Data Policy

Chiseko Agritech and Logistics Limited, trading as Sekonomics — Draft 1.0 for legal review (replaces the Privacy Policy last modified November 2024) — 15 September 2026

What personal data Sekonomics actually collects, why, who it is shared with, where it is stored, how long it is kept and what your rights are under the Data Protection Act No. 3 of 2021.

This Data Policy explains how Chiseko Agritech and Logistics Limited (“Chiseko”, “we”, “us”) collects and uses personal data when you use the Sekonomics platform at www.chiseko.com (the “Platform”). It is written to describe what the Platform actually does today. Where a practice is planned but not yet live, it says so.

Chiseko is the data controller for the personal data described here within the meaning of the Data Protection Act No. 3 of 2021 (the “Act”). [CONFIRM: Chiseko's registration as a data controller with the Office of the Data Protection Commissioner, and the registration number to cite here. Registration is required by the Act; see Drafting Note 1.]

This Policy replaces the Privacy Policy last modified in November 2024. That document described practices the Platform does not have (advertising partners, custom-audience advertising, CCTV, alcohol age verification, telephone call recording, prize draws, job applications, Facebook registration and third-party cookies); none of them applies and they have been removed.

1. Who we are and how to contact us about your data

1.1Chiseko Agritech and Logistics Limited, [CONFIRM: registered office address — the previous Privacy Policy gave Plot 3132566, John Ken Road, 10 Miles, Chibombo, Zambia].
1.2Email: info@chiseko.com [CONFIRM: whether the dataprotection@chiseko.com mailbox cited in the previous Privacy Policy exists on the company's Amazon WorkMail account and is monitored; if so, list it here instead]. Telephone or WhatsApp: +260 960 821 404 or +260 775 944 114. Website: www.chiseko.com.
1.3[LAWYER TO CONFIRM: whether the Act requires Chiseko to designate a data protection officer, and if so the officer's name and contact details to be inserted here.]

