Privacy Policy
Last updated: 25 May 2026
1. Who we are
Zim Estates (zimestates.co.zw) is a property listing marketplace operated by Crossbow Digital, a company registered in Zimbabwe with offices at Office No. 1, L Amai Plaza, 44 Main Street, Gweru, Zimbabwe. We operate as a platform connecting property buyers, renters, agents, and developers. We do not handle money or take commission on transactions.
2. What data we collect
We collect the following categories of personal data: Contact information including phone number, email address, and full name when you register or submit a lead form. Identity documents including National ID number, date of birth, nationality, and residential address when you complete KYC verification. Selfie and ID document images for identity verification purposes. Property listing data including property address, description, photos, and pricing. Usage data including pages visited, search queries, session duration, and scroll depth collected via Google Analytics 4 and Microsoft Clarity. Device and browser information for security, fraud prevention, and platform analytics. Technical error diagnostics — when the site encounters a bug, we automatically capture the error message, the page you were on, your browser type, and (if you are signed in) your account so we can fix the problem and let you know when it is resolved.
3. Why we collect your data
We collect your data for the following purposes: To verify your identity and prevent fraud on the platform. To enable you to list, search for, and enquire about properties. To send you OTP verification codes via SMS. To notify you of price drops on saved listings via WhatsApp or email. To send you the optional monthly property market newsletter if you subscribe. To understand how users interact with the platform so we can improve it (analytics). To investigate fraud reports and maintain platform safety. To comply with Zimbabwean law and regulatory requirements, including the Data Protection Act [Chapter 11:12] (2021).
4. How we store your data
Your data is stored on Supabase PostgreSQL servers located in the European Union (Ireland). Identity documents and selfies are encrypted at rest using AES-256 encryption. After successful KYC verification, original document files are deleted from our active storage within 30 days. We retain verification hashes to prevent re-submission of fraudulent documents. Listing data, lead data, and account data are retained for the lifetime of your account plus 12 months after account deletion. Technical error diagnostics are retained for a maximum of 90 days and are deleted immediately if you delete your account.
5. Who we share your data with
We do not sell your personal data. We share data only in the following circumstances: With the agent or property owner when you submit a lead enquiry, so they can contact you about the property. With Africa Talking, our SMS provider, to send OTP verification codes. With Resend, our email provider, to send transactional emails. With Sentry (Functional Software, Inc., processed in the EU region) for error monitoring and diagnostics, where we send only a non-identifying account reference, never your email or name. With Google LLC (Google Analytics 4) and Microsoft Corporation (Microsoft Clarity) for anonymous usage analytics. With our hosting and infrastructure providers including Vercel and Supabase under data processing agreements. With law enforcement or regulatory authorities when required by Zimbabwean law.
6. Your rights under the Data Protection Act [Chapter 11:12]
Under Zimbabwe's Data Protection Act [Chapter 11:12] (2021) and applicable data protection principles, you have the following rights: The right to be informed about how your data is used (this policy fulfils that obligation). The right to access the personal data we hold about you. The right to correct inaccurate personal data. The right to request erasure of your personal data. The right to object to processing of your personal data for direct marketing. The right to withdraw consent for analytics and marketing communications at any time. The right to lodge a complaint with Zimbabwe's Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) or the relevant data protection authority. To exercise any of these rights, contact us at compliance@zimestates.co.zw or via WhatsApp at +263 78 127 0233.
7. Analytics and cookies
We use the following technologies to understand how users interact with the platform: Google Analytics 4 (GA4), collects anonymised data about page views, session duration, and user journeys. Microsoft Clarity, records anonymised session replays and heatmaps to identify usability issues. Both tools use cookies and browser storage. You can opt out of analytics cookies via our cookie consent banner, which appears on your first visit. Essential cookies required for the platform to function (session management, security tokens) cannot be disabled. We do not use advertising cookies or sell data to advertising networks.
8. KYC data handling
Identity verification data is handled with the highest level of care. Your National ID and selfie are used only to verify your identity and are not shared with any third party except where required by law. AI-assisted verification is used as a first screen only. All verification decisions are reviewed by a human member of our trust team. You may request deletion of your KYC data at any time, which will result in your verified status being removed and any active listings being suspended pending re-verification.
9. Data security
We implement the following security measures: All data transmitted to and from our platform is encrypted using TLS 1.3. Database access is restricted by Row Level Security policies. All API endpoints are rate-limited to prevent abuse. Audit logs are maintained for all sensitive operations. Our team undergoes regular security training. In the event of a data breach we will notify affected users and the relevant authorities within 72 hours, as required by the Data Protection Act [Chapter 11:12].
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or SMS. Continued use of the platform after notification constitutes acceptance of the updated policy. The date at the top of this page indicates when the policy was last updated.
11. Contact us
For any privacy-related questions or requests, contact us at: Email: compliance@zimestates.co.zw. WhatsApp: +263 78 127 0233. Post: Privacy Officer, Crossbow Digital, Office No. 1, L Amai Plaza, 44 Main Street, Gweru, Zimbabwe.