Privacy Policy

Zyba (“Zyba”, “we”, “us”) provides a QR-powered guest-experience platform for hospitality venues and other businesses in Zambia. This policy explains what personal data we handle, why, and your rights under the Data Protection Act, 2021 of Zambia.

Who this covers

We work with two groups of people: operators — the venues and businesses that use Zyba — and guests — the people who scan a code or open a Zyba page. Guests do not create accounts.

What we collect

• From operators: your name, email, phone number, business details, sign-in information (we use a magic-link, so we do not store passwords), and billing references for payments.
• From guests: when a code is scanned or a page is used we record a scan event (the time, the code, approximate location such as country, device type and IP address) and anything a guest chooses to submit — an order, a booking, a service request or feedback, including a name or phone number if they provide one.
• Guest registration details: where a venue uses pre-arrival check-in, a guest submits the identity details that a licensed property is required to record to lodge a guest — passport or national ID number, nationality, address and estimated arrival time, plus a passport or ID front/photo-page image and, where applicable, a back image. This is sensitive personal data. The guest provides it directly for that stay, and we hold it on the venue’s behalf so the venue can meet its registration obligations. Submitted images are converted to new metadata-free JPEGs, stored separately from public venue images, and can only be downloaded by authorized staff for that venue; document access is logged.

How we use it

• To deliver the service and show a venue its own analytics.
• To process orders, bookings, billing and payments.
• To send operational alerts to operators (e.g. new orders).
• To keep the service secure and prevent abuse.
• To improve the product.

Legal basis

We process operator data to perform our contract with you; guest scan and usage data on the basis of our and the venue’s legitimate interest in running and measuring the service; guest registration details to enable the venue to comply with its legal obligation to register lodged guests; and other data with consent where the law requires it.

Who we share it with

We do not sell personal data. We share it only with the service providers that run Zyba — hosting and database providers, our product analytics and error tool, payment providers, and messaging providers used to send alerts — and where required by law. Some of these providers process data outside Zambia (for example in the European Union or United States); where they do, we rely on appropriate safeguards.

How long we keep it

We keep personal data for as long as needed to provide the service and to meet legal, accounting and security obligations, after which it is deleted or aggregated. Scan totals are derived from underlying events and may be retained in aggregate.

Security

Data is encrypted in transit and access is limited to what is needed to run the service. We do not store full card details.

Your rights

Under the Data Protection Act, 2021 you may request access to, correction of, or deletion of your personal data, and may object to certain processing. You may also complain to the Data Protection Commissioner. To exercise any of these, contact us via the link below.

Cookies & analytics

We use essential cookies to keep operators signed in, and a product analytics tool to understand how the service is used so we can improve it. Public pages are designed to be light and do not require an account.

Children

Zyba is intended for businesses and is not directed at children.

Changes

We may update this policy; we will revise the date above when we do.

Contact

Questions or requests: get in touch.