2. The personal data we collect

2.1When you register and manage an Account:
1. your mobile phone number, stored both as entered and in international (E.164) format, and whether it has been verified by a one-time passcode;
2. your name (stored as your username) and, if you give it, your email address, together with whether the address has been verified by a confirmation link and who added it (you, an administrator, or a legacy record);
3. the account type you chose (farmer, buyer, market intelligence, transporter or partner), and, for staff, an administrator role;
4. profile details according to your account type: contact name, organisation name, address lines, city and province; for buyers, business type and delivery address; for transporters, vehicle type, capacity in kilograms and coverage area; for partners, sector and what you offer; for market intelligence subscribers, the commodities you follow;
5. for farmers: first and last name, the type of identity document (NRC or passport) and its number, farm address lines, city or district and province, the crops you grow and the quantities you expect;
6. the dates your Account was created and last used, how many times you have signed in, and, if your Account is deactivated, when, by which administrator and why.
2.2When you sign in. The Platform has no passwords. To sign you in we generate a one-time passcode and send it to your phone by SMS or to your verified email address. We store: a cryptographic hash of the passcode (never the passcode itself), its expiry time, the number of attempts, when it was last sent and which channel was used; a log of every passcode request with your phone number, the time, your IP address, the outcome and the SMS provider's reference; and a delivery log for every SMS and email passcode showing the recipient, the sender ID used, the carrier, the delivery status reported by the provider, any error and the cost. Delivery-receipt callbacks from the SMS provider are stored as received, including the sending server's IP address.
2.3When you list produce or post a requirement:
1. for a Listing: title, produce, category, description, quantity and unit, price and currency, Grade, province, district and area, the dates available, and any photographs you upload (which are stored on our server);
2. for a Requirement: title, produce, category, description, quantity and unit, Grade, target price and currency, delivery province, district and area, delivery notes, the date needed by and how often;
3. for an expression of interest against a Requirement: quantity, unit, price, an optional link to your Listing and your message;
4. the review status of each item and the history of every status change, with the administrator who made it and the reason.
5. Listings and Requirements have fields for latitude and longitude. [CONFIRM: at the date of this draft the forms do not collect coordinates and these fields are reserved for future route planning; if they are ever populated, this Policy must be updated.]
2.4When you place an order or pay:
1. the name, company, delivery address, city, province or state, country, postal code, phone number, email address and order note you enter at checkout;
2. the products, quantities, prices, delivery cost, currency, exchange rate applied and total of the Order, and its fulfilment and payment status;
3. references from our payment provider, DPO Pay: our own order reference, DPO's transaction token and reference, the result code and explanation, and a record of each interaction with DPO with any secret values removed. We never receive or store your card number, security code or mobile money PIN; you enter those on DPO's own page;
4. for bulk buyers, historical trades that Chiseko has recorded from paper invoices with your agreement, marked as historical, including your purchase order number and the line items;
5. if you are a farmer, the amounts paid to you for produce, recorded outside the Platform in Chiseko's accounting records [CONFIRM: there is no in-Platform payout record at the date of this draft].
2.5When you use Market Intelligence:
1. your subscription status (free trial, active, past due, cancelled or expired), trial and billing period dates and the history of status changes;
2. once billing is live: a payment-method token issued by DPO Pay together with the card brand, last four digits and expiry month and year (display only), and invoices and charge attempts. No card numbers are stored. [CONFIRM: billing is not active at the date of this draft; no payment methods or invoices exist.]
3. for buyers, analytics derived from your own Orders (quantities and prices of each commodity over time, and seasonal suggestions based on them).
2.6Other data you give us:
1. reviews and ratings you post on produce;
2. articles, market notes or stories you author on the Platform, if you have been given authoring rights, with any images you upload;
3. messages you send through the contact form (name, email address and message), which are emailed to Chiseko, and details you submit through the public farmer registration form, which are emailed to Chiseko;
4. correspondence with us by email, phone or WhatsApp.
2.7Technical data and cookies:
1. your IP address, recorded when you request a sign-in code and when an administrator changes your Account, and in the ordinary access logs of our web server [CONFIRM: web-server log retention];
2. a session cookie (“userInfo”) holding your sign-in token and basic profile so that you stay signed in, and a “region” cookie holding the currency or region you selected;
3. your shopping cart and wishlist, kept in your browser's local storage on your device, not on our server, until you check out or clear them;
4. We do not use analytics, advertising or tracking cookies, pixels or third-party scripts. [CONFIRM: verified by searching the Platform's code for common analytics and advertising tags; none is present.]
2.8Administrator records. Every change an administrator makes to a user Account (for example changing an email address, changing a role, or deactivating the Account) is written to an audit log recording the administrator, the person affected, what changed (the values before and after), the reason and the administrator's IP address. Administrators' own actions are therefore also personal data that we keep.

3. Data we deliberately do not collect

3.1We do not collect passwords, card numbers, security codes, mobile money PINs, bank account numbers, date of birth, gender, marital status, health data, biometric data, or precise location from your device.
3.2We do not receive personal data about you from data brokers, social media platforms or public sources, and we do not build marketing profiles of you.
3.3Market Intelligence source messages. Price observations in Market Intelligence are transcribed from messages posted in trader WhatsApp groups of which Chiseko staff are members. Staff export a chat manually and paste it into an administration tool. The tool separates the sender's phone number from the message and discards it; the number is never stored and never appears in Market Intelligence. What is stored is the message text, the date, the parsed price and commodity, and a truncated, salted cryptographic hash of the sender's number whose only purpose is to recognise the same message pasted twice; it cannot be reversed to the number and is never shown to users. [LAWYER TO CONFIRM: whether a truncated salted hash of a phone number is pseudonymised personal data under the Act, and whether Chiseko's processing of trader-group messages — as a group member, for a commercial product, without the posters' consent — is lawful under the Act's legitimate-interest or other grounds. CONFIRM: the message text itself is kept verbatim and could contain a phone number or name that the trader typed into the message; administrators should be instructed to remove such details before confirming a price, and the tool should be changed to strip phone-number patterns from message text. See Drafting Note 3.]

