Privacy Policy

The Zimbabwe Football Association ("ZIFA", "we", "our", or "us") operates the ZIFA Tickets platform — including the mobile application distributed under the bundle identifier zw.co.zifa.tickets and the associated website — to sell official match tickets, merchandise, and supporter products on behalf of ZIFA and its affiliated competitions.

We are committed to protecting the personal information you share with us. This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and what rights you have under the Zimbabwe Data Protection Act, Chapter 11:12 (2021) and other applicable law.

By using ZIFA Tickets, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the app and contact us to request deletion of any data already collected.

We collect only the information necessary to provide you with a secure, functional ticketing experience. This includes:

2.1 Information you provide directly

• Full name — used to personalise your account and print on tickets where required.
• Email address — used for account registration, order confirmations, and transactional communications.
• Phone number — used for order updates and WhatsApp ticket delivery.
• Payment method reference — we receive a tokenised reference or masked card detail from our payment processor (ContiPay). We do notstore full card numbers (see Section 4).

2.2 Information collected automatically

• IP address — used for fraud prevention and geographic access controls.
• Device information — operating system version, device model, app version, and unique device identifiers (where permitted by your platform settings).
• Push notification tokens — collected when you grant notification permission, used solely to deliver match-day alerts and important account notifications to your device.
• Usage data — pages viewed, screens visited, session duration, and in-app interactions, used in aggregate to improve the service.

2.3 Information we do NOT collect

• Full payment card numbers, CVV codes, or PINs.
• Government-issued ID numbers (unless specifically required for a competition regulation and disclosed at point of collection).
• Biometric data.
• NFC chip data — our Matchday Pass / NFC feature is coming soon and no NFC data is collected at this time (see Section 9).

We use your personal information for the following purposes:

We will not use your personal data for purposes incompatible with those listed above without first seeking your explicit consent.

All payment transactions made on the ZIFA Tickets platform are processed by ContiPay (Pvt) Ltd, a licensed payment service provider in Zimbabwe. ContiPay handles the entry, transmission, and storage of your payment card or mobile money details in accordance with PCI-DSS standards.

ZIFA does not receive, transmit, or store your full card number, CVV, expiry date, or mobile money PIN. We receive only a transaction reference number, a masked card representation (e.g., **** **** **** 1234), and the payment outcome (approved / declined).

By completing a purchase, you also agree to ContiPay’s privacy policy and terms of service, which are available on the ContiPay website.

We do not sell, rent, or trade your personal information to third parties for commercial purposes. We share data only in the following limited circumstances:

• ContiPay (payment processor) — receives the minimum data needed to process your transaction (name, amount, reference).
• Email service provider — your email address and name are shared to deliver order confirmation and transactional emails on our behalf. This provider is contractually prohibited from using your data for its own purposes.
• WhatsApp Business API — your phone number is used to deliver your ticket via WhatsApp where you have selected this delivery method.
• Law enforcement or regulators — we may disclose information when required to do so by Zimbabwean law, court order, or legitimate request from a government authority.
• ZIFA affiliates — for the limited purpose of administering competitions and verifying ticket validity at the venue.

All third-party service providers are bound by contractual data-processing agreements that require them to keep your information confidential and process it only for the specified purpose.

We retain your personal information for as long as your account remains active or as needed to provide you with the service. Specifically:

• Account data — retained until you request deletion or your account has been inactive for 3 years, whichever comes first.
• Transaction records — retained for a minimum of 7 years to comply with Zimbabwean financial record-keeping requirements, even after account deletion.
• Push notification tokens — deleted when you uninstall the app, revoke notification permission, or request account deletion.
• Marketing subscription data — retained until you unsubscribe.
• Server logs and IP records — retained for up to 90 days for security and fraud-prevention purposes.

Under the Zimbabwe Data Protection Act 2021, you have the following rights regarding your personal information:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may ask us to correct inaccurate or incomplete personal data.
• Right to erasure (“right to be forgotten”) — you may request deletion of your personal data, subject to our legal retention obligations (e.g., financial records).
• Right to object — you may object to processing based on legitimate interest, including direct marketing.
• Opt-out of marketing — every marketing email includes an unsubscribe link. You can also email us at [email protected] to opt out.

To exercise any of the above rights, contact us at [email protected]. We will respond within 30 days. We may ask you to verify your identity before processing your request.

We may send push notifications to your device to inform you about:

• Upcoming matches and ticket availability.
• Order status updates (e.g., ticket confirmed, payment failed).
• Important announcements from ZIFA.

Push notifications require your explicit opt-in consent. You can withdraw this consent at any time by adjusting your device’s notification settings:

• iOS:Settings → Notifications → ZIFA Tickets → turn off “Allow Notifications”.
• Android:Settings → Apps → ZIFA Tickets → Notifications → turn off notifications.

Disabling notifications does not affect your ability to purchase tickets or access your account.

ZIFA Tickets is developing a Matchday Pass feature that will use Near Field Communication (NFC) technology to allow contactless entry at ZIFA venues. This feature is not yet available.

When the Matchday Pass feature launches, we will update this Privacy Policy to describe what NFC-related data (if any) is collected, how it is used, and how you can opt in or out. The feature will be subject to additional terms and conditions.

At this time, no NFC data is collected by the ZIFA Tickets application.

The ZIFA Tickets website uses cookies and similar tracking technologies to:

• Maintain your session and keep you logged in.
• Remember your cart and preferences.
• Collect anonymised analytics (e.g., page views, popular fixtures) to improve the platform. We use only privacy-respecting analytics tools and do not sell this data.

Strictly necessary cookies (session management, CSRF protection) cannot be disabled as they are essential for the site to function. You may disable non-essential cookies through your browser settings; doing so will not prevent you from purchasing tickets but may affect certain site features.

The ZIFA Tickets mobile app does not use browser cookies. It uses local storage on your device to cache session tokens and preferences, which you can clear by logging out or uninstalling the app.

We implement industry-standard technical and organisational measures to protect your personal information, including:

• Encryption of data in transit using TLS 1.2 or higher.
• Encrypted storage of sensitive fields (e.g., passwords are hashed and salted using bcrypt).
• Role-based access controls limiting internal access to personal data.
• Regular security reviews and penetration testing.
• Payment processing handled entirely by PCI-DSS-compliant ContiPay (we never touch raw card data).

While we strive to protect your information, no method of transmission over the internet or method of electronic storage is 100% secure. If you believe your account has been compromised, contact us immediately at [email protected].

ZIFA Tickets is intended for users who are 13 years of age or older. We do not knowingly collect personal information from children under the age of 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected] and we will promptly delete such information.

Users between the ages of 13 and 17 should use the platform under parental or guardian supervision. Ticket purchases by minors require a payment method authorised by a parent or guardian.

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable law. When we make material changes, we will:

• Update the effective date at the top of this page.
• Send a notification via the app or email if the change materially affects how we handle your data.

Your continued use of ZIFA Tickets after the effective date of any updated Privacy Policy constitutes your acceptance of the changes. We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us: