Privacy and Personal Data Protection Policy

01Introduction and Scope

This Privacy and Personal Data Protection Policy (“policy”) describes how the Vendora platform collects, uses, shares and protects the personal data of its users, including customers, agents, riders, merchants and their teams, and retail shops, who use the shop at vendora.co.mz, the mobile apps (Vendora, Vendora Comerciante, Vendora Motorista and Vendora Agente) and the management console.

Vendora is a sales and distribution platform in Mozambique: customers buy from verified shops, agents share products and earn commission on completed sales, and riders deliver the orders. The shops are the sellers of the goods; Vendora is the intermediary.

Vendora is committed to processing personal data in accordance with the Electronic Transactions Law (Law No. 3/2017, of 9 January), the African Union Convention on Cybersecurity and Personal Data Protection (Malabo Convention), ratified by Mozambique, and the principles set out in the proposed Personal Data Protection Law currently before the Assembly of the Republic. We commit to fully adopting the obligations of the new law once it enters into force, including the formal designation of a Data Protection Officer and registration with the future National Personal Data Protection Authority (ANPD).

02Data Controller

The controller responsible for personal data collected through the Vendora platform is:

Each shop receives the data of the orders placed with it, as needed to prepare and deliver them, and is responsible for its use of that data under its contract with Vendora.

03Data Protection Officer

In accordance with Article 65 of the Electronic Transactions Law, Vendora maintains designated responsibility, within its operation, for compliance with data protection principles. For matters relating to the processing of your personal data, or to exercise the rights described in Section 11, you may contact:

04Personal Data We Collect

We collect only the data necessary for the platform to function and for the purposes described in this policy, in line with the principle of data minimisation.

Special categories of data: we do not request or intentionally process sensitive data (political opinions, religious beliefs, health, sexual orientation, criminal records). The face photo used to verify agents and riders serves only to confirm that the person is the document's holder, and is deleted within the periods in Section 9.

05How We Collect Your Data

• Directly from the user: when placing an order, confirming the number by SMS, registering as an agent, rider or merchant, uploading documents and photos, and contacting support.
• Automatically, through use of the platform: the status of orders and deliveries, agents' links opened, riders' positions while on shift, and technical data needed to run and secure the service.
• From authorised third parties: the mobile-wallet operator (payment confirmations and the wallet holder's name); the shop and the rider (order status and proof of delivery); and the agent whose link brought you.

06Purposes and Legal Basis for Processing

Where processing is based on consent, the user may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Automated decisions: some checks are automatic — for example, choosing the rider who is offered a delivery, or a number or device already linked to fraud, which puts the order on hold. An order is never refused nor an account closed by an automated decision alone: these cases are reviewed by a member of staff, and you can ask for that review through the contacts in Section 3.

07Sharing Data with Third Parties

We do not sell, rent or trade personal data. Data may be shared, in limited form, with:

• The shop selling and the rider delivering: what is needed to prepare and deliver the order — the address, the landmark and, to the rider, the first name. The customer's number is shown partly hidden; contact goes through the platform.
• The agent who shared the product: only their own sales, with the customer's data hidden.
• Essential service providers, always under contractual confidentiality obligations: cloud hosting and infrastructure (Amazon Web Services); SMS delivery (Pavulla); mobile-wallet payments (the payment provider and the M-Pesa, e-Mola and mKesh operators); app notifications (Expo and Google Firebase); and writing product descriptions at a shop's request (Anthropic — receives only the product's details and photos, never customer data).
• Competent authorities: where required by law, court order, or to protect the rights, safety and property of Vendora, its users, or third parties.

08International Data Transfers

The platform's data is hosted on Amazon Web Services infrastructure in South Africa (Cape Town). Some providers listed in Section 7 process data in other countries (including the European Union and the United States), only as far as their service requires. We ensure that such transfers occur only to jurisdictions or entities offering adequate data protection guarantees, through appropriate contractual mechanisms.

09Data Retention

Once applicable periods have elapsed, personal data is securely deleted or irreversibly anonymised. Where a data subject asks for deletion of data the law requires us to keep (for example, tax records), the personal fields of those records are pseudonymised. A deleted account leaves the backups as they expire, within 30 days.

10Data Security

• Encryption of data in transit and at rest; ID document images are encrypted with a key of their own.
• Access control, role-based, limited to authorised personnel on a strict need-to-know basis; each shop, agent and rider sees only their own data.
• File scanning: every uploaded file is scanned for malware before it is shown.
• Moderation: shops' products are reviewed before publication.
• Backups performed regularly, with restore tests.
• Audit logging of administrative actions on the platform, including access to ID document images.
• Incident response: a defined procedure for identifying, containing and notifying personal data breaches.

11Your Rights as a Data Subject

To exercise any of these rights, contact the Data Protection Officer through the channels indicated in Section 3, or on WhatsApp +258 85 601 7019. Before replying, we confirm that the number or account is yours.

To delete your account: in the Vendora Agente app, under Mais, Eliminar conta, or at vendora.co.mz/eliminar-conta. You confirm with a code sent by SMS; your access ends at once, and the account is deleted within 30 days. An open contest or review, a delivery in progress or commission not yet paid delays the deletion, and we tell you why and until when; commission you have earned is paid first. We delete your name and number, your agent link, the verification documents and photos and your wallet; we keep, without your name or number, what the law requires (Section 9). We send you an SMS when it is done.

12Minors and Alcoholic Drinks

The platform is not directed at persons under 18 years of age, and does not intentionally collect data from minors. Agents and riders must be 18 or over. Alcoholic drinks are sold only to over-18s: the customer confirms their age when ordering and the rider asks for ID on delivery; to a minor, the order is not handed over and goes back to the shop. If data from a minor is identified as collected without appropriate consent, it will be deleted as soon as possible, upon contact through Section 3.

13Cookies and Similar Technologies

The site uses only necessary cookies: the signed-in session and the chosen language. We use no advertising cookies and no third-party tracking tools (no Google Analytics, no pixels). The apps keep on the phone only what they need to work (for example, the cart and the confirmed number).

14Changes to This Policy

This policy may be updated periodically, in particular to reflect the entry into force of the new Personal Data Protection Law. Material changes will be communicated through the apps or the site, indicating the effective date.

15How to Exercise Your Rights or Lodge a Complaint

16Governing Law

This policy is governed by the laws of the Republic of Mozambique, namely the Electronic Transactions Law (Law No. 3/2017), the African Union Convention on Cybersecurity and Personal Data Protection, and the Personal Data Protection Law, once it enters into force.