ZeroWaste+ is a sustainability performance platform operated by RiseUp Africa Inc., a company incorporated in Canada with active operations in Haiti, Kenya, Rwanda, and Canada. For the purposes of applicable data protection legislation, RiseUp Africa Inc. acts as the Data Controller.

This Policy applies to all individuals whose personal data we process, including:

• Registered users of the ZeroWaste+ platform (app.zerowaste.plus)
• Visitors to zerowaste.plus and join.zerowaste.plus
• SAFI 2030 community members
• Prospective clients who submit a registration or inquiry form
• Representatives of corporate or SME client organisations

This Policy does not apply to third-party websites or services that may be linked from our platform.

We collect only data that is necessary, proportionate, and lawful for the purposes described in this Policy.

We do not collect or process special category data (e.g. health, biometric, racial or ethnic origin data) unless explicitly consented to and required for a specific service feature.

We process personal data strictly for the following purposes:

• Platform delivery: To create and manage your account, provide access to features, and personalise dashboards.
• Service communications: To send service updates, security alerts, and support responses.
• Analytics and improvement: To analyse usage patterns and improve platform performance and usability.
• Legal compliance: To meet obligations under data protection, sustainability reporting, and anti-money laundering laws.
• Security: To detect, prevent, and respond to fraud, misuse, or security incidents.
• Marketing (opt-in only): To send newsletters or promotional content to users who have explicitly opted in.

We do not use your personal data for automated decision-making or profiling that produces legal or significant effects without human oversight.

For users in the EU/EEA or other jurisdictions requiring a lawful basis, we rely on the following grounds:

We implement technical and organisational measures commensurate with the sensitivity of the data and the risks involved, including:

• All data in transit is encrypted using HTTPS/TLS 1.2 or higher
• Data at rest is encrypted on Firebase/Google Cloud infrastructure
• Role-based access controls (RBAC) restrict staff access to data on a need-to-know basis
• Firestore security rules enforce per-user data isolation at the database level
• Regular security audits, vulnerability monitoring, and incident response protocols
• All subprocessors are bound by Data Processing Agreements (DPAs)

In the event of a personal data breach that poses a risk to individuals, we will notify the relevant supervisory authority within 72 hours of becoming aware, and affected individuals without undue delay, in accordance with applicable law.

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law.

Upon expiry of the applicable retention period, data is securely deleted or anonymised in a manner that prevents re-identification.

We do not sell, rent, or trade your personal data. Data may be shared only in the following circumstances:

All third-party processors are vetted and bound by Data Processing Agreements (DPAs) that require them to process data only on our instructions and in accordance with applicable law.

Our operations span Kenya, Rwanda, Haiti, and Canada, and our cloud infrastructure is operated by Google Cloud. Data may be transferred internationally. When transfers involve personal data from the EU/EEA or countries with adequacy requirements, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Google Cloud’s data residency controls and Privacy Shield successor frameworks
• Compliance with Kenya’s Data Protection Act requirements on cross-border transfers
• Compliance with Rwanda’s Law No. 058/2021 on cross-border data flows

You may request a copy of the applicable transfer safeguards by contacting [email protected].

Depending on your location and applicable law, you have the following rights with respect to your personal data:

To exercise any of these rights, submit a request to [email protected]. We will respond within 30 calendar days. We may require identity verification before processing your request.

We use cookies and similar technologies on our website and platform for the following purposes:

• Essential cookies: Required for platform functionality and session management.
• Analytics cookies: We use Google Analytics 4 (GA4) to understand platform usage. Analytics data is aggregated and does not identify individuals.
• Security cookies: reCAPTCHA v3 is used to detect and prevent automated abuse.

You can manage or disable non-essential cookies through your browser settings or our cookie consent interface. Note that disabling essential cookies may affect platform functionality.

For full details, see our Cookie Policy.

ZeroWaste+ is a business platform not directed at individuals under the age of 16. We do not knowingly collect personal data from minors. If we become aware that a minor has provided personal data without verified parental or guardian consent, we will delete that data promptly.

If you believe a minor’s data has been submitted to us, please contact [email protected] immediately.

We may update this Privacy Policy periodically to reflect changes in law, technology, or our practices. Material changes will be communicated via:

• An in-platform notification for registered users
• An email notice to the address on your account
• An updated “Last Updated” date at the top of this page

Your continued use of ZeroWaste+ after the effective date of any update constitutes your acknowledgment of the revised Policy. Where required by law, we will seek your renewed consent.

For any questions, requests, or concerns regarding this Privacy Policy or the way we process your personal data, please contact our Data Protection team:

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority: