Privacy Policy

263 Ads is an online marketplace and advertising service for Zimbabwe, run by Clickatrix Digital Solutions (Private) Limited (registration number 38546A0242025), of 12th Floor, Joina City, Harare. In this policy, “we” and “us” mean 263 Ads.

For the personal information described here, we are the data controller under the Cyber and Data Protection Act [Chapter 12:07] (“the Act”). The Data Protection Authority is the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).

For anything about your personal information, contact us at [email protected] or on WhatsApp +263 78 396 6994.

This policy covers 263ads.co.zw, the business portal, our WhatsApp and email conversations with you, and the advertising services on our Pricing page: listings and promotions, business subscriptions, qualified leads and managed campaigns.

When you enquire about a listing, the business that receives your enquiry decides how it uses your details to answer you, and it is responsible for that use under the Act. Our Terms of Use require businesses to use enquiries only to deal with the person who sent them.

Links to other services — WhatsApp, your email app, a map — take you to their own privacy terms.

We collect only what each part of the service needs (section 13 of the Act).

You browse

What we collectNo name or contact details. Our servers receive your device's IP address and browser type, as every website's do.

WhyTo deliver the page, keep the service secure and stop abuse, such as too many enquiries from one address.

You enquire about a listing

What we collectYour name and phone number (required), email address and message (optional), and which listing it was about.

WhyTo pass your enquiry to the business, and to keep a copy so we can help with a dispute or a report of fraud.

You create an account

What we collectYour full name, email address, phone number, password (stored only in scrambled, hashed form), whether you are an individual or a business, and your business name.

WhyTo give you an account, sign you in securely and let you manage your listings and enquiries.

You complete a profile

What we collectOptionally: a short bio, a photo and your date of birth. For a business: its logo, address, phone, WhatsApp number and description.

WhyTo show the business on its listings. Your personal profile is never shown publicly.

You post a listing

What we collectThe listing itself: title, description, price, photos, location and the contact details you choose to show.

WhyTo publish it. A listing is public by design.

You buy an advertising service

What we collectThe contact person, business details, campaign brief, payment records and campaign results.

WhyTo deliver what you ordered, report on it, invoice you and keep the records the law requires.

You message us on WhatsApp or email

What we collectWhat you send us, and your number or address.

WhyTo reply, and to post a listing on your behalf if that is what you asked for.

Required fields are marked on each form. Without a name and phone number we cannot pass an enquiry on, and without an email address and password we cannot open an account. Everything else is optional.

Date of birth is sensitive information under the Act (section 3), so we only keep it if you choose to enter it, which is your written consent (section 11). We never show it publicly, and you can delete it at any time from your profile.

Under section 10 of the Act we process personal information:

• With your consent: When you send an enquiry, open an account, enter optional profile details or agree to be contacted by an advertiser. You can withdraw consent at any time; that does not undo processing that has already happened.
• For our legitimate interests: Keeping the service secure, preventing fraud, measuring how listings perform and improving the service — never where your rights outweigh them.
• To comply with the law: For example keeping financial records or responding to a lawful order.

Listings are public, and so is the seller information shown beside them: the business name, phone and WhatsApp numbers, address and whether we have verified the business. If you list as an individual, the contact details you add to a listing are public too. Consider using a business or dedicated number.

A business that signs up as a business, or that we add for a client, is also listed in our public Directory, whether or not it has a listing up: its name, logo, description, address, phone and WhatsApp numbers, website, the categories it lists in, how many listings it has, when it joined and whether we have verified it. Its email address is not shown. Individual sellers are not listed in the Directory.

Search engines and other people can copy public listings. Removing a listing takes it off 263 Ads, but we cannot recall copies others have made.

We do not sell lists of personal information. We share it only with:

• The business you contact: Your enquiry and the details in it.
• Advertisers who buy qualified leads: Only the details of people who have explicitly agreed to be contacted by that advertiser, and only for the enquiry they made. That agreement is what the advertiser pays for.
• Our service providers: Such as Hostinger, which hosts the site, its database and its photos on servers outside Zimbabwe, and those who send our email. Each works under a written contract that requires it to keep the information secure and use it only on our instructions (section 18).
• Advertising partners: Facebook page owners, influencers, WhatsApp group administrators and community networks we book for a campaign receive the advert, not your personal information.
• Authorities: When the law requires it, or to protect someone's safety or investigate fraud.

