Privacy Policy

Last updated: 28 September 2026

Elitrasmart Medical Supplies Limited ("Elitrasmart", "we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have under the Data Protection Act No. 3 of 2021 of the Republic of Zambia ("the Act").

1. Who we are

Elitrasmart Medical Supplies Limited is a Zambian company that supplies medical uniforms and related products, and organises the Smart National Quiz. Our head office is at Cairo Road, opposite Bank of Zambia, Church House Building, Shop No. 4, Lusaka, Zambia.

For the purposes of the Act, Elitrasmart is the data controller of the personal data described in this Policy.

Contact for privacy matters: elitrasmartltd@gmail.com or +260 978 544 195.

2. Personal data we collect

2.1 Account registration (distributor application)

When you register for a wholesale (distributor) account, we collect:

• Full name, email address, and phone number;
• Country, city, state/province, ZIP/postal code, and street address;
• Employment status and name of employer;
• Marital status;
• Next-of-kin details (name, phone number, address, and relationship to you);
• Business details (business name, duration in business, website/social media page, business structure, and a description of your business);
• A copy of your business licence or registration certificate (uploaded file);
• A copy of your NRC, passport, or driver's licence (uploaded file) for identity verification;
• A password (stored only in hashed form — we cannot see it);
• Your application status (pending, approved, or rejected);
• Any appeal you submit against a decision on your application, together with our response to it.

2.2 Shopping, carts and orders

When you shop with us, we collect:

• Your name, email address, phone number, and delivery location;
• The products you view, add to cart, and order, including sizes, quantities, and prices;
• Custom design files or images you upload with an order (for example, embroidery or logo artwork);
• Order status, delivery status, and payment status.

2.3 Payments

• For Smart Quiz ticket purchases we collect your mobile money phone number and chosen provider (MTN, Airtel, or Zamtel), which are transmitted to our payment processor, PawaPay, to request payment.
• For other orders we may collect proof-of-payment documents you upload (for example, bank transfer or mobile money receipts).
• We collect payment amounts, balances, and transaction references.

We do not collect or store card numbers. Card payments are not currently accepted.

2.4 Smart Quiz registration

When a school registers for the Smart National Quiz, we collect from the school's representative:

• Name, position, school name, school address, province, town, phone number, and email address;
• The school's primary goal for participating and how the school heard about the quiz.

2.5 Communications

• The emails we send you (registration confirmations, payment receipts, and notifications);
• Any correspondence you send to us (support requests, enquiries, complaints).

2.6 Technical data collected automatically

• Cookies: a session cookie, a CSRF security token, and a "remember me" cookie (only if you tick that box);
• Server logs, which may record your IP address, browser type, device information, and pages visited.

2.7 Third-party content

Our podcast page embeds YouTube videos. When you view them, YouTube (Google) may collect data about you under its own privacy policy. We also load Google Fonts. We do not receive personal data from these services beyond standard usage statistics.

2.8 Information about other people

Our distributor application asks for the name, phone number, address, and relationship of your next of kin. By giving us those details, you confirm that you have that person's permission to share them with us. We use them only to reach someone on your behalf if we cannot contact you, and never for marketing. If you would like us to remove those details, contact us and we will do so once your account is closed and any outstanding orders are settled.

3. Purposes and lawful bases for processing

We process your personal data for the following purposes and on the following lawful bases:

Purpose	Lawful basis
Processing your account application and deciding whether to approve it	Taking steps to enter into a contract with you (pre-contractual steps)
Fulfilling your orders, arranging delivery, and managing your account	Performance of a contract
Processing payments and refunds, and verifying proof of payment	Performance of a contract; legal obligation (financial records)
Verifying your identity using your NRC/passport/driver's licence and business registration documents	Compliance with a legal obligation; our legitimate interest in preventing fraud and vetting distributors
Sending you emails about your orders, payments, and registrations	Performance of a contract; legitimate interest in keeping you informed about transactions you initiated
Registering your school for the Smart Quiz and sending participation details	Performance of a contract; your consent
Improving our website, products, and services	Legitimate interest
Complying with tax, accounting, and other legal obligations	Legal obligation

Where we rely on consent, you may withdraw it at any time by contacting us, without affecting the lawfulness of processing carried out before the withdrawal.

4. Sensitive personal data

Your NRC, passport, or driver's licence and your business registration documents are identity documents. We treat them as sensitive, use them only to verify your identity and vet your application, restrict access to them to authorised staff, and do not use them for any other purpose or share them with third parties except as required by law.

5. Who we share your data with

We do not sell your personal data. We share it only as follows:

• PawaPay (payment processing): your phone number and payment amount, to request and process mobile money payments for Smart Quiz tickets;
• Our email service provider: to deliver transactional emails to you;
• Our website hosting provider: to store the website and its database;
• Regulators, law enforcement, or courts: where the law requires us to.

Any processor acting on our behalf is required to protect your data and use it only for the purposes we specify.

6. International transfers and storage

Our website and database are hosted by our hosting provider, whose servers may be located outside Zambia. Where personal data is transferred or stored outside Zambia, we rely on appropriate safeguards and contractual protections. We are progressively aligning our storage arrangements with the data localisation requirements of the Act, including the requirement that sensitive personal data be stored within Zambia.

7. How long we keep your data

• Account data: for as long as your account is active, and for a reasonable period after closure for legal and accounting purposes;
• Order and payment records: for the periods required by Zambian tax and company law;
• Identity and business registration documents: only for as long as needed to vet your application;
• Quiz registration data: until the relevant quiz cycle is concluded and records are archived, unless you ask us to delete it earlier;
• Appeal records: for as long as we hold the application they relate to, so that we can show how a decision was reached and reviewed.

When data is no longer needed, we delete or securely destroy it.

8. Security

We protect your personal data with appropriate technical and organisational measures, including:

• HTTPS encryption in transit;
• Passwords stored only as hashes;
• Restricted, role-based access for staff;
• Two-factor authentication available for your account;
• Backups to protect against data loss.

No method of transmission or storage is 100% secure. If a breach occurs that is likely to affect your rights, we will notify the Data Protection Commissioner and you without undue delay, as required by the Act.

9. Your rights under the Data Protection Act

As a data subject in Zambia, you have the right to:

1. Access and information — know whether we process your data, what we process, why, who we share it with, and how long we keep it, and obtain a copy;
2. Rectification — have inaccurate or incomplete data corrected;
3. Erasure — have your data deleted where the law permits;
4. Restriction of processing — limit how we process your data in certain circumstances;
5. Object — object to processing based on legitimate interests;
6. Data portability — receive your data in a structured, commonly used format;
7. Protection from automated decision-making — we do not make decisions about you solely by automated means;
8. Complaint — lodge a complaint with the Data Protection Commissioner of Zambia if you believe we have breached the Act.

To exercise any of these rights, contact us at elitrasmartltd@gmail.com. We will respond within the timeframes required by law and may ask you to verify your identity first.

10. Cookies

We use only essential cookies:

• A session cookie so the website remembers you as you browse;
• A CSRF token that protects your account against malicious requests;
• A "remember me" cookie, only if you select that option at login.

Third-party content (YouTube, Google Fonts) may set its own cookies. You can block or delete cookies in your browser settings, but the website may not function correctly without the essential ones.

11. Children

The Smart Quiz involves students, but registrations are made by adult school representatives, and accounts may only be created by persons who can lawfully enter contracts. We do not knowingly collect personal data directly from children. If you believe a child has provided us personal data without parental consent, contact us and we will delete it.

12. Changes to this Policy

We may update this Policy from time to time. The updated version will be posted on this page with a new "Last updated" date. Material changes will be notified to registered users by email.

13. How to contact us

• Email: elitrasmartltd@gmail.com
• Phone: +260 978 544 195
• Address: Cairo Road, opposite Bank of Zambia, Church House Building, Shop No. 4, Lusaka, Zambia

Regulator: Office of the Data Protection Commissioner of Zambia — www.dataprotection.gov.zm