4. Why we use your personal data and the legal basis

4.1We use your personal data for the following purposes. [LAWYER TO CONFIRM: the wording of the lawful bases under the Act (in particular consent, performance of a contract, compliance with a legal obligation and legitimate interests) and the section references to cite.]
1. To create and secure your Account and sign you in by one-time passcode, to detect and limit abuse of the sign-in system, and to prove that a code was sent and delivered — necessary to provide the service you asked for, and in our legitimate interest in keeping Accounts secure.
2. To verify who you are: for farmers, to check the identity document, farm address and crops you give us, which is how buyers can rely on a Listing — necessary for the contract with you and in our and buyers' legitimate interest in a trustworthy marketplace.
3. To review, publish and manage Listings and Requirements, and to match supply with demand — necessary for the contract with you.
4. To take and fulfil Orders, arrange transport, process payments through DPO Pay, handle Grade Claims and refunds, pay farmers and keep accounting records — necessary for the contract, and to comply with tax and accounting law.
5. To run Market Intelligence: to manage your trial and subscription, and, for buyers, to calculate analytics from your own Orders — necessary for the contract with you.
6. To contact you about your Account, Orders, Listings, Requirements, claims, payments and changes to our terms — necessary for the contract and for our legal obligations.
7. To keep audit records of administrator actions and status changes, so that disputes can be resolved from the record — in our legitimate interest and, for money matters, to comply with law.
8. To respond to your enquiries, complaints and requests to exercise your rights — necessary for our legal obligations and legitimate interests.
9. To show aggregate statistics on the Platform (numbers of farmers, buyers, districts and volumes; supply and demand by commodity) that do not identify anyone — in our legitimate interest.
10. To comply with the law, respond to lawful requests from authorities, and establish, exercise or defend legal claims.
4.2Marketing. At the date of this draft the Platform does not send marketing messages; the only emails and SMS it sends are sign-in codes, email-address confirmation links, account notices from administrators and copies of contact-form submissions. If we begin sending marketing by email, SMS or WhatsApp we will do so only as the Act permits, will tell you, and will give you a simple way to opt out in every message. [CONFIRM: to be updated if marketing begins.]
4.3Automated decisions. The Platform does not make decisions about you by automated means that have legal or similarly significant effects. Every Listing, Requirement and Account decision is made by a person. The demand-matching tool ranks candidate Listings for an administrator to consider; the buyer analytics feature makes suggestions for you to consider; neither makes a decision.

5. Who we share your personal data with

5.1Other users of the Platform, only to the extent needed for a trade:
1. if you are a farmer who expresses interest in a buyer's Requirement, that buyer can see your name, phone number and email address so that you can speak;
2. if you are a buyer, the farmer or transporter fulfilling your Order receives the delivery address, contact name and phone number needed to deliver it [CONFIRM: today this is passed on by Chiseko staff, not shown automatically in the farmer's Account];
3. the public pages of the Platform show approved Listings only in summary (crop, grade, province, district, volume and harvest window) and never show a Seller's name, contact details, price or exact location. Requirements are shown only to signed-in sellers and administrators, without the buyer's contact details.
5.2Service providers who process data on our instructions:
1. Amazon Web Services, Inc. (AWS) — hosts the Platform's web server, database and uploaded images, in the AWS us-east-1 region (Northern Virginia, United States). Daily database backups are kept on the same server [CONFIRM: backup retention period and whether copies are sent to Amazon S3; at the date of this draft the S3 upload in the backup script is disabled].
2. Amazon Simple Email Service (SES), part of AWS, region us-east-1 (United States) — sends our emails, including sign-in codes from otpnoreply@chiseko.com; SES receives your email address and the message.
3. Amazon WorkMail, part of AWS — hosts the @chiseko.com mailboxes in which your emails to us are stored [CONFIRM: WorkMail region].
4. D7 Networks (Direct7 Networks), based in the United Arab Emirates — sends sign-in codes by SMS; D7 receives your mobile phone number and the message, and returns delivery receipts. The sender ID shown on your phone is “Sekonomics”, registered with D7 Networks and the Zambian mobile networks.
5. DPO Pay (DPO Group / 3G Direct Pay Limited), headquartered in Kenya with operations in South Africa and other African countries — processes payments and, once billing is live, stores payment methods; DPO receives your name, email address, phone number, the amount, currency and our order reference, and you enter your card or mobile money details directly with DPO under DPO's own privacy policy.
6. Open-Meteo (weather) and the publishers whose public RSS feeds we read (news) receive no personal data about you; our server requests their public data on a schedule.
5.3Transporters. Where Chiseko engages a transporter to deliver an Order, the transporter receives the delivery address, contact name and phone number for that delivery and must use them for that delivery only.
5.4Professional advisers, auditors and insurers, under confidentiality, where needed to run our business or deal with a claim.
5.5Authorities. The Office of the Data Protection Commissioner, the Zambia Revenue Authority, the Competition and Consumer Protection Commission, the police, courts and other authorities where the law requires or permits, or to establish, exercise or defend legal claims.
5.6A buyer of our business. If Chiseko or substantially all of its assets are sold or merged, personal data may be transferred to the new owner, who must continue to use it in accordance with this Policy.
5.7We do not sell personal data. We do not share it with advertising networks or data brokers.

6. Where your data is stored and international transfers

6.1The Platform's server, database, uploaded images and backups are hosted by Amazon Web Services in the United States (region us-east-1). Emails are sent through Amazon SES in the United States. Sign-in SMS messages are sent through D7 Networks in the United Arab Emirates. Payments are processed by DPO Pay in Kenya and South Africa. Each of these involves transferring your personal data outside Zambia.
6.2Zambia's Data Protection Act No. 3 of 2021 restricts the transfer of personal data outside Zambia, and requires that sensitive personal data be processed and stored on servers or in data centres located in Zambia. [LAWYER TO CONFIRM: (a) whether any category of data we hold — in particular NRC and passport numbers, and payment and payout details — is “sensitive personal data” under section 2 of the Act, which would make hosting it outside Zambia unlawful regardless of safeguards; (b) which of the Act's conditions for transferring other personal data outside Zambia (data-subject consent, a Commissioner-approved adequacy or contractual safeguard, or another ground) Chiseko relies on for AWS, SES, D7 and DPO; and (c) whether Chiseko must migrate hosting to a Zambian data centre or an AWS region acceptable to the Commissioner. See Drafting Note 1. This Policy does not claim that the current arrangement complies; it describes it.]
6.3Where we transfer data outside Zambia we rely on the service provider's contractual commitments to protect it (AWS's, D7's and DPO's data-processing terms) and on the technical measures in section 8. By registering, you acknowledge that your data will be processed in the countries named above. [LAWYER TO CONFIRM: whether acknowledgement at registration is sufficient consent under the Act, and whether a separate, explicit consent step is needed.]

7. How long we keep your data

7.1At the date of this draft the Platform does not delete data automatically. Deactivating an Account switches off sign-in but keeps the record; withdrawing a Listing or Requirement keeps it with a “withdrawn” status. Deletion happens when you ask for it (section 9) or when we run a periodic clean-up, subject to the periods below. [CONFIRM: retention is a policy decision, not yet implemented in code; the periods below are proposals for the founder and lawyer to confirm.]
7.2Proposed retention periods:
1. Account and profile data: for as long as your Account is active, and for [RETENTION PERIOD: e.g. 12 months] after it is closed or deactivated, unless a longer period below applies.
2. Farmer identity document type and number: for as long as your Account is active; deleted [RETENTION PERIOD] after closure. [LAWYER TO CONFIRM: any know-your-customer or tax obligation to keep it longer.]
3. Orders, invoices, payments, payouts, Grade Claim records and the audit trails behind them: [RETENTION PERIOD: e.g. 6 years] after the end of the financial year in which the transaction took place, to meet tax and accounting law. [LAWYER TO CONFIRM: the retention period required by the Income Tax Act and Value Added Tax Act.]
4. Sign-in code hashes: deleted on use or expiry. Sign-in request and message delivery logs, including IP addresses: [RETENTION PERIOD: e.g. 12 months].
5. Administrator audit logs: [RETENTION PERIOD: e.g. 6 years], because they are the record relied on in disputes.
6. Listings, Requirements and expressions of interest: for as long as your Account is active and for [RETENTION PERIOD] afterwards; withdrawn and rejected items are kept for the same period with their status.
7. Market Intelligence source messages: the parsed price and message text are kept indefinitely as part of the price history; the salted sender hash is kept with them. [FOUNDER TO CONFIRM.]
8. Contact-form emails and correspondence: [RETENTION PERIOD: e.g. 24 months].
9. Database backups: [CONFIRM: rotation period in the backup script]; a deleted record may persist in a backup until that backup is rotated.
7.3Aggregate statistics that do not identify anyone may be kept indefinitely.

