Privacy policy

1. Who we are

This website is run by Ayanda Water & Investments, trading as Ayanda Construction (“we”, “us”). We are the data controller for the personal information described here, which means we decide how it is used and are responsible for protecting it.

We handle personal information in line with Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]. Many of our clients live abroad, so we also follow the main principles of the UK GDPR and South Africa's POPIA where they apply to you.

2. What we collect

When you ask for a quote

• Your name, WhatsApp/phone number and/or email address, and the country you live in.
• Where the project is, when you'd like to start, and anything you tell us about it.
• Any material list, job brief or solar sizing you add from our calculators.

When you use a calculator's “Send on WhatsApp” button

• The name, number and (optionally) project location you enter, and the message you were about to send, so your request isn't lost if the WhatsApp message doesn't arrive.

When you use the “Ask us” assistant

• The questions you type, and whether you found an answer helpful, so our team can add better answers. Questions are stored without your name or contact details — please don't type personal information into it. If you choose “Ask our team”, the name and contact details you give are handled like any other enquiry. To write its replies, the assistant sends your question and the last few messages of the chat (never your name or contact details) to our AI provider.

When you message us on WhatsApp or by email

• Your messages and contact details, held in WhatsApp (Meta) and our email account (Google).

Automatically

• Your IP address is used briefly to stop spam and abuse (for example, limiting how many forms can be sent in a few minutes). It is kept in short-lived server memory and technical logs, not in our customer records.
• We do not use analytics, advertising or tracking cookies, and we don't build profiles of visitors.

What we don't collect

• We don't ask for payment card details, ID numbers or other sensitive information through this website.

3. How we use it, and why we're allowed to

4. No marketing without your permission

We won't send you newsletters or promotions unless you clearly ask for them, and you can stop them at any time. We never sell or rent your information.

5. Who we share it with

Only our own team (in our office CRM, which requires a staff login) and service providers who process data for us under contract:

• Vercel — hosts this website (servers in the USA and Europe).
• Supabase — stores enquiries in our database (servers in London, United Kingdom).
• Google — our email account and, where used, a copy of each enquiry in our Google Drive.
• WhatsApp (Meta) — only when you choose to message us there.
• Groq — writes the website assistant's replies from the question and recent chat messages (servers in the USA).
• Apple and Google push services — deliver new-enquiry alerts to our staff's phones (your name, the service and town only).

We may also share information with professionals working on your project (for example an architect, engineer or council) when it's needed for the job, or when the law requires it.

6. International transfers

Some of our providers store data outside Zimbabwe (in the United Kingdom, the European Union and the USA). We only use established providers that protect data with contractual safeguards, encryption and access controls, so your information has a comparable level of protection wherever it is held.

7. How long we keep it

• Enquiries that don't go ahead: deleted within 24 months of our last contact with you.
• Clients: for the length of the project and then as long as tax and company law requires us to keep business records (generally six years).
• Questions asked in the website assistant: 12 months.
• Technical logs: a few weeks.
• Information saved in your own browser (see our cookies & storage page): until you clear it.

8. How we protect it

• The site is served only over encrypted HTTPS, with strict security headers.
• Enquiries are stored in a database that is not reachable from the public internet without our credentials.
• Staff sign in individually; passwords are stored only as strong one-way hashes; repeated failed sign-ins are blocked; every change to an enquiry is logged.
• Only staff who need your information to do their job can see it.

9. Your rights

You can ask us, free of charge, to:

• tell you what personal information we hold about you and give you a copy;
• correct anything that is wrong or incomplete;
• delete your information (unless we must keep it, for example tax records);
• stop or limit how we use it, or object to follow-up messages;
• move it to another provider in a common format.

Email info@ayandawaterinvestments.com with “Privacy request” in the subject. We'll confirm who you are and reply within 30 days.

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Data Protection Authority in Zimbabwe (POTRAZ), or, if you live there, the UK Information Commissioner's Office or South Africa's Information Regulator.

10. Children

This website is for adults arranging building work. We don't knowingly collect information from anyone under 18.

11. Changes to this policy

If we change how we use personal information, we'll update this page and the date at the top. Significant changes will also be highlighted on the website.