Privacy Policy & Data Protection Notice

1. Identity of the Data Controller & Data Protection Officer (DPO)

For the purposes of the Cyber and Data Protection Act [Chapter 12:07] and the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (Statutory Instrument 155 of 2024), the Data Controller responsible for processing your personal information is:

2. Scope of This Privacy Notice

This Privacy Policy governs how Qstructs Systems collects, uses, stores, discloses, and safeguards personal information across:

• Our official website (https://qstructssystems.com), including both our Building & Construction Supplies division (/bricks) and Technology & Creative division (/dev);
• Our online Quotation, Customer Portal, and Mobile Money Checkout services (EcoCash and InnBucks via Paynow Zimbabwe);
• The Quick Bricks mobile application published by Qstructs Systems; and
• Direct customer communications via email, telephone, WhatsApp, and physical visits to our Harare office.

3. Categories of Personal Information We Collect

In accordance with Section 13 of the Cyber and Data Protection Act [Chapter 12:07], we collect only the minimum personal data necessary for specified, explicit, and legitimate business purposes:

• Identity & Contact Information: First name, last name, email address, telephone/mobile number, company or organization name, and physical delivery address when you request a quotation, register a customer account, or submit a contact enquiry.
• Quotation, Order & Transaction Data: Selected building materials or technology services, quantities, delivery preferences, installment plan elections, official quotation references, and payment status records.
• Mobile Money Payment Data: When paying via EcoCash or InnBucks through our integrated Paynow Zimbabwe gateway, we process the mobile money phone number you provide and receive transaction reference tokens and payment confirmation statuses. Qstructs Systems never collects, sees, or stores your EcoCash/InnBucks PIN—authorization occurs strictly on your mobile handset via USSD.
• Community & Marketing Data: Your email address when subscribing to our newsletter, and your name, email address, optional website URL, and comment text when posting comments on our blog.
• Technical & Cybersecurity Logs: IP address, browser user-agent, session cookies, CSRF security tokens, and encrypted form render timestamps (SpamGuard) required to protect our platform against automated bot abuse, unauthorized access, and cyber threats.

4. Purpose and Lawful Basis for Processing

Under Sections 7 to 11 of the Cyber and Data Protection Act [Chapter 12:07], we process personal data only where at least one of the following lawful bases applies:

• Performance of a Contract & Pre-Contractual Steps: Generating building material quotations, scheduling brick and hardware deliveries, providing IT/software/branding services, managing your customer portal account, and processing payments.
• Data Subject Consent: Sending marketing newsletters, publishing your blog comments, or responding to voluntary enquiries submitted via our website or WhatsApp. You may withdraw your consent at any time by contacting our DPO at info@qstructssystems.com.
• Compliance with Legal Obligations: Maintaining accurate tax, accounting, and commercial transaction records under Zimbabwean law (including ZIMRA and POTRAZ statutory requirements).
• Legitimate Interests: Ensuring network and information security, preventing fraud, enforcing rate limits on authentication and public forms, and improving service delivery.

5. Your Statutory Rights Under Zimbabwean Law (POTRAZ)

Under Sections 13 to 17 of the Cyber and Data Protection Act [Chapter 12:07] and SI 155 of 2024, every data subject in Zimbabwe has the following enforceable rights:

• Right to be Informed (Section 13): To be informed transparently about who is collecting your personal data, for what purpose, and how it is processed.
• Right of Access (Section 14): To request confirmation of whether we hold personal information about you and to obtain a copy of that data.
• Right to Rectification (Section 14): To request correction or updating of any inaccurate, incomplete, or outdated personal information we hold (you may also update your profile directly in your Customer Account Portal).
• Right to Erasure / Deletion (Section 14): To request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to mandatory statutory retention periods.
• Right to Object to Processing (Section 14): To object at any time to the processing of your personal information for direct marketing or newsletter communications, free of charge.
• Right Regarding Automated Decision-Making (Section 15): Not to be subjected to decisions based solely on automated processing that produce legal effects or significantly affect you. Qstructs Systems does not conduct automated profiling of customers.
• Right to Lodge a Complaint with POTRAZ: If you believe your data protection rights have been infringed, you have the right to lodge a formal complaint with our Data Protection Officer at info@qstructssystems.com or directly with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).

6. Data Sharing, Third-Party Processors & Cross-Border Transfers

We do not sell, rent, or trade your personal information to third parties. We share personal data only with trusted service providers acting under strict confidentiality and security obligations:

• Payment Gateway Processors: Paynow Zimbabwe, EcoCash (Econet Wireless), and InnBucks solely to initiate and verify mobile money or online payments for your quotations.
• Logistics & Delivery Partners: Our internal fleet and verified transport personnel strictly for delivering bricks, pavers, roofing tiles, and hardware to your nominated site address.
• Hosting & Cloud Infrastructure: Where website hosting or transactional email servers are located outside Zimbabwe, we ensure compliance with Sections 28 and 29 of the Cyber and Data Protection Act [Chapter 12:07] and POTRAZ cross-border transfer safeguards so your data receives an adequate level of protection.

7. Technical Security Measures & Data Breach Notification

In compliance with Section 18 of the Cyber and Data Protection Act [Chapter 12:07] and SI 155 of 2024, Qstructs Systems implements strict technical and organizational security controls, including:

• HTTPS/TLS transport encryption and strict security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security);
• Cryptographic hashing of user passwords (Bcrypt) and signed URLs for quotation checkout and PDF access;
• Role-based access controls restricting administrative data access to authorized personnel only; and
• Cryptographic hash verification on all Paynow payment callbacks before finalizing payment statuses.

Data Breach Notification (SI 155 of 2024): In the unlikely event of a security breach affecting personal data, Qstructs Systems will notify POTRAZ within 24 hours of becoming aware of the incident (via statutory Form DP3) and will notify affected data subjects within 72 hours where the breach poses a high risk to their rights and freedoms.

8. Cookies & Essential Session Technologies

Our website uses strictly necessary first-party cookies to maintain your login session, preserve items in your Brick Quote Cart, and protect forms against Cross-Site Request Forgery (XSRF-TOKEN). If you choose to check "Save my name, email, and website in this browser for the next time I comment" on our blog, those preferences are stored strictly at your direction. We do not use intrusive third-party behavioral advertising trackers.

9. Data Retention Schedule & Children's Privacy

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected:

• Quotations, Invoices & Payment Records: Retained for the statutory period required by Zimbabwean tax and commercial law (typically 6 years).
• Contact Enquiries & Unfinalized Quotes: Reviewed periodically and archived or deleted once the enquiry is resolved and no ongoing contractual relationship exists.
• Newsletter Subscriptions: Retained until you request to unsubscribe.
• Protection of Children: Our products and services are directed at adults and business entities (18 years and older). In accordance with the Cyber and Data Protection Act, we do not knowingly collect personal information from children without verified parental or legal guardian consent.