This policy explains how your data is collected, used, and protected when using the Zahra application to purchase products, manage orders, handle deliveries and the e-wallet, and communicate with customer service.
The app is operated by Zahra Al-Khashkhash Company for Importing and Distributing Beauty Equipment and Cosmetics. For privacy-related inquiries, you can reach us at info@zahra.com.ly.
1. Data We Collect
We collect the data necessary to provide the app’s services, including:
- Account Data: Phone number, name, email address (when provided), and account verification details.
- Address & Location Data: Delivery address, map coordinates you select or grant the app permission to access, and additional address details you provide.
- Order Data: Products, quantities, prices, payment methods, order notes, and order history (deliveries, cancellations, and returns).
- Wallet & Payment Data: Balance, top-up history, transfers, payments, transaction amounts, reference numbers, and transaction status.
- Interaction Data: Favorite products, ratings, reviews, and requests for restock notifications.
- Support Data: Support ticket topics, messages, and information sent to customer service.
- Technical Data: IP address, session and guest identifiers, push notification tokens, and technical data necessary to operate the app, diagnose errors, and secure the service.
When using the app as a guest, we may save a guest identifier, address, shopping cart, and preferences to ensure a seamless experience.
2. How We Use Your Data
We use your data to:
- Create, verify, and manage your account.
- Display available products and assign the appropriate branch based on your delivery location.
- Process orders, payments, and e-wallet transactions.
- Execute deliveries, cancellations, returns, and financial settlements.
- Provide customer support and respond to inquiries or complaints.
- Send order status updates and requested notifications.
- Operate, optimize, and troubleshoot the application.
- Prevent fraud, abuse, and secure user accounts.
- Comply with legal and accounting obligations and resolve disputes.
3. Location & Device Permissions
We request access to your device location when using features that require it, such as pinpointing your delivery address on the map. You can deny or revoke this permission via your device settings and manually enter your address where available.
Note: Failing to provide a valid location or address may affect our ability to identify the correct branch or fulfill delivery.
You can also manage push notification permissions through your device settings. Disabling notifications will not prevent app usage, but it may prevent you from receiving order status and product alerts.
4. Electronic Payment & Wallet
Card payments are processed securely via Plutu and associated financial institutions.
Card details are entered directly on the payment provider’s secure page. Zahra systems do not store full card numbers or security codes (CVV). We only retain transaction metadata required for verification and reconciliation, such as the amount, transaction reference, and status.
Processing of payment data by third parties is subject to their respective privacy and security policies.
5. Data Sharing
We share data only to the extent necessary to fulfill our services with:
- Branches & Delivery Personnel: To fulfill your order, including necessary contact details, address, and delivery instructions.
- Payment Processors & Financial Entities: To process, verify, and settle transactions.
- Technical Service Providers: Hosting, mapping, and notification infrastructure providers (including Google Maps and Firebase services).
- Competent Authorities: When required by legal obligations, to protect rights, investigate fraud, or resolve legal disputes.
We do not make your account or address details public. However, published product reviews and associated information displayed by the app may be visible to other users. Sharing a link to your favorite products allows anyone with the link to view the items included.
6. On-Device Storage
We use local storage on your device to save preferences and operational data, such as selected language, chosen address, guest ID, and incomplete payment attempts.
We also store login credentials using secure local storage mechanisms available on your device. Deleting the application may remove locally stored data, but it does not constitute a request to delete your account or records stored on our servers.
7. Data Retention & Account Deletion
We retain data as long as necessary for the purposes outlined in this policy. Retention periods vary based on data type, account and order status, legal accounting requirements, and dispute resolution needs.
You can request account deletion via the dedicated option inside the app or by contacting us at the email provided below. Verification of identity may be required prior to processing the request.
Upon account deletion, certain transaction records, order history, and data required to meet legal obligations, prevent fraud, or settle claims may be retained strictly as necessary.
8. Data Protection
We implement technical and organizational measures to protect your data, including encrypted communications, access controls, account security, and monitoring of sensitive operations.
While no method of transmission or electronic storage is completely secure, we strongly advise against sharing verification codes or login credentials. Please notify us immediately if you suspect unauthorized access to your account.
9. Your Rights & Privacy Choices
You can update editable information directly in the app, manage device permissions, or request account deletion.
You may also contact us to request access to, correction of, or deletion of your personal data, or to inquire about its usage. Requests will be handled in accordance with applicable legal requirements after verifying your identity.
10. Third-Party Services & Cross-Border Data Transfer
Some technical service providers may use servers located outside Libya. Consequently, data necessary to run these services may be processed in other countries under the provider’s operational and privacy policies.
When redirected to a third-party service (such as a payment gateway), their specific privacy policy applies to the data collected directly by them.
11. Children's Privacy
The application is intended for commercial shopping and transactions and is not directed at children. If you are a parent or guardian and believe a child has provided personal data without consent, please contact us so we can verify and take appropriate action.
12. Updates to This Policy
We may update this Privacy Policy to reflect changes in our services or data processing practices. The updated version will be published with a revised effective date. Material changes will be communicated with appropriate notice, and consent will be requested where legally required.
13. Contact Us
For privacy inquiries and requests:
- Operating Entity: Zahra Al-Khashkhash Company
- Email: info@zahra.com.ly
- Address: Misrata, Libya