01 Introduction
Kapaz Cafe ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, share, and safeguard your personal information when you use our website, mobile applications, and on-site services.
By using our services, you consent to the practices described in this policy. If you do not agree, please do not use our services.
02 Who We Are
Data Controller: Kapaz Cafe, SAMFYA SAMFYA, Republic of Zambia.
We are the data controller responsible for the personal data collected through our services. Our Data Protection Officer can be reached at:
| privacy@kapazcafe.com | |
| Phone | +260971648209 |
03 Information We Collect
We collect the following categories of personal information:
Personal Identifiers
- First and last name
- Email address (optional for customers)
- Phone number (required for account creation)
- Date of birth (optional)
- Nationality (optional)
- Physical address (optional)
Payment & Transaction Data
- Payment method (cash, card, mobile money)
- Transaction reference and amount
- Payment status and history
- Refund records
Booking Data
- Room, table, or fleet reservations
- Check-in and check-out dates
- Number of guests
- Special requests or instructions
Technical Data
- IP address
- Browser type and version
- Device type (desktop, mobile, tablet)
- Pages visited and time spent
- Session and login logs
Communication Data
- Contact form submissions
- Email correspondence
- Support and inquiry records
- Feedback and reviews
04 How We Collect Data
- Directly from you: when you register, book, make a payment, contact us, or leave a review.
- Automatically: through cookies, server logs, and analytics when you visit our website.
- From third parties: payment gateways, booking platforms, and mobile money providers with your consent.
- On-site: through our front desk systems, POS, and guest registration forms.
05 Why We Collect Data
We use your personal information for the following purposes:
| Purpose | Examples |
|---|---|
| Service Delivery | Processing bookings, check-ins, orders, and fleet reservations. |
| Payments | Processing payments, issuing receipts, handling refunds. |
| Communication | Booking confirmations, reminders, support replies. |
| Personalization | Loyalty points, tailored offers, preferences. |
| Security | Fraud prevention, login monitoring, access control. |
| Legal Compliance | Tax records, ZRA reporting, audit trail. |
| Improvement | Analytics, service evaluation, feature development. |
06 Legal Basis for Processing
We process personal data under the following legal bases, in line with the Zambian Data Protection Act and, where applicable, the GDPR:
- Contract: to fulfil bookings and provide services you have requested.
- Legal Obligation: to comply with tax, accounting, and regulatory requirements.
- Legitimate Interest: to secure our systems, prevent fraud, and improve services.
- Consent: for marketing communications and optional features (e.g., loyalty programs).
You may withdraw consent at any time without affecting the lawfulness of prior processing.
07 Cookies & Tracking
Our website uses cookies and similar technologies to keep you logged in, remember preferences, and improve your experience.
| Cookie Type | Purpose | Required? |
|---|---|---|
| Session Cookies | Authentication and CSRF protection | Yes |
| Preference Cookies | Remember language and display settings | Optional |
| Analytics Cookies | Measure site usage and performance | Optional |
You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the platform.
08 How We Share Information
We do not sell your personal data. We may share it only with:
- Payment processors — to complete transactions (card, mobile money).
- Service providers — email, SMS, hosting, and analytics vendors under strict data-processing agreements.
- Regulators — when required by law (e.g., ZRA for tax invoices).
- Law enforcement — to prevent fraud or comply with a court order.
- Successors — in the event of a merger or acquisition, with continued protection.
09 Data Security
We take data security seriously and use industry-standard measures, including:
- Encryption in transit: HTTPS/TLS for all web traffic.
- Password hashing: bcrypt with strong cost factor.
- Access controls: role-based permissions, session management.
- CSRF protection: token validation on all state-changing requests.
- Audit logging: all sensitive actions are logged.
- Regular backups: encrypted off-site copies.
10 Data Retention
We retain personal data only as long as necessary for the purpose it was collected:
| Data Type | Retention Period |
|---|---|
| Active account data | While your account remains active |
| Deleted accounts | Soft-deleted, purged after 30 days |
| Booking & transaction records | 7 years (tax compliance) |
| Audit logs | 90 days (rotated), archived for 2 years |
| Session logs | 90 days |
11 Your Privacy Rights
Depending on your jurisdiction, you have the following rights:
Right to Access
Request a copy of the personal data we hold about you.
Right to Rectification
Correct inaccurate or incomplete data.
Right to Erasure
Request deletion of your data, subject to legal retention.
Right to Restrict
Limit the processing of your data in certain cases.
Right to Data Portability
Receive your data in a machine-readable format.
Right to Object
Object to processing based on legitimate interest or for marketing.
Right to Withdraw Consent
Revoke previously given consent at any time.
Right to Complain
Lodge a complaint with the local data protection authority.
To exercise any of these rights, email us at privacy@kapazcafe.com. We will respond within 30 days. We may verify your identity before fulfilling a request.
12 Children's Privacy
Our services are not directed to children under the age of 16. We do not knowingly collect personal data from children without parental consent.
If you believe a child has provided us with personal data, please contact us immediately and we will delete it.
13 Third-Party Links
Our website may contain links to third-party sites (e.g., social media, payment gateways). We are not responsible for the privacy practices of those sites.
We encourage you to read the privacy policies of any third-party service you use.
14 International Transfers
Your data is primarily stored within Zambia. However, some service providers (e.g., cloud hosting, email) may process data outside Zambia.
When we transfer data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses.
15 Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page.
For material changes, we will notify you by email or by a prominent notice on our website. Continued use of our services after changes constitutes acceptance.
16 Contact Us
If you have questions, concerns, or complaints about this Privacy Policy or how we handle your data, contact us:
Data Protection Officer
| Lodge | Kapaz Cafe |
|---|---|
| Address | SAMFYA, SAMFYA |
| privacy@kapazcafe.com | |
| Phone | +260971648209 |
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Zambia.