Mikana (Private) Limited (“Mikana”, “we”, “us”) respects your privacy. This policy explains what personal information we collect through mikana.co.zw, why, how long we keep it, and your rights under the Cyber and Data Protection Act [Chapter 12:07] and, where applicable, the EU/UK GDPR.

1. Who is responsible for your data

Mikana (Private) Limited, Harare CBD, Harare, Zimbabwe, is the data controller. Contact our data protection lead at privacy@mikana.co.zw or on WhatsApp +263 77 457 6928.

2. What we collect

Information you choose to give us in our guided flow or on WhatsApp: your answers (what you need, business type, goals, timeline, budget), your WhatsApp number or email, and optionally your name and a message.
Privacy-safe usage data: pages viewed, buttons clicked, scroll depth, device type, approximate country, the campaign or website that referred you, and page-speed measurements. We never store your raw IP address — it is converted into a one-way hash that changes every day.
With your consent only: analytics cookies (Google Analytics, Microsoft Clarity) and marketing cookies (Meta Pixel).
Admin accounts: staff email addresses and sign-in records.

3. Why we use it (lawful bases)

Purpose	Lawful basis
Replying to your request, preparing a preview, consultation or quote	Steps at your request before entering a contract
Delivering services you buy	Performance of a contract
Privacy-safe, first-party measurement and security (rate limiting, spam protection)	Legitimate interests in running a secure, working website
Analytics and advertising cookies, Meta Conversions API	Your consent — withdraw any time
Occasional offers by WhatsApp or email	Your consent — opt-in only
Accounting and legal records	Legal obligation

4. Who we share it with

We never sell your data. We use trusted processors under contract: Supabase (database), Vercel (hosting), Resend (email), Cloudflare (spam protection), and — only with your consent — Google (Analytics), Meta (Pixel and Conversions API) and Microsoft (Clarity). Contact details sent to Meta are hashed (SHA-256) first.

5. International transfers

Our providers store data outside Zimbabwe (European Union (Supabase, Vercel edge network)). We only use providers that offer appropriate safeguards such as standard contractual clauses and strong security certifications, as required by the Cyber and Data Protection Act [Chapter 12:07].

6. How long we keep it

Data	Retention
Enquiries that don't become clients	24 months, then deleted
Client records	Duration of the contract + 6 years (legal/tax)
Detailed usage events	13 months; anonymous daily totals kept longer
Consent records	3 years
Rate-limit counters	24 hours

7. Your rights

You can ask to access, correct or delete your data, object to processing, withdraw consent, or receive a copy of your data. Use our data request page or email us; we respond within 14 days. You may also complain to the data protection authority: Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).

8. Security

We use encryption in transit (HTTPS/HSTS), row-level database security, strict access controls with multi-factor authentication for staff, audit logs, spam and abuse protection, and regular dependency security audits.

9. Children

Our services are for businesses. We do not knowingly collect data from children under 16.

10. Changes

We will post any changes here and update the version date. If changes affect cookie consent, we will ask you again.