Privacy Policy

• Account data: Name, email address, phone number, city, gender and date of birth where provided, and password authentication information when you register.
• Identity and business verification: Government-issued identification details and document images for individual seller verification, including selfie/liveness verification where required. Business sellers may provide company registration information and registration documents.
• Rider and vehicle information: Rider identity and account information, vehicle owner information corresponding to registered vehicle records, vehicle registration number, vehicle type, and other information required to administer courier operations.
• Orders and transactions: Products ordered or sold, order information, parcel information, delivery address, pickup point information, order status, transaction amounts, delivery charges, purchase history, and related transaction records.
• Payment information: Mobile money phone number and network/provider used for payment routing, payment method information saved at the user's request, transaction references, payment status, wallet records, earnings, withdrawal requests, and payout information. We do not store mobile money PINs.
• Store and pickup location: Seller store or business location used to coordinate parcel pickup and logistics. This is a fixed business or pickup location and is not continuous live location tracking.
• Delivery location: Rider live GPS position only during an active last-mile delivery after a parcel has been picked up and is en route to the buyer. The relevant buyer may view the rider's live location during that delivery. Riders are not continuously tracked through the Services.
• Delivery verification: Parcel QR codes, system-generated delivery PINs, handoff confirmations or digital signatures, timestamps, and parcel custody records used to verify transfers between sellers, riders, hub personnel, and buyers.
• Communications: Messages sent through Lupasphere in-app messaging features where those messages relate to an order, parcel, delivery, or customer support interaction, as well as other support correspondence.
• Device and usage information: App version, device model, and event logs where collected for security, diagnostics, service improvement, and bug diagnosis.

We process personal data where:

• it is necessary to perform our contract with you, such as creating accounts, fulfilling orders, processing payments, or providing delivery services;
• we have a legal obligation, such as applicable KYC, AML/CTF, financial, tax, or record-keeping requirements;
• it is in our legitimate interest, such as fraud prevention, security, dispute resolution, service administration, and service improvement; or
• you have given consent where consent is required, such as for certain optional communications or processing. Where processing is based on consent, you may withdraw that consent subject to applicable law.

• Creating and administering buyer, seller, rider, and other authorized platform accounts.
• Matching buyers, sellers, hubs, riders, and logistics operations to fulfil orders.
• Processing mobile money payments and maintaining payment, transaction, wallet, and payout records.
• Processing seller withdrawals and applicable rider earnings and payouts.
• Verifying seller identities, businesses, vehicle owners, and riders for platform safety and applicable legal or operational requirements.
• Processing seller store and pickup locations to coordinate parcel collection and logistics.
• Providing temporary rider location tracking during active last-mile deliveries.
• Verifying parcels and handoffs using QR codes, delivery PINs, digital signatures, timestamps, and other custody records.
• Facilitating transactional in-app communications relating to orders, parcels, deliveries, and customer support.
• Sending account, order, payment, and delivery status notifications.
• Detecting, investigating, and preventing fraud, prohibited activity, unauthorized access, and misuse of the Services.
• Resolving disputes and maintaining records necessary to establish transaction and parcel custody history.
• Improving our products and services through aggregated analytics and service-performance analysis.
• Maintaining the security, reliability, and functionality of our systems.

We do not sell personal data. We share information only where necessary to provide our Services, protect our users and systems, or comply with applicable legal obligations.

• Riders: Assigned riders may receive the buyer information necessary to complete the assigned delivery, including the delivery address and relevant contact information.
• Sellers: A buyer's name and relevant order details may be shared with the seller whose products are included in the order.
• Hub and logistics personnel: Authorized personnel may receive parcel, order, and custody information necessary to receive, sort, hold, transfer, verify, and release parcels.
• Buyers: During an active last-mile delivery, the relevant buyer may receive temporary live location information concerning the rider assigned to that delivery.
• Payment providers: Relevant payment information may be exchanged with MTN, Airtel, Zamtel, and their applicable payment services to initiate, process, confirm, reconcile, or disburse mobile-money transactions.
• Service providers: Lupasphere uses trusted technology and service providers, including Vercel for application hosting and deployment, Supabase for database and backend infrastructure, and SMSALA for SMS delivery. These providers may process information necessary to provide their services to Lupasphere.
• Legal and regulatory: Information may be disclosed where required or permitted by Zambian law, a competent regulatory authority, the Financial Intelligence Centre, Bank of Zambia, a court, or another lawful authority.

Some of our service providers may store or process information outside Zambia. For example, cloud infrastructure and technology providers may operate systems in other jurisdictions.

Where personal data is transferred or processed outside Zambia, we take reasonable steps to ensure that it receives an appropriate level of protection consistent with the Data Protection Act No. 3 of 2021, including appropriate contractual, technical, or organizational safeguards where applicable.

Account data is retained while your account is active. You may request deletion of your Lupasphere account and associated personal data through Lupa Hub → Messages → Lupa Support or by emailing support@lupasphere.com.

Because user accounts may be linked to orders, transactions, payments, KYC information, logistics records, support records, wallet records, and other related data, account deletion is a sensitive action and may be processed manually by authorized Lupasphere staff.

When you submit an account deletion request, Lupasphere will verify the request and review the account and its associated records. Personal and account information that is not required to be retained will be deleted or anonymized as appropriate.

Certain information may need to be retained where required or permitted by applicable Zambian law or regulatory requirements. This may include payment records, transaction and order records, KYC information, tax records, AML/CTF records, wallet and payout records, delivery and parcel custody records, and information necessary to resolve disputes or maintain required financial and operational records. Such information will be retained only for the applicable retention period.

You may also request deletion of specific categories of non-mandatory personal data without deleting your entire account. Each request will be reviewed based on applicable legal, regulatory, contractual, security, and operational requirements.

Lupasphere may request additional information to verify the identity of the requester and confirm that the deletion request is authorized. Once the request has been verified and the necessary review completed, authorized Lupasphere staff will carry out the applicable deletion or anonymization process.

Because deletion may involve records linked to other users, orders, transactions, payments, deliveries, or regulatory records, some information may not be eligible for immediate deletion. Where retention is required, the information will be securely retained for the applicable period and deleted or anonymized when the retention requirement expires.

Once the applicable deletion process has been completed, Lupasphere will provide confirmation through the relevant support channel.

To request account or data deletion:

• In-app: Lupa Hub → Messages → Lupa Support
• Email: support@lupasphere.com

We store passwords as bcrypt hashes and transmit data over TLS. We do not store your mobile money PIN or payment credentials. Access to production systems is restricted to authorized Lupasphere personnel based on operational requirements. We maintain procedures to detect, investigate, and respond to personal data breaches.

Under the Data Protection Act No. 3 of 2021, and subject to applicable limitations, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of data we are not legally required to keep;
• object to or restrict certain processing; and
• withdraw consent where processing is based on consent.

To exercise any right, contact support@lupasphere.com. We respond within the period required by applicable law.

Our Services are intended for users aged 18 and over. We do not knowingly collect personal data from children in violation of applicable law. If we learn that we have collected such information improperly, we will take appropriate steps to delete it.

If you are not satisfied with how we handle your personal data, you may contact us first at support@lupasphere.com. You may also have the right to lodge a complaint with the Data Protection Commissioner of Zambia in accordance with applicable law.

Lupasphere Integrated Platforms Limited
Plot 1193/B, Ibex, Chongwe, Zambia
PACRA: 120261046351
General: info@lupasphere.com · Support: support@lupasphere.com