Privacy policy

1. Who is responsible for your data

Dzra Ltd, of 1 Independence Avenue, Osu, Accra, Ghana, is the data controller for merchant accounts and for the running of the platform. Write to privacy@dzra.com about anything on this page.

If you bought something from a shop on Dzra, that shop is the controller of your order and contact details, and decides how it uses them. We process that information on the shop’s behalf, as its processor, so that the store, the checkout and the order can work. Requests about your data are best sent to the shop first; if you cannot reach them, we will help.

2. What we collect

From merchants

• Your name, email address, phone number and password (stored hashed, never in readable form).
• Your business name, category, address and store content.
• Your plan, commission charged and subscription history.
• Support messages you send us.

From shoppers, on behalf of the merchant

• Name, phone number, email address and delivery address given at checkout.
• What was ordered, the amounts, the delivery area and the order’s status history.
• A payment reference and result from the payment provider. Card numbers and Mobile Money PINs are entered on the provider’s own page — they never pass through Dzra and we never store them.

Automatically

• Server logs containing the IP address, the page requested, a timestamp and the browser’s user-agent string, kept for security and debugging.
• The contents of a cart, held in a signed cookie in the visitor’s own browser rather than on our servers.

3. Why we use it, and on what basis

• To provide the service — running your store, processing orders and taking payment. Basis: performance of a contract.
• To keep the platform safe — preventing fraud, abuse and unauthorised access, and rate-limiting sign-in attempts. Basis: our legitimate interest in a secure service.
• To support you — answering your messages and fixing faults. Basis: contract and legitimate interest.
• To meet legal obligations — accounting, tax and responding to lawful requests. Basis: legal obligation.
• To tell you about the product — occasional email to merchants about changes that affect their store. Basis: legitimate interest, and you can opt out of anything non-essential.

We do not sell personal data, we do not share it with advertisers, and we do not market to your customers.

4. Who we share it with

• The merchant whose shop an order was placed with, which receives the customer’s details in order to fulfil it.
• Our payment provider, which receives the amount, reference and contact details needed to take and settle the payment.
• Our hosting and storage providers, which hold the database and uploaded images on our instructions.
• Authorities, where we are legally required to disclose, or where it is necessary to investigate fraud or protect someone from harm.

Each provider is bound to use the data only for the service it supplies to us.

5. Where it is held

Our infrastructure providers may store or process data outside Ghana. Where that happens, we rely on contractual protections requiring a standard of protection equivalent to that required by the Data Protection Act, 2012 (Act 843).

6. How long we keep it

• Merchant account and store data: while the account is open, then up to 90 days.
• Orders, payments and invoices: seven years, because tax and accounting law requires it — this applies even after an account is closed.
• Server and security logs: up to 90 days.
• Support correspondence: up to two years.

7. How we protect it

• Traffic is encrypted in transit; passwords are stored only as salted hashes.
• Every request is scoped to the business it belongs to, so one merchant’s data cannot be reached from another merchant’s session.
• Sign-in attempts are rate-limited, and payment notifications are cryptographically verified before they are trusted.
• Access to production data is limited to the people who need it to run the service.

No system is perfectly secure. If a breach affects you, we will tell you and the Data Protection Commission without undue delay.

8. Cookies

Dzra sets only the cookies it needs to work:

• A session cookie, so a signed-in merchant stays signed in.
• A cart cookie, holding only the items and quantities chosen, signed so that it cannot be edited to change a price.

There are no advertising cookies, no third-party trackers and no cross-site profiling. Because every cookie we set is strictly necessary to deliver a service you asked for, there is no consent banner to click through.

9. Your rights

Under Act 843 you may ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct anything inaccurate;
• delete data we no longer have a lawful reason to keep;
• stop using your data for a purpose you object to; or
• stop sending you non-essential messages.

Write to privacy@dzra.com. We respond within one business day and complete requests within 30 days. If you are not satisfied, you may complain to the Data Protection Commission of Ghana.

10. Children

Dzra is not intended for anyone under 18, and we do not knowingly collect data from children. Tell us if you believe we have, and we will delete it.

11. Changes

We will update this page when our handling of data changes, and will notify merchants by email where the change is material. The date at the top is the date it last changed.