SahwiGate Privacy Policy

This Privacy Policy and Data Protection Notice ("Policy") sets out how SahwiGate, operating under and in affiliation with the Nyaradzo Group ("we", "us", "our"), collects, processes, stores, protects, and discloses personal data in connection with:

• The SahwiGate web application (sahwigate.com) and associated mobile applications.
• Digital event ticketing and access control for concerts, sports (including marathons and walkathons), cultural, and corporate functions.
• The Nyaradzo Funeral Transport & Bus Manifest System (including public registration portals, teller portals, and bus boarding manifests).
• Interactive conversational chatbots deployed across Meta WhatsApp Cloud API and related messaging platforms.

This Policy is governed by and construed in strict conformity with the laws of the Republic of Zimbabwe, specifically the Cyber and Data Protection Act [Chapter 12:07] (Act No. 5 of 2021), the Consumer Protection Act [Chapter 14:14], and the National Payment Systems Act [Chapter 24:23].

In accordance with Section 3 of the Cyber and Data Protection Act [Chapter 12:07]:

We collect only the minimum necessary personal data required to deliver our services:

Under Section 11 of the Cyber and Data Protection Act, we process your data strictly under the following lawful grounds:

When you register for funeral transportation provided by Nyaradzo Group / SahwiGate:

• Policyholder Verification: Your National ID is queried securely against the Nyaradzo / Easipol policyholder database to verify client status and determine policyholder benefits.
• Transport Safety & Manifests: Your name, allocated seat number, trip route, and Next of Kin emergency details are included on the official bus manifest accessible only to authorized dispatchers, bus marshals, and licensed drivers for transit safety.
• No Public Directory: Funeral listings and passenger registrations are private and accessible solely via direct links, unique codes, or authorized teller portals.

When you interact with the SahwiGate or Nyaradzo Funeral WhatsApp Chatbots via the Meta WhatsApp Cloud API (Graph API v22.0):

• Your mobile phone number and WhatsApp profile name are processed to manage interactive booking sessions.
• Conversational state data is maintained temporarily in isolated session stores and automatically reset after 24 hours of inactivity.
• Boarding passes and tickets are delivered directly as secure, digitally signed PDF documents.
• Inbound messages are validated using SHA-256 HMAC cryptographic signatures to prevent unauthorized spoofing or tampering.

SahwiGate complies strictly with the National Payment Systems Act [Chapter 24:23] and PCI-DSS data security standards:

Mobile money transactions (EcoCash, InnBucks, OneMoney) are authenticated through secure USSD pushes or official API tokens with end-to-end cryptographic verification.

We do not sell, rent, or trade your personal data. Disclosures are limited to authorized third parties under strict contractual data processing agreements:

Where personal data is transferred outside Zimbabwe (e.g. to cloud servers hosted by Amazon Web Services or Meta Platforms API nodes), such transfers comply strictly with Section 28 of the Cyber and Data Protection Act:

• The recipient jurisdiction ensures an adequate level of data protection comparable to Zimbabwean standards.
• Standard Contractual Clauses (SCCs) and binding data processing agreements are in place.
• All data transmitted across borders is protected with industry-standard TLS 1.3 encryption in transit and AES-256 encryption at rest.

We retain personal data only for as long as necessary to achieve the specific purposes for which it was collected or to satisfy statutory obligations:

• Financial, Payment & Tax Records: Retained for 7 years in compliance with ZIMRA tax regulations and Reserve Bank of Zimbabwe requirements.
• Funeral Transport Manifests: Retained for 3 years for transport safety verification and regulatory audits.
• Event Ticketing Records: Retained for 2 years post-event to resolve chargebacks, claims, or customer inquiries.
• Transient WhatsApp Chat Sessions: Automatically purged after 24 hours of inactivity.

In accordance with Section 24 of the Act, we maintain technical, physical, and organizational security measures:

As a data subject under Zimbabwean law, you hold the following non-negotiable statutory rights:

To exercise any of these rights, submit a written request to our Data Protection Officer at dpo@nyaradzo.co.zw. We will respond within thirty (30) days as required by law.

SahwiGate does not knowingly register or collect personal information from individuals under the age of eighteen (18) without the explicit verifiable consent of a parent or legal guardian. Where children participate in sporting events (such as fun runs or junior marathons), registration must be completed by an authorized adult.

In the unlikely event of a security incident resulting in a breach of personal data that presents a risk to the rights and freedoms of data subjects:

• We will notify the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) within seventy-two (72) hours of becoming aware of the breach.
• We will communicate the breach without undue delay to affected data subjects with actionable guidance on mitigating potential adverse effects.

If you have questions, concerns, or wish to file a data privacy request, please contact our designated Data Protection Officer: