Privacy Policy

How Explore Zimbabwe handles personal data

Last updated: 15 October 2026

This Privacy Policy explains how Explore Zimbabwe handles information submitted through the directory, supplier certification, profile-claim, event, review, enquiry and booking-request features. It describes the current site build and should be reviewed by a qualified adviser before a wider public launch.

Information you provide

We collect the information needed to process the action you choose. This can include your name, email address, country, message, review content and optional contact details when you submit an enquiry, booking request or review.

Businesses applying for certification provide business identity and contact details, a physical address, website or social link and a company logo. A registration number may be provided but is not mandatory. Applicants may also submit up to five optional business photos and a rights/permission confirmation and credit/source note. These photos and application materials remain private to authorised moderators until the supplier profile is approved and published. Event organisers provide event information and an organiser name and email; optional phone, WhatsApp and website details may be made public only if the event is approved.

People requesting to claim a business profile provide their name, email, business role and an explanation that authorised staff can use to assess the request; a phone number is optional. Claim details are private to authorised staff. A request alone does not grant account access, publish edits or change whether the business is verified.

Customer and supplier sign-in use separate entry points. Google sign-in is available only where its credentials are configured. Email/password registration, verification and recovery are not currently available, so password credentials are not collected or stored. Reviews are not anonymous and may show the reviewer's display name, country and profile image alongside the review. A separate public reviewer profile is private by default and is published only after the reviewer explicitly opts in.

How we use information

We use submitted information to review and publish eligible business and event profiles, assess profile-claim requests, display approved public contact details, record enquiries and booking requests, administer reviews, maintain saved lists for signed-in users, respond to requests and protect site forms from misuse.

Travel Planner requests use the number of days, broad budget preference and interests submitted to draft an itinerary. Service Finder requests use the text you submit with a limited set of public provider information to rank relevant providers. Do not include sensitive personal information in either tool.

Information shown publicly

Published business profiles can show names, locations, telephone or WhatsApp details, websites, email addresses, logos and other approved public information. Some newly imported businesses may be displayed with source-backed public contacts while clearly labelled “Not verified”; this label means Explore Zimbabwe has not verified or accredited the business. Visitors should confirm the business and its details directly before relying on them. Approved events can show the public contact details supplied by the organiser. Published reviews can show the reviewer's display name, profile image, country, rating, date and review text. If a reviewer explicitly makes a public profile, the page may collect those already-public approved reviews from currently published providers and show the reviewer's display name and opted-in review history together. The public profile does not show the reviewer's email address, account or OAuth identifiers, staff role, saved items, private drafts, pending reviews or flagged reviews. Reviewers can switch the public profile off from My Reviews; this hides the profile page and removes its public history link.

Storage, access and service providers

Certification submissions, profile-claim requests, event submissions, enquiries, booking requests, reviews, saved items and authorised account records are stored in the project database. Claimant contact details and evidence are available only to authorised staff and are not displayed on the public profile. Uploaded business media is stored in managed object storage. Transactional email for email verification and password recovery is not yet configured; those account functions remain unavailable until an email provider is connected.

The site may use Google for sign-in and public Maps information where configured, and a managed AI service for the optional planning and service-finder tools. Those services may handle the information sent to them in order to provide their function. Their own terms and privacy practices apply.

Site statistics and security

The site records aggregate page-view events using page type and slug. It does not store a visitor profile, precise device location or IP address in the analytics table. Profile-claim submissions use short-lived fixed-window rate limits. The rate-limit table stores keyed HMAC fingerprints of network and email values, not raw IP addresses or email addresses, and prunes expired buckets during subsequent claim requests.

Do not submit payment card details, identity documents or other confidential information through the directory. The current site does not take payments or confirm reservations.

Your choices and requests

You may leave optional fields blank. If you need to correct or remove information submitted through the site, contact the directory owner through the About us route and identify the submission or public page concerned. Requests are assessed against the site's operational, moderation and record-keeping needs.

Changes to this policy

We may update this Policy as the service develops. The date above will be updated when material changes are published.

For copyright, source and image-licence information, read the image rights section of our Terms of Use.