Privacy Policy
Last updated: 2026-09-05 · Effective: [DATE] · Version 2.0
This Privacy Policy explains how Zera (“we”, “us”, “our”) collects, uses, stores, shares, and protects personal information when you use our multi-vendor marketplace website and related services at https://shop.zeraitservices.online (the “Platform”). It is written for customers, vendors/sellers, visitors, and other users in Ghana and elsewhere. This document should be reviewed by qualified legal counsel before publication. Version 2.0. Effective date: [DATE].
Short privacy notice
Zera operates an online marketplace. We collect account, order, delivery, payment-status, vendor verification, device/security, and (with consent) analytics or marketing data to run the Platform, prevent fraud, and comply with law. We do not sell your personal information. Payment card numbers are processed by payment providers—not stored by us as full card numbers. You can manage marketing and cookie preferences, export data, or request account deletion in Privacy settings. Contact: [PRIVACY EMAIL]. Full details are in this Privacy Policy.
1. Important notice and legal framework
This Policy is designed with Ghana’s Data Protection Act, 2012 (Act 843) and guidance from the Data Protection Commission of Ghana in mind. If you access the Platform from another country, additional privacy laws may apply depending on your location and the processing involved. References to concepts such as “controller”, “processor”, “legitimate interests”, or “data subject rights” are used for clarity and do not, by themselves, mean we claim compliance with the EU GDPR or any other foreign regime unless that law actually applies to a specific processing activity.
Registration with the Data Protection Commission (Act 843) is an operational requirement for data controllers in Ghana. Confirm your registration status with legal counsel: [DPC REGISTRATION STATUS].
This Policy is not legal advice. Have qualified counsel confirm registrations, retention periods, international transfer safeguards, and wording before you rely on it publicly.
2. Definitions
- Platform / Website / Marketplace: the online multi-vendor shopping service operated by us, including customer, vendor, admin, and related operational interfaces.
- Customer / Buyer: a person who browses, registers, or buys products through the Platform.
- Vendor / Seller: a person or business that lists and sells products through the Platform.
- Administrator / Staff: authorised personnel who operate the Platform’s administrative tools.
- Personal Data: information that identifies or can reasonably identify you (for example name, email, phone, address).
- Processing: any operation on personal data such as collection, storage, use, disclosure, or deletion.
- Service Provider: a third party that helps us run the Platform (for example hosting, email/SMS, payments), under contract or as an independent regulated provider.
- We / Us / Our: Zera.
- You / User: a visitor, customer, vendor, or other person using the Platform.
3. Who we are and how to contact us
Controller identity (confirm with counsel): Zera.
Website: https://shop.zeraitservices.online.
Business address: [BUSINESS ADDRESS].
Privacy contact email: [PRIVACY EMAIL].
Data Protection Officer (if appointed): [DPO NAME], [DATA PROTECTION OFFICER EMAIL].
Ghana data protection authority (for complaints): Data Protection Commission of Ghana. Further information: https://dataprotection.org.gh/. Confirm current official contact details with the Commission before publishing.
4. Roles: marketplace, vendors, and service providers
Our role depends on the activity. For Platform accounts, marketplace order coordination, security monitoring, and most Platform operations, we typically determine the purposes and means of processing.
When a vendor receives limited buyer details needed to fulfil an order, the vendor may process that information for fulfilment and related customer service. Vendors may have independent legal responsibilities under applicable law for how they handle that data.
Payment providers process payment credentials according to their own privacy notices and regulatory obligations. We receive payment status and limited metadata (such as method label or truncated identifiers where provided), not full card numbers or mobile-money PINs.
5. Information we collect
We collect only categories needed to operate the marketplace features you use. Exact fields depend on how you use the Platform.
5.1 Account and authentication
- Name, email address, and optional phone number.
- Password (stored using secure hashing—never in plaintext).
- Optional social/sign-in identifiers if you choose a supported social login (env-configured).
- Email/phone verification status and one-time codes used for verification or sign-in security.
- Account preferences, privacy/terms acceptance versions, and marketing opt-in choices.
- Passkeys or multi-factor options where enabled for your account type.
5.2 Customer shopping and orders
- Delivery region, city, street address, GhanaPost GPS / digital address (where provided), and optional map coordinates from checkout.
- Cart contents, order numbers, products purchased, amounts, currency, vendors involved, payment status, refunds, and timestamps.
- Reviews, ratings, support messages, and coupon use related to your activity.
- Saved delivery preferences on your profile where you store them.
5.3 Vendor and shop information
- Legal/display name, business type, shop name and description, website, and contact phone.
- Optional business registration number and optional tax identification where provided during onboarding.
- Product listings, images, inventory, promotions, and performance metrics related to your shop.
- Payout preferences such as bank or mobile-money details needed to pay you (stored with appropriate protections).
