Privacy Policy

Effective: May 4, 2026 · Last updated: May 4, 2026

This Privacy Policy describes how Ecodrop Enterprises Pty Ltd ("Ecodrop", "we", "our", or "us") collects, uses, and protects your personal information when you use the Ecodrop mobile application (the "App") and related services. Please read it carefully.

1. Who We Are

Ecodrop is operated by Ecodrop Enterprises Pty Ltd, a company providing water refill services in Victoria Falls, Zimbabwe. For the purposes of the Zimbabwe Cyber and Data Protection Act [Chapter 12:07] and equivalent regulations applicable to your residence, Ecodrop Enterprises Pty Ltd is the data controller responsible for your personal information.

2. Information We Collect

Information you provide:

• Account details: full name, email address, and (optionally) phone number.
• Profile data you choose to add or update from within the App.
• QR code labels and any names you assign to your bottles or tags.
• Support messages you send to us.

Information collected automatically:

• Device location (precise GPS coordinates), only while you are using the station-finder, with your permission. We use it solely to show nearby refill stations and the route to them — we do not store your location on our servers.
• Usage data: refill balances, QR scans at stations, transaction history, and app interactions needed to operate your account.
• Device and diagnostic data: device model, operating system, app version, language, time zone, and network status.
• Local storage: QR codes, recent deals, and a sync queue cached on your device for offline use.

Information from third parties:

• Payment metadata from PayNow Zimbabwe (Pty) Ltd, our PCI-DSS-compliant payment processor in Zimbabwe (transaction reference, amount, status, the payment method used — card, EcoCash, OneMoney, or InnBucks — and the last four digits of the card where applicable). We never see or store your full card number, CVV, or banking credentials.
• Authentication data from Google or Apple if you sign in with those providers (name and email only — we do not receive your password).

3. How We Use Your Information

• Create and secure your account.
• Generate, manage, and validate QR codes for water dispensing.
• Process payments for QR codes, refill packages, and physical products.
• Show you nearby refill stations on the map.
• Track your refill balance and dispensing history.
• Send transactional notifications (payment receipts, low-balance reminders, refill confirmations).
• Provide customer support and respond to your questions.
• Detect and prevent fraud, abuse, and unauthorised access.
• Improve the App, fix bugs, and develop new features.
• Comply with legal obligations, including tax, accounting, and regulatory requirements.

We do not use your personal information for advertising and we do not sell it.

4. Legal Basis for Processing

• Performance of a contract — to provide the App, fulfil your purchases, and support the service you sign up for.
• Consent — for optional features such as location access and push notifications, which you can withdraw at any time in your device settings.
• Legitimate interests — to keep the service safe and reliable, prevent fraud, and improve our product, balanced against your rights.
• Legal obligation — to retain transaction records and respond to lawful requests.

5. Service Providers and Sub-Processors

• Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage) — account, database, and backend hosting. Firebase Privacy
• PayNow Zimbabwe (Pty) Ltd — payment processing in United States Dollars (USD) and ZiG (ZWG). PCI-DSS-compliant; supports cards, EcoCash, OneMoney, and InnBucks. PayNow Privacy
• Google Maps Platform — map tiles and location features. Google Privacy
• Apple and Google — distribution of the App and platform-level push notifications.

When the hardware at a refill station scans your QR code, the station controller validates it against our backend and records the dispense. The station only receives the QR code identifier and the dispense outcome — not your name, email, phone, or payment details.

6. International Transfers

Our backend infrastructure is provided by Google Cloud and Firebase, which may store and process data outside Zimbabwe (typically in the European Union or United States). Where required by law, we rely on appropriate safeguards such as Google’s Standard Contractual Clauses to protect your data during transfer. By using the App you acknowledge that your information may be processed outside Zimbabwe.

7. Data Retention

• Account data — for as long as your account is active.
• QR codes — for the lifetime of the QR (one year from issue) and a short period afterwards for support.
• Transaction records — at least five years after the transaction, to meet tax, accounting, and audit obligations.
• Diagnostic data — typically 90 days.
• Cached offline data — until you sign out or clear app data on your device.

When you ask us to delete your account, we remove your personal profile within 30 days. We may retain anonymised or legally required records (such as accounting entries) for the periods set out above.

8. Security

We protect your information with technical and organisational measures, including encryption in transit (HTTPS/TLS), encryption at rest in Firebase, role-based access control, and least-privilege Cloud Functions for sensitive operations such as payment verification. Card and mobile-money details are handled exclusively by PayNow Zimbabwe on PCI-DSS-compliant infrastructure and never reach our servers.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authority as required by law.

9. Your Rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date.
• Delete your account and associated personal data.
• Object to or restrict certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent for optional permissions (location, notifications, marketing) at any time.
• Lodge a complaint with the data protection authority in your jurisdiction.

To exercise any of these rights, email us at info@ecodrop.co.zw. We will respond within 30 days. We may need to verify your identity before acting on a request.

10. Children

The App is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. Users between 13 and 18 should use the App only with the consent of a parent or legal guardian. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Permissions and Push Notifications

The App requests the following device permissions, all of which are optional:

• Camera — to scan QR codes at water stations.
• Location (when in use) — to show nearby refill stations on the map.
• Photo library — to save your QR code as an image if you choose to.
• Notifications — to send refill, payment, and balance updates.

You can change or revoke any of these permissions in your device settings at any time. Some features will be unavailable without the relevant permission.

12. Tracking

We do not engage in cross-app or cross-website tracking, we do not use third-party advertising SDKs, and we do not sell or share your data for advertising. The App’s iOS Privacy Manifest declares NSPrivacyTracking as false.

13. Changes to This Policy

We may update this Privacy Policy as the App evolves. When we make material changes, we will notify you in the App or by email and update the "Last updated" date above. Your continued use of the App after a change takes effect means you accept the updated policy.

14. Contact Us

Ecodrop Enterprises Pty Ltd
Victoria Falls, Zimbabwe
Email: info@ecodrop.co.zw
Website: ecodrop.co.zw