This Privacy Policy explains how BFC Consultancy ("BFC", "we", "us", or "our") collects, uses, stores, shares, and protects personal information when you use the BFC Surveys mobile application and related web services (together, the "Service"). It applies to field surveyors who use the BFC Surveys mobile app and to anyone who interacts with our website at https://www.bfc.co.zw/.
BFC Consultancy is the data controller responsible for your personal information. You can contact us at any time at [email protected] or by post at 144 Domboshava Road, Hellensville, Borrowdale, Harare, Zimbabwe.
1. Who this policy is for
BFC Surveys is a business-to-business retail audit platform. Surveyors use the app on behalf of their employer or contracting agency to evaluate retail outlets for our clients (such as beverage and consumer-goods brands). The app is intended for users aged 16 and over and is not directed to children.
2. Information we collect
2.1 Information you provide
- Account details: full name, email address, phone number, password (hashed), date of birth, and your assigned office or employer.
- Profile information: profile photo (optional) and address details if you choose to add them.
- Survey content: answers you record in scorecards, free-text observations, and photographs of products, shelves, coolers, and merchandising compliance.
- Support correspondence: the content of any messages you send us by email.
2.2 Information collected automatically
- Outlet GPS coordinates: when you submit a survey at a retail outlet, the app records the coordinates of that outlet so the client knows where the audit took place. We do not track your location continuously and we do not collect your location while the app is closed or in the background.
- Device and technical data: device model, operating system version, app version, language, time zone, IP address, crash logs, and unique installation identifiers used to deliver push notifications.
- Usage analytics: aggregate, non-identifying information about how you use the app (for example, which screens you visit and how often you sync) so we can improve the Service.
2.3 Information from third parties
We may receive information from your employer or the agency that contracts you (for example, your assignment to specific outlets or scorecards). We do not buy personal data from data brokers.
3. Device permissions
The app requests the following device permissions. You can change or revoke these in your device settings, but doing so may limit your ability to complete surveys.
| Permission | Why we need it |
|---|---|
| Camera | To take photos of shelves, coolers, products, and merchandising compliance as evidence within a survey. |
| Photos / media | To attach existing images from your device to a survey when a fresh photo is not required. |
| Storage | To save surveys offline so you can keep working without an internet connection and sync later. |
| Push notifications | To alert you to new assignments, sync status, and important account messages. |
| Network access | To upload completed surveys and download new scorecards. |
We do not request continuous, foreground, or background location, microphone, contacts, calendar, SMS, call logs, or any health and biometric data.
4. How we use your information
- To create and operate your surveyor account and authenticate you securely.
- To deliver completed surveys, photos, and outlet GPS coordinates to the client whose audit you are conducting.
- To synchronise data between your device and our servers, including retrying failed syncs.
- To provide customer support, send service notifications, and respond to your enquiries.
- To detect, prevent, and investigate fraud, abuse, security incidents, and breaches of these terms.
- To improve the Service through aggregate analytics and crash diagnostics.
- To comply with legal obligations under Zimbabwean law and the laws of any other jurisdiction in which we operate.
5. Legal bases for processing
Where Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] or any other applicable data-protection law requires us to identify a legal basis, we rely on:
- Performance of a contract — to deliver the Service you signed up for.
- Legitimate interests — to operate, secure, and improve the Service in ways you would reasonably expect.
- Legal obligation — where retention or disclosure is required by law.
- Consent — for any processing for which you have given separate consent (for example, optional analytics where required).
6. Sharing your information
We share personal information only as described below. We do not sell your personal information.
- Clients of BFC Consultancy: the brand or retailer for whom you are conducting an audit receives the survey answers, photos, and outlet GPS coordinates you submit on their assignment. Your name and surveyor identity may also be visible so the client can verify the audit.
- Your employer or contracting agency: where you have been assigned by an employer or office, that entity can see your activity, attendance, and audit performance.
- Service providers: trusted third parties who process data on our behalf, including hosting providers, push-notification services (Firebase Cloud Messaging by Google for Android, Apple Push Notification service for iOS), and map providers (Google Maps).
- Legal and safety: regulators, courts, or law enforcement when we are legally required to disclose information, or where we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others.
- Corporate transactions: in connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations.
7. International transfers
Our hosting and notification providers may store or process your information outside Zimbabwe. Where this happens we put appropriate safeguards in place, including contractual obligations on our processors to protect your information at a level consistent with this policy.
8. How long we keep your information
- Account data (name, email, phone, password) is kept while your account is active and for up to 30 days after deletion, after which it is permanently removed from production systems.
- Survey content (answers, photos, outlet GPS) belongs to the client whose audit you completed and may be retained by them and by us for as long as the client requires for their reporting, audit, and legal obligations. After your account is deleted, your identity is replaced with an anonymous label so the survey content can no longer be linked to you.
- Technical logs and backups are kept for up to 90 days for security and operational reasons before being overwritten.
9. How we protect your information
We use industry-standard safeguards including HTTPS/TLS encryption in transit, hashed passwords, role-based access control, time-limited API tokens, and audit logging. No system is perfectly secure; if we become aware of a breach affecting your personal information we will notify you and the relevant authorities as required by law.
10. Your rights
Subject to applicable law, you have the right to:
- access the personal information we hold about you;
- correct information that is inaccurate or incomplete;
- request deletion of your account and personal information (see Section 11);
- object to or restrict certain processing;
- withdraw any consent you have given, without affecting the lawfulness of prior processing;
- complain to Zimbabwe's Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), which acts as the Data Protection Authority under the Cyber and Data Protection Act, or any other regulator competent in your jurisdiction.
To exercise these rights, email [email protected]. We will respond within 30 days.
11. Account deletion
You can delete your BFC Surveys account at any time:
- In the app: open the app, go to Profile → Settings → Delete Account, and confirm.
- On the web: visit https://bfc-surveys-nefsqefi.on-forge.com/account/delete and submit a deletion request.
When you delete your account we revoke all login sessions immediately, mark the account as deleted, and within 30 days we permanently remove your personal account data and replace your identity on any retained survey records with an anonymous label. Some information may be retained longer where the law requires it (for example, fraud-prevention records or audit trails).
12. Children
BFC Surveys is intended for use by adults engaged in professional retail audit work and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at [email protected] and we will delete it.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date at the top of this page and, where appropriate, notify you in the app or by email. Your continued use of the Service after the update means you accept the revised policy.
14. Contact us
If you have questions about this Privacy Policy, or want to exercise any of your rights, contact:
BFC Consultancy
Privacy & Data Protection Office
144 Domboshava Road, Hellensville, Borrowdale, Harare, Zimbabwe
Email: [email protected]
Web: https://www.bfc.co.zw/