Privacy Policy

Rare Infoway Private Limited ("we", "us", "our") is the data controller for the ZamZam mobile application (the "App").

Under the Data Protection Act, 2021, we maintain accountability measures required by section 50 and register with the Office of the Data Protection Commissioner where required.

ZamZam is a multi-role digital platform for Zambia connecting students, teachers, mentors, employees, entrepreneurs, HR professionals, and government users. It provides:

• Accounts and profiles — registration, login, role-based dashboards, portfolio, resume builder, skills, education and experience records, certificates.
• Marketplace — listing, browsing, searching, and negotiating the sale or exchange of goods and services.
• Messaging — one-to-one and group text chat, voice messages, image and document sharing, and GIF exchange (via GIPHY).
• Video sessions — live audio/video calls and screen sharing powered by Jitsi Meet.
• Jobs and internships — job postings, applications, tracking, saved jobs, and internship listings.
• Mentorship — mentor discovery, requests, sessions, and guidance.
• Learning and courses — course listings, enrolment, course content, and certificates of completion.
• AI guidance chatbot — conversational AI assistant powered by Google Gemini, available to all roles.
• Push notifications — call alerts, message notifications, and platform updates via Firebase Cloud Messaging.
• Startups and funding — startup discovery and funding-tracking features for entrepreneurs.
• Workspace tools — resume builder, skills tracker, session management, and My Courses.

We process personal data only where a lawful condition under section 13 of the Act is met:

Children: Section 17 of the Act requires verifiable parental/guardian consent before we process data of a child or vulnerable person. Contact dhairy@rareinfoway.com if you believe a child's data was collected without appropriate authority.

We request permissions only when the relevant feature is first used. On Android 13+ we use granular READ_MEDIA_* permissions rather than broad storage access.

6.1 Our Processors

6.2 User-to-User Sharing

• Your public profile (name, photo, role, bio, skills) is visible to other registered users where configured as public.
• Marketplace listings are visible to all App users.
• Chat messages are shared only with the intended recipient(s) or group members.

6.3 Cross-Border Transfers (Part X)

Our processing involves transfers outside Zambia (including Google FCM, Google Gemini, AWS, Jitsi, Amplitude, and GIPHY). We implement safeguards under section 71, including contractual mechanisms where available. Primary application and database servers are hosted on AWS Africa (af-south-1, Cape Town, South Africa).

We retain personal data only as long as necessary, consistent with section 12(1)(e) and the minimum one-year rule in section 51(1) of the Act.

• TLS/HTTPS for all data in transit.
• Password hashing (no plaintext storage).
• Short-lived JWT tokens for video session access.
• Short-lived presigned URLs for media file access.
• Access controls and role-based permissions on backend systems.
• Incident response procedures.

Data breaches: We will comply with section 49 of the Act — notify the Data Protection Commissioner within 24 hours where required, and notify affected users as soon as practicable.

Subject to the Act (including section 67 derogations), you have:

To exercise any right, contact dhairy@rareinfoway.com. We will verify your identity before acting and respond within a reasonable period.

Complaints: Lodge with the Data Protection Commissioner under section 68. Appeals lie to the High Court within 30 days (section 69).

We will not send direct marketing without a lawful basis and, where required, your consent. Every marketing communication will include an unsubscribe mechanism as required by section 61 of the Act.

We will publish updates at https://rareinfoway.com and update the "Last updated" date. For material changes, we may seek fresh consent or take other steps required by Zambian law.

Office of the Data Protection Commissioner — oversight, registration, complaints, and guidelines under the Data Protection Act, 2021.

Public portal: https://www.dataprotection.gov.zm/