Menu

Privacy Policy

This policy explains how PropertyHandle Africa collects, uses, and protects your personal data in compliance with the Zimbabwe Data Protection Act and GDPR principles.

1. Introduction

PropertyHandle Africa (Pvt) Ltd ("we", "us", "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

We comply with the Zimbabwe Data Protection Act (2021) and adhere to international best practices including GDPR principles where applicable.

2. Data We Collect

2.1 Information You Provide

  • Account: your name, email address and phone number, and your password (we store only a one-way hash of it). If you turn on two-factor sign-in, we store its secret in encrypted form.
  • Identity verification (KYC): a copy of your national identity card or passport, and a document that proves your address. These documents show details such as your ID or passport number, date of birth, photograph and home address. The form also asks for your date of birth and nationality; we do not store those answers separately from the documents.
  • Buying a stand: when we prepare an offer to purchase or an agreement of sale for you, it can include your full name, email address, phone number, home address, date of birth and ID number.
  • Payments: your email address, mobile-money number, the amounts you pay, payment references and your payment history. We do not receive card or bank account details.
  • Property estimates and reports: the property's address and details that you enter, and any photos of it that you upload.
  • Enquiries to developers: your name, email address, phone or WhatsApp number, your message, and the plot size and budget you mention.
  • Waitlist: your name, email address and country, whether you are registering as an individual or an organisation, your connection to Zimbabwe, your investment experience and the kinds of property you are interested in.
  • Developer and tokenization applications: the company's details, the contact person's name, email address and phone number, and the project documents you upload.

2.2 Automatically Collected Data

  • Server logs: your IP address, browser and device details, and the pages and features you request.
  • With some forms: when you send a developer enquiry, register interest in a plot, or submit a listing or tokenization application, we store your IP address and browser details with it.
  • Cookies and browser storage: see our Cookie Policy.

3. How We Use Your Data

We use your personal data to:

  • Create and manage your account
  • Process your payments
  • Comply with KYC/AML regulatory requirements
  • Send payment receipts and confirmations
  • Provide customer support
  • Improve our platform and services
  • Send marketing communications (with your consent)
  • Detect and prevent fraud

5. Who Receives Your Data

These are the companies that receive personal data from us, what they receive, and where they process it.

  • cloud.co.za, our hosting provider (server in South Africa): stores everything held on the platform, including accounts, reports, payment records, KYC documents and outreach records.
  • Google, for Gemini (United States and other countries where Google operates), which writes the explanation in your estimate or report. Gemini receives the property's suburb and city, its type, size, number of bedrooms and bathrooms, year built, asking price and the features you select. It also receives the figures our code calculated, comparable listings (their type, suburb, asking price, size and bedrooms) and nearby amenities. If you upload photos, our page removes all the information stored in each photo file, such as where and when it was taken and the camera used, before it is sent, so Gemini receives the image only. Gemini does not receive the street address, your name, email address, phone number or account details.
  • Google, for Maps (United States and other countries where Google operates): suburb and city names and the locations of developments, to find nearby amenities and place properties on a map. It does not receive your name or contact details.
  • PayNow (Zimbabwe): your email address, mobile-money number, the amount and our payment reference, when you pay for a report.
  • Nivacity, our mail host (servers in Germany): every email we send or receive, including the address, the name used and the message. This covers account emails (verification, password reset, two-factor codes, receipts and waitlist confirmations) and our partnership outreach mailbox.
  • MailBaby, the relay our mail host uses (United States): the recipient address and message of each email we send, to deliver it.
  • Backblaze (Canada East region): encrypted copies of our database, for disaster recovery. They are encrypted before they leave our server, and Backblaze does not hold the key.
  • Services your browser contacts when our pages load: Google Fonts (Google), the Tailwind, unpkg and jsDelivr code libraries (served through Cloudflare), map images from OpenStreetMap and CARTO (served through Fastly), Esri and GitHub, and photos from Unsplash (served through Fastly). Like any website, they receive your IP address and browser details when your browser asks them for a file. We do not send them anything else.
  • Regulatory authorities: SECZ, RBZ or ZIMRA, where the law requires it.
  • Legal advisers: when necessary to protect our legal rights.

We do not use analytics, advertising or chat services, and we do not sell your personal data.

6. Partnership Outreach

We email businesses (estate agencies, developers, valuers and financial institutions) about working together. This section explains what we collect for that and how to stop it.

What we collect. Business contact details that are published as an organisation's contact, on public registers such as the Estate Agents Council's register of agents in good standing, or on the organisation's own website, usually its contact page. We take the organisation's name, the email address it publishes for contact and, where a register lists one, the name of its principal estate agent. That includes a free-mail address (for example a Gmail address) where that is the address the organisation publishes as its business contact. We do not take free-mail addresses from staff lists, personal pages or social profiles, or from listings of individual agents. We only take an address that the page actually shows to visitors, and we do not collect phone numbers or home addresses for outreach.

