Privacy Policy

ZamTicket (“ZamTicket”, “we”, “us”, or “our”) is a bus and accommodation booking platform operating in Zambia through our website and mobile applications (together, the “Platform”). ZamTicket is a trading name of ZAMKET TICKET LIMITED, a company registered in Zambia (Company Registration No. 120261050812), whose registered office is at 6th Floor Tazara House, Dedan Kimathi Road, Kamwala, Lusaka, Zambia.

For the purposes of the Data Protection Act No. 3 of 2021, ZAMKET TICKET LIMITED (trading as ZamTicket) is the data controller responsible for the personal data described in this policy. Where we onboard bus operators and accommodation providers, those suppliers act as independent controllers of the booking data they receive to deliver their services.

This policy applies to personal data we process about customers who use the Platform to search, book, and pay for bus tickets and accommodation; about suppliers (bus operators and hoteliers) who apply to list with us; and about visitors to our website and apps. It does not apply to the independent practices of suppliers, payment providers, or other third parties that operate their own services and have their own privacy notices.

Depending on how you use the Platform, we may collect the following categories of personal data:

• Account information — your name, email address, mobile phone number, and a password, which is protected with industry-standard measures and never stored in a readable form.
• Booking and travel details — the trips and stays you book, travel dates, passenger and guest details you provide, boarding and drop-off points, room and seat selections, your ticket and booking references, and your booking history.
• Payment information — when you pay online, your payment is processed by an established third-party payment provider. ZamTicket does not collect or store your full card or mobile-money credentials. We retain payment references, amounts, currency, and the status of each transaction so we can confirm bookings, provide receipts, and handle refunds.
• Supplier application / KYC data — if you apply to list a bus service or property, we collect business and contact details, ownership or representative information, property or fleet details, and any verification or “know-your-customer” documents you submit so we can assess and process your application.
• Location and usage data — approximate or device location used to power search, maps, and live trip tracking; device and app information; pages and features used; and technical log data such as IP address, device identifiers, and timestamps.
• Communications — messages, support requests, and feedback you send us, and our correspondence with you.

We collect personal data:

• directly from you, when you create an account, make a booking, apply to list, or contact support;
• automatically, as you use the Platform, through your device, cookies, and similar technologies; and
• from third parties, such as our payment provider (confirmation that a payment succeeded or failed) and the supplier connected to your booking.

We use personal data to operate the Platform and to meet our legal obligations, including to:

• create and manage your account and authenticate you securely;
• process bookings, issue tickets and confirmations, and pass the necessary details to your chosen supplier;
• process payments and refunds through our payment provider;
• provide customer support and respond to your enquiries;
• send you service communications about your bookings (such as confirmations, reminders, and trip updates);
• assess and process supplier listing applications;
• maintain the security of the Platform and prevent fraud and abuse;
• understand and improve our services; and
• comply with applicable laws and respond to lawful requests from authorities.

We rely on one or more lawful bases for this processing, including your consent, the performance of a contract with you, our legitimate interests in running and improving the Platform, and compliance with our legal obligations. Where we rely on consent (for example, certain marketing or location uses), you may withdraw it at any time.

We share personal data as needed to provide and promote the service, and never sell it. We may share data with:

• Suppliers — the bus operator or property you book receives the booking details they need to deliver the service, such as passenger or guest name, contact, and travel or stay details.
• Payment provider — our third-party payment provider processes your payment and receives the data required to do so.
• Service providers — hosting, storage, mapping, messaging, and analytics providers that operate the Platform on our behalf under appropriate confidentiality and data protection obligations.
• Advertising and marketing partners — established providers that help us measure our advertising and show you relevant ZamTicket adverts. They may receive limited information about your activity on our website, as described in sections 7 and 12.
• Authorities and legal — where required to comply with the law, enforce our terms, or protect the rights, safety, and property of ZamTicket, our users, or others.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

Some of the providers and partners we use to run and promote the Platform are located outside Zambia, which means certain personal data is transferred to and processed in other countries. In particular:

• our payment provider processes payments and may process the related data outside Zambia;
• our hosting providers — established international cloud providers that host and serve the Platform — may process request and log data outside Zambia;
• our storage providers — established international cloud storage providers — store certain files and images (such as property and listing photos) outside Zambia; and
• our advertising and measurement partners may receive certain website-activity data and process it outside Zambia, including in the United States, to provide advertising measurement and remarketing (see section 12).

