Privacy Policy

Last updated: 7 September 2026 · Download as PDF

ZimLayby is a layby (lay-by) platform operating in Zimbabwe. We're owned and operated by Millennial Ultra Solutions (Pvt) Ltd. This policy explains what information we collect from you, how we use it, who we share it with, and the rights you have over your data. We've tried to write it in plain English instead of legalese.

1. Who runs this

ZimLayby is operated by Millennial Ultra Solutions (Pvt) Ltd, a company registered in Zimbabwe. It is the data controller for everything described in this policy, and the postal address at the bottom of this page is where to reach it.

Every shop on the platform today — Appliance & Home, Sofa & Couch Centre, Beds, Restapedic, Capri Home Appliances and Groceries — is one of our own storefronts, not an independent business. When you apply for a layby at one of them, your information stays inside a single company rather than being passed to a separate retailer. The platform is built to host independent retailers too; if one joins, we will update this policy to explain what they receive and why, before it happens.

Layby Africa, Inc. — a company being incorporated in Delaware, United States — is intended to hold the platform software and licence it to Millennial Ultra Solutions (Pvt) Ltd and to other retailers. That licence is not yet in place, and Layby Africa holds none of your information. If that changes, we will update this policy and tell you before any of your data moves.

2. Information we collect

We only collect what's necessary to run a layby agreement and stay in touch with you about it.

You give us directly

• Identity: your full name and Zimbabwean National ID number or passport number (for verification)
• Contact: your phone number (WhatsApp), email address, and residential address
• Next of kin (optional): name, phone, and relationship of someone we can contact if we can't reach you
• Order details: the items you've selected, the payment plan you've chosen, and any notes you send us
• Payments: proof of payment you send us (e.g. EcoCash transaction references, bank transfer screenshots)
• Signature: your typed signature on the layby agreement
• Account details (optional): if you create a ZimLayby account before applying, your name, email and phone, plus any basket of items you save for later
• Referrals (optional): if you apply using a friend's referral code, we record that they referred you — they see only your first name and whether your layby has started, never your purchases or balance. If you share your own code, we record who used it so we can credit you.

We collect automatically

• Usage data: when you log into your customer portal, when you view your layby balance, when you click payment links
• Device info: your IP address, browser type, and operating system (used for security)
• Cookies: one session cookie that keeps you signed in. That is the only cookie we set. We don't use third-party tracking or advertising cookies on any customer-facing page.
• On your device: your browser's local storage remembers small preferences — your light/dark theme, a basket you've saved, a referral code from a link you tapped. This stays on your device, is never sent to advertisers, and isn't a tracking cookie.
• Aggregate analytics: we count page visits with a privacy-friendly, cookieless analytics tool we host ourselves. It tells us how many people visited a page, not who you are, and it doesn't follow you across other websites.
• Visitor counting (third party): our public shopping pages also load a small cookieless counter from LiveTraction, a service that shows our investors real visitor numbers. Like any web request it sees your IP address and browser type; it sets no cookies, builds no profile of you, and doesn't follow you to other websites. It runs on browsing pages only — never inside your signed-in account or portal.

3. How we use your information

• To run your layby: processing your application, sending you reminders, recording payments, generating receipts and statements, holding inventory aside in your name
• To verify you: matching your ID against your details, contacting your next of kin if we can't reach you
• To communicate with you: WhatsApp and SMS messages about your layby (due dates, payment confirmations, status changes). Occasionally we also send offers or programme announcements — reply STOP to any of those and you won't get more; service messages about your own layby continue either way.
• To improve the service: understanding which products customers layby, which payment schedules they choose, where they get stuck
• To meet legal obligations: tax records, anti-money-laundering checks, fraud prevention

4. Who we share with

We don't sell your data to anyone. We share it only with parties that help us run the service:

• Staff at the shop you've laybyed with (e.g. Appliance & Home). They need your details to reserve your items, process payments, and contact you. Because every shop on the platform is part of Millennial Ultra Solutions (Pvt) Ltd, this is access inside one company rather than sharing with an outside business — and staff can only see the customers of their own shop.
• Meta / WhatsApp Business Cloud API — to send you WhatsApp messages. Meta processes your phone number and message content as a data processor on our behalf.
• Twilio — to send you SMS messages when WhatsApp isn't available.
• Email providers — to deliver receipt, sign-in and statement emails to your inbox.
• Payment gateway (Payonify) — if you pay by card or mobile money through our payment page, the gateway processes your payment details; we never see your full card number.
• Error monitoring (Sentry) — when something on our side breaks, technical details of the failure (which may include your IP address and the request that failed) are sent to our error-monitoring service so we can fix it.
• LiveTraction — receives anonymous page-visit pings from our public shopping pages, and aggregate business totals (customer counts and amounts collected — never individual records), so investors see live, verifiable traction.
• Cloud hosting (Fly.io, Cloudflare) — our servers are operated by these providers under standard data-processing agreements.
• Zimbabwean authorities — if compelled by law (e.g. court order, ZIMRA request, police investigation).

We never share your information with advertisers or data brokers.

5. How long we keep it

• Active layby data: for the lifetime of your layby plus the receipt period
• Financial records (payments, agreements, receipts): 7 years, as required by Zimbabwe's Income Tax Act for businesses
• Account data (name, phone, email, address): as long as you have an active account with us, plus 7 years after your last layby
• Logs (login attempts, IP addresses): typically 90 days unless flagged for security review

6. Your rights

You have the right to:

• Access the information we hold about you
• Correct any inaccurate information (you can update most details from your customer portal at zimlayby.com/me)
• Delete your account data — see our Data Deletion page for how to request this. Note: financial records that we're legally required to keep cannot be deleted before the 7-year retention period.
• Object to specific uses of your data
• Receive a copy of your data in a portable format

To exercise any of these rights, email us at privacy@zimlayby.com. We aim to respond within 30 days.

7. Security

We protect your information with HTTPS encryption in transit, hashed PINs (we never store your PIN in plain text), brute-force protection on login, and access controls so only the staff of your specific shop can see your details. No system is 100% secure, but we take reasonable steps and respond promptly to any security incident.

8. Children

Our service is for people aged 18 and over. We don't knowingly collect information from anyone under 18. If you believe we have, contact us and we'll delete it.

9. Changes to this policy

If we make significant changes to this policy, we'll let you know through your customer portal or by message before the change takes effect. The "Last updated" date at the top will always reflect the current version.

10. Cross-border data transfers

Some of our service providers (Meta, Twilio, Cloudflare, Fly.io) process data outside Zimbabwe — primarily in the United States and Europe. These providers have their own privacy commitments and are bound by data-processing agreements with us.