Privacy Policy

Good Taste Milling, of Lusaka, Zambia, is the data controller for the personal data described here. We mill and deliver maize meal and stock feed, and we run Good Taste Pocket, the wallet and loyalty app that goes with it.

We handle personal data in line with the Data Protection Act No. 3 of 2021 of Zambia. To reach a person about anything on this page, write to [email protected].

We collect what we need to take an order, deliver it, and pay you back the credit you have earned. Nothing here is gathered for advertising.

Account

Your name, email address, password, phone number, date of birth and, if you add one, a profile photo. Passwords are stored only as a one-way hash — we never hold the password itself.

Delivery details

The street address, city and country you give us so an order can reach you.

Orders

What you ordered, the sizes and quantities, the price at the time, the payment method you chose (cash, mobile money, bank transfer or wallet credit), the delivery status, and the record of who confirmed the handover.

Good Taste Pocket wallet

Your wallet balance, your cumulative spend, your loyalty tier and the history of tier changes, every wallet credit and debit, your referral code and the code of anyone who referred you.

Device

A push notification token issued by your device, so we can send you order updates. It identifies the device, not you personally.

Technical

A session cookie that keeps you signed in, and server logs recording the IP address, browser or device identifier, page address and time of each request.

We do not collect or store card numbers or mobile money PINs. Payment is taken on delivery or arranged separately, and the app records only which method you chose.

Each purpose below has a lawful basis under the Data Protection Act. Where that basis is your consent, you can withdraw it at any time, without affecting anything we did before you withdrew it.

Create your account and keep it secure

Performance of our contract with you

Confirm your phone number with a one-time code

Performance of our contract, and our security obligations

Take, mill, pack and deliver your order

Performance of our contract with you

Confirm delivery by QR code or SMS code, and credit your wallet

Performance of our contract with you

Run the Good Taste Pocket wallet, loyalty tiers and referral rewards

Performance of our contract with you

Send you birthday and promotional messages

Your consent, which you may withdraw at any time

Detect fraud, investigate abuse and keep the service available

Our legitimate interest in protecting the service

Produce sales and delivery reports in aggregate

Our legitimate interest in running the business

We do not use your data to make automated decisions that have a legal effect on you. Your loyalty tier is worked out automatically from how much you have spent, but it changes only the rate at which you earn credit.

Your phone number is how we confirm it is really you, and how a driver reaches you on the day. We use it in three ways.

Verification codes. When you register, or reset your password, we text you a six-digit code that expires after five minutes. There is a limit on how often a code can be sent.

Delivery confirmation. If you have no smartphone to scan a QR code, we text you a code to read back to the agent. We store only a one-way hash of that code — the code itself exists in your SMS inbox and nowhere in our systems.

Order updates. Messages about an order you have placed.

SMS messages are delivered for us by Africa's Talking, who receive your number and the message in order to send it.

If you allow notifications, your device gives us a push token so we can tell you when an order moves, when credit lands in your wallet and, if you have given us your birthday, to send you a birthday message.

You can switch notifications off in your device settings at any time. Ask us and we will delete the stored token as well.

We do not sell personal data, and we do not share it with advertising networks. It reaches other parties in only two situations.

Our delivery agents. The agent assigned to you sees your name, phone number, delivery address and the orders they are handling for you. They need it to find you and hand over the right sacks.

Service providers. Companies that run part of the service for us, under contract, and only for that purpose.

Africa's Talking

Delivers our SMS messages. Receives your phone number and the text of the message sent to it.

UploadThing

Stores images uploaded to the service. Receives profile and product images and their file metadata.

Our hosting and database provider

Runs the servers and database behind the site and the app. Holds all of the data described above, on our behalf.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

The site sets one cookie: a session token that keeps you signed in. It is strictly necessary — without it you would be signed out on every page. It lasts seven days, refreshes while you are active, and is marked Secure and HttpOnly, so it travels only over an encrypted connection and cannot be read by scripts.

We set no advertising cookies and no third-party tracking cookies. Our servers keep ordinary access logs, which include your IP address and browser or device identifier, so we can investigate faults and abuse.

We keep personal data only as long as it is useful for the purpose it was collected for, or as long as the law requires.

Account and contact details

For as long as your account is open

Orders, wallet transactions and tier history

Kept after an account closes, as accounting and dispute records

Wallet credit

Expires twelve months after it is earned, unless we change the term

Delivery QR codes and SMS codes

Short-lived — they expire within minutes or hours of being issued

Server access logs

Rotated and overwritten on a rolling basis

Orders and wallet movements are financial records. We keep them after an account closes because we may need them for accounts, for tax, and for any dispute about what was delivered or what was owed.

Passwords are stored as one-way hashes. Traffic between your device and our servers is encrypted in transit. Session cookies are Secure and HttpOnly. Delivery codes are stored hashed. Staff accounts are separated by role, so an agent cannot reach data an agent does not need, and requests are rate limited to blunt automated attacks.

No service can promise perfect security. If a breach ever affects your data in a way that puts you at risk, we will tell you and the Office of the Data Protection Commissioner, as the law requires.

Under the Data Protection Act No. 3 of 2021 you have the right to be told what we hold about you and why, to get a copy of it, to have it corrected if it is wrong, to ask us to erase it, to object to how we use it, to withdraw consent you have given, and not to be subject to a decision made purely automatically that has a legal effect on you.

To use any of these rights, write to [email protected] from the email address on your account, or tell us enough for us to be sure it is you. We answer within thirty days. There is no charge.

If our answer does not satisfy you, you may complain to the Office of the Data Protection Commissioner in Zambia.

You can ask us to delete your account at any time by writing to [email protected]. Say which account you mean, and we will confirm before we act.

We will remove your sign-in details, your contact and delivery details, your date of birth, your profile photo and your push token, and we will revoke your sessions so the account can no longer be used.

We keep the underlying order and wallet records, with your identifying details removed where we can. These are accounting records, and we are not able to erase them on request. Any wallet credit left on a closed account is forfeited.

Good Taste Pocket is not intended for children. We do not knowingly collect personal data from anyone under eighteen. If you believe a child has given us their data, write to us and we will delete it.

Some of the companies that run parts of the service for us process data on servers outside Zambia. Where that happens, we use providers that commit contractually to protecting the data to a standard consistent with the Data Protection Act.

If we change how we handle personal data, we will update this page and change the date at the top. Where a change materially affects you, we will tell you in the app or by email before it takes effect. The version published here is always the one that applies.

Questions, requests and complaints about privacy all go to the same place.