Privacy policy

01Who we are and how to reach us

ShonaDirect is operated by Shona Prince Technologies, a company incorporated in Zimbabwe that also operates from Maputo, Mozambique. Shona Prince Technologies decides why and how the information described here is used. That makes it the data controller for it.

Write to us at support@shonatech.africa, or by post to Shona Prince Technologies, Avenida Das FPLM, #526, Maputo, Mozambique. Use that address for any question about this policy, for a request about your own information, and for a complaint. The team that reviews brand applications can also be reached at admin@shonatech.africa.

We have not appointed a data protection officer. The laws that apply to us require one of an organisation whose main work is monitoring people at scale, or handling sensitive information at scale, and ShonaDirect is neither of those. Requests are handled by the people who run ShonaDirect, at the addresses above.

02This is a service for businesses

The people whose information we hold are the directors, managers and employees a brand puts forward to act for it: the person who applies, the people the brand invites onto its account, and the contacts named in the documents it sends us. We hold information about them because of the work they do, not because of their private lives.

We do not ask for information about shoppers, and we do not want it. Sales reach a brand's dashboard from Shona's own retail systems as counts, dates, stores and amounts. A brand never sees the name, the card, the phone number or any other detail of the person who bought its product in a Shona store.

We do not ask for sensitive information such as health, race, religion, political opinion, trade union membership, genetic data or biometric data, and there is nowhere on ShonaDirect to enter it. Please do not upload it. If a document you send us happens to contain something like that, tell us and we will take it out.

03What we collect

Almost all of it comes from the brand itself. The trading records are produced by Shona's own warehouse and retail systems as goods move and sell.

Company information

Trading name, registered legal name, country of incorporation, company registration number, website, product categories, a description of the brand, and the company address.

The people on the account

First and last name, work email address, phone number, the role the brand gives each person, and the password chosen at sign up. A password is stored only as a hash. Nobody at Shona can read it back, and nobody at Shona will ever ask you for it.

Documents

The files a brand uploads to prove it is what it says it is, such as a certificate of incorporation, a tax certificate, an export licence and product certifications, together with anything else we ask for during the review.

Settlement details

Bank name, account name, account number, SWIFT code, IBAN, the bank's country and the settlement currency. We use these only to pay a brand what it has earned.

Product and trading records

The products a brand submits, their photographs, specifications and certificates, the consignments it declares, what arrived and in what condition, stock counts by location, sales totals, returns, settlement statements and payments.

Records of what happens on the account

Sign in times, and the changes a brand's own users make, with the time, the user, the internet address the change came from and the browser it came from. This is an audit trail, so that a brand and Shona can both see who changed what.

What you write to us

Emails and support messages, and our replies, so that a question can be picked up by whoever handles it next.

04Why we use it, and the legal reason we may

Every use below has a purpose and a legal reason behind it. Where the reason is our legitimate interests, we have weighed our interest against yours, and we will explain the weighing to anyone who asks.

Reviewing an application

We read the company details and the documents to decide whether to open an account and distribute for the brand. The reason is that these are steps taken at the applicant's request before a contract, and that we have a legitimate interest in knowing who we are distributing for and standing behind in our own stores.

Running the account

Opening the account, inviting users, reviewing products, planning allocations, receiving consignments, tracking stock and reporting sales. The reason is that we need to do it to perform our contract with the brand.

Paying settlements

We use the banking details only to pay a brand what its statement says it has earned. The reason is performance of the contract, together with the accounting records we are obliged by law to keep.

Keeping the service safe

Sign in records, audit records and technical logs let us see an account being misused, work out what happened after a problem, and prove who approved what. The reason is our legitimate interest in a service that is secure and can be audited, which is also in the interest of every brand on it.

Service messages

We email account holders about their own account: a decision on an application, a product review, an invitation, a password reset, a consignment, a statement. These are part of the service, not marketing, and we send them to perform the contract. There is no advertising list on ShonaDirect and we do not sign anyone up to one.

Meeting our obligations

Tax, customs, company law, accounting, product safety and the checks we have to make before we trade with a company. The reason is that the law requires it of us.

Defending our position

Keeping the records we would need for an audit, a dispute, an insurance claim or a legal claim. The reason is our legitimate interest in being able to prove what happened, and the establishment or defence of legal claims.

Anything we ask permission for

If we ever want to do something we do not need to do, such as naming a brand in a case study or using its logo in our own marketing, we will ask first. That runs on consent, and consent can be withdrawn at any time by writing to support@shonatech.africa, with no effect on anything done before.

