Privacy Policy

"Personal data" means information relating to an identified or identifiable person: names, contact details, identification numbers, device data and account records. "Processing" covers anything done with that data, from collection to deletion. "Controller" is the party deciding why and how data is processed; "processor" is a party processing it on the controller's instructions. Zing markbit is the controller for the data described here.

When you register we ask for your first name, surname, telephone number and e-mail address. When you verify your account we additionally collect identity documents and, where a check requires it, a selfie or live capture. When you transact we record the amounts, methods and destinations involved. When you contact support we keep the content of your messages. Nothing on this list is decorative: each item exists because a service you requested cannot work without it.

Like most websites we receive technical data from your browser: IP address, approximate location derived from it, browser type, pages visited and times. This data serves security, fraud prevention and basic analytics about how the site is used. It is associated with your account when you are signed in and analysed in aggregate when you are not.

We use a small set of cookies: a session cookie that keeps you signed in, a preference cookie remembering interface choices, and security cookies that help recognise suspicious logins. Marketing cookies are set only with your consent. You can clear or block cookies in your browser at any time; blocking the session cookie simply means signing in again on each visit.

Some processing is performed for us by processors under contract: hosting providers running our servers, verification services checking documents, e-mail services delivering our messages and analytics tools summarising site usage. Each processor acts only on our documented instructions, is bound to confidentiality and security commitments, and processes nothing beyond what its function requires.

We use your data to answer your enquiries, to provide the trading service you registered for, to verify your identity as required, to process deposits and withdrawals, to secure your account, to meet accounting and legal obligations, and, with consent, to send marketing you asked for. We do not sell personal data, and we do not use identity documents for any purpose beyond verification and security.

Processing stands on four bases. Contract: delivering the service you signed up for requires the data named above. Legal obligation: verification, record keeping and reporting duties under the applicable Zambian requirements. Legitimate interest: fraud prevention, security and the improvement of our service, balanced against your expectations. Consent: marketing messages and non-essential cookies, always withdrawable. Where processing rests on consent and you withdraw it, the processing stops; the rest continues on its own bases.

Account data is kept while your account is active and for a closing period after closure, to handle outstanding matters. Verification records are retained for the period the applicable requirements set for AML files. Support correspondence is kept for up to three years. Usage logs used for security are rotated within months. When a retention period ends, data is deleted or irreversibly anonymised; backups age out on their own schedule.

Our primary processing sits with providers whose infrastructure may lie outside Zambia. Where data crosses borders, transfers are covered by contractual safeguards with the recipient, and we select providers able to honour protection comparable to the requirements we owe you here. A current list of processor categories is available on request.

We disclose personal data to the licensed entities that execute trading on the platform, to affiliated companies within our group where they perform part of the service, to IT and verification providers as described above, to payment providers carrying your transactions, and to regulators or state authorities where a lawful requirement compels us. We do not disclose data to advertisers, data brokers or social platforms.

Data in transit is encrypted; data at rest is encrypted on the storage layer; access follows role-based permissions and is logged. The full set of measures, from two-factor authentication to audit trails, is described on the security page. No system is perfect, which is why we also maintain an incident process and, where required, will notify you and the authorities of a breach affecting your data.

You may request access to the data we hold about you, correction of what is inaccurate, deletion of what we no longer have a basis to keep, restriction of processing while a dispute is resolved, and objection to processing based on legitimate interest. Marketing consent can be withdrawn at any time. Requests go to [email protected]; we answer within the timelines the applicable requirements set and may ask a question or two to locate and protect your record. Rights are not absolute: verification records, for instance, survive a deletion request for the period the law requires.

The categories of providers we rely on are hosting and infrastructure, email delivery, identity verification, analytics, payment processing and customer-support tooling. Each receives the minimum data its role requires. Should a provider change or a new category be added in a way that matters to you, this page is updated.

We use privacy-respecting, aggregate analytics to understand which pages help users and where the site confuses them. Analytics data is not used to build advertising profiles, and the Google Analytics slot on the site stays empty until the team activates it with a compliant configuration. You can recognise analytics usage in your browser tools and block it without losing any site function.

If we ever run advertising or retargeting that requires cookies or similar identifiers, it runs only on your consent, given through a clear choice and revisable at any time. Our own marketing messages to registered users carry an unsubscribe link that works immediately.

This site references external services such as exchanges and map embeds. Once you follow a link or an embedded component loads, the destination's own policy governs what it collects. We name the services we rely on so you can look them up, and we avoid embedding anything that does not earn its presence.

The services are not directed at persons under eighteen, and we do not knowingly collect data from children. If you believe a minor has provided us data, write to [email protected] and we will remove it after verifying the circumstances.

This policy can change as our services or the applicable requirements evolve; the version on this page is the one in force, taking effect from publication, and material changes are announced to registered users where practicable. Questions about anything here go to [email protected], reach the team that owns this policy, and are answered during Monday to Friday, 08:00 to 17:00 (CAT).