Privacy Policy

1Who we are (the data controller)

1.1 Bimalu Recycling, operating in Lusaka, Republic of Zambia, is the controller of personal information processed through this Website and our operations portal. We operate together with related companies in the Bimalu group, including Bimalu Zambia Limited (bimaluzambia.com).

1.2 For any privacy matter — a question, a request, or a complaint — contact us at sales@bimaluzambia.com or at our Lusaka facility. We treat every privacy contact seriously and respond within a reasonable time.

2Scope of this policy

2.1 This policy covers the public Website, the Staff Portal used by authorised employees, and personal information we collect when you visit our facility, contact us by email or phone, or transact with us.

2.2 This policy does not cover third-party websites we link to (such as bimaluzambia.com or social media pages), which have their own privacy policies.

3Personal information we collect

3.1 Website visitors. We collect very little: your contact details only if you choose to email or call us (your name, email address, phone number and the content of your message), plus the minimal technical data described in clause 6.

3.2 Staff portal users. For authorised personnel we process: full name, work email address, username, role (for example supervisor or warehouse worker), a securely hashed password, account status, sign-in records and security audit trails of actions performed in the system.

3.3 Suppliers and sellers of Materials. When you deliver or offer Materials, we may record your name, identification details (such as NRC or company registration), contact details, vehicle registration, proof-of-ownership documents, transaction records (weights, grades, prices), and payment details or payment references.

3.4 Business contacts. If you represent a customer, partner or regulator, we keep your business contact details and records of our communications and agreements.

3.5 We do not collect special categories of personal data through the Website, and we do not knowingly collect data from children (see clause 12).

4Sources of information

• directly from you — when you email us, visit our facility, deliver Materials, or use the Staff Portal;
• automatically from your device — minimal technical data (see clause 6);
• from your employer or Bimalu management — where an account is created for you as staff;
• from documents you provide — such as identification or proof of ownership in a transaction.

5How we use personal information & why

5.1 We use personal information only where we have a proper basis. The main purposes and their legal bases under the Data Protection Act are:

• Responding to enquiries you send us — based on your consent and our legitimate operations;
• Operating the Staff Portal — creating accounts, authenticating sign-ins, enforcing security limits (such as blocking repeated failed attempts), and keeping audit trails — based on our legitimate interests and, for employees, the employment relationship;
• Running our recycling operations — recording transactions, weights, grades and payments, and meeting record-keeping duties — based on contractual necessity and legal obligations;
• Preventing fraud and theft — verifying ownership of Materials and keeping identification records — based on our legitimate interests and legal obligations;
• Keeping the Website working — remembering a theme preference on your device and protecting systems from misuse — based on legitimate interests and consent where required;
• Meeting legal duties — responding to lawful requests from authorities and regulators — based on legal obligation.

5.2 We do not use personal information for automated decision-making or profiling that produces legal effects.

5.3 We do not send marketing messages through this Website, and we do not sell personal information — ever.

6Cookies & local storage

6.1 We use only strictly necessary and functional storage — no advertising or third-party analytics trackers:

• PHP session cookie — keeps staff signed in securely while they use the portal, and carries the security token that protects forms against cross-site request forgery. It expires when you close your browser or sign out.
• “Remember me” token — if a staff member ticks “Remember me”, we store a single cookie on their device containing a random token; the matching secret is stored hashed in our database, and the token can be revoked at any time.
• Theme preference (“bimaluSeen”) — a small value stored in your browser’s localStorage (with a cookie fallback) so the Website remembers you have visited and can show returning visitors the dark theme. It contains no personal details and never leaves your device.

6.2 You can clear cookies and site data anytime in your browser settings; the Website will simply treat you as a first-time visitor.

7Sharing of personal information

7.1 We share personal information only with:

• Bimalu group companies (including Bimalu Zambia Limited) where needed for operations, manufacturing integration or group administration;
• service providers that host our Website and systems, bound by appropriate confidentiality and security obligations;
• professional advisers — auditors, accountants and lawyers, where reasonably required;
• banks and payment providers — to execute payments for Materials purchased;
• authorities — where disclosure is required by law, court order or a lawful request, or where necessary to prevent unlawful activity.

7.2 We never sell, rent or trade personal information to third parties for their own purposes.

8International transfers

8.1 Our hosting and service providers may process data outside Zambia. Where that happens, we take reasonable steps to ensure the receiving party protects personal information with safeguards comparable to those required by Zambian data protection law — including contractual confidentiality and security commitments.

9How we protect your information

• passwords are stored only as modern one-way password hashes — never in plain text;
• sign-in is protected with per-session security tokens and automatic rate limiting of repeated failed attempts;
• “remember me” tokens are random, stored hashed, and revocable;
• all user actions in the operations system are written to an audit trail;
• access to systems and databases is restricted to authorised personnel and least-privilege principles;
• connections to our Website are encrypted with HTTPS/TLS;
• development and production environments are separated, and installation access is removed after setup.

9.1 No system is perfectly secure. We commit to reviewing and improving our safeguards, and to notifying affected individuals and the Data Protection Commissioner of any personal data breach as required by law.

10How long we keep information (retention)

10.1 We keep personal information only as long as necessary for the purpose collected and for the periods required by Zambian law, then securely delete or anonymise it:

• staff account records — for the duration of employment or engagement, then per our lawful retention practice;
• transaction, weighing and payment records — as required by tax, audit and commercial law;
• identification and proof-of-ownership records — as long as needed to evidence lawful acquisition of Materials;
• failed sign-in attempt records — on a rolling 15-minute security window;
• “remember me” tokens — until expiry or revocation;
• theme preference — until you clear your browser data;
• enquiry emails — as long as needed to handle them and for reasonable record-keeping.

11Your rights

Subject to the Data Protection Act No. 3 of 2021, you have the right to:

• be informed — which this policy does;
• access — ask us to confirm what personal information we hold about you and receive a copy;
• rectification — correct information that is inaccurate or incomplete;
• erasure — ask us to delete information that is no longer needed or lawfully held;
• restriction and objection — ask us to pause or stop certain processing, including processing based on legitimate interests;
• withdraw consent — where we rely on consent, at any time, without affecting earlier processing;
• complain — lodge a complaint with us directly, or with the Data Protection Commissioner of Zambia.

12Children

12.1 The Website and our services are not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it promptly.

13Third-party websites

13.1 Our Website links to other sites (for example bimaluzambia.com). We are not responsible for their privacy practices. Read their policies before giving them personal information.

14Changes to this policy

14.1 We may update this policy to reflect changes in our operations or the law. The “last updated” date and version number at the top of this page always identify the current version, and significant changes will be highlighted on this page.

15How to contact us or make a request

15.1 To exercise any right in clause 11, or ask anything about this policy, email sales@bimaluzambia.com or write to us at our Lusaka facility, addressed to “Data Protection — Bimalu Recycling”.

15.2 We may ask for proof of identity before acting on a request, to protect your information from others. We aim to respond within thirty (30) days. Requests are free of charge; we may charge a reasonable fee only where permitted by law for repetitive or excessive requests.

15.3 If you are not satisfied with our response, you may escalate to the Data Protection Commissioner of Zambia.

16Also read

16.1 Our Terms & Conditions govern your use of this Website and form part of our agreement with you.