We do not send newsletters or marketing messages at the moment. If we start, we will only send them to people who have agreed to receive them, and you can object at any time, free of charge (section 15(1)(c)), by replying STOP or contacting us.

Messages about an enquiry, your account or a service you bought are not marketing.

We use the least we can:

ads_vendor_session

What it doesKeeps a business signed in to its portal. It cannot be read by scripts on the page.

How longUp to 30 days, or until you sign out

ads_admin_session

What it doesThe same, for 263 Ads staff.

How longUp to 30 days, or until signing out

ads:view:…, ads:src:… (session storage)

What it doesRemembers that this browser tab has already counted a view of a listing, and where it came from, so a reload is not counted twice. It contains no identifier.

How longUntil you close the tab

We set no advertising or analytics cookies, and no other company sets cookies through our pages. You can clear all of these in your browser settings; you will just need to sign in again.

So businesses can see whether advertising works, we count, for each listing and each day, how many times it was viewed, how many times its Call and WhatsApp buttons were pressed, and which kind of page the visit came from (the home page, search, another website and so on).

These are counts, nothing more. We do not record who viewed a listing, and the counts contain no IP address, device details or identifier.

We make no decision about you based solely on automated processing that has a legal or similarly significant effect (section 25).

For managed campaigns, an enquiry may be given a score that is simply the sum of points for the answers you gave, shown in full to the business. A person at the business decides what to do with it.

Our hosting provider, Hostinger, keeps the site, its database and its photos on servers outside Zimbabwe, and other providers may do the same. We transfer personal information out of Zimbabwe only where the recipient's country or organisation ensures an adequate level of protection (section 28), or where section 29 allows it — for example because the transfer is needed to provide the service you asked for, or you have consented.

We keep information only as long as we need it (section 7):

• Enquiries: Kept 24 months after the last activity on it, then deleted, unless they are part of an open dispute or fraud report.
• Accounts: While the account is open. When you ask us to close it, we delete or anonymise your personal information within 30 days, except what we must keep by law.
• Listings: While they are live. Archived listings are deleted with the account.
• Records of paid services: For the period Zimbabwean tax and company law requires.
• Server and security logs: Kept 90 days.
• Listing counts: Kept, as they contain no personal information.

We take technical and organisational measures appropriate to the risk (section 18). These include encrypted connections, passwords stored only as hashes, sign-in cookies that page scripts cannot read, access limited to the staff who need it, and keys that never reach the browser.

If a security breach affects personal information, we will notify POTRAZ within 24 hours (section 19), and tell the people affected promptly where they need to act to protect themselves.

No system is perfectly secure. Use a password you do not use anywhere else, and tell us straight away if you think your account has been misused.

Under the Act (section 14) you have the right to:

• Be informed: How your information is used, which is what this policy is for.
• Access: The personal information we hold about you.
• Object: To all or part of how we process it, including to direct marketing at any time, free of charge.
• Correct: Information that is false or misleading. Most of it you can edit yourself in your account.
• Delete: Information that is false or misleading. We will also delete your account and its information when you ask, unless the law requires us to keep part of it.
• Withdraw consent: To anything you consented to, free of charge and without giving a reason (section 11).

To use any of these rights, contact us at [email protected] or on WhatsApp +263 78 396 6994. We may ask you to confirm your identity first. We do not charge, and we respond within 30 days.

Under the Act a child is anyone under 18. Accounts are for adults. We do not knowingly collect a child's personal information without the consent of a parent or guardian (section 10), who may exercise the child's rights on their behalf (section 26). If you believe a child has given us information, contact us and we will delete it.

Listings for schools, colleges and courses are about the institution and its offer; enquiries about them should be sent by a parent, guardian or adult student.

Please contact us first at [email protected], and we will try to put things right.

You can also complain to the Data Protection Authority, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), at [email protected] or www.potraz.gov.zw.

When we change this policy we update the date below. If a change affects how we use information you have already given us, we will tell account holders by email before it takes effect.

This policy takes effect on 12 October 2026.