Where it came from. For every detail we record the page it came from and the date we read it.

What we send. Emails about partnerships only. Every email says who we are and gives our postal address.

Stopping it. Every email has an unsubscribe link. Clicking the button on the page it opens stops all our email to that address, permanently. The unsubscribe button in your email app works too, and so does replying to ask us to stop. We then keep only a one-way code made from the address, not the address itself, so that we never email it again.

How long we keep it. If you have not replied to us, we delete your record 18 months after we last found it on its source or last emailed you, whichever is later.

If you reply. The 18-month deletion stops applying once you reply. We keep your record, your messages and ours, so that we have the history of our conversation and do not ask you something you have already answered. We delete them 3 years after the last message between us, in either direction; automatic replies and bounced emails do not count. You can ask us to erase them sooner, as below.

Access and erasure. To see what we hold about you, or to have it erased, email legal@propertyhandleafrica.com or reply to any of our emails. Erasure removes your details, the record of where we found them and our messages to you. We keep only the one-way code, so that you are not contacted again.

LinkedIn and X. If an organisation's website links to a person's LinkedIn or X profile, we may note the link. We never read profiles, and any message there is written and sent by a person, by hand.

7. Data Retention

We do not yet delete most data automatically. This is what happens to it today:

  • Account, reports and payment records: kept while your account exists, and after that until you ask us to delete them.
  • KYC documents: kept until you ask us to delete them. Where anti-money-laundering law requires us to keep them for a period, we keep them for that period even if you ask sooner.
  • Waitlist: kept until you withdraw. Withdrawing erases your name, email address and technical details at once; we keep only your anonymous answers.
  • Partnership outreach records: 18 months after we last found the details on their source or last emailed you; if you replied, 3 years after the last message between us (section 6).
  • Marketing preferences: until you withdraw consent.
  • Backups: anything we delete stays in our encrypted backups for up to 400 days, until those backups expire.

8. Your Rights

Under data protection laws, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate or incomplete data
  • Erasure: Request deletion of your data (subject to legal requirements)
  • Restriction: Limit how we process your data
  • Portability: Receive your data in a structured format
  • Objection: Object to processing based on legitimate interests
  • Withdraw Consent: Withdraw marketing consent at any time

To use any of these rights, email legal@propertyhandleafrica.com. There is no self-service tool yet, so we handle each request by hand.

9. Security

We protect your data with:

  • Encryption in transit: HTTPS using TLS 1.2 or 1.3
  • Passwords stored only as one-way (bcrypt) hashes
  • Two-factor sign-in, which you can turn on for your account
  • Sign-in cookies that page scripts cannot read, and protection against other websites submitting forms as you
  • Encryption of two-factor secrets and connected-account tokens in our database, and AES-256 encryption of every database backup before it leaves our server
  • Access to KYC documents and payment records limited to administrator accounts
  • A security check of our code before every deployment

10. Where Your Data Is Processed

Our server is in South Africa. Some of the companies in section 5 process data in other countries:

  • United States and other countries where Google operates: Google (Gemini, Maps, Fonts)
  • Germany: Nivacity (email)
  • United States: MailBaby (email delivery)
  • Canada (Canada East region): Backblaze (encrypted backups)
  • Zimbabwe: PayNow (payments)
  • Worldwide networks: Cloudflare, Fastly, Esri and GitHub, which serve files to your browser from a location near you

Backups are encrypted on our server before they are sent abroad.

11. Children's Privacy

Our platform is not intended for individuals under 18 years of age. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us immediately.

12. Policy Changes

We may update this Privacy Policy periodically. We will notify you of material changes via email or platform notification. Your continued use of the platform after changes constitutes acceptance.

13. YouTube

We publish our own videos on our YouTube channel, youtube.com/@propertyhandleafrica, and some articles on this site play those videos through YouTube's embedded player. We use the YouTube API Services only to upload our own videos to our own channel and to add links to related articles. We do not use them to collect, store or share any information about you.

When you play a video on this site or watch one on YouTube, YouTube handles that viewing under the Google Privacy Policy (https://policies.google.com/privacy), and your use of YouTube is subject to the YouTube Terms of Service (https://www.youtube.com/t/terms). Our site uses YouTube's privacy-enhanced mode, so YouTube does not set cookies until you press play.

The only YouTube information we keep is the ID and status of the videos we upload. We delete it when we remove a video. You can review or remove any app's access to your Google Account at https://myaccount.google.com/permissions, and you can ask us about this at legal@propertyhandleafrica.com.

14. Contact Us

For privacy-related inquiries:

You may also lodge a complaint with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as the data protection supervisory authority.