Zimbabwe's Data Protection Act allows the same things in its own words. It allows processing that is needed to meet a legal obligation. It allows processing that promotes the legitimate interests of the organisation holding the information, so long as those interests do not override the rights of the person the information is about. For everything else it looks to the consent of an adult with full legal capacity. The reasons above are written in the wider language used in Europe and the United Kingdom, so that a brand anywhere can see which one applies to it.

05Who we share it with

Inside Shona Prince Technologies, access is limited to the people whose work needs it: the team that reviews applications, the warehouse and logistics team, the retail team and the finance team.

Google Cloud

ShonaDirect runs on Google Cloud. Google holds the servers, the database and the uploaded files on our instruction and under a written contract, and does not use what it holds for its own purposes.

Postmark

Email from ShonaDirect is delivered through Postmark. It receives the recipient's name and email address and the content of the message, only so that it can deliver it.

Shona's own systems

The warehouse, point of sale and accounting systems that run the Shona retail network. They are how a sale becomes a line on a statement and how a settlement becomes a payment.

Banks and payment providers

The banks that move a settlement from Shona to the brand receive the payment details needed to make the payment.

Professional advisers

Accountants, auditors, insurers and lawyers, where they need it to do their work for us, and always under a duty of confidence.

Authorities

Customs, tax, product safety and data protection authorities, and a court, where the law requires it or where it is needed to bring or defend a legal claim.

A buyer of the business

If Shona Prince Technologies is sold, merged or reorganised, records may pass to the new owner, who would be bound by this policy until it publishes its own.

We do not sell personal information, to anyone, for any price. We do not share it with advertisers, data brokers or list sellers. No provider we use is allowed to use it for anything other than the job we gave it.

06Where it is held, and why it crosses borders

The application and the database behind it, which hold a brand's account, products, consignments, stock, sales and settlements, run in Google Cloud's United States region. The documents a brand uploads are stored in Google Cloud Storage in the European Union. The website that serves these pages runs in Google Cloud's Belgium region. Product photographs, which a brand supplies for its goods to be sold, are stored in Google Cloud Storage in the United States.

Shona Prince Technologies works from Zimbabwe and Mozambique, and its retail network reaches the countries listed on the home page. The people who review applications, run the warehouses, manage the stores and pay settlements are in those countries, and they read this information from there.

So information crosses borders for one reason: the service cannot be delivered from a single country. A brand in one country ships goods to a warehouse in another, sells through stores in a third, and is paid from a bank in a fourth.

Zimbabwe's Data Protection Act allows information to be sent to another country where an adequate level of protection is ensured there, and separately allows a transfer that is necessary to perform the contract between the person and the controller, or to bring or defend a legal claim. Kenya's Data Protection Act and its 2021 General Regulations set out the same kind of grounds, with appropriate safeguards written into the contract. European and United Kingdom law works the same way. Those are the grounds we rely on.

We have a written contract with every provider that holds information for us, which is what Zimbabwe's Act requires of a controller, and we choose providers that can show the technical and organisational measures they have in place. Mozambique's own data protection law is still being made. Until it is in force we apply the same standard there that we apply in Zimbabwe.

07How long we keep it

We keep records for as long as there is a reason to, and then we stop. The reasons, and what follows from each, are these.

Brand, product and trading records

Kept while the relationship is live, and after it ends for as long as the tax law and the company law of each country where the goods were sold, and where the settlements were paid, require those records to be kept. That period is fixed by the law of the country rather than by us, and where several apply we keep the record for the longest of them.

Settlement and payment records

Kept for the same period, because they are accounting records in every country that touches the transaction.

Documents uploaded during review

Kept while the account is open, because they are what the approval rests on, and afterwards for as long as they support a transaction whose records we are required to keep.

Applications that are not approved

Deleted within six months of the decision, together with the documents and the contact details sent with them, unless the applicant asks us to hold the application open so it can be resubmitted, or we are required to keep it for a legal reason. An applicant who wants it deleted sooner can say so and we will do it.

Audit records

Kept while the account exists, because their whole purpose is to show who changed what across the life of the relationship.

Support messages

Kept for as long as we need them to deal with the matter and to show how it was dealt with.

When a period ends, the record is deleted or stripped of anything that identifies a person. Trading totals that no longer identify any person or any brand may be kept to plan the network.

08How we protect it

These are measures that are in place today, not intentions.

• Everything travels over an encrypted connection. There is no unencrypted route into ShonaDirect.
• Sign in tokens live in cookies that page scripts cannot read, and the token used to renew a session never reaches the code running in your browser at all.
• Passwords are stored as hashes and are never stored in a form anyone can read.
• A bank account number and an IBAN are masked down to their last few characters before they leave our systems. The dashboard has no screen anywhere that shows a full account number or a full IBAN.
• Uploaded documents sit in a private store with no public link. A document is delivered only in answer to a signed in request from the account that owns it.
• Access inside Shona is limited to the people whose work needs it, and a brand controls who on its own side is an owner, an admin or a viewer.
• Changes made on a brand's account are written to an audit record with the time, the user, the internet address and the browser.
• Backups are taken so that records can be restored after a failure.

No system is perfectly safe and we will not pretend otherwise. We hold no information security certification, and we would rather say that plainly than imply a badge we do not have.

09What you can ask us to do

Whoever you are and wherever you are, you can ask us to do the following about information we hold about you.

• Tell you what we hold and what we use it for.
• Give you a copy of it.
• Correct anything that is wrong or out of date.
• Delete information that is false or misleading.
• Stop using it where our reason is our own legitimate interests and your position outweighs ours.
• Withdraw a permission you gave us, where we asked for one.

Where the law that applies to you gives you more than that, we will honour it. Brands in Europe and the United Kingdom, for example, also have rights to erasure, to restriction of use, and to receive their information in a portable form, and we will act on those requests too. No decision on ShonaDirect that affects a brand, including the decision on its application, is made by a machine on its own. A person makes it.

To ask for any of this, write to support@shonatech.africa from the address on the account, or with enough detail for us to be sure who you are. We answer within one month. If a request is complicated we will say so and tell you how long it will take. We do not charge for it.

Some things we cannot do, and we would rather be straight about that than promise and fail. We cannot delete a settlement record that a tax authority is entitled to see, or an audit record that shows who approved a consignment. Where we cannot do what you ask, we will tell you and tell you why.

If you are not happy with how we have handled something, tell us first and give us the chance to fix it. You can also complain to the data protection authority where you are. In Zimbabwe that is the Postal and Telecommunications Regulatory Authority of Zimbabwe, which the Data Protection Act names as the Data Protection Authority. In Kenya it is the Office of the Data Protection Commissioner. In the European Union and the United Kingdom it is your national supervisory authority.

10If something goes wrong

If information is lost, taken or exposed, we will work out what happened, stop it, and tell the people who need to know.

Zimbabwe's Data Protection Act requires a data controller to notify the Data Protection Authority within twenty four hours of a security breach affecting the data it processes. We work to that deadline, and where another country we operate in sets a shorter one we work to the shorter one.

We will also tell the brand, and the people affected, without undue delay where the breach is likely to put them at risk. We will say what happened, what it means for them, what we have done, and what they should do.

11Cookies and what your browser stores

ShonaDirect uses no advertising cookies, no tracking pixels and no third party analytics. Nothing on this site follows you to another site, and no advertiser is told you were here.

The cookies we do set are the ones a signed in portal cannot work without. They are set by ShonaDirect itself, marked so that page scripts cannot read them, sent only to this site, and served over an encrypted connection. They last up to thirty days, and signing out clears them.

sd_at

The token that proves your session to the API. Without it you are signed out on every click.

sd_rt

The token used to renew that session quietly when it expires, so you are not thrown out mid task.

sd_exp

When the current session token expires, so the site knows when to renew it.

sd_ctx

A small record of your brand name, your name, your role and your account status, so the dashboard can draw the right thing before it has spoken to the API. It holds nothing sensitive and no token.

Because all four are strictly necessary to keep you signed in, there is no consent banner asking whether you would like to stay signed in. There is nothing else here to consent to.

Your choice of the light or the dark theme is kept by your browser in its own storage rather than in a cookie, and it never reaches us. Clearing site data in your browser removes everything above and signs you out.

12Children

ShonaDirect is a service for companies. It is not offered to children and we do not knowingly hold information about anyone under eighteen. If you believe we have, write to support@shonatech.africa and we will remove it.

13Changes to this policy

We will change this policy when what we do with information changes, when we add or replace a provider, or when the law changes. The version on this page is always the one that applies, and the date at the top of the page is the date it last changed.

Where a change materially affects account holders, we will tell them by email before it takes effect.

14Effective date and contact

This version takes effect on 14 September 2026 and replaces anything published before it.

Shona Prince Technologies, Avenida Das FPLM, #526, Maputo, Mozambique. Email support@shonatech.africa.