Privacy Policy

Who we are

Zera operates a multi-vendor online marketplace. We act as a data controller for account, order, payment coordination, fraud-prevention, and platform operations data.

Independent sellers and delivery partners who receive limited buyer details to fulfil an order act as separate controllers or processors for that fulfilment purpose, as described below and in our Seller Privacy Agreement.

Scope

This policy covers buyers, sellers, delivery riders linked to the platform, job applicants, and website visitors.

It does not cover third-party websites linked from listings, seller-owned external shops, or payment-provider portals once you leave our site—those services have their own privacy notices.

Information we collect

We collect personal data in the following categories:

Account & identity: name, email, phone number, password (stored hashed), profile photo, and verification status.
Buyer checkout: delivery addresses, delivery instructions, and order history.
Seller / shop: business name, shop details, payout preferences, KYC or ID documents where required for verification, and listing content you upload.
Payments: payment method labels, transaction references, and status from payment partners. We do not store full card numbers or mobile-money PINs.
Delivery & logistics: recipient contact details for shipment, and limited live-location data during active deliveries where that feature is enabled.
Communications: messages, support tickets, reviews, and job applications (including CVs you upload).
Technical & security: IP address, device/browser type, approximate location derived from IP, cookies, session identifiers, and fraud-prevention signals.
Marketing preferences: whether you opted in or out of promotional emails and related consents.

How we collect data

Directly from you when you register, check out, message support, apply for a role, or update settings.
Automatically when you use the site (logs, cookies, and security telemetry), subject to our Cookie Policy.
From sellers, payment partners, or logistics partners only as needed to process an order or investigate abuse.
From publicly available sources only where needed for fraud checks or business verification, and only to the extent permitted by law.

How we use your data

We use personal data to:

Create and manage accounts, shops, and staff access.
Process, fulfil, track, and support orders and returns.
Coordinate payments, refunds, payouts, and chargeback responses with payment partners.
Send transactional notices (order updates, security alerts, password resets).
Personalize recommendations and search where enabled.
Detect, investigate, and prevent fraud, abuse, and policy violations.
Run careers and hiring processes when you apply for a job.
Comply with Ghanaian law, tax, accounting, and regulator requests.
Improve reliability, security, and user experience of the marketplace.
Send marketing emails only if you have opted in (you can unsubscribe anytime).

Legal bases (including Act 843)

Zera processes personal data in line with the Data Protection Act, 2012 (Act 843) of Ghana and other applicable law. Depending on the activity, we rely on:

Contract: to provide the marketplace, process your orders, and operate seller tools.
Legal obligation: tax, accounting, dispute, and regulatory requirements.
Legitimate interests: platform security, fraud prevention, service improvement, and internal analytics—balanced against your rights.
Consent: marketing emails, non-essential cookies/analytics, and other optional features where consent is required. You may withdraw consent without affecting services that do not depend on it.

Sharing with sellers

When you buy from a seller, we share only what is needed to fulfil your order.

Typically shared: buyer name, delivery address, and phone number for delivery contact.
Not shared with sellers: full payment card or mobile-money credentials, your email (unless a specific fulfilment flow requires it and is enabled), or your order history with other shops.

Sellers must use this data only to fulfil the order and must follow our Seller Privacy Agreement. Misuse can lead to suspension and further action.

Payment processors, logistics & other processors

We use carefully selected service providers who process data on our instructions or as independent controllers for their regulated services:

Payment partners (for example card and mobile money) to authorize and settle transactions.
Delivery / rider partners to complete shipment using recipient contact and address details.
Cloud hosting, email, SMS/OTP, analytics (only with consent where required), and security monitoring vendors.

We require appropriate contractual and technical safeguards. We do not sell your personal information to third parties for their own marketing.

International transfers

Some infrastructure or subprocessors may store or process data outside Ghana (for example cloud hosting). Where that happens, we take steps intended to keep an adequate level of protection, such as contractual clauses and access controls. Ask us if you need more detail about current processors.

Children

Zera is not directed at children under the minimum age required by Ghanaian law to enter online contracts. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will take appropriate steps to delete it.

Security

We use industry-standard measures appropriate to a marketplace handling orders and identity data, including:

HTTPS encryption in transit.
Hashed passwords and role-based admin access.
Secure payment integrations (no storage of full card PANs).
Logging, monitoring, and fraud controls.

No method of transmission or storage is 100% secure. Please use a strong unique password and protect your devices.

Retention

We keep personal data only as long as needed for the purposes above, including legal, tax, and dispute needs.

Account data is kept while your account is active. Order and fraud records are typically retained for longer periods (often up to about seven years). Sessions, OTPs, and some analytics are kept for shorter periods.

See our public Data Retention Schedule for current category-by-category periods. You may request account deletion from Privacy settings, subject to records we must keep by law.

Your rights

Subject to Act 843 and other applicable law, you may:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Request deletion where applicable (we may retain what law requires).
Export a copy of your data from Privacy settings.
Opt out of marketing emails at any time.
Object to or restrict certain processing, and withdraw consent where processing is consent-based.
Lodge a complaint with the Data Protection Commission of Ghana.

Many of these actions are available in your account under Privacy settings. For other requests, email privacy@example.com. We may need to verify your identity before acting.

Your rights in Ghana

If you are in Ghana, Act 843 gives you rights of access, correction, and related protections regarding how controllers process your data. You may also complain to the Data Protection Commission if you believe your rights have been infringed.

Commission information: https://dataprotection.org.gh/

Data breaches

If a personal data breach is likely to result in a risk to your rights, we will notify you and, where required, the Data Protection Commission without undue delay, with clear information about what happened, what data may be involved, and steps you can take.

Cookies & similar technologies

We use essential cookies for login, cart, and security. Analytics and similar non-essential cookies are used only with your consent where the cookie banner applies. Details are in our Cookie Policy.

Policy updates

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. For material changes, we may ask you to re-accept the policy when you next sign in, or notify you by email or in-product notice where appropriate.

Contact

Privacy questions, rights requests, and data-protection concerns:

privacy@example.com

For seller-specific obligations, also read the Seller Privacy Agreement. For how long we keep categories of data, see the Data Retention Schedule.