Privacy Policy.

Who we are

Heartech is a retailer of new and certified pre-owned mobile devices and accessories, based in Zimbabwe and trading online at heartech.tech. In this policy, “we”, “us” and “Heartech” mean Heartech, the controller responsible for the personal information described below.

What this policy covers

This policy applies to our website, our in-store and delivery operations, and to our automated Instagram assistant— the messaging bot that answers direct messages and comment replies on our Instagram professional account. The bot is built on Meta's Instagram Messaging API, so the Instagram account is linked to our Facebook Page. Your use of Instagram itself is also governed by Meta's own privacy policy, which we do not control.

Information we collect

When you message our Instagram assistant, we receive:

• Your Instagram username, profile picture and the Instagram-scoped user ID that Meta assigns to your conversation with us.
• The content of your messages, including any photos, videos, voice notes or other attachments you send, and the time they were sent.
• Anything you choose to share in conversation — for example your name, phone number, email address, delivery address, device model, IMEI or serial number, and details of a fault you want repaired.

When you buy from us, in a store or through heartech.tech, we also hold your order details, the items and prices involved, payment status, and any warranty or repair history linked to your device.

We do not collect your Instagram password, and we never ask for card numbers, PINs, mobile-money PINs or one-time passcodes over Instagram. Anyone who does is not us.

How we use your information

• To answer your questions and send you prices, stock and quotes.
• To take, confirm, reserve, deliver and invoice orders, and to arrange repairs, trade-ins and warranty claims.
• To send you order, delivery and repair status updates.
• To keep the sales, stock and accounting records we are required to keep as a business.
• To improve the assistant's replies and detect fraud, spam or abuse of the service.

We rely on your consent, given when you start a conversation with us, and on our legitimate interest in running the shop and serving customers. We do not use your Instagram messages to build advertising profiles, and we do not sell your personal information to anyone.

Automated replies and human staff

The assistant answers automatically. When a request needs judgement — pricing on a trade-in, a repair diagnosis, a complaint — a member of Heartech staff reads the conversation and replies personally. You can ask to speak to a person at any point. Messages are visible to authorised Heartech staff only.

Who we share it with

We share personal information only with:

• Meta Platforms — as the operator of Instagram, Meta transmits and stores the messages you send us.
• Our service providers — the hosting, database and email providers that run our systems on our instructions, under contract, and only for the purposes described here.
• Delivery and repair partners — the name, phone number and address needed to deliver your order or service your device.
• Authorities — where we are required to disclose information by law, or to establish or defend a legal claim.

Where your information is stored

Our systems are hosted on servers in the European Union and messages are processed on Meta's infrastructure, so your information is transferred outside Zimbabwe. We only use providers that apply recognised technical and contractual safeguards to that transfer.

How long we keep it

• Instagram conversations: up to 24 months from your last message, then deleted.
• Sales, invoice and warranty records: for as long as the applicable tax, accounting and consumer-protection laws require us to keep them.
• Enquiries that never became an order: deleted once they are no longer useful, and in any case within 24 months.

Your rights

You can ask us to give you a copy of the personal information we hold about you, correct anything that is wrong, delete it, or stop using it for a particular purpose. You can also withdraw your consent to being messaged at any time — just tell the assistant to stop, or block the account.

To have your data deleted, follow the steps on our data deletion page. We respond to requests within 30 days.

Security

Access to customer records is restricted to named Heartech staff accounts with role-based permissions, data is encrypted in transit and at rest by our providers, and our databases are backed up daily. No system is perfectly secure, but we take these obligations seriously and will tell you promptly if a breach affects your information.

Children

Our store and our Instagram assistant are meant for adults. We do not knowingly collect information from children under 13. If you believe a child has sent us personal information, contact us and we will delete it.

Changes to this policy

If we change how we handle your information we will update this page and change the date above. Material changes will be announced on our Instagram account.

Contact us

Email privacy@heartech.tech or WhatsApp +263 775 402 327 with any privacy question, request or complaint.