Privacy policy
What personal data WavePay processes, why, which processors we use, how long we keep it and how to exercise your rights under Zimbabwe's data protection law and the GDPR.
Updated · TeraTech Solutions (Private) Limited
Who we are
WavePay is operated by TeraTech Solutions (Private) Limited, Harare, Zimbabwe ("T3raTech", "we"). For merchants' buyers we are usually a processor acting for the merchant; for merchants and website visitors we are the controller. Contact: support@t3ratech.co.zw.
What we process
- Merchants: name, owner email, keys (as hashes), connected provider account identifiers (credentials sealed), plan and usage.
- Buyers: email address and, for wallet prompts, phone number (encrypted, with keyed hashes for lookups), payment reference, amount, currency, status and the provider's reference.
- Licence holders: licence key activations and the device public key used to verify them.
- Visitors: page views and interactions through Google Analytics 4, a language and theme preference, and network address for rate limiting and abuse protection.
What we never process
Card numbers, card security codes and bank passwords. They are entered on the provider's own page and never reach WavePay. We do not sell personal data and we do not build advertising profiles.
Why we process it (lawful bases)
To run the service and your contract (settle payments, issue licences, send receipts); legitimate interests (security, fraud and abuse prevention, reconciliation, improving the service); legal obligations (financial records, tax); and consent where we ask for it (newsletters: every message carries one-click unsubscribe).
Processors and recipients
- Cloudflare: hosting, network and database.
- Paynow, PayPal and Verifone (2Checkout): the payment providers you or the buyer choose.
- SendGrid: transactional and newsletter email.
- Binance: reading credited crypto deposits for T3raTech's own sales.
- Google Analytics and ShareThis: website analytics and share buttons (see cookies).
- GitHub Pages: hosting of part of this website.
Each processes data only for the purpose above and under its own terms.
International transfers
Our processors operate worldwide, so data may be processed outside Zimbabwe. We rely on the safeguards each processor offers and on the data protection law that applies to you.
Retention
We keep payment and ledger records for as long as financial record-keeping requires, buyer contact data only as long as it is needed to settle, support and receipt a payment, and operational logs for a short period. Ask us to delete what the law does not require us to keep.
Your rights
Under the Cyber and Data Protection Act 2021 of Zimbabwe, and under the GDPR where it applies, you may ask for access, correction, deletion, restriction, portability and to object, and to complain to the supervisory authority (in Zimbabwe, POTRAZ). Write to support@t3ratech.co.zw; we answer within one month. Buyers: your merchant decides why your data is collected, so we will also pass your request to them.
Children and changes
WavePay is for businesses and is not directed at children. We will post changes here with a new date; material changes are also emailed to merchants.