8. How we keep your data secure

8.1Connections to the Platform are encrypted with TLS (HTTPS). Sign-in codes and email-confirmation tokens are stored only as cryptographic hashes; there are no passwords to steal. Sign-in code requests are rate-limited per phone number and codes expire quickly.
8.2Card and mobile money details are never entered on, sent to or stored by our systems; they are handled by DPO Pay on DPO's own pages. Records of payment provider interactions are stored with secret values removed.
8.3Access to the database and server is limited to Chiseko's technical staff and contractors who need it, under confidentiality. Administrative functions on the Platform are limited to accounts with an administrator role, and every administrative change to a user Account, Listing, Requirement, subscription or content item is logged with the person responsible.
8.4The database is backed up daily. Backups are stored on the same server [CONFIRM: encryption of backups and off-server copies].
8.5Trader phone numbers in Market Intelligence source data are discarded before storage (section 3).
8.6No system is perfectly secure. If we discover a personal data breach that is likely to harm you we will notify the Data Protection Commissioner and, where required, you, within the periods the Act requires. [LAWYER TO CONFIRM: breach-notification duties and time limits under the Act.]
8.7You must keep your phone number and email address under your control and never share a one-time passcode; see the Usage Policy.

9. Your rights

9.1Under the Data Protection Act No. 3 of 2021 you have rights over your personal data, which you can exercise by contacting us at the details in section 1. [LAWYER TO CONFIRM: the exact list of rights, the exceptions and the response time limits under the Act.] They include the right to:
1. be told what personal data we hold about you and receive a copy of it (access);
2. have inaccurate or incomplete data corrected (rectification) — you can update most Account details yourself in your profile;
3. have your data erased where we no longer have a lawful reason to keep it (erasure), subject to the retention obligations in section 7;
4. object to processing based on our legitimate interests, and to any direct marketing;
5. receive the data you gave us in a structured, machine-readable form and have it sent to another controller where technically feasible (portability);
6. withdraw a consent you have given, without affecting processing already carried out;
7. not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you;
8. lodge a complaint with the Office of the Data Protection Commissioner, Zambia [CONFIRM: current contact details of the Commissioner's office].
9.2To protect your data we will check that a request comes from you, normally by sending a one-time passcode to the phone number on your Account. We aim to respond within thirty (30) days, and will tell you if we need longer for a complex request. There is no fee unless a request is manifestly unfounded or excessive.
9.3Closing your Account. You can ask us to close your Account at any time. We will deactivate it immediately and delete or anonymise the data we are not required to keep at the end of the retention periods in section 7. Orders, invoices and payment records are kept for the period the law requires even after your Account is closed.

10. Children

10.1The Platform is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has registered or given us personal data, contact us and we will delete it.

11. Links to other sites

11.1Market Intelligence contains links to news publishers' websites, and the Platform's footer links to our Facebook and LinkedIn pages. Those sites have their own privacy policies and we are not responsible for them. Payment pages are provided by DPO Pay under DPO's privacy policy.

12. Changes to this Policy

12.1We will update this Policy when the Platform's practices change — for example when subscription billing goes live, when a payout or claim feature is built, or if hosting moves. The current version, with its date, is always published on the Platform. Material changes will be notified to you by email, SMS or a notice in your Account before they take effect, and where the Act requires your consent we will ask for it.

Shopping cart

Subtotal: