B&A Privacy Policy

1. Who we are and what this policy covers

Box and Atlas Development is based at 8 Fife Street, Bulawayo, Bulawayo 00000, Zimbabwe. We operate public property and service pages, enquiry and seller-intake forms, property tools, internal workflow applications, and authorised business integrations used to manage property information, leads, communications, marketing, and service delivery.

This policy applies when you browse our Services, submit an enquiry or property, request due diligence or another service, communicate with us by email, phone, WhatsApp, Facebook, or Instagram, or otherwise provide information to us. It does not replace a third party’s own privacy policy.

2. Information we collect

Depending on how you interact with us, we may collect:

• Identity and contact information: name, email address, telephone or WhatsApp number, organisation, and communication preferences.
• Property and service information: listing or parcel references, location, property type, size, condition, asking price, paperwork status, ownership or seller details, buyer criteria, shortlist information, appointment details, and notes you provide.
• Files and content: property photographs, documents submitted for a deeds or due-diligence request, messages, reviews, comments, and other material you choose to send.
• Account and operational information: account identifiers, roles, workflow history, consent records, task and CRM records, and audit information needed to administer authorised users and services.
• Technical and usage information: IP address, browser and device characteristics, operating system, referring pages, approximate location derived from technical data, timestamps, security logs, cookie identifiers, and interactions with our pages.
• Transaction information: a payment reference, amount, status, provider, and reconciliation history if a payment service is activated for a specific transaction. We do not claim that every payment rail or checkout shown in planning materials is live.
• Connected-channel information: message and delivery metadata, platform-scoped identifiers, Page or professional-account metadata, and other information supplied through authorised Meta, WhatsApp, Facebook, or Instagram interactions.

Property and due-diligence documents may contain sensitive or official information. Please provide only what is reasonably necessary for the request and do not send passwords, access tokens, full payment-card details, or unrelated identity records.

3. Where information comes from

We collect information directly from you, from authorised representatives or collaborators, from property owners, sellers, agents, service providers, and business partners, from public property or company sources where lawful, and from the platforms you use to contact us. We may also receive operational records from our WordPress site, Asset Atlas applications, CRM, database, analytics, mapping, payment, email, and messaging providers.

4. How we use information

We use personal information to:

• respond to enquiries and deliver requested property, development, due-diligence, maintenance, marketing, or related services;
• create, review, publish, correct, promote, and reconcile property information;
• manage seller leads, buyer requests, shortlists, appointments, communications, service cases, and CRM follow-up;
• operate accounts, internal workflows, access controls, backups, audit trails, and security monitoring;
• send service messages and, where permitted, relevant marketing or property updates;
• measure and improve site performance, usability, content, campaigns, and service quality;
• prevent fraud, misuse, unauthorised access, and other harmful activity;
• comply with legal, regulatory, tax, accounting, professional, and dispute-resolution obligations; and
• establish, exercise, or defend legal rights.

5. Reasons we rely on for processing

Where applicable law requires a legal basis, we process information because it is necessary to take steps you request or perform a contract, because you gave consent, because we or another party have a legitimate interest that is not overridden by your rights, or because we must comply with law. You may withdraw consent for future processing at any time, but withdrawal does not make earlier lawful processing unlawful.

6. When and with whom we share information

We share information only where reasonably necessary for the purposes in this policy. Recipients may include:

• authorised staff, contractors, agents, property owners, sellers, buyers, collaborators, or professional advisers involved in the relevant request;
• hosting, database, storage, security, and application providers, including WordPress infrastructure and Supabase where used;
• CRM and workflow providers, including Zoho Bigin or a documented successor;
• communications and publishing providers, including email services and Meta services such as WhatsApp, Facebook, and Instagram;
• analytics, tag-management, mapping, and media providers, including Google and Mapbox where their features are loaded;
• payment providers when a specific payment route is activated and selected;
• regulators, courts, law enforcement, tax authorities, or other parties where disclosure is required or reasonably necessary to protect rights and safety; and
• a buyer, successor, or adviser in connection with a genuine business reorganisation, financing, merger, or sale.

Service providers may process information only for their contracted services and under their own applicable terms and privacy obligations.

7. Meta, WhatsApp, Facebook, and Instagram

Our Meta connection is an administrator-only business integration used to select and operate managed Facebook Page and linked Instagram Professional Account assets, publish approved property content, and support official WhatsApp communication. It is not customer social login, and we do not offer website users a “Log in with Facebook” account path through this integration.

If you message us through a Meta service, that service processes the communication under its own terms. We may receive the message, contact details, platform-scoped identifiers, delivery status, and related metadata needed to respond and keep an operational record. Removing our app or business integration from Meta can stop future access, but a separate deletion request may still be needed for information already received by us. See Data Deletion.

8. Cookies and similar technologies

We and our service providers may use necessary cookies, local storage, pixels, tags, and similar technologies for security, preferences, site operation, measurement, and authorised marketing. Google Tag Manager is present in the shared site shell and may load approved measurement tags. Embedded maps, media, social features, or other third-party tools may set their own identifiers.

You can use available consent controls and browser settings to manage non-essential cookies. Blocking necessary storage may prevent some features from working. We do not interpret a browser Do Not Track signal as a universal opt-out where no consistent technical standard applies, but we honour rights and opt-outs required by applicable law.

9. Public property information and user content

Information intentionally published in a property listing, review, public profile, or campaign may be visible to anyone and may be indexed or reshared outside our control. We keep exact location, private notes, and other restricted operational fields out of public channels where the system marks them as private. Before providing listing content, you must have authority to share it and should avoid including unnecessary personal information.

10. International processing

We operate from Zimbabwe and use service providers whose infrastructure, support teams, or subprocessors may be located in other countries. We therefore do not limit this policy to the incomplete Termly draft’s fixed country list. Where required, we use contractual, organisational, or other lawful safeguards for international transfers and assess the information and service involved.

11. How long we keep information

We keep information only for as long as reasonably necessary for the relevant service, relationship, consent, security, audit, dispute, and legal purpose. Retention depends on the record: an unanswered enquiry need not be kept as long as a completed transaction, mandate, regulated property record, tax record, security log, or unresolved dispute.

When information is no longer needed, we delete or anonymise it. Limited copies may remain in protected backups until normal rotation, or may be retained where law, fraud prevention, accounting, professional duties, or legal claims require it. Access to retained information remains restricted.

12. Security

We use proportionate technical and organisational safeguards such as role-based access, protected credentials, validation, audit records, transport security, backups, and restricted administrative tools. No internet or storage system is completely secure. You are responsible for protecting your own credentials and for telling us promptly about suspected unauthorised access.

13. Children

The Services are intended for people aged 18 or older. We do not knowingly solicit personal information from or market the Services to children. If you believe a child supplied personal information without appropriate authority, contact us at ntando@boxandatlas.com so we can investigate and take appropriate action.

14. Your rights and choices

Depending on applicable law and the circumstances, you may ask us to provide access to personal information, correct it, delete it, restrict or object to processing, provide a portable copy, or explain a decision. You may withdraw consent and opt out of direct marketing at any time.

We may need to verify your identity and authority before acting. Rights can be limited where another person’s rights, legal privilege, a transaction record, fraud prevention, professional duties, or another legal exception applies. You may also complain to an appropriate data-protection or regulatory authority.

15. Access, correction, and deletion requests

Use our Data Deletion page for the request steps, including requests connected to Meta, WhatsApp, Facebook, or Instagram. You may also email ntando@boxandatlas.com. Do not include passwords, tokens, or full payment-card information in the request.

16. Third-party links and services

The Services may link to third-party websites, maps, listings, media, social platforms, payment services, or documents. We do not control their independent privacy practices. Review their policies before providing information to them.

17. Changes to this policy

We may update this policy when the Services, providers, legal requirements, or our practices change. The date at the top identifies the current version. Material changes may also be highlighted on the Services or communicated directly where appropriate.

18. Contact us

For privacy questions or requests, contact: