Privacy Policy

1. Who we are

w2a is a platform operated by Pardus Solutions (Pvt) Ltd, a company registered in Zimbabwe ("w2a", "we", "us"). w2a lets organisations and individuals run services over WhatsApp, a web portal and branded mobile apps — taking orders, accepting payments, registering people, issuing documents and capturing signatures.

Contact: info@w2a.co.zw · Data protection: dpo@w2a.co.zw · WhatsApp: +263 71 662 5470

2. Controller and processor — who is responsible for what

This distinction matters, because it determines who you should approach about your data.

Situation	Who is the controller	What w2a is
You message a business, school, clinic or government department that uses w2a	That organisation. They decide what to ask you and why.	A processor, acting on their instructions
You create a w2a account, or visit this website	w2a (Pardus Solutions)	The controller

So if you gave your details to a shop using w2a and want them corrected or deleted, that shop decides — though you may contact us and we will route your request and, where we can, act on it. If your question is about your w2a account, we are responsible and you should contact us directly.

3. What information we collect

From people who use a w2a-powered service

• Your WhatsApp phone number and display name, because that is how the conversation works.
• What you send in the conversation — answers to a form, items you order, files or photographs you attach.
• Transaction records — orders, payments, receipts, invoices and documents issued to you.
• Signature evidence, where you sign a document (see section 10).

From organisations and individuals with a w2a account

• Account details: name, organisation, email address, phone number and role.
• Configuration you create: apps, forms, products, prices and settings.
• Integration credentials (for example router or payment-provider keys), encrypted at rest.
• Usage and audit records: sign-ins, changes made, who published or deleted what and when.

From this website

• Standard server logs (IP address, browser type, pages requested) for security and troubleshooting.
• We do not use advertising trackers or third-party marketing cookies on this site.

We do not collect payment card numbers. Payments are processed by licensed providers such as Paynow/EcoCash; we receive only the result — paid, failed, and a reference.

4. Why we process it, and our lawful basis

Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] requires a lawful basis for processing personal information. Ours are:

Purpose	Lawful basis
Delivering the service you asked for — answering your message, taking your order, issuing your receipt	Performance of a contract / your request
Messaging you on WhatsApp	Your consent, given when you first make contact or opt in
Keeping transaction, tax and signature records	Legal obligation, and legitimate interest in accurate records
Securing the platform, preventing fraud and abuse	Legitimate interest
Improving the product	Legitimate interest, using aggregated or de-identified information

We do not sell personal information. We do not share it with advertisers, data brokers or anyone else for their own marketing purposes.

5. WhatsApp, Meta and your consent

w2a delivers messages through the WhatsApp Business Platform, operated by Meta. This means:

• Opt-in comes first. A business may only message you after you have contacted it or otherwise agreed to be contacted. w2a records that consent.
• You can stop it at any time. Reply STOP to end messages from that service, or block the number in WhatsApp. We honour this.
• Meta processes message delivery. Your use of WhatsApp is also governed by WhatsApp's own Privacy Policy, which we do not control.
• Message content stays with the organisation. We do not use your conversations for advertising, and we do not sell them.
• Businesses using w2a must follow Meta's WhatsApp Business Messaging Policy. Misuse — spam, prohibited goods, harassment — can result in suspension by us or by Meta.

6. Who we share information with

Only where it is necessary to run the service:

• The organisation you contacted. If you message a shop, the shop sees your order.
• Meta / WhatsApp, to deliver messages.
• Payment providers such as Paynow, to process a payment you initiate.
• Infrastructure providers hosting our servers, under confidentiality obligations.
• Law enforcement or regulators where legally required — and we will tell you unless the law forbids it.

Each organisation's data is isolated from every other organisation's. One w2a customer cannot see another's records.

7. How we protect information

• Encryption in transit (HTTPS/TLS) across the website, portals and APIs.
• Encryption at rest for credentials and integration secrets.
• Role-based access — owner, administrator and staff roles limit who can see and do what.
• Audit logging of consequential actions, with actor and timestamp.
• Tenant isolation enforced at the data layer.
• Least-privilege database accounts for the application, separate from administrative access.
• Single-use, expiring links for sensitive actions such as signing a document.

No system is perfectly secure, and we will not pretend otherwise. We aim to reduce risk, detect problems quickly, and tell you honestly if something affects you.

8. How long we keep it

• Conversation and transaction records: while the organisation's account is active, and thereafter as required for tax, accounting or legal purposes.
• Signature evidence: for the life of the underlying agreement — deleting it would destroy the proof it exists to provide.
• Account records: while your account is open, and for a reasonable period afterwards.
• Server logs: a short rolling window for security and diagnostics.

Organisations using w2a can export and delete their own records at any time.

9. Your rights

Under the Cyber and Data Protection Act you have the right to:

• Be told what personal information is held about you and why.
• Access a copy of it.
• Correct information that is wrong or incomplete.
• Object to processing, and withdraw consent — including by replying STOP.
• Request deletion, where no overriding legal reason requires us to keep it.
• Complain to the Data Protection Authority (section 15).

To exercise any of these, email dpo@w2a.co.zw. We will respond within 30 days. If the information belongs to an organisation using w2a, we will pass your request to them and support them in answering it.

10. Electronic signatures

When you sign a document through w2a we deliberately record more than the drawing, because a signature without context proves very little:

• The signature image you drew.
• The date and time of signing.
• Your IP address and a description of the device/browser used.
• The phone number the signing link was issued to.
• The exact document text and consent wording displayed to you at that moment.
• Cryptographic hashes of the document and signature, so later alteration is detectable.

This evidence is stored with the signed record, available to the organisation that requested it and to you on request. Signing links are single-use and time-limited, and a signature cannot be overwritten once captured.

11. Children

w2a is intended for adults and organisations. Where a service processes information about minors — a school registering learners, for example — that organisation is the controller and is responsible for obtaining consent from a parent or guardian. We do not knowingly collect information directly from children for our own purposes.

12. Storage and international transfers

w2a's application data is hosted on servers managed for us in a secured facility. Some sub-processors necessary to deliver the service — notably Meta, for WhatsApp message delivery — operate internationally, so certain message metadata is processed outside Zimbabwe. Where we transfer personal information across borders we do so on a basis permitted by the Act, and only to the extent needed to deliver the service.

13. If something goes wrong

If a security breach affects your personal information we will notify the affected organisations and, where required, the Data Protection Authority, without undue delay. We will tell you what happened, what information was involved, what we have done and what you should do. We would rather deliver awkward news promptly than manage it quietly.

14. Changes to this policy

We will update this page when our practices change, and revise the "last updated" date. If a change materially affects your rights we will give notice through the service, rather than relying on you to re-read this page.

15. Contact and complaints

Data protection queries: dpo@w2a.co.zw
General: info@w2a.co.zw · +263 71 662 5470
Operator: Pardus Solutions (Pvt) Ltd, Harare, Zimbabwe

If you are not satisfied with our response you may complain to the Data Protection Authority. In Zimbabwe that function is performed by the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) under the Cyber and Data Protection Act [Chapter 12:07]. Current contact details are published on the POTRAZ website.