Privacy Policy

Dishi is a food ordering and delivery service in Harare, Zimbabwe. When you use our website or apps, we decide why and how your personal information is used, which makes us the data controller under the Cyber and Data Protection Act [Chapter 12:07] and the Cyber and Data Protection Regulations (Statutory Instrument 155 of 2024).

You can reach our Data Protection Officer at hello@orderdishi.com.

We only collect what we need to take, deliver and support your order.

• Account details: your name and mobile number, and your email address if you choose to give it.
• Delivery details: your suburb, street address, landmarks and delivery instructions, and any addresses you save.
• Orders: what you ordered, from which kitchen, prices, promotions used, and the time and status of each order.
• Payments: the payment method you chose, the amount and a payment reference. We never see or store full card numbers, mobile money PINs or one-time codes. These go straight to our payment provider.
• Support messages: what you tell us on WhatsApp, by email or by phone, including any photos you send about an order.
• Technical information: your device type, browser, IP address and the pages you visit, kept in security logs so we can stop fraud and fix problems.

If you are a restaurant partner or rider, we also collect the business and identity details needed to approve you and pay you. These are covered in your partner agreement.

• To create and secure your account, including sending sign-in codes by SMS.
• To pass your order to the kitchen and your delivery details to your rider.
• To take payment, give refunds and keep accounting records.
• To answer your questions and handle complaints.
• To detect and stop fraud, abuse of promotions and attacks on our systems.
• To send you offers, but only if you said yes. You can stop these at any time.

We rely on four lawful grounds: the agreement between us when you place an order, your consent (for marketing and optional features), our legal duties (for example tax records), and our legitimate interest in keeping the service safe.

We do not make decisions about you that have legal or similarly significant effects using automated processing alone.

We never sell your personal information. We share it only with people who need it to serve you:

• The restaurant preparing your order sees your first name, what you ordered and any notes for the kitchen.
• Your rider sees your first name, mobile number, delivery address, landmark and instructions, only for the time needed to deliver.
• Our payment provider processes mobile money and card payments.
• Our technology providers host our website and database and send SMS and email for us. They may only use your information to provide their service to us.
• Authorities, when the law requires it, for example a valid court order.

Some of our technology providers store information on secure servers outside Zimbabwe, including in the United Kingdom and the European Union. These countries have data protection laws of their own. We choose providers that encrypt data, restrict access and sign data protection terms with us, and we declare where data is stored in our licence with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).

• Account details: while your account is open, then deleted when you close it.
• Order and payment records: for as long as tax and accounting law requires, then deleted.
• Rider location during a delivery: only while the order is active.
• Support messages: up to 24 months after your last contact, unless they are part of an open complaint.
• Security logs: up to 12 months.

• All connections to Dishi are encrypted.
• Our database only lets each person see their own records, enforced by the database itself, not just by the app.
• Staff access is limited to the people who need it, protected by two-step sign-in and recorded.
• Our website blocks scripts we did not write, which protects you from many common attacks.

If a breach puts your information at risk, we will report it to POTRAZ within 24 hours of finding it, and tell you within 72 hours if it is likely to cause you serious harm, as the regulations require.

Under the Cyber and Data Protection Act you have the right to:

• be told how your information is used, as this policy does;
• see the information we hold about you;
• have wrong or misleading information corrected;
• have your information deleted when we no longer need it or should not have it;
• restrict or object to how we use it, including for direct marketing;
• withdraw your consent at any time, free of charge;
• complain to us, and to POTRAZ as the Data Protection Authority.

Email hello@orderdishi.com from the address or number on your account. We will confirm it is you, then respond within 30 days. To close your account and delete your information, see Data deletion.

You must be 18 or older to create an account or pay for an order. We do not knowingly collect information from children. If you think a child has given us their details, contact us and we will delete them.

We only use storage that the site needs to work, such as remembering your cart. See our Cookie Policy and choose your preferences in Cookie settings.

When we make an important change, we will tell you on the website or by message before it takes effect. The date at the top shows when this policy last changed.