Privacy Policy

How Explore Zimbabwe handles personal data

Last updated: 16 October 2026

This Privacy Policy explains how Explore Zimbabwe handles information submitted through the directory, supplier certification, profile-claim, event, review, enquiry and booking-request features. It describes the current site build and should be reviewed by a qualified adviser before a wider public launch.

Information you provide

We collect the information needed to process the action you choose. This can include your name, email address, country, message, review content and optional contact details when you submit an enquiry, booking request or review.

Businesses applying for certification provide business identity and contact details, a physical address, website or social link and a company logo. A registration number may be provided but is not mandatory. Applicants may also submit up to five optional business photos and a rights/permission confirmation and credit/source note. These photos and application materials remain private to authorised moderators until the supplier profile is approved and published. Event organisers provide event information and an organiser name and email; optional phone, WhatsApp and website details may be made public only if the event is approved.

People requesting to claim a business profile provide their name, email, business role and an explanation that authorised staff can use to assess the request; a phone number is optional. The signed-in account ID is associated with the claim privately. Claim details are private to authorised staff. A request alone grants no supplier access: only staff approval can link that account to a profile, and that link provides limited quote-inbox tools rather than public profile editing. It does not add or change a verification badge.

Customer and supplier sign-in use separate entry points and support email/password as well as Google where Google credentials are configured. Passwords are stored as salted cryptographic hashes, not in readable form. The site does not currently send email verification or password-recovery messages. Reviews are not anonymous and may show the reviewer's display name, country and profile image alongside the review. A separate public reviewer profile is private by default and is published only after the reviewer explicitly opts in.

How we use information

We use submitted information to review and publish eligible business and event profiles, assess profile-claim requests, display approved public contact details, record enquiries and booking requests, administer reviews, maintain saved lists for signed-in users, process quote requests and supplier replies, and protect site forms from misuse. Quote-request records include the service category, Zimbabwe location, budget range, timeline and project scope, plus selected provider IDs and status. They are visible to the customer account and the specific selected providers only.

Travel Planner requests use the number of days, broad budget preference and interests submitted to draft an itinerary. The Diaspora service finder sends the description you enter to a managed AI service to extract request fields and match them against public, eligible provider records. Review the result before continuing. Do not include passwords, financial-account information, identity documents or other sensitive personal information.

Information shown publicly

Published business profiles can show names, locations, telephone or WhatsApp details, websites, email addresses, logos and other approved public information. Some newly imported businesses may be displayed with source-backed public contacts while clearly labelled “Not verified”; this label means Explore Zimbabwe has not verified or accredited the business. Visitors should confirm the business and its details directly before relying on them. Approved events can show the public contact details supplied by the organiser. Published reviews can show the reviewer's display name, profile image, country, rating, date and review text. If a reviewer explicitly makes a public profile, the page may collect those already-public approved reviews from currently published providers and show the reviewer's display name and opted-in review history together. The public profile does not show the reviewer's email address, account or OAuth identifiers, staff role, saved items, private drafts, pending reviews or flagged reviews. Reviewers can switch the public profile off from My Reviews; this hides the profile page and removes its public history link.

Storage, access and service providers

Certification submissions, profile-claim requests, event submissions, enquiries, booking requests, reviews, saved items, quote requests, provider quote replies and authorised account records are stored in the project database. Claimant contact details and evidence are available only to authorised staff and are not displayed on the public profile. Quote requests are routed to selected providers' in-platform inboxes; the customer's name and account email are not included in that request. No email or WhatsApp notification is sent automatically. Uploaded business media is stored in managed object storage. Password recovery and email verification messages are not configured.

The site may use Google for sign-in and public Maps information where configured, and a managed AI service for the optional planning and service-finder tools. Those services may handle the information sent to them in order to provide their function. Their own terms and privacy practices apply.

Site statistics and security

The site records aggregate page-view events using page type and slug. It does not store a visitor profile, precise device location or IP address in the analytics table. Account, profile-claim and RFQ actions use short-lived fixed-window rate limits. The rate-limit table stores keyed HMAC fingerprints of network and email values, not raw IP addresses or email addresses.

Do not submit payment card details, identity documents or other confidential information through the directory. The site does not take payments or confirm reservations. Marking a provider as hired updates the quote-request status only; discuss and confirm any service agreement and payment directly with the provider.

Your choices and requests

You may leave optional fields blank. If you need to correct or remove information submitted through the site, contact the directory owner through the About us route and identify the submission or public page concerned. Requests are assessed against the site's operational, moderation and record-keeping needs.

Changes to this policy

We may update this Policy as the service develops. The date above will be updated when material changes are published.

For copyright, source and image-licence information, read the image rights section of our Terms of Use.