- Shop verification status and related operational records.
5.4 Vendor verification (KYC) — sensitive
To reduce fraud and meet legal/operational verification needs, we may request identity and business verification information from vendors (and, where applicable, certain operational roles such as riders). Access is restricted to authorised staff and systems. KYC information is not shown publicly on product pages.
Depending on applicable legal and verification requirements, we may request identity numbers (for example a Ghana Card number), proof-of-address documents, business details, and payout account details. For seller onboarding as currently implemented, we do not collect Ghana Card image scans—number-based verification and other documents (such as proof of address) may apply instead.
Where necessary, verification information may be processed by authorised verification or compliance partners under appropriate safeguards. Retention of KYC materials follows our retention framework and legal obligations: [KYC RETENTION PERIOD — confirm with counsel].
5.5 Payments
Payments are completed through third-party payment providers configured on the Platform (for example card and mobile-money checkout where enabled). Those providers may collect and process payment credentials under their own privacy policies.
We do not store full payment card numbers (PAN) or CVV. We may retain transaction references, payment status, method labels, and limited truncated identifiers (such as last four digits or BIN metadata) when returned by a provider for support, fraud review, and reconciliation.
5.6 Delivery and logistics
To fulfil deliveries we process recipient name, address details, and phone number as needed. Authorised delivery personnel or logistics partners may receive only what is reasonably necessary for a specific delivery.
Where live-tracking features are enabled for an active delivery, limited location-related operational data may be processed for that delivery window and then retained only as needed for disputes and security ([ORDER LIVE LOCATION RETENTION — see Data Retention Schedule]).
5.7 Device, technical, and security information
- IP address, browser and device type, operating system, and approximate location derived from IP where appropriate.
- Pages/paths visited, referring URLs, timestamps, session identifiers, and diagnostic/error information.
- Security and abuse-prevention signals (for example failed login patterns, device observations, rate-limit and monitoring events).
- We do not claim continuous GPS tracking of customers’ devices unless a specific feature you use requests location for delivery or maps and you provide it.
5.9 Marketing preferences and notifications
- Whether you opted in to promotional emails and/or SMS marketing.
- Transactional notifications (order updates, security alerts, verification codes) needed to operate your account—these are not the same as marketing and generally cannot be fully disabled without affecting the service.
6. How we use personal data
- Create and authenticate accounts; verify email/phone where required.
- Process carts, orders, payments coordination, refunds, and payouts.
- Share limited fulfilment data with the relevant vendor and delivery partners.
- Provide customer support and dispute resolution.
- Operate vendor onboarding, KYC/verification, and shop tools.
- Send transactional messages by email, SMS, push, or in-app channels where configured.
- Detect and prevent fraud, abuse, fake reviews, coupon misuse, credential stuffing, scraping, and security incidents.
- Apply rate limiting, security monitoring, and audit logging.
- Improve search, recommendations, and Platform reliability where enabled.
- Measure traffic and performance with first-party analytics and, if configured and consented, optional third-party analytics/ads pixels.
- Send marketing only where you have opted in (or another lawful basis applies under local law).
- Comply with legal, tax, accounting, and regulatory obligations.
- Enforce our terms and protect the rights and safety of users and the Platform.
7. Legal bases / justifications
The appropriate basis depends on the activity and applicable law. We do not use a single basis for everything. Under Act 843 and related principles, processing may be justified by, among others:
- Contract / service delivery: creating your account, processing orders, enabling vendor tools.
- Legal obligation: tax, accounting, lawful requests, and mandatory retention.
- Legitimate interests: security, fraud prevention, service improvement, and internal operations—balanced against your rights.
- Consent: marketing messages, non-essential cookies/analytics, and other optional features where consent is required. You may withdraw consent without affecting essential services that do not depend on it.
9. What vendors can see about customers
Vendors receive only information reasonably necessary to fulfil and support their own orders—not your full marketplace history with other shops.
- Typically available: buyer name; delivery region/city; payment method label (not card data); order contents and status for that vendor’s shop.
- Street address, digital address, and phone: provided when the vendor is responsible for self-delivery; for platform/hub fulfilment, street-level details are restricted by default so vendors see what they need operationally without unnecessary contact data.
- Email: not shared with vendors by default.
- Vendors must not use customer data for unrelated marketing, sell it, or keep it longer than needed. See the Seller Privacy Agreement.
10. Marketing communications
Promotional emails or SMS are sent only if you opt in (or another lawful basis applies). Defaults are opt-out unless you choose otherwise during registration or in Privacy settings.
You can unsubscribe from marketing emails using the link in those messages or via account Privacy settings. Transactional messages (orders, security, verification) are separate and may continue as needed to operate the service.
