Effective Date: October 2026

Website: www.sh.co.zw

Data Controller: Stachings Holdings (Pvt) Ltd

Statutory Framework: Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe

1. Introduction & Data Controller Details

Stachings Holdings (Pvt) Ltd ("Stachings Holdings," "Company," "we," "us," or "our") operates www.sh.co.zw and its associated business divisions (including StaChemicals Co., Stachings Safety Shop, The Tool Store, Stachings Service Hub, and StaFoods Zimbabwe).

This Privacy Policy informs clients, website visitors, suppliers, and business contacts ("Data Subjects" or "you") how we collect, process, store, and protect your personal data in strict compliance with the Cyber and Data Protection Act [Chapter 12:07] and guidelines issued by the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as the National Data Protection Authority.

2. Legal Lawful Bases for Processing
Under Section 24 of the Cyber and Data Protection Act [Chapter 12:07], we process personal data only where a lawful ground exists, including:

• Consent: Where you have granted explicit, freely given consent (e.g., subscribing to updates or submitting contact forms).
  
  
• Contractual Necessity: Where processing is required to issue quotations, execute supply contracts, dispatch industrial goods, or render equipment repair services.
  
  
• Legal Obligation: Where processing is required under Zimbabwean law, such as tax reporting to the Zimbabwe Revenue Authority (ZIMRA) or occupational safety record-keeping.
  
  
• Legitimate Interests: Where processing is required for fraud prevention, network security, and corporate administration, provided your fundamental rights do not override these interests.
  
  

3. Categories of Data Collected
We collect and process the following categories of data:

• Identity & Corporate Contact Data: Full name, corporate title, company name, physical and postal address, corporate email address, and phone numbers.
  
  
• Billing & Commercial Data: Tax Identification Numbers (TIN/BP Numbers), banking details, proforma invoices, delivery notes, and transaction histories in legal tender (USD / ZiG).
  
  
• Technical & Usage Data: Internet Protocol (IP) addresses, browser type, operating system, referrer URL, pages visited, and session durations collected via website cookies and logs.
  
  
• Divisional Operational Data: Safety equipment sizing details, technical equipment service logs, and Safety Data Sheet (SDS) download requests.
  
  

4. Purposes of Processing
Your personal data is processed strictly for specified, explicit, and legitimate business purposes:

• Fulfilling B2B and B2C orders, processing payments, and arranging freight or site delivery across Zimbabwe.
  
  
• Maintaining occupational health, chemical safety, and equipment service tracking.
  
  
• Managing customer accounts, providing technical support, and responding to quotation requests.
  
  
• Maintaining website cybersecurity, identifying unauthorized access, and complying with statutory audit requirements.
  

5. Data Subject Rights
Under the Cyber and Data Protection Act [Chapter 12:07], you possess the following statutory rights regarding your personal data:

• Right to Information & Access: You have the right to request confirmation of whether we hold your personal data and to receive a clear summary or copy of such data.
  
  
• Right to Rectification: You may request the immediate correction or updating of inaccurate, incomplete, or outdated personal data.
  
  
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where it is no longer required for the purpose for which it was collected, subject to statutory record-retention laws (e.g., ZIMRA financial audit requirements).
  
  
• Right to Object & Withdraw Consent: You may object to the processing of your data for direct marketing or withdraw your consent at any time without affecting the lawfulness of processing conducted prior to withdrawal.
  
  
• Right to Lodge a Complaint: If you believe your data protection rights have been infringed, you have the right to lodge a complaint with our Data Protection Officer or directly with POTRAZ (The Data Protection Authority).
  
  

6. Data Protection & Security Safeguards
We implement technical, physical, and organizational measures to safeguard personal data against destruction, loss, alteration, unauthorized disclosure, or access:

• Encrypted web transmission protocols (SSL/TLS) for www.sh.co.zw.
  
  
• Role-based access controls ensuring only authorized personnel access commercial databases.
  
  
• Regular security assessments and endpoint threat monitoring to satisfy statutory cyber hygiene obligations.
  
  

7. Cross-Border Transfers of Personal Data
In accordance with Chapter 12:07 provisions governing international data flows:

• Personal data collected by Stachings Holdings is primarily stored and processed on secure servers located within Zimbabwe.
  
  
• Where third-party cloud service providers or regional logistics platforms operate outside Zimbabwe, transfers will occur only if the destination jurisdiction provides an adequate level of data protection or where appropriate contractual safeguards (approved by POTRAZ) are enforced.
  
  

8. Data Retention Schedule
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Commercial & Financial Transaction Records: Retained for a minimum of 6 years to satisfy Zimbabwean tax (ZIMRA) and statutory accounting obligations.
  
  
• General Web Enquiries & Quotations: Retained for up to 24 months from the date of last interaction.
  
  
• Technical & Analytics Logs: Retained for up to 12 months for security auditing.
  
  

9. Data Breach Notification Protocol
In the event of a security incident that compromises the confidentiality, integrity, or availability of your personal data, Stachings Holdings will:

1. Notify POTRAZ within statutory timelines following discovery of the breach.
   
   
2. Communicate the nature of the breach, potential risks, and corrective actions directly to affected Data Subjects where high risk to individual rights is identified.
   
   

10. Contact Information & Data Protection Officer
For enquiries regarding this Privacy Policy, exercising your data rights, or lodging data protection concerns, contact our Data Protection Officer (DPO):

• Company Name: Stachings Holdings (Pvt) Ltd
  
  
• Data Protection Enquiries: privacy@sh.co.zw
  
  
• General Enquiries: sh@sh.co.zw
  
  
• Phone: +263 715 729 669 / +263 785 654 692