Privacy Policy
Last updated: 28 October 2026
Surrey Group, 55km Peg, Harare–Mutare Road, Marondera, Zimbabwe (“Surrey”, “we”, “us”) respects your privacy. This policy explains what personal information we collect through our websites, www.surreygroup.org and our online shop shop.surreygroup.org, how we use it, and the rights you have under Zimbabwe’s Cyber and Data Protection Act [Chapter 12:07].
1. Information we collect
Information you give us
- Orders and accounts: your name, phone number, email address, billing details, chosen collection outlet and order history. If you create an account, we also store your login details. Passwords are stored in encrypted form.
- Enquiries: anything you send us by email, WhatsApp, contact form or social media.
Information collected automatically
- Technical data such as your IP address, browser and device type, the pages you visit and the time of your visit.
- Cookies and similar technologies (see section 6).
Payment information: payments are processed by Paynow. Your card, bank or mobile money details are entered on Paynow’s secure platform. We never see or store your full payment details. We only receive confirmation that a payment was made.
2. How we use your information
- To process, prepare and hand over your orders, and to send order confirmations and updates.
- To manage your account and answer your questions or complaints.
- To handle payments, prevent fraud and keep our websites secure.
- To improve our websites, products and services.
- To send you news and offers, but only if you have agreed to receive them. You can unsubscribe at any time.
- To meet our legal, tax and accounting obligations.
We use your information on these legal grounds: to perform our contract with you, with your consent, to comply with the law, or where it is in our legitimate business interests and does not override your rights.
3. Who we share it with
We do not sell your personal information. We only share it where needed with:
- Our payment provider (Paynow).
- Service providers who help us run our websites and send email, such as web hosting, website platform (Squarespace and WordPress/WooCommerce), email delivery and IT support. They may only use your data to provide their service to us.
- Surrey outlet staff who prepare and hand over your order.
- Authorities, regulators or courts where the law requires it.
Some of these providers store data on servers outside Zimbabwe. Where this happens, we take reasonable steps to make sure your information is protected to a standard consistent with Zimbabwean law.
4. How long we keep it
We keep order and account information for as long as your account is active and for as long as needed for legal, tax and accounting purposes (usually up to 7 years). We keep enquiries for as long as needed to deal with them. After that, we delete or anonymise the information.
5. Security
We use reasonable technical and organisational measures to protect your information, including encrypted (HTTPS) connections, access controls and secure third-party payment processing. No system is completely secure, so please keep your account password private.
6. Cookies
Our websites use cookies, which are small files stored on your device. They are used to:
- keep the shop working, for example your cart and login (essential cookies);
- remember your preferences; and
- understand how visitors use our sites (analytics cookies).
On the shop you can accept or decline non-essential cookies using the cookie banner, and you can change your choice at any time with the cookie icon. You can also block or delete cookies in your browser settings, but some parts of the sites may then not work properly.
7. Your rights
Under the Cyber and Data Protection Act you have the right to:
- know whether we hold personal information about you and get a copy of it;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information, or object to us using it, where the law allows;
- withdraw your consent at any time, for example to marketing messages; and
- complain to the Data Protection Authority (POTRAZ) if you think we have not handled your information properly.
To use any of these rights, contact us using the details below. We may need to confirm your identity before we act on your request.
8. Children
Our websites are not aimed at children under 18 and we do not knowingly collect their personal information. Orders must be placed by an adult.
9. Links to other sites
Our websites link to other sites, such as Facebook, Instagram, TikTok, WhatsApp, YouTube and Paynow. Those sites have their own privacy policies, and we are not responsible for how they handle your information.
10. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.
11. Contact us
Surrey Group, 55km Peg, Harare–Mutare Road, Marondera, Zimbabwe
Email: greencroft@surreygroup.org
WhatsApp: +263 77 214 3317