11. Automated fraud detection, security monitoring, and rate limiting
We use automated and manual systems to protect the Platform. These systems may analyse account, order, device, IP, coupon, review, and traffic patterns to detect suspicious activity, abuse, or attacks.
Outcomes may include additional verification, temporary locks, rate limits, declined risky actions, or account review. Where a decision significantly affects you and applicable law requires it, you may request human review by contacting [PRIVACY EMAIL].
We do not publish internal security thresholds. Technical logs (IP, user-agent snippets, event codes) may be stored for investigation and then pruned per our retention schedule.
13. International transfers
Service providers or infrastructure may process data outside Ghana where legally permitted. Where transfers occur, we take steps intended to protect personal data (for example contractual safeguards and access controls). Specific transfer mechanisms should be confirmed with counsel and documented for your live vendor list: [INTERNATIONAL TRANSFER SAFEGUARDS — confirm].
14. Data retention
We keep personal data only as long as reasonably necessary to provide services, meet legal/accounting duties, resolve disputes, prevent fraud, and secure the Platform. Automated cleanup runs for several categories where configured.
See the public Data Retention Schedule (/data-retention) for current category periods derived from Platform configuration. Placeholders requiring business/legal confirmation include: KYC documents [KYC RETENTION PERIOD]; inactive accounts; order/payment records; security logs; analytics; marketing preference records.
Deleting your account does not always erase every record immediately—order, payment, and fraud records may be retained or anonymised as required by law and Platform integrity.
15. Security
We implement reasonable and appropriate technical and organisational safeguards designed to protect personal information, including HTTPS/TLS in transit, password hashing, encryption of certain sensitive fields at rest (for example some address and verification fields), access controls, privileged-account protections, rate limiting, monitoring, audit logging, backups, and secure development practices where implemented.
No internet transmission or storage system can be guaranteed completely secure. Please use a strong unique password and protect your devices.
16. Personal data breaches
If a personal-data breach occurs, we investigate, contain the incident, assess risk, and notify regulators and affected individuals where legally required. We remediating controls as appropriate. We do not promise a fixed public notification deadline beyond what applicable law requires—confirm timing with counsel for Ghana DPC obligations.
17. Your privacy rights
Depending on applicable law and circumstances, you may have rights to access, correct, delete (where applicable), object, withdraw consent, restrict certain processing, obtain a portable copy of data you provided, and lodge a complaint with a supervisory authority.
Not every right applies to every situation (for example we may refuse deletion of records we must keep for tax or fraud prevention).
- Self-service: Privacy settings in your account (marketing preferences, data export, account deletion request).
- Other requests: email [PRIVACY EMAIL]. We may need to verify your identity.
- Ghana: you may complain to Data Protection Commission of Ghana (https://dataprotection.org.gh/). Confirm official channels before publishing.
18. Account deletion
You may request account deletion from Privacy settings. We typically verify the request (for example by email code) and then deactivate and anonymise account identifiers (such as replacing email/name and clearing profile delivery fields).
Orders and certain financial/security records may be retained in anonymised or restricted form for legal, accounting, dispute, and fraud-prevention purposes. Street-level order addresses may be scrubbed where configured.
Administrators and some operational accounts may be restricted from self-service deletion.
19. Children’s privacy
The Platform is intended for users who can lawfully enter online marketplace transactions under applicable law. We do not knowingly collect personal information from children where prohibited. We do not currently collect date of birth at customer registration. If you believe a child has provided personal data inappropriately, contact [PRIVACY EMAIL] and we will take appropriate steps.
Minimum age for use: [MINIMUM AGE — confirm with counsel / product policy].
20. Third-party links and vendor sites
The Platform may link to third-party websites or services. We are not responsible for their privacy practices. Review their policies before sharing information with them.
21. Vendor privacy responsibilities (summary)
Vendors must use customer data only for permitted fulfilment and support purposes; protect it; not sell it; not use it for unauthorised marketing; not retain it longer than needed; comply with applicable privacy law; and notify us of relevant security incidents involving Platform customer data. Full obligations: Seller Privacy Agreement (/seller-privacy).
22. Changes to this Policy
Effective date: [DATE]. Version: 2.0. The “Last updated” date on this page will change when we revise the Policy.
For material changes we may require re-acceptance when you next sign in (where enabled) or notify you by email or in-product notice. Continued use after the effective date of an update constitutes acceptance where permitted by law. We do not claim that every editorial change requires fresh consent.
23. Complaints and contact
Privacy questions and rights requests: [PRIVACY EMAIL]
Postal / business address: [BUSINESS ADDRESS]
Data Protection Officer (if applicable): [DPO NAME] — [DATA PROTECTION OFFICER EMAIL]
If we cannot resolve your concern, you may contact Data Protection Commission of Ghana: https://dataprotection.org.gh/