1. Overview
This Privacy Policy explains how Ntumai collects, uses, shares and protects personal information when you visit our website, create an account, place orders, apply as a vendor or tasker, or contact support. It applies to the Ntumai mobile apps, the marketplace and this website. Ntumai is the data controller for this information and is based in Lusaka, Zambia.
2. Information we collect
Account and profile details (name, email address, phone number, profile photo, password credentials); order and activity data (items ordered, errands requested, delivery addresses and saved places, order history, ratings and reviews); location data used for delivery and task matching; device and technical data (device model, operating system, app version, device identifiers, push notification tokens, IP address, crash and diagnostic logs); payment references and tokens returned by approved payment providers; support messages and call records; and, for vendors and taskers, onboarding and verification records including identity documents, vehicle details and payout information.
3. Payment information
Payments are processed by approved third-party providers (mobile money operators, card processors and wallet providers). Full card numbers and mobile money PINs are entered with the provider and are never stored on Ntumai systems. We keep only a payment reference, the masked last digits, the provider name and the transaction outcome so we can reconcile orders, handle refunds and meet accounting obligations.
4. Device permissions we ask for
Location — to show coverage, calculate ETAs and fees, match nearby taskers and support live tracking. Camera and photos — to upload a profile picture, vendor listing images, or proof-of-delivery and dispute photos. Notifications — to send order status, rider arrival and account alerts. Storage — to cache images and receipts. Each permission is requested at the moment it is needed, is optional, and can be withdrawn at any time in your device settings; declining a permission only disables the feature that depends on it.
5. How we use information
We use information to provide deliveries and marketplace services, create and secure your account, match orders to nearby taskers, process payments and refunds, verify vendors and taskers, prevent fraud and abuse, investigate safety incidents, provide customer support, send service messages about your orders, meet legal and tax obligations, and analyse usage so we can fix problems and improve the product. We use information for marketing messages only where you have opted in, and you can opt out at any time.
6. Our legal basis
We process personal information where it is necessary to perform our contract with you (delivering your order), where we have a legal obligation (tax, accounting and regulatory records), where we have a legitimate interest that does not override your rights (fraud prevention, platform safety, product improvement), and where you have given consent (marketing messages and non-essential cookies). We handle personal data in line with the Data Protection Act of Zambia.
8. Location data
Location data is used to show coverage, calculate ETAs and fees, match nearby taskers, route deliveries and support live tracking. A tasker's location is shared with the customer only while an order is active. Precise background location is collected only from tasker accounts while they are on shift, so that orders can be assigned and tracked; it is not collected from customer accounts in the background. You can control device-level location permissions from your phone settings at any time.
9. Security
We use technical and organisational safeguards appropriate to the risk, including encryption of data in transit, access controls and least-privilege access for staff, logging and monitoring of administrative actions, and confidentiality obligations for people who handle user data. No system is completely secure, so we also maintain an incident response process and will notify you and the relevant authority where a breach is likely to result in a risk to your rights.
10. How long we keep information
We keep account and profile data for as long as your account is open. Order, delivery and support records are kept for the life of the account and then for the period needed to resolve disputes and meet legal obligations. Transaction, invoice and payout records are kept for the period required by Zambian tax and accounting law. Diagnostic and crash logs are kept for a short operational period and then deleted. Records tied to fraud, safety incidents or an active legal claim are kept until the matter is closed.
11. Deleting your account and data
You can ask us to delete your Ntumai account and the personal data linked to it at any time, whether or not you still have the app installed. Use the account deletion request page or email privacy@ntumai.com from your registered address. We acknowledge requests within 2 business days and complete verified deletions within 30 days, with backup copies purged within 90 days. That page also sets out exactly what is deleted and the limited records we must keep by law.
12. Your rights and choices
You can request access to the information we hold about you, correction of anything inaccurate, deletion of your account and data, a copy of your data in a portable format, restriction of or objection to certain processing, and withdrawal of consent where processing is based on consent. You can also opt out of marketing messages at any time. Email privacy@ntumai.com to exercise any of these rights — we respond within 30 days. If you are unhappy with our response you may complain to the Data Protection Commissioner in Zambia.
13. Children
Ntumai is not directed at children. You must be at least 18 years old to create an account, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a child, we delete it promptly. If you believe a child has given us personal information, contact privacy@ntumai.com and we will act on it.
14. International transfers
Some of the providers we rely on for hosting, analytics, messaging and payments process data outside Zambia. Where information is transferred abroad we take steps to ensure a comparable level of protection, including contractual safeguards with those providers and limiting transfers to what is necessary to run the service.
16. Changes to this policy
We may update this policy as the service changes. The revised version is posted here with a new “Last updated” date, and where a change materially affects how we use your information we will give you notice in the app or by email before it takes effect.
17. Contact us
For privacy questions or to exercise your rights, email privacy@ntumai.com, contact Ntumai support from the app or website, or write to Ntumai, Plot 4818, Addis Ababa Drive, Lusaka, Zambia.