platform inbox between renters and owners	When you send or receive messages on the platform
Usage data	Pages visited, search queries, browser type, IP address, device type	When you use the website
Review data	Star ratings and written reviews submitted after completed trips	When you leave a review

3. How we use your data

We use your personal data only for the purposes for which it was collected:

• To operate the platform — creating accounts, processing bookings, verifying identities, and facilitating communication between renters and owners
• To process payments — coordinating with payment providers to confirm receipt and issue refunds
• To verify identity — confirming that renters hold a valid licence and that owners are legitimate vehicle owners before approving bookings and listings
• To provide condition checklists — storing checklist photos and signatures for the duration of the booking and the dispute resolution period
• To send communications — booking confirmations, payment receipts, booking notifications, and platform updates by email and WhatsApp
• To resolve disputes — reviewing messages, checklist data, and payment records when a dispute is raised
• To improve the platform — analysing anonymised usage data to understand how people use ZimTravelBook and improve the experience
• To comply with legal obligations — maintaining records as required by Zimbabwean law

We do not use your personal data for advertising purposes. We do not sell your data to third parties. We do not use your data to build advertising profiles.

4. Who we share data with

We share your personal data only where necessary and only with the following categories of recipients:

Other platform users

When a booking is confirmed, the renter's first name is shared with the owner for pickup purposes. The owner's first name is shared with the renter. Full surnames, phone numbers, email addresses, and other contact details are never shared between renters and owners — all communication goes through the platform inbox.

Payment providers

We share necessary transaction data with Paynow, Remitly, and Flocash solely for payment processing purposes. These providers process payments under their own privacy policies and are not permitted to use your data for any other purpose.

Communication providers

We use third-party providers for email delivery (such as Resend or Mailgun) and WhatsApp Business API notifications (such as Africa's Talking or Twilio). These providers receive only the data necessary to deliver the communication.

Infrastructure providers

We use Supabase for database and file storage and Netlify/Cloudflare for website hosting. These providers operate under strict data processing agreements.

Legal requirements

We may disclose your data to law enforcement or regulatory authorities if required to do so by Zimbabwean law, a court order, or to protect the safety of our users.

We do not share your data with any other third parties without your explicit consent.

5. How long we keep your data

• Account data — retained for as long as your account is active, and for 2 years after account closure
• Booking data — retained for 5 years after the booking date for financial and legal compliance
• Checklist photos and signatures — retained for 12 months after the booking return date, or until any related dispute is fully resolved
• Platform messages — retained for 12 months after the booking is completed
• Payment records — retained for 7 years as required by Zimbabwean financial regulations
• Usage data — retained in anonymised, aggregated form indefinitely

After the relevant retention period, data is securely deleted or anonymised.

6. Your rights

You have the following rights in relation to your personal data held by ZimTravelBook:

• Right to access — you may request a copy of the personal data we hold about you
• Right to correction — you may request that inaccurate data be corrected
• Right to deletion — you may request deletion of your personal data, subject to our legal retention obligations
• Right to restrict processing — you may request that we restrict how we use your data in certain circumstances
• Right to data portability — you may request a copy of your data in a structured, machine-readable format
• Right to object — you may object to processing of your data for certain purposes

To exercise any of these rights, contact us at [email protected] with your name, email address, and the nature of your request. We will respond within 30 days.

7. How we protect your data

We take the security of your personal data seriously. Our security measures include:

• All data transmitted between your browser and our servers is encrypted using HTTPS/TLS
• Passwords are stored using industry-standard hashing — we cannot see your password
• Database access is restricted to authorised personnel only
• File storage (checklist photos) is secured with access controls and not publicly accessible
• Payment card data is never stored on ZimTravelBook servers — card processing is handled entirely by Paynow

No system is entirely secure. In the event of a data breach affecting your personal data, we will notify affected users as required by applicable law.

8. Cookies

ZimTravelBook uses cookies and similar technologies to operate the platform and understand how it is used. For full details of the cookies we use and how to manage them, see our Cookie Policy.

9. Third-party links

Our website may contain links to third-party websites — for example, links to payment providers or information resources. ZimTravelBook is not responsible for the privacy practices of third-party websites. We recommend reading the privacy policy of any third-party site you visit from a link on ZimTravelBook.

10. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised effective date. For significant changes, we will notify registered users by email. Continued use of ZimTravelBook after a policy change constitutes acceptance of the updated policy.

11. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

ZimTravelBook (Pvt) Ltd
Harare, Zimbabwe
Email: [email protected]