1. Data We Collect
- Account data: name, email, phone number, password hash (we never store passwords in plain text).
- Order data: delivery address, contact number, items purchased, payment transaction reference.
- Technical data: anonymised analytics (pages visited), IP address (stored short-term for fraud prevention & security logs), browser type.
- Customer support: messages, tickets and attachments sent via contact forms or tickets system.
2. How We Use Your Data
- To create and administer your account, send login / password-reset / verification emails.
- To process and fulfil orders: confirming payment, coordinating shipping, contacting you about delivery.
- To send transactional emails (invoices, dispatch notices, password changes).
- To detect fraud, block suspicious activity and secure the platform.
- To administer our loyalty program (points, tiers and rewards).
- To send promotional newsletters only if you opt in (one-click unsubscribe link always included).
3. Payment & Security
All payments are handled by licensed payment service providers (MTN Eswatini MoMo, Eswatini Mobile Money, DPO Group, Visa/Mastercard or similar). We never process or store your full card number or MoMo PIN. Passwords are hashed with PHP password_hash() and sessions are protected with SameSite cookies + CSRF tokens.
4. Who We Share Data With
- Couriers / delivery partners — only your name, phone number and shipping address.
- Payment processors — only order reference and amount (PCI-compliant partners).
- Cloud/hosting provider — Hostinger (physical server operator, covered by contract and DPA).
- Law enforcement — only when compelled by a lawful Eswatini court order.
We do not sell, rent or trade your personal data to any third party for marketing purposes.
5. Cookies
We use session cookies (strictly necessary) to maintain your login, cart and wishlist. Optional analytics cookies can be disabled via your browser.
6. Your Rights (GDPR-aligned)
- Access — request a copy of personal data we hold about you.
- Correction — edit your profile via the Account page or contact support.
- Erasure ("right to be forgotten") — contact us and we will delete your account and order history (where not required by tax/retention law).
- Data portability — export your data as JSON/CSV on request.
- Withdraw consent — unsubscribe from marketing or revoke permissions at any time.
7. Data Retention
Account data is retained while your account is open. Order/invoice records are retained for a minimum of 6 years as required by Eswatini tax law, regardless of account closure.
8. Children
This website is not intended for children under 16. If you believe a child under 16 has registered, contact us and we will remove the account.
9. Changes to This Policy
Changes will be posted on this page with the updated date. Material changes will be announced via email to registered users at least 14 days before taking effect.
10. Data Protection Contact
To exercise any of your rights, or to raise a concern, email our Data Privacy lead at no-reply@theagriproduce.com with the subject "Data Privacy Request".