Privacy notice

GreenSpace is a product of Tariah Technologies. Tariah Technologies decides how and why your personal data is used on GreenSpace, so it is the data controller under the Act.

Registered business name

TARIAH TECHNOLOGIES

Registered address

22nd Street, Plot 8, Libala Stage 3, Lusaka, Zambia

PACRA business name number

320261072589

Data Protection Officer

Robert Sampa, +260 97 368 7449

Privacy questions and requests

privacy@tariahtechnologies.com

This notice covers greenspacezm.com and every GreenSpace service: accounts, listings for property, vehicles, stays, jobs and items, messages, bookings, payments and the tools we provide to agencies, dealers, hosts and commercial landlords.

It explains what we collect, why, who sees it, where it is kept, how long we keep it and what you can do about it. Our main forms show a short note where we ask for information, with a link to the matching part of this page.

You can ask us to show you your data, correct or delete it, stop or limit how we use it and give you a copy you can take elsewhere. You can withdraw your consent at any time and complain to the Data Protection Commission. Your rights explains each one and how to use it.

Each part below says what we collect, why, whether you must give it, who sees it and our lawful basis under section 13 of the Act.

Your account

• What: your first and last name, email address, phone number and password.
• Why: to create and secure your account, let you sign in and contact you about your account and activity.
• Required: yes. Without them we cannot open an account.
• Who sees it: your name appears on your public listings, reviews and profile. Your email address is seen by the members of organisations you join, the owners and admins of those organisations and the hosts or sellers you contact and their team (see Your team and Bookings). Your phone number is shown to signed-in users who ask to see it on a listing you post as a private seller (see Listings).
• Basis: contract and your consent.

Optional profile details

• What: your province, how you heard about GreenSpace, date of birth, nationality, address, a short bio, a profile photo, a business name, a tax number and your notification choices.
• Why: to complete your profile, show your photo to people you deal with and count, in total numbers, where our users come from.
• Required: no. Leaving them blank changes nothing about what you can do.
• Who sees it: your photo is public. The rest is private to you and GreenSpace.
• Basis: your consent. You can remove any of them from your profile at any time.

Agents

• What: your name, contact details, date of birth, address, experience, languages, business and tax details, a photo of your NRC or passport and any certificates you upload.
• Why: to check your identity, that you are 18 or over and that you are qualified, before we list you as an agent.
• Required: yes for the identity document, date of birth and contact details. Without them we cannot list you as an agent.
• Who sees it: the agent directory shows everyone your name, photo, title, bio, city and country, the kinds of agent work you do, your languages, service areas, years of experience and business name, whether you are verified or featured, your ratings and number of reviews, how many listings you have, your messaging availability, when you joined and when you were last active. GreenSpace reviewers check your identity document and certificates. They are never shown on your profile. We do not show your date of birth, street address, phone, email or tax number on your public profile either.
• Basis: contract, our legitimate interest in keeping fraudulent agents off GreenSpace and your consent.

Organisations

When you register an agency, dealership, hospitality business or commercial property business we collect:

• Business details: name, trading name, description, tagline, legal form, registered company name and PACRA number and, for commercial organisations, whether you let or manage property that belongs to someone else. The name, description and tagline are public once your organisation is live. The legal form and registration details stay within your organisation and GreenSpace.
• Contact details: email, phone, website and social links. These are public on your organisation's profile, to anyone, signed in or not. If you use a personal number or address, it will be public.
• Locations: address, opening hours, a map pin and a phone number. Addresses and hours are public. A location's phone number is shown only to signed-in users.
• Brand: logo, cover image and colour. These are public.
• Payout and tax details: if you give us a TPIN, payout provider, account holder name or number, only your organisation's owners and admins and GreenSpace see them.
• Your acceptance of our Terms: who accepted, when and which version.

• Why: to set up your organisation, work out which documents the law requires for your type of business, review it, publish it and pay you where that applies.
• Required: the name, a description, an email or phone number, a main location and the answers about your legal form are needed to submit for review. Everything else is optional.
• Basis: contract and your consent.

Compliance documents

• What: documents that show your business may trade. Depending on your business these are a PACRA certificate, a ZIEA certificate of registration and Compensation Fund certificate, a council trading licence, an RTSA motor dealer's vehicle licence, a Zambia Tourism Agency licence, council fire and health certificates, a liquor licence, a ZRA tax clearance certificate, proof of business address, a title deed or head lease and a Data Protection Commission registration certificate.
• Personal data in them: they can name you or other people, such as a sole trader, directors, partners, a property owner or a landlord, and can show an NRC number, TPIN, address, sex or marital status.
• Why: to check that the organisation holds the licences the law requires before we show it to the public, and to keep a record of that check.
• Required: each document is marked Required or Recommended on the upload screen. You cannot submit your organisation for review without the required ones. A live organisation whose required documents are not verified by its deadline is hidden from public listings until they are. Recommended documents never block anything.
• Deadline emails: if your organisation has a documents deadline, we email its contact address and its owners and admins when the deadline starts, before it ends and if it passes.
• Who sees it: only your organisation's owners and admins and GreenSpace reviewers. Documents are never public. We keep them in private storage in the United States and open them only through links that expire within an hour.
• Other people named in your documents: before you upload a document that names someone else, make sure they know you are sharing it with GreenSpace for this check. We use their details only for the check.
• How long: while the organisation is on GreenSpace, then 1 year (see How long we keep your data).
• Basis: contract, our legitimate interest in keeping unlicensed businesses off GreenSpace and your consent.

