Privacy Policy

This Privacy Policy describes how Listify ("we", "our" or "us") collects, uses, stores and shares personal information when you use the Listify Platform (website and associated services).

Listify is the data controller responsible for your personal data. We are committed to protecting your privacy in accordance with the CyberSecurity and Data Protection Act, 2021 (Act 5 of 2021) of Zimbabwe ("the Act"), and where applicable, the Electronic Commerce and Electronic Signatures Act [Chapter 11:05].

The regulatory authority responsible for data protection in Zimbabwe is the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), which also administers cyber-security matters under the Act.

Data Controller contact: Contact page

Information you provide directly:

• Account data: name, email address, phone number and password (stored in hashed form via AWS Cognito) when you register.
• Profile data: optional information such as your location (city/suburb) and a profile photo.
• Listing data: descriptions, photographs, asking price, location and category of items you list.
• Communications: messages and enquiries you send to other users or to us through the Platform.
• Payment data: billing information entered during checkout. Card numbers are handled entirely by Stripe — we do not store or have access to your full card details.

Information we collect automatically:

• Technical data: IP address, browser type and version, operating system and device type.
• Usage data: pages visited, listings viewed, search queries entered, time spent on pages and click patterns.
• Cookies and similar technologies: see our Data Policy for full details.

When you use Listify Finance, we may collect identity and contact details, residential information, income and affordability information, guarantor details, your selected vehicle and loan estimate, supporting documents, and versioned records of the permissions and declarations you give.

A saved draft is not shared with a lender. If you explicitly submit an application, we may share the submitted application revision and the documents you selected with the named lender so it can assess and process your request. The lender then acts as an independent data controller for its own assessment, compliance and lending activities.

We may use automated tools to extract document fields and flag inconsistencies for human review only where the relevant notice and permission are presented. An automated flag is not a lending decision. Optional automated document checks may be declined without preventing manual review.

Guarantor information should be supplied only after the guarantor has agreed to be contacted. Finance permissions are recorded against a versioned notice so we can demonstrate what was agreed and when. Retention periods for applications and lending records may differ from ordinary marketplace data where law, fraud prevention or a lender's regulatory obligations require it.

We use the information we collect to:

• Create and manage your account;
• Display your listings to potential buyers across the Platform;
• Process payments for subscription plans and promotion credits;
• Send transactional notifications — including listing enquiries, payment receipts and security alerts;
• Enforce our Terms of Service and detect, investigate and prevent fraud, abuse or illegal activity;
• Conduct internal analytics to understand how users interact with the Platform and to improve its design and functionality;
• Send marketing or promotional communications where you have given us consent to do so (you may opt out at any time); and
• Comply with our legal obligations under applicable Zimbabwean law.

Under the CyberSecurity and Data Protection Act, 2021, we rely on the following lawful bases for processing your personal data:

• Contract performance: processing necessary to provide our services to you, including account management, displaying listings and processing payments.
• Legitimate interests: processing necessary for our legitimate business interests — including fraud prevention, platform security, analytics and improving our services — where these interests are not overridden by your rights.
• Consent: where we rely on your consent (e.g. marketing emails, optional analytics cookies, advertising pixels), you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation: where processing is necessary to comply with a legal requirement, including responding to lawful requests by law enforcement authorities.

Listify does not sell, rent or trade your personal data to third parties for their own marketing purposes. We may share your information in the following circumstances:

• With other users: your public profile information (name, public listings, contact details shown on listings) is visible to all Platform users. You can control which contact details appear on your listings.
• With service providers: we share data with third parties who help us operate the Platform, including AWS (hosting and authentication), Stripe (payment processing) and analytics providers. These providers are contractually bound to process data only as instructed by us and in compliance with applicable data protection law.
• With law enforcement: we may disclose personal data where required to do so by law, court order or other legal process, or where we reasonably believe disclosure is necessary to protect the rights or safety of Listify, our users or the public.
• In a business transfer: if Listify is involved in a merger, acquisition or sale of assets, your personal data may be transferred as part of that transaction. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

The Platform is hosted on Amazon Web Services (AWS) infrastructure located primarily in the us-east-1 region (Northern Virginia, United States). As a result, your personal data is transferred to and stored in the United States.

Stripe, our payment processor, may process billing data in the United States and/or the European Union.

Where we transfer personal data outside Zimbabwe, we ensure appropriate safeguards are in place in accordance with Part IV of the CyberSecurity and Data Protection Act, 2021, including contractual obligations on recipients to provide an equivalent level of data protection.

We retain personal data for the following periods:

• Account data: for the duration your account is active and for 12 months after account deletion, to allow you to reactivate and to resolve any outstanding disputes.
• Active listing data: until the listing is deleted or archived.
• Archived listing data: 12 months after archival, then permanently deleted.
• Payment and transaction records: 7 years from the date of transaction to comply with Zimbabwean tax and financial record-keeping obligations.
• Technical logs: 90 days, after which they are automatically deleted.
• Communications: 12 months from the date of the communication.

After the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to you.

Under the CyberSecurity and Data Protection Act, 2021 (Act 5 of 2021), you have the following rights with respect to your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right to rectification: you may request that we correct inaccurate or incomplete personal data.
• Right to erasure: you may request that we delete your personal data, subject to certain legal exceptions (e.g. where retention is required for legal compliance).
• Right to restrict processing: you may ask us to limit how we use your data while a complaint or correction request is pending.
• Right to data portability: you may request a machine-readable export of personal data you have provided to us.
• Right to object: you may object to processing based on legitimate interests, including profiling for marketing purposes.
• Right to withdraw consent: where processing is based on consent, you may withdraw that consent at any time without affecting prior lawful processing.

To exercise any of these rights, contact us via our Contact page. We will respond within 30 calendar days of receiving your request. We may need to verify your identity before processing your request.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction:

• Encryption in transit: all data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Authentication security: user authentication is handled by AWS Cognito, which provides industry-standard password hashing (bcrypt), multi-factor authentication options and brute-force protection.
• Infrastructure isolation: our servers are deployed within an AWS Virtual Private Cloud (VPC) with strict network access controls.
• Access controls: access to production systems and personal data is restricted to authorised personnel on a least-privilege basis.
• Payment security: card data is processed exclusively by Stripe, which is PCI-DSS Level 1 certified. We do not store or have access to your full card details.

While we take these measures seriously, no system can guarantee absolute security. If you believe your account has been compromised, contact us immediately.

The Platform is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors.

If you are a parent or guardian and believe that your child has provided personal data to us without your consent, please contact us via our Contact page and we will promptly delete the relevant information.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) within 72 hours of becoming aware of the breach, as required by the CyberSecurity and Data Protection Act, 2021;
• Notify affected users without undue delay, including a description of the nature of the breach, the categories of data affected and the steps we are taking or recommend you take to protect yourself; and
• Take immediate remedial action to contain the breach and prevent further unauthorised access.

If you believe your data may have been involved in a security incident, please contact us immediately via our Contact page.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal obligations. The current version will always be published at listify.co.zw/privacy with the date of the most recent revision.

For material changes — those that significantly affect your rights or our data practices — we will notify you by email or in-app notification at least 14 calendar days before the change takes effect.

For any questions, concerns or requests relating to this Privacy Policy or your personal data, please visit our Contact page.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate your complaint to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the competent data protection supervisory authority under the CyberSecurity and Data Protection Act, 2021.