Privacy notice

Who this covers

Road Runner Delivery Services is a courier operating in Harare, Zimbabwe. This notice covers everyone whose details pass through us:

• Our clients. The businesses that book deliveries with us, and the people at those businesses who hold an account.
• Recipients. The people our clients send parcels to. You almost certainly have no account with us and have never agreed to anything with us. We still hold your name, address and phone number, because we cannot deliver a parcel without them.
• Visitors. Anyone who opens this website or a tracking link.

Our two roles

Under the Data Protection Act [Chapter 11:12] we act in two different capacities, and it matters which one applies:

• For a recipient's details, we act on our client's instructions. The shop you ordered from decided to send you something and passed us your address to do it. We use those details to make the delivery and for nothing else. We do not market to you, and we do not sell or share your details with anyone who is not carrying your parcel.
• For our own records, we decide. Client accounts, API keys, delivery history, billing and the security logs that go with them are ours, and the decisions about them in this notice are ours to make.

What we hold

About a client account

• The business name, the collection address and a contact number.
• The name and email address of each person who can sign in, and a hashed password.
• API keys. We store a key identifier and a hash of the secret, never the secret itself, which is why we cannot show it to you a second time.
• Webhook endpoint addresses and their signing secrets, which are stored encrypted.

About a delivery

• The collection and delivery addresses, and the distance between them on the road.
• The recipient's name and phone number, and an email address if the client supplied one.
• Any note the client added for the courier, and what the parcel is described as.
• The amount to collect, if it is a cash on delivery job.
• Every status change with the time it happened and where it came from.

About the technical side

• Request logs, including IP address and timestamp, kept so we can investigate abuse and work out what happened when something goes wrong.
• A record of every call we made to a client's webhook endpoint: the event type, the reply code and how long it took. We keep a fingerprint of what we sent, never the message itself, so that log cannot become a second copy of a recipient's details.

We do not collect anything special about you in the sense the Act uses: no health information, no biometric data, no political or religious affiliation. If a client puts something like that in a free-text delivery note, that is their decision and their responsibility, not something we ask for.

Why we hold it

Each of these has a reason and none of them is "because we might as well":

• To make the delivery. A courier cannot find an address that we do not have, or call ahead on a number we were not given.
• To perform our contract with the client. Accounts, keys and billing exist because the client asked us to carry parcels for them.
• To prove what happened. When a customer says a parcel never arrived, the record of who marked it delivered and when is the only thing that settles it.
• To keep the service safe. Rate limits, signed requests and security logs protect our clients' accounts from being used by someone else.
• To meet our own legal and tax obligations.

The tracking link

Every delivery carries a tracking link that our client can pass to the recipient, usually by SMS or WhatsApp. It is worth being exact about what that page is, because anyone holding the link can open it.

The page deliberately shows a reduced view:

• The recipient's first name only, never the full name.
• The suburb, never the street address.
• A partly masked phone number.
• The stage the parcel is at, and the courier's first name.

The link itself is a long random value, not a guessable order number, and the page is rate limited so it cannot be found by trying. It carries no advertising, sets no cookies and is not indexed by search engines. It stops working 7 days after the delivery finishes.

Even so, a link shared into a group chat is visible to that group. Our clients should send it to the recipient and not more widely.

How long we keep it

These are the actual periods the system enforces, applied by a job that runs every day. They are read from the same settings that job uses, so this section cannot drift away from what really happens.

• Raw courier provider messages: 90 days. After that the body is cleared and only the fact of the event remains.
• Raw delivery event payloads: 90 days. Same rule, same reason.
• Webhook delivery records: 90 days.
• Diagnostic captures: 30 days. These exist to help us debug a problem in the last few weeks, not to be a record.
• Tracking links: 7 days after the delivery reaches its final state.

The delivery record itself, meaning who sent what to which suburb and when it arrived, is kept for as long as we need it to answer a dispute and to meet our tax and accounting obligations. A client account is kept while it is open, and its records are kept after it closes for the same reasons.

Who else sees it

We share what has to be shared, and no more:

• The courier carrying the parcel, who needs the address and a phone number to deliver it.
• Our dispatch provider, which receives the delivery details in order to assign a courier.
• Our hosting and infrastructure providers, which hold the data at rest on our behalf.
• Google, when a delivery is priced, because the road distance between two addresses is measured there.
• The authorities, where we are legally required to produce something.

We do not sell personal information, we do not share it for anyone else's advertising, and we do not use it to train anything.

Some of these providers operate outside Zimbabwe, which means delivery and account data may be stored or processed abroad. Where that is the case we rely on the provider's own contractual protections.

How it is protected

• Everything travels over HTTPS, and we refuse to send a webhook to an address that is not encrypted.
• API requests are signed and timestamped, so a captured request cannot be replayed later.
• API secrets are hashed and webhook signing secrets are encrypted at rest.
• Sign-in is rate limited per account and per address.
• An API key only carries the permissions it was issued with, and can be revoked immediately.

No system is perfect. If we become aware of a breach affecting your information we will tell you and the Data Protection Authority as the Act requires.

Your rights

Under the Data Protection Act you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct it, if it is wrong;
• delete it, where we are not required to keep it;
• stop using it in a particular way; or
• explain a decision we made about you.

A client can do most of this without asking: your account details are editable in the portal, and your delivery history is there to read.

We will answer a request within 30 days and will not charge for it. We may need to confirm who you are first, because handing someone else's delivery history to the wrong person would be the exact harm this is meant to prevent.

If you are receiving a parcel

Your details reached us from the business you ordered from. If you want them corrected or removed, that business is the right place to start, because they are the ones who decided to send you something and they hold the order.

You can still write to us directly and we will help, but we may need to check with them before changing a delivery that is already in progress.

Changes

If we change something material here we will update the date at the top of this page and tell account holders by email before it takes effect.

Contact us

Write to us through the contact page and mark it for the attention of the person responsible for data protection. If you are not satisfied with our answer, you can complain to the Data Protection Authority, which in Zimbabwe is POTRAZ.