Privacy Policy

ZamTicket (“ZamTicket”, “we”, “us”, or “our”) is a bus and accommodation booking platform operating in Zambia through our website and mobile applications (together, the “Platform”). ZamTicket is a trading name of Weson Industries Limited, a company registered in Zambia (PACRA Registration No. 120251021673), whose registered office is at Tazara House, 6th Floor, P.O. Box 99008, Lusaka, Zambia.

For the purposes of the Data Protection Act No. 3 of 2021, Weson Industries Limited (trading as ZamTicket) is the data controller responsible for the personal data described in this policy. Where we onboard bus operators and accommodation providers, those suppliers act as independent controllers of the booking data they receive to deliver their services.

This policy applies to personal data we process about customers who use the Platform to search, book, and pay for bus tickets and accommodation; about suppliers (bus operators and hoteliers) who apply to list with us; and about visitors to our website and apps. It does not apply to the independent practices of suppliers, payment providers, or other third parties that operate their own services and have their own privacy notices.

Depending on how you use the Platform, we may collect the following categories of personal data:

• Account information — your name, email address, mobile phone number, and a password (which we store only in encrypted/hashed form, never in plain text).
• Booking and travel details — the trips and stays you book, travel dates, passenger and guest details you provide, boarding and drop-off points, room and seat selections, your ticket and booking references, and your booking history.
• Payment information — when you pay online, your payment is processed by our payment provider, Flutterwave. ZamTicket does not collect or store your full card or mobile-money credentials. We retain payment references, amounts, currency, and the status of each transaction so we can confirm bookings, provide receipts, and handle refunds.
• Supplier application / KYC data — if you apply to list a bus service or property, we collect business and contact details, ownership or representative information, property or fleet details, and any verification or “know-your-customer” documents you submit so we can assess and process your application.
• Location and usage data — approximate or device location used to power search, maps, and live trip tracking; device and app information; pages and features used; and technical log data such as IP address, device identifiers, and timestamps.
• Communications — messages, support requests, and feedback you send us, and our correspondence with you.

We collect personal data:

• directly from you, when you create an account, make a booking, apply to list, or contact support;
• automatically, as you use the Platform, through your device, cookies, and similar technologies; and
• from third parties, such as our payment provider (confirmation that a payment succeeded or failed) and the supplier connected to your booking.

We use personal data to operate the Platform and to meet our legal obligations, including to:

• create and manage your account and authenticate you securely;
• process bookings, issue tickets and confirmations, and pass the necessary details to your chosen supplier;
• process payments and refunds through our payment provider;
• provide customer support and respond to your enquiries;
• send you service communications about your bookings (such as confirmations, reminders, and trip updates);
• assess and process supplier listing applications;
• maintain the security of the Platform and prevent fraud and abuse;
• understand and improve our services; and
• comply with applicable laws and respond to lawful requests from authorities.

We rely on one or more lawful bases for this processing, including your consent, the performance of a contract with you, our legitimate interests in running and improving the Platform, and compliance with our legal obligations. Where we rely on consent (for example, certain marketing or location uses), you may withdraw it at any time.

We share personal data only as needed to provide the service, and never sell it. We may share data with:

• Suppliers — the bus operator or property you book receives the booking details they need to deliver the service, such as passenger or guest name, contact, and travel or stay details.
• Payment provider — Flutterwave processes your payment and receives the data required to do so.
• Service providers — hosting, storage, mapping, messaging, and analytics providers that operate the Platform on our behalf under appropriate confidentiality and data protection obligations.
• Authorities and legal — where required to comply with the law, enforce our terms, or protect the rights, safety, and property of ZamTicket, our users, or others.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

Some of the providers we use to run the Platform are located outside Zambia, which means certain personal data is transferred to and processed in other countries. In particular:

• Flutterwave processes payments and may process the related data outside Zambia;
• Vercel hosts and serves our website and may process request and log data outside Zambia; and
• Cloudflare R2 stores certain files and images (such as property and listing photos) outside Zambia.

Where we transfer personal data outside Zambia, we take steps intended to ensure it remains protected to a standard consistent with the Data Protection Act No. 3 of 2021, including using reputable providers that offer appropriate safeguards and limiting the data shared to what is necessary. By using the Platform you acknowledge that your data may be processed outside Zambia as described here; where the Act requires your consent for a particular transfer, we will obtain it.

We keep personal data only for as long as necessary for the purposes set out in this policy, consistent with the retention principle of the Data Protection Act No. 3 of 2021. How long that is depends on the type of data and why we hold it — for example, we keep booking and transaction records for as long as needed to provide the service, handle disputes and refunds, and meet accounting, tax, and other legal requirements. When data is no longer needed, we delete it or anonymise it.

Subject to the conditions and exceptions in the Data Protection Act No. 3 of 2021, you have rights over your personal data, including the right to:

• be informed about how your data is used (as set out in this policy);
• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted in certain circumstances;
• object to, or request that we restrict, certain processing; and
• withdraw any consent you have given, at any time.

You can update much of your account information directly in the app or on the website. To exercise any of these rights, contact us at info@zamticket.org. We may need to verify your identity before we act on a request, and we will respond within the timeframes required by law.

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, or misuse. These include encryption of data in transit, storing passwords only in hashed form, restricting access to data on a need-to-know basis, and using reputable infrastructure providers. No method of transmission or storage is completely secure, so while we work to protect your data we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately.

Our website and apps use cookies and similar technologies to keep you signed in, remember your preferences, keep the Platform secure, and understand how it is used so we can improve it. Some of these are essential for the Platform to function; others help us measure and improve performance. You can control non-essential cookies through your browser or device settings, though disabling some may affect how the Platform works.

The Platform is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

We may update this policy from time to time to reflect changes in our services, technology, or legal requirements. When we do, we will revise the “Last updated” date above, and where the changes are significant we will provide a more prominent notice. Your continued use of the Platform after an update means you accept the revised policy.

If you have questions, requests, or concerns about your personal data or this policy, contact us at info@zamticket.org. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Zambia, which oversees compliance with the Data Protection Act No. 3 of 2021.

See also our Terms & Conditions.