Diilzo Marketplace Ltd ("Diilzo", "we", "us") operates a multi-seller marketplace that connects buyers with independent stores, wholesalers and suppliers — in Uganda and internationally. This policy explains what information we collect when you use our website, mobile app and related services, and what we do with it.
1. Information we collect
You give it to us
- Account details — name, email address, phone number and password when you register, plus your profile photo and optional referral code.
- Order & delivery details — delivery addresses, recipient name and phone number, delivery notes and pickup-station choices.
- Seller & supplier information — store name and description, business registration and KYC verification documents, payout details (mobile money number or bank account) and staff accounts you add to your store.
- Payment information — the payment method you choose (MTN Mobile Money, Airtel Money, card or cash on delivery). Card payments are processed by our PCI-DSS compliant payment processor; Diilzo never sees or stores your full card number. Mobile money payments are confirmed with the telecom — we store only the transaction reference, never your mobile money PIN.
- Communications — messages you send to sellers through buyer–seller chat, product reviews and ratings, support tickets, disputes and emails to our team.
We collect it automatically
- Order & escrow records — items purchased, amounts paid, escrow hold/release status, refunds, invoices and delivery confirmations.
- Device & log data — IP address, browser type, pages visited and approximate location (country/city), used for security and to show prices in your currency.
- Shopping activity — products you view, search for, wishlist and buy, which powers recently-viewed lists and recommendations.
- Guest identifiers — if you browse without an account, a guest cart ID cookie keeps your cart until you sign in.
We receive it from others
- Sign-in partners — if you choose "Continue with Google", Google shares your name and email with us to create your account.
- Payment & telecom providers — transaction confirmations from Stripe, MTN and Airtel.
- Carriers & pickup stations — delivery status and proof-of-delivery updates on your orders.
2. How we use your information
- Run the marketplace: process orders, hold and release escrow payments, arrange delivery and handle returns, refunds and disputes.
- Operate seller services: store management, payouts, subscriptions, advertising (AdPulse) and POS sales.
- Keep you signed in, sync your cart and wishlist across devices and remember your country and currency.
- Send order updates, delivery notifications, 2FA verification codes and — only if you opt in — deals and newsletters.
- Prevent fraud and abuse: detect suspicious logins, fake listings and payment fraud, and enforce our Terms of Service.
- Improve the platform: understand which categories and features people use so we can make the marketplace better.
- Meet legal obligations: tax records, anti-money-laundering checks and lawful requests from authorities.
3. Who we share it with
We sell access to the platform — never your personal data. We share only what is needed for the service to work:
- Sellers & suppliers receive your name, delivery address and phone number so they can fulfil and deliver your order. They must use it only for that order.
- Buyers see a seller's public store name, ratings and reviews — never their private account data.
- Payment processors (Stripe for cards; MTN and Airtel for mobile money) receive what they need to complete your transaction.
- Delivery partners — carriers and pickup stations receive the recipient details required to deliver your parcel.
- Service providers — Cloudinary (product images), email delivery and hosting providers that process data on our behalf under contract.
- Authorities — where the law requires it, or to protect buyers, sellers and Diilzo from fraud and harm.
If Diilzo is ever involved in a merger or acquisition, your information may transfer to the new owner — you will be notified before that happens.
4. Cookies & similar technology
We use a small set of first-party cookies:
- sessionid — keeps you logged in (essential).
- csrftoken — protects forms and API calls from forgery (essential).
- dz_guest_cart_id — keeps a guest cart before you sign in.
- dz_country_code — remembers your country so we show local products and prices in the right currency.
You can block cookies in your browser settings, but sign-in, cart and checkout will stop working without the essential ones.
5. How we protect your data
We use encrypted connections (HTTPS), hashed passwords, optional two-factor authentication, CSRF-protected session cookies and role-based access so staff only see what they need. Payments pass through PCI-compliant processors and buyer funds are held in escrow until delivery is confirmed. Read more on our Security page.
No system is 100% secure. Protect your account with a unique password and two-factor authentication, and never share your password, OTP codes or mobile money PIN with anyone — Diilzo staff will never ask for them.
6. Your rights & choices
- Access & correct — view and update your details any time under My Account.
- Download your data — request a copy of the personal data we hold about you.
- Delete your account — ask us to close your account. We remove your profile except records we must keep for tax, escrow and fraud-prevention purposes.
- Marketing — unsubscribe from promotional emails with the link in any message; order and security emails still arrive because they are part of the service.
To exercise any of these rights, email support@diilzo.com — we respond within 30 days.
7. How long we keep it
Account data lives while your account is active. Order, escrow and invoice records are kept for up to 7 years to satisfy tax and accounting law. Chat and dispute records are kept while the related order can still be disputed, then deleted or anonymised.
8. Children
Diilzo is not directed at children under 18 and they may not create accounts. If we learn a child has registered, we delete the account.
9. International transfers
Some service providers (hosting, Stripe, Cloudinary) process data outside Uganda. Where they do, contracts require them to protect it to a standard consistent with this policy and applicable data-protection law.
10. Changes to this policy
When we update this policy we post the new version here and change the "Last updated" date. For significant changes we notify you by email or a notice in your account.
Privacy questions or requests: support@diilzo.com, +256 700 000 000 (Mon–Sat, 8am–8pm EAT), or via the contact page.
