Privacy policy

Vergeo5 respects your privacy. This policy explains what data we collect, why we collect it, how long we keep it, and your rights under the Zambia Data Protection Act (DPA).

Vergeo5 operates vergeo5.com and is the data controller for personal data processed through the customer app, subject to applicable Zambian law.

We collect account details (phone, email, name), order and payment references, delivery addresses (landmark + GPS where provided), device and usage data, communications (WhatsApp, SMS, email), and KYC documents for vendors. Payment card data is handled by Lenco's hosted widget — we do not store full card numbers.

We process data based on contract performance (fulfilling orders), legitimate interests (fraud prevention, platform security), legal obligations (tax and regulatory records), and consent where required (marketing, optional features). You may withdraw consent for optional processing without affecting core order services.

We use your data to operate the marketplace, process payments and escrow, deliver notifications, improve search and recommendations, comply with law, and resolve disputes. We do not sell your personal data.

We share data with vendors (fulfilment), payment partners (Lenco), messaging providers (WhatsApp Cloud API, Africa's Talking, Resend), cloud hosts (Supabase, Vercel, OCI), and authorities when legally required. All processors are bound by contract.

Account data is kept while your account is active. Order and payment records are retained for at least seven years for tax and dispute purposes. Marketing consent logs are kept for three years. Anonymised analytics may be retained longer.

We use encryption in transit, row-level security on database tables, server-side secrets, and access controls. Sensitive documents (KYC, invoices) are stored in private buckets with strict access rules.

You may request access, correction, export, or deletion of your personal data. Use your account data settings to submit export or deletion requests. Note: this route is planned — full data export and deletion flows will ship in a future account release (M04-P06). Some data must be retained for legal or financial obligations.

We use essential cookies for sessions and security. Analytics (e.g. GA4) may be used with consent where required. You can manage preferences in your browser.

Vergeo5 is not directed at children under 16. We do not knowingly collect data from children.

We will update this policy when practices change. Check the date at the top of this page.

Privacy questions or DPA requests: contact us through the Help centre. We respond within statutory timeframes.