Your team

When you invite someone we store their email address, the role you chose and who invited them. We use it to send them one invitation email, which tells them who invited them. An invitation expires after 14 days. The email names GreenSpace and Tariah Technologies, says what the address is used for and links to this section. Once someone joins, the organisation's members see their name, photo and email address. Basis: our legitimate interest, and yours, in letting organisations add their staff.

Listings, contact details and job adverts

• What: your listing's text, price, photos, location and any contact details you add.
• Who sees it: listings are public once approved. A private seller's phone number is shown only to signed-in users who ask to see it. A job advert's "How to apply" details are shown only to signed-in users. Applicants contact the employer directly; GreenSpace does not receive job applications or CVs.
• Photos: do not upload photos that show other people without their agreement.
• Location: address suggestions may come from Google, which then receives what you type. If you press "Use my location", your browser shares your position with us to place the pin.
• Basis: contract and your consent.

Messages

We store the messages and files you send through GreenSpace and show them to the people in the conversation. GreenSpace staff open messages only to investigate a report, a dispute or misuse. Basis: contract.

Bookings, viewings and test drives

• What: the listing, dates, guests, your notes and the booking's status.
• Who sees it: the host, seller or agent and the members of their organisation. When you send a request they see your name, email address and phone number so they can confirm it.
• Confirmations: we may send you a confirmation by email and, where switched on, by SMS.
• Basis: contract, and your consent to share your contact details with the host, given when you send the request.

Payments

• Subscriptions: when you pay for a plan we send your mobile money number, the amount and a reference to MTN Mobile Money or Airtel Money, and store the result and the provider's reply.
• Paying a host: you pay the host's own mobile money wallet and GreenSpace does not handle that money. We show you the host's wallet number and registered name so you can check them before you enter your PIN. A transaction ID you enter is shown to the host. If you are a host, your wallet number and registered name are shown to guests whose bookings you confirm.
• Basis: contract and our legal obligation to keep financial records.

Reviews and reports

Reviews are public with your name. If you report a listing, a user or a review, the person you report is not told who you are. Basis: contract and our legitimate interest in keeping the marketplace safe.

Records organisations keep about other people

Organisations can record tenants, guests, reservations, staff and invoices in their GreenSpace dashboard. For those records the organisation decides what to collect and why, and GreenSpace stores them on its behalf. The organisation must tell those people and answer their requests. If you are a tenant, guest or staff member, contact the organisation first. You can also write to us.

How you use GreenSpace

• Listing views: when you open a listing we record your IP address, browser type and the time, to count unique views. The person or organisation that posted the listing can see these records today. We will limit them to view counts and delete the IP addresses after 30 days.
• Analytics: we use Vercel Web Analytics and Speed Insights to count page views and measure speed. They receive the page address and basic device information. We remove invitation tokens from page addresses before they are sent. If you accept analytics cookies we also use Google Analytics. It sets cookies and receives the page address, your device and browser details and your approximate location, so we can see how people find and use GreenSpace. We remove invitation and sign-in tokens from the page address before it is sent. Google Analytics stays off until you accept, and you can withdraw at any time from Cookie settings in the footer.
• Security and audit logs: we log sign-ins, admin actions and errors, including IP addresses, to protect accounts and investigate problems.
• Basis: our legitimate interest in running and securing the service. Google Analytics runs on your consent only.

Maps

Our maps come from Google Maps and OpenFreeMap. When a map loads, your device connects to them and they receive your IP address and the area shown. When you type into an address search with suggestions, Google receives what you type. Google uses this data under its own privacy policy.

Cookies and browser storage

GreenSpace sets cookies only to keep you signed in. If you accept analytics cookies, Google Analytics also sets two cookies, named _ga and _ga_ followed by a code, which can last up to two years. Google may set its own cookies when one of its maps loads. Your browser also stores your theme, the organisation you last worked in, unsaved drafts, your vehicle comparison list and payment progress on your device. We use no advertising cookies and no cross-site tracking. Clearing your browser data removes them.

Sometimes you give us information about someone else: a colleague you invite, the people named in a compliance document and the guests and tenants in your dashboard.

Share it only if you are allowed to and the person knows. We collect it from you under section 16(2) of the Act and use it only for the purpose described here.

