Privacy Policy

Last updated 24 October 2026 · OMRI Investments Pty Ltd, Gaborone, Botswana · [email protected]

Draft for pre-launch. Reviewed by OMRI management; to be confirmed by legal counsel before public launch.

OMRI Investments Pty Ltd is the data controller for Vendors Harven. This policy explains what personal data we process and your rights under the Botswana Data Protection Act, 2024.

What we collect

• Account: name, email, phone, password (stored only as a one-way hash), two-step verification settings.
• Seller verification: Omang or passport number, ID and selfie images, proof of address, CIPA documents, payout account. ID numbers, payout details and documents are encrypted (AES-256) and only our verification team can view them (finance staff also see payout details when they make a payout); every view is logged. If a return is accepted, the buyer is shown your return address and phone number so they can send the item back.
• Refund details: if you paid by bank transfer or Orange Money and a refund is owed, the bank account or Orange Money number you give us to pay it into. It is encrypted, only our finance team sees it when sending the refund (every view is logged), and it is erased once the refund has been sent. We keep the bank name and the last four digits for our records.
• Orders: delivery address and phone (shared with the seller and the courier only after payment), items, amounts, tracking events including courier scan locations.
• Your activity: items you watch, searches you save, vehicles you add to My Vehicles, offers, bids, messages between you and other members (contact details in them may be masked), reviews and feedback you write, your notification choices, and the device you allow push notifications on. If you verify a phone number we use it for sign-in codes and urgent SMS alerts.
• Newsletter: your email address, if you subscribe (with a confirmation step and one-tap unsubscribe).
• Invites and rewards: your personal invite code, who joined with it (shown to you as a first name and initial), who invited you, the rewards and Harven credit you earn and spend, and the order that triggered them.
• Technical: IP address and device information for security, fraud prevention and rate limiting.
• Where visitors come from: to see which channels bring people to Vendors Harven, your browser sends one anonymous note per visit saying where you arrived from (for example “Google” or “WhatsApp”), and whether that visit led to a sign-up or an order. This uses no cookies and stores no IP address or device details. We keep daily totals per source, and for a sign-up or order made during the visit we keep its reference with that source label so we can see which channels lead to sales. We also count visits per campaign tag, and which search engines and apps fetch our pages. The label stays in your browser tab until you close it, and counting follows your choice in the cookie dialog.

Why we use it (lawful basis)

• To provide the marketplace and fulfil orders (contract).
• To verify sellers, prevent fraud and keep accounts secure (legitimate interests and legal obligations, including anti-money-laundering).
• To send service messages such as order updates, offers, returns and cases, payouts and security notices, by email, in the app and by push or SMS (consent and legitimate interests). Saved-search alerts are sent because you asked for them. We send the newsletter and other marketing only with your consent.
• To run the referral programme, including checking for abuse (contract and legitimate interests), and to measure and improve the platform from anonymous daily totals.
• To protect members: automated checks on listings and messages (for example banned words and contact-detail masking) and, where we decide a case, reading the evidence both sides add.

Who we share it with

The other party to your transaction (only what’s needed to complete it), couriers (delivery details only), and our service providers:

• Payment providers (DPO Pay, Orange Money, banks)
• Password safety check (Have I Been Pwned), which receives only the first characters of a one-way hash of your password, never the password
• Couriers (delivery details only, to carry your parcel) and parcel-tracking services such as DHL, FedEx, Aramex and Botswana Post, which receive only the tracking number
• SMS providers (Africa’s Talking or Twilio) and your browser’s push service, which receive your phone number or device address and the message
• Hosting (DigitalOcean, London)
• Network security (Cloudflare)
• Email delivery (Resend, or the mail provider we configure)
• Search engines and social networks: to promote items we share public listing information(title, photos, price, location, delivery cost) with search engines (Google, Bing), product catalogues (Google, Meta) and our own channels (Facebook Page, Telegram). We don’t include seller names or contact details.
• Automated assistants (AI services such as OpenAI), only if we switch them on: they read listing text (title, description, location, price, condition, your seller level and account age) and our own admin figures to help us review listings, write posts and summarise the day. Phone numbers, email addresses and links are removed first, and your name, messages, photos and payment details are never sent. Clean listings may be approved automatically; a person decides anything that rejects a listing or affects your account or money.

Some of these providers process data outside Botswana under contractual safeguards. We never sell personal data.

How long we keep it

Account data: while your account is open. Order and payment records: 7 years for tax and accounting; after that the delivery address and phone on the order are removed and only the amounts stay. Seller verification records: 5 years after you stop selling, as anti-money-laundering rules require, then the documents are deleted and the personal fields are blanked. Signed-in sessions are removed 30 days after they expire and in-app notifications after 12 months. A newsletter sign-up you never confirm is deleted after 30 days, the order and sign-up source labels behind our traffic totals after 24 months, and the emails we send are logged for 30 days. Security and audit logs are append-only and are kept indefinitely so we can account for what happened on the platform; we review this at least once a year. Encrypted backups are kept for 30 days, so deleted data can remain in a backup for up to that long. These clean-ups run automatically every night.

Cookies and device storage

We don’t use advertising or third-party tracking cookies, and no other company’s scripts run on Vendors Harven. The only thing loaded from another company while you browse is images: item photos come from our storage and delivery network, and the parcel tracking map loads map tiles from OpenStreetMap, which therefore sees your IP address when you open a map. This is everything we store in your browser:

• Sign-in cookies (vh.session_token and related vh.* cookies): keep you signed in and protect your account. Essential — the site can’t work without them.
• Language (vh_locale cookie): set only when you pick English or Setswana.
• Your preferences on this device (browser storage, never sent to us unless you use the feature): recent searches, vehicles you save while signed out, whether you closed the “install app” or buyer guide tips, and an invite code if you arrived through a friend’s invite link, kept until your new account can use it.
• Your cookie choice (vh_cookie_choice) and an offline copy of the site’s pages and images (the service worker cache), so the app opens faster and works with a poor connection.
• Push notifications (only if you turn them on): your browser gives us an address for your device, which we keep on our servers until you turn them off.
• Anonymous visit counting (optional): a note of where this visit came from, kept in this browser tab until you close it, so we can count visits per source (for example Google or WhatsApp). It is only used if you accept, or haven’t declined, in the cookie dialog.

Your rights

You can access, correct, export or delete your data, and object to or restrict certain processing. Download your data or delete your account from your Account page. Deleting your account signs you out everywhere and anonymises it, and removes your watchlist, notifications, saved searches, saved vehicles, store follows, push devices, newsletter subscription, invite code and unspent Harven credit. We keep what the law requires or what other people’s records depend on, detached from your identity: orders and payments, seller verification records, messages and reviews you wrote, and the invites and rewards already earned. We can’t delete an account that has open orders, live auctions with bids, or a payout balance still to be settled until those are cleared, and you must have signed in within the last 15 minutes. For other requests, or to complain, email [email protected]; you may also complain to the Information and Data Protection Commission of Botswana.

Security

Encryption in transit and at rest for sensitive fields, two-step verification (required when you apply to sell and for staff, and available to everyone), an append-only audit log, and encrypted backups.