SMS-Pop | Bulk SMS Service Zimbabwe

This Privacy Policy describes how SMS Pop ("we", "us", or "our") collects, uses, discloses, and protects your personal data when you use the SMS Pop platform ("Service") in Zimbabwe. By using our Service, you agree to the collection and use of information in accordance with this policy and the Cyber and Data Protection Act [Chapter 11:12] of Zimbabwe.

1 Information We Collect

1.1 Personal Information You Provide

Account Information: Full name, email address, phone number, and password when you register.
Billing History: Transaction records from the billing process.
System Interactions: Information you provide when you create or manage contacts and campaigns.
Communications: Records of your interactions with our support team and feedback submissions.

1.2 Information Collected Automatically

Usage Data: Login history, message logs, and platform interactions.

2 How We Use Information

2.1 Service Provision

To create and manage your account and provide the SMS services.
To authenticate users and prevent unauthorized access.
To process transactions and send billing notifications.
To deliver SMS messages and provide delivery reports.

2.2 Communication

To respond to your inquiries and provide customer support.
To send important notices about service changes, terms updates, or policy changes.
To inform you about new features, products, or promotional offers (with opt-out option).

2.3 Business Operations

To monitor and analyse usage trends to improve our services.
To prevent fraud, abuse, and security incidents.
To comply with legal obligations under Zimbabwean law.

Legal Basis for Processing: We process your data based on (1) your consent, (2) performance of a contract with you, (3) compliance with legal obligations in Zimbabwe, or (4) legitimate business interests that do not override your rights.

3 Data Sharing and Disclosure

3.1 Service Providers

SMS Gateway Providers: To route and deliver your messages.
Payment Processors: To handle financial transactions securely.
Cloud Hosting Providers: For data storage and infrastructure.

3.2 Legal Requirements

To comply with court orders, subpoenas, or other legal requests.
To assist law enforcement in investigations as required by law.
To comply with telecommunications regulations from POTRAZ.

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction, with appropriate confidentiality protections.

Data Protection Commitment: We never sell your personal data. All third parties must agree to confidentiality obligations and may only process data for specified purposes in compliance with Zimbabwe's Cyber and Data Protection Act.

4 Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required or permitted by Zimbabwean law.

Data Type	Retention Period	Reason
Account Information	5 years after account closure	Legal and financial record-keeping requirements
Transaction Records	7 years	Zimbabwe Revenue Authority tax compliance
SMS Message Logs	30 days after delivery	Operational requirements, unless longer retention is required by law
Customer Support Records	3 years	Service quality and dispute resolution

5 Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in compliance with Zimbabwe's Cyber and Data Protection Act.

Technical Protections

Encryption: TLS for data in transit, AES-256 at rest.
Network Security: Firewalls and intrusion detection systems.
Access Controls: Role-based access and least-privilege principles.
Vulnerability Management: Regular security patching.

Organisational Protections

Privacy accountability: Designated responsibility for data protection compliance within our organisation.
Staff training: On data protection and privacy best practices.
Policies and procedures: Data protection and incident response plans.
Vendor controls: Contractual data protection obligations for processors.
Audit trails: Logging and monitoring of access to sensitive data.

Data Breach Notification: In the event of a personal data breach, we will notify you and the relevant Zimbabwean authorities as required by law.

6 Your Rights Under Zimbabwe's Cyber and Data Protection Act

As a data subject, you have the following rights regarding your personal data:

Access and Portability

Request a copy of your personal data in a structured, commonly used format.

Rectification

Correct inaccurate or incomplete personal data we hold about you.

Erasure

Request deletion of your personal data under certain circumstances.

Restriction

Limit how we use your data while disputes are resolved.

Objection

Object to certain processing activities such as direct marketing.

Withdraw Consent

Withdraw previously given consent at any time without affecting prior processing.

To exercise any of these rights, contact us using the details below. We may need to verify your identity before processing your request. There is no fee for reasonable requests.

7 International Data Transfers

As a Zimbabwe-based company, we primarily store and process data within Zimbabwe. When some service providers operate in other countries, we ensure appropriate safeguards are in place as required by the Cyber and Data Protection Act, including processing only in countries with adequate protections or through contractual safeguards.

8 Cookies and Tracking Technologies

We use cookies to enhance your experience:

Cookie Type	Purpose	Duration
Essential Cookies	Necessary for platform functionality (login, security)	Session

9 Children's Privacy

Our service is not directed to individuals under 18. We do not knowingly collect personal data from children. If we become aware that we have done so, we will remove it in accordance with Zimbabwean law.

10 Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will notify you through the Service or by email at least 3 days before the changes take effect. The "Last updated" date at the top indicates when it was last revised.

11 Complaints

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue.

You also have the right to lodge a complaint with the Zimbabwe Data Protection Authority if you believe your rights under the Cyber and Data Protection Act have been violated.

Privacy & Data Enquiries

For any data rights requests or privacy concerns, please contact us:

Email

support@smspop.co.zw

Phone

+263 714239734 (Mon–Fri, 8am–5pm CAT)

Postal Address

Privacy Enquiries
SMS Pop / Farnux Labs
88 Rezende Street
Harare, Zimbabwe