We rely on section 13 of the Act:

• Contract: to provide the service you asked for.
• Legal obligation: to keep records the law requires and answer lawful requests.
• Legitimate interests: to keep GreenSpace safe, check organisations and agents, prevent fraud and improve the service, where your rights do not outweigh them.
• Consent: for optional details, marketing and sharing your details with other users.

We also ask for your written consent when you create an account and when you submit an organisation. You can withdraw consent at any time (section 15 of the Act). Withdrawing does not affect what we did before, but we may then be unable to provide the part of the service that needs it.

The Act treats sex, marital status, race, ethnic origin, health, religious or similar beliefs, political opinions, trade union membership and genetic and biometric data as sensitive. We do not ask for any of these.

Identity and compliance documents can show some of them, such as sex or marital status. We use those documents only to check identity and licences, and we never analyse a face or fingerprint.

• Other users, as What we collect and why describes: your public profile and listings with everyone, your phone number with signed-in users who ask for it and your contact details with the other side of a booking or conversation.
• Service providers that run GreenSpace for us, listed below. We have not yet confirmed a data processing contract with each of them.
• Payment providers: MTN Mobile Money and Airtel Money, to process payments you make. They use your data under their own terms.
• Authorities: the police, courts or regulators where the law requires it, or to prevent a threat to national security, defence or public order or to investigate an offence (section 53(4) of the Act).
• A buyer of the business: if Tariah Technologies sells or merges GreenSpace, under this notice.

We do not sell your personal data. You can ask us for a list of the third parties we have shared your data with (see Your rights).

The Act requires personal data to be stored on servers in Zambia unless an exception applies (sections 70 and 71). GreenSpace stores and processes personal data in the United States. Supabase holds our database and files in the AWS US East region in Ohio. Our website and server functions run on Vercel in Washington, D.C.

We store your data there because our database, files and website run on these providers' servers. Supabase and Vercel encrypt your data in transit and at rest, and database rules limit each record to the people this notice names and to GreenSpace staff.

Tariah Technologies will apply to the Data Protection Commission for authorisation to store personal data outside Zambia. We will update this section when it has.

GreenSpace will ask for your consent to this storage separately from accepting our Terms. You will be able to withdraw it by closing your account.

Two rules run automatically:

• Listing edits: when you edit a live listing, rules check the change, for example a large price change. An edit can be accepted, sent to a person for review or rejected. A rejection gives the reason. To have a person look at a rejection, write to privacy@tariahtechnologies.com.
• Document deadlines: an organisation whose required documents are not verified by its deadline is hidden from public listings until they are. A person checks every document.

No decision about you is made by a machine alone without a route to a person.

Automatic deletion is being built. Once it runs, we will keep personal data only while we need it and, where section 51 of the Act requires it, for at least one year after that. At the end of each period below we will delete it or remove anything that identifies you.

Until deletion is automatic, you can ask us to delete your data at any time (see Your rights).

Database rules limit each record to the people this notice names and to GreenSpace staff. Compliance documents sit in private storage and open only through links that expire within an hour. Admin actions are logged.

If there is a breach

If a security breach affects your personal data, we will tell the Data Protection Commission within 24 hours and tell you as soon as we can (section 49 of the Act).

You can ask us to:

• confirm whether we hold your data and give you a copy, with its purpose, source, recipients and how long we keep it (section 58). The first copy is free;
• tell you every third party we have shared it with (section 58(3));
• correct or complete it (section 59);
• delete it (section 60);
• stop using it, including for marketing (section 61);
• limit how we use it while a question is settled (section 63);
• give it to you, or to another service, in a machine-readable format (section 65);
• have a person review an automated decision (section 62).

You can also withdraw your consent at any time (section 15).

How to use your rights

You can edit most details in your profile. You can delete your account yourself from Edit profile, on the Notifications tab. For anything else, write to privacy@tariahtechnologies.com. We may ask you to prove who you are.

We answer within 30 days.

Some rights have limits, for example where we must keep records by law (section 67).

We send marketing emails only if you switch them on. You can switch them off in your profile at any time.

You must be 16 or over to use GreenSpace. If you are 16 or 17, you need the consent of a parent or guardian to create an account.

We will ask for that consent when you sign up.

We do not knowingly collect data from children under 16. If you think a child under 16 has given us data, write to privacy@tariahtechnologies.com and we will delete it.

Write to us first at privacy@tariahtechnologies.com so we can put things right. You can also complain to the Data Protection Commission (section 68 of the Act).

Phone

+260 750 799 801 (Monday to Friday, 08:00 to 17:00)

Email

info@dataprotection.gov.zm

Website

www.dataprotection.gov.zm (opens in a new tab)

You can appeal a decision of the Commission to the High Court within 30 days (section 69).

We will post any change here with a new effective date. Before a significant change takes effect we will tell you by email or in GreenSpace.