Privacy policy
Privacy Policy
Last updated: 3rd June 2026
OPSANDO BUSINESS SOLUTIONS LIMITED (“Opsando”, Opsando.com", “we”, “us” or “our”) operates an online shop and auction platform (the “Services”). This Privacy Policy explains how we collect, use, store, share and protect your personal information when you use the Services, including when you browse, buy, bid in an auction, or sell through us, and your rights in relation to that information.
We handle personal information in accordance with the Data Protection Act No. 3 of 2021 of Zambia (the “DPA”) and other applicable Zambian law. By using the Services you acknowledge that you have read this Privacy Policy.
1. Who we are (data controller)
The data controller responsible for your personal information is:
OPSANDO BUSINESS SOLUTIONS LIMITED
Registered office: Stand No. LN-15584/1, Sunshare Tower, Lusaka, Lusaka Province, Zambia
Company Registration No.: 120261039572
Contact for privacy matters: privacy@opsando.com, +260-96-1188125.
2. Personal information we collect
Depending on how you use the Services, we may collect or process the following, including inferences drawn from it:
- Contact details: your name, billing address, shipping or collection address, phone number and email address.
- Financial and payment information: payment method, transaction details, payment confirmation, and (where applicable) mobile-money or bank account details used for payment or, for sellers, for payout.
- Account information: username, password, preferences and settings, and your Opsando Store Credit balance and history.
- Transaction information: items you view, add to cart or wishlist, buy, return, exchange or cancel, and your past transactions.
- Auction information: the auctions you enter, your bids and bidding history, any minimum bidding balance you hold or that we reserve, any Default Fee applied if you win and do not pay, and whether you won, paid for and collected a Lot.
- Seller information (if you consign goods to us): your identity and contact details, the goods you list, and the payout details we use to settle proceeds to you.
- Communications: the information you include when you contact us, for example a support enquiry.
- Device and usage information: your device, browser, network and IP address, other identifiers, and how you interact with the Services, including through cookies and similar technologies.
3. Where we get your personal information
- Directly from you, when you create an account, use the Services, bid, buy, sell, or communicate with us.
- Automatically, from your device and through cookies and similar technologies when you use the Services.
- From our service providers, when they collect or process personal information on our behalf.
- From our partners or other third parties, where permitted by law.
4. Our lawful basis for processing
We process your personal information only where the DPA allows, including: with your consent; because it is necessary to perform our contract with you (for example, to fulfil an order or run an auction you enter); to comply with a legal obligation; or for our legitimate interests (such as securing the Services and preventing fraud), where these are not overridden by your rights. Where we rely on consent, you may withdraw it at any time.
5. How we use your personal information
- Providing the Services. To create and manage your account, process payments, run auctions you take part in, manage Store Credit and bidding balances, fulfil and deliver orders and won Lots, arrange collection, handle returns, refunds and exchanges, and provide a tailored shopping experience.
- Settling with sellers. If you consign goods, to list them, conduct the sale, and pay you your proceeds.
- Security and fraud prevention. To authenticate accounts, secure payments, and detect and act on fraudulent, unsafe or manipulative activity, including bid manipulation.
- Communicating with you. To provide support, respond to you, and send service messages about your account, orders, bids and transactions.
- Marketing. To send you marketing where permitted (see section 9), which you can opt out of at any time.
- Legal and compliance. To comply with applicable law, respond to lawful requests, and enforce our terms and policies.
6. How we share your personal information
- With Shopify and other service providers who act for us, such as hosting, payment processing, analytics, customer support, cloud storage, fulfilment and delivery carriers.
- With delivery carriers, to the extent needed to deliver your order or a won Lot.
- With third-party sellers — limited. Because we act as your single point of contact for auction purchases, we do not give a third-party seller your contact details. We share only what is necessary to fulfil and deliver the sale.
- With marketing partners, where you have not opted out and as permitted by law; they use your information under their own privacy notices.
- Where you direct or consent to it, or in connection with a business transaction (such as a merger), or to comply with the law, enforce our terms, or protect our rights and the rights of others.
7. Relationship with Shopify
The Services are hosted by Shopify, which collects and processes personal information about your use of the Services in order to provide and improve them. Information you submit may be transmitted to and processed by Shopify and other providers that may be located outside Zambia (see section 8). In those circumstances Shopify acts as a processor for us and, for some enhanced features, in its own right. To learn how Shopify uses personal information and the rights you may have, see https://privacy.shopify.com.
8. Storage, international transfers and data localisation
Where your data is stored. Under Part X of the DPA, personal data and sensitive personal data relating to people in Zambia are, as a rule, required to be processed and stored on servers located in Zambia. We take this requirement into account in how we set up and use our systems.
Transfers outside Zambia. Some of our providers, including Shopify, store or process data outside Zambia. Where your personal information is transferred outside Zambia, we rely on the grounds permitted by the DPA, which may include your express consent together with transfer mechanisms approved by the Data Protection Commissioner (such as approved standard contracts or intragroup schemes), a category prescribed by the Minister as permissible, or approval by the Commissioner. By using the Services and providing your information, you consent to such transfers where consent is the applicable ground.
Sensitive personal data. Sensitive personal data is subject to stricter localisation rules and we will handle it accordingly.
9. Marketing and electronic communications
We send marketing communications only in line with the Electronic Communications and Transactions Act, 2021 and the DPA. Each marketing message identifies us and includes a way to opt out. You can opt out at any time using the unsubscribe option in our messages or by contacting us, and we will stop sending marketing after you do. We may still send non-marketing service messages about your account, orders and transactions.
10. Cookies and similar technologies
We and our providers use cookies and similar technologies to operate the Services, remember your preferences, measure usage, and support advertising. You can manage cookies through your browser settings and, where offered, through our cookie controls. Blocking some cookies may affect how the Services work.
11. Security and data breaches
We use reasonable technical and organisational measures to protect personal information, but no system is perfectly secure and information sent to us may not be secure in transit. If a security breach affecting your personal data occurs, we will notify the Data Protection Commissioner within the time required by the DPA (currently 24 hours) and will notify affected individuals where required.
12. How long we keep your information
We keep personal information only as long as needed for the purposes described in this policy, including to provide the Services, maintain your account, comply with legal obligations, resolve disputes, and enforce our agreements, and for the retention periods required under the DPA. When it is no longer needed, we securely delete or anonymise it.
13. Your rights
Subject to the DPA and any conditions or exceptions in it, you have the right to:
- Be informed about how we process your personal information;
- Access the personal information we hold about you;
- Have inaccurate or incomplete information corrected;
- Request deletion of your personal information;
- Object to, or request that we restrict, certain processing;
- Receive a copy of certain information and, where applicable, have it transferred; and
- Withdraw consent where we rely on it.
To exercise any of these rights, contact us using the details in section 16. We may need to verify your identity, and you may use an authorised agent who provides proof of authority. We will respond within the time required by law and will not discriminate against you for exercising your rights.
14. Children
The Services are intended for adults. You must be at least 18 years old to hold an account, bid or buy. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, contact us and we will delete it.
15. Complaints
If you have a concern about how we handle your personal information, please contact us first using the details below so we can try to resolve it. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Zambia.
16. Contact us
For any question about this Privacy Policy or to exercise your rights, contact us at:
OPSANDO BUSINESS SOLUTIONS LIMITED
Stand No. LN-15584/1, Sunshare Tower, Lusaka, Lusaka Province, Zambia
Email: privacy@opsando.com
Telephone: +260-96-1188125
17. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or operational reasons. We will post the updated policy here, change the “Last updated” date, and give notice where the law requires.
