Privacy Policy

This Privacy Policy explains how CocoMia Brew & Bloom, Shop 18 Sam Levy's Village, Borrowdale, Harare, Zimbabwe ("CocoMia", "we", "us", "our") collects, uses, shares, and protects personal information when you use our website and mobile application (together, the "Platform"), including as a customer or as a delivery driver. It also explains the choices and rights available to you.

We are the data controller responsible for the personal information described in this policy. If you have any questions, contact us at hello@cocomia.co.zw.

1. Information We Collect

Information you provide to us

• Account details — name, email address, and password (stored in encrypted/hashed form — we never store it as plain text), or your name, email address and Google account identifier if you sign in with Google.
• Profile information — phone number and, if you choose to add one, a profile photo (selected from your photo library or camera).
• Order information — items ordered, delivery address you type in, special instructions or dietary/allergen notes, order history, and your chosen payment method (cash or card — we do not collect or store card numbers, see Section 3).
• Communications — messages you send us through the contact form, by email, or by phone, and any order ratings or reviews you submit.
• Driver information (delivery drivers only) — name, phone number, vehicle details, and delivery/earnings records. Driver accounts are created by CocoMia, not through public self-registration.

Information collected automatically

Our servers automatically log standard technical information needed to operate and secure the Platform, such as IP address, device/browser type, and request timestamps. We do not use advertising SDKs, third-party analytics trackers, or behavioural advertising on the Platform, and the mobile app does not access your device's precise GPS location — delivery distance is calculated from the address you type in, using the Google service described below.

2. How We Use Your Information

We use the information described above to:

• create and manage your account, and authenticate you when you sign in;
• take, prepare, calculate the price and delivery fee for, fulfil, and deliver your orders;
• communicate with you about your orders, account, or enquiries you raise with us;
• allocate orders to delivery drivers and enable drivers to contact you and navigate to your delivery address;
• display order reviews you choose to submit;
• maintain the security, integrity and proper functioning of the Platform, and prevent fraud or abuse; and
• keep records required for accounting, tax, and other legal or regulatory obligations.

We process this information because it is necessary to perform our contract with you (fulfilling orders and operating your account), to comply with legal obligations (such as financial recordkeeping), and, in limited cases, our legitimate business interests (such as keeping the Platform secure). We do not send marketing communications and do not sell your personal information to anyone.

3. How We Share Your Information

We only share personal information as follows:

• Delivery drivers — a driver assigned to your order can see your name, phone number, delivery address, and order details needed to complete the delivery.
• Google — if you use Google Sign-In, Google authenticates you and shares your name, email, and Google account identifier with us. Separately, our servers send the delivery address you provide to Google's mapping/distance-calculation service to estimate delivery distance and fees, and the driver app can open Google Maps with that address for turn-by-turn directions. Google processes this information under its own privacy policy.
• Service providers — companies that host our servers and database, and deliver transactional emails (such as order or account notifications) on our behalf, under confidentiality obligations and only to provide those services to us.
• Legal & safety — where required by law, legal process, or to protect the rights, property, or safety of CocoMia, our staff, drivers, or customers.
• Business transfers — if CocoMia were to undergo a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

Payment cards: we do not collect, transmit, or store payment card numbers or other card details through the Platform. Card payments are taken in person on a physical card machine at the time of collection or delivery, outside of the app or website.

We do not sell your personal information, and we do not share it with third parties for their own advertising purposes.

4. Data Retention

We retain account information for as long as your account is active. Order records (including the items, amounts, and delivery address associated with each order) are retained for as long as needed to fulfil the order and afterwards for our accounting, tax, and legal recordkeeping obligations, even if you later delete your account — in that case the order records are kept but are no longer linked to identifying account details such as your name or email. Driver delivery/earnings records are retained for payroll and accounting purposes for as long as required by law.

5. Your Rights & Choices

Depending on your location, you may have the right to access, correct, or request deletion of your personal information, and to object to or restrict certain processing. You can exercise most of these directly in the app or website:

• Access & correction — view and edit your name, phone number, and profile photo from Profile in the app, or My Account on the website.
• Account deletion — request deletion of your account at any time from Profile → Delete Account in the app (or by emailing us). We will erase or anonymise your personal details, subject to the limited order-record retention described in Section 4.
• Other requests — for any other request relating to your personal information, contact us at hello@cocomia.co.zw. We will respond within a reasonable time.

6. Data Security

We use industry-standard measures to protect personal information, including encrypted transport (HTTPS) between the app/website and our servers, hashed password storage, and access controls that restrict who at CocoMia can view customer and driver data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Children's Privacy

The Platform is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us so we can delete it.

8. International Data Transfers

Our servers and service providers may be located outside your country, and third-party services we use (such as Google) may process data in other countries, including the United States. Where this occurs, we take reasonable steps to ensure information is handled consistently with this Policy and applicable law.

9. Cookies

The website uses only essential cookies needed for it to function — for example, to keep you signed in and to protect against cross-site request forgery. We do not use advertising or third-party tracking cookies. The mobile app does not use cookies; it stores your sign-in token securely on your device.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Platform or legal requirements. We will update the "Last updated" date above when we do, and where changes are material we will take reasonable steps to notify you (such as an in-app notice).

11. Contact Us

If you have questions about this Privacy Policy or how we handle your personal information, contact us at hello@cocomia.co.zw, +263 789 333 618, or Shop 18 Sam Levy's Village, Borrowdale, Harare, Zimbabwe.