Where we transfer personal data outside Zambia, we take steps intended to ensure it remains protected to a standard consistent with the Data Protection Act No. 3 of 2021, including using reputable providers that offer appropriate safeguards and limiting the data shared to what is necessary. By using the Platform you acknowledge that your data may be processed outside Zambia as described here; where the Act requires your consent for a particular transfer, we will obtain it.

We keep personal data only for as long as necessary for the purposes set out in this policy, consistent with the retention principle of the Data Protection Act No. 3 of 2021. How long that is depends on the type of data and why we hold it — for example, we keep booking and transaction records for as long as needed to provide the service, handle disputes and refunds, and meet accounting, tax, and other legal requirements. When data is no longer needed, we delete it or anonymise it.

You may delete your ZamTicket account at any time from within the app (Profile → Delete Account), or by writing to us at privacy@zamticket.org. You may also request deletion via zamticket.org/delete-account.

When you delete your account, we immediately end your access: your sign-in details and any linked sign-in methods are disabled, and you can no longer sign in.

For 30 days after deletion, you may ask us to restore your account; we will verify your identity before acting on any such request. After that period, your profile is permanently removed.

Information we retain. We retain records of bookings made through ZamTicket, including the passenger or guest details recorded on those bookings, for a period of seven (7) years from the date of the booking. We retain this information because:

• transport operators and accommodation providers require accurate records of persons who travelled or stayed with them;
• it may be necessary for establishing, exercising, or defending legal claims, including in relation to incidents involving passengers, guests, operators, or properties;
• it enables us to detect, investigate, and prevent fraud and misuse of the platform; and
• we are required to keep certain transaction records for accounting and tax purposes.

Retained records are not used to contact you, to profile you, or for marketing. Access is restricted to authorised personnel, and to competent authorities where we are lawfully required to disclose.

We process this information on the basis of our legitimate interests in platform safety and fraud prevention, the establishment or defence of legal claims, and compliance with our legal obligations, in accordance with the Data Protection Act No. 3 of 2021 of the Republic of Zambia.

If you believe we hold information about you that we no longer need, you may contact us at privacy@zamticket.org.

Subject to the conditions and exceptions in the Data Protection Act No. 3 of 2021, you have rights over your personal data, including the right to:

• be informed about how your data is used (as set out in this policy);
• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted in certain circumstances;
• object to, or request that we restrict, certain processing; and
• withdraw any consent you have given, at any time.

You can update much of your account information directly in the app or on the website. To exercise any of these rights, contact us at info@zamticket.org. We may need to verify your identity before we act on a request, and we will respond within the timeframes required by law.

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, or misuse. These include industry-standard protection for data in transit and at rest, secure handling of sign-in credentials, restricting access to personal data on a need-to-know basis, and ongoing monitoring of our systems. No method of transmission or storage is completely secure, so while we work to protect your data we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately.

Our website and apps use cookies and similar technologies to keep you signed in, remember your preferences, keep the Platform secure, and understand how it is used so we can improve it. Some of these are essential for the Platform to function; others help us measure and improve performance.

We also use advertising and measurement technologies to promote ZamTicket. In particular, our website uses the Meta Pixel, a measurement tool provided by Meta Platforms, Inc. It uses cookies and similar technologies to record certain activity on our website — such as the pages you view and the actions you take — and shares that information with Meta. We use it to measure how well our advertising performs, to understand how visitors use the Platform, and to show you relevant ZamTicket adverts on Meta’s services and on other sites — a practice known as “remarketing”. Data about your visit is therefore shared with Meta Platforms, which is based in the United States and uses it in accordance with its own privacy policy (see section 7 on international transfers).

You can control non-essential cookies and tracking through your browser or device settings, and you can manage or opt out of personalised advertising through your advertising settings on Meta’s services, through industry opt-out tools, or by contacting us at info@zamticket.org. Disabling some cookies may affect how the Platform works.

The Platform is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

We may update this policy from time to time to reflect changes in our services, technology, or legal requirements. When we do, we will revise the “Last updated” date above, and where the changes are significant we will provide a more prominent notice. Your continued use of the Platform after an update means you accept the revised policy.

If you have questions, requests, or concerns about your personal data or this policy, contact us at info@zamticket.org. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Zambia, which oversees compliance with the Data Protection Act No. 3 of 2021.

See also our Terms & Conditions.