Updated: 1 July 2026

1. Introduction

Choto (we, our or us) is committed to protecting your privacy. This Privacy Policy explains how your personal information is collected, used, and disclosed when you use the Choto digital Energy-as-a-Service (EaaS) platform.

This Privacy Policy applies to the Choto website and its associated subdomains, together with our mobile application and digital platform (collectively, the Platform or the Service), through which customers access renewable energy services, including Scan & Go battery rental, Amanzi purified water and Freeze Hub cold storage, at independently operated local energy hubs.

By accessing or using the Platform, you confirm that you have read, understood and agree to our collection, storage, use and disclosure of your personal information as described in this Privacy Policy and in our Terms & Conditions. If you do not agree, please do not use the Choto Service.

2. Definitions & Key Terms

For clarity, the following terms have the meanings set out below wherever they appear in this Privacy Policy:

Agent / Local Agent — an independent business that operates a physical energy hub and delivers Choto services to customers through the Platform.
Company — Galactic Renewables (54 Jason Moyo Ave, Harare, Zimbabwe), the entity responsible for your information under this Privacy Policy.
Country — Zimbabwe, where Choto and the owners/founders of Choto are based.
Customer / You — a person or entity registered with Choto, or otherwise using the Platform, to access energy services.
Cookie — a small amount of data generated by a website and saved by your web browser, used to identify your browser, provide analytics, and remember information such as your language preference or login details.
Device — any internet-connected device — such as a phone, tablet or computer — used to access the Platform and use the Services.
Energy Hub — a community-operated location, run by an Agent, at which Choto energy services are delivered.
IP Address — a number assigned to every device connected to the internet, which can often be used to identify the general location from which a device connects.
Personnel — individuals employed by Choto or under contract to perform a service on its behalf.
Personal Data — any information that, directly or indirectly, or in combination with other information, allows for the identification of a natural person.
Platform / Service — the Choto website, mobile application and digital Energy-as-a-Service system, together with all associated features and functionality.
Third-Party Service — advertisers, sponsors, marketing partners and other providers whose content, products or services are made available through or linked from the Platform.

3. What Information Do We Collect?

We collect information from you when you visit the Platform, register an account, load a wallet or make a payment, rent or purchase an energy service, subscribe to updates, respond to a survey or otherwise contact us. This may include:

name or username;
phone number;
email address;
mailing and billing addresses;
age;
account password;
payment information, including mobile money and card details processed through our payment providers; and
transaction and service-usage records, such as battery rentals and swaps, water dispensed and cold-storage bookings.

With your permission, we may also collect information from your mobile device — such as approximate or precise location — to help you find nearby energy hubs and available services. These device features are optional and can be managed through your device settings.

4. How Do We Use the Information We Collect?

Any information we collect from you may be used to:

personalise your experience and help you find relevant energy hubs and services;
provide, operate and improve the Platform and our energy services;
process transactions, manage your wallet and deliver the services you request;
respond to your customer service requests and support needs;
administer a contest, promotion, survey or other Platform feature;
communicate with you about your account, transactions and service updates; and
send periodic emails where you have chosen to receive them.

5. The Agent Network & Your Information

Choto operates a marketplace that connects you with independently operated energy hubs. To deliver a service you request, we may share limited information with the relevant Agent — for example, confirming a valid battery rental, water purchase or storage booking so the Agent can serve you at their hub.

Agents are independent businesses and are responsible for handling any personal information they collect directly from you at their locations in accordance with applicable law. We share only the information reasonably necessary to complete your transaction, and we do not authorise Agents to use that information for their own unrelated marketing.

6. Information We Receive from Third Parties

We may receive information about you from third parties when you interact with us. For example, when you submit your details to show interest in becoming a Choto customer, we may receive information from a provider of automated fraud-detection services. We may also collect information you have made publicly available on social media, which you can control through your privacy settings on those platforms.

7. Do We Share the Information We Collect?

We may share the information we collect, both personal and non-personal, in the following circumstances:

Service providers

We engage trusted third-party providers to perform functions on our behalf — such as hosting and maintaining our servers and the Platform, database storage, email management, payment and mobile-money processing, customer service, and fulfilling the services you access. We share personal information with these providers only to the extent needed to perform these services.

Local Agents

As described in Section 5, we share limited transaction information with the Agent who will deliver your requested service.

Analytics and advertising partners

We may share portions of our log-file data, including IP addresses, with analytics partners and ad networks. Where an IP address is shared it may be used to estimate general location, connection type and device type, and to provide aggregated auditing, research and reporting.

Business transfers and affiliates

We may share or transfer your information to our current and future affiliated companies, and, in the event of a merger, asset sale or other reorganisation, to our successors-in-interest, provided they agree to honour this Privacy Policy.

Legal and safety

We may disclose information to government or law-enforcement officials, or to private parties, where we believe in our sole discretion it is necessary to respond to legal process, protect our rights or those of others, ensure the safety of any person, prevent illegal or harmful activity, or comply with applicable laws and court orders.

8. How Do We Use Your Email Address?

By submitting your email address on the Platform, you agree to receive emails from us. We only email people who have authorised us to contact them, and we do not send unsolicited commercial email. You can unsubscribe at any time using the opt-out link included at the bottom of each email. Email addresses submitted solely through the order or payment process are used only to send information relating to that transaction, unless you have also provided the same address to us through another method.

9. How Long Do We Keep Your Information?

We keep your information only for as long as we need it to provide the Choto Service and fulfil the purposes described in this policy, plus any period required to meet our legal, tax or regulatory obligations. The same applies to anyone who carries out services on our behalf.

Where you delete your account, we will remove or anonymise your personal information from the databases we actively use within a reasonable period (ordinarily within 60 days), except where we are required by law to retain certain records, such as transaction and financial records, for longer.

10. How Do We Protect Your Information?

We implement a range of security measures to keep your personal information safe when you register, make a payment, or otherwise submit information. Sensitive payment information is transmitted using encryption and processed through our payment providers; full card details are not stored on our systems after a transaction.

However, no method of transmission or storage is completely secure. While we use reasonable physical, electronic and managerial safeguards to protect your information, we cannot guarantee its absolute security. If applicable law imposes any non-disclaimable duty to protect your personal information, you agree that intentional misconduct will be the standard used to measure our compliance with that duty.

11. International Transfers

Choto is incorporated in Zimbabwe. Information we collect may be transferred to, and hosted by, our offices, personnel or third-party providers located in other countries, including countries that may not have data-protection laws equivalent to those in your own jurisdiction. To the fullest extent allowed by applicable law, by using the Platform you consent to the transfer and hosting of your information in this way.

12. Your Rights — Access, Correction & Deletion

You may contact us to (1) update or correct your personal information, (2) change your communication preferences, or (3) delete the personal information we hold about you, by cancelling your account. Such updates and deletions will not affect information we are required to retain by law, or information already shared with third parties in accordance with this Privacy Policy before your request.

To protect your privacy and security, we may take reasonable steps to verify your identity — for example, by requesting your account password — before granting access or making corrections. You are responsible for keeping your password and account details confidential.

Please note that, because we back up our systems to protect against inadvertent loss, a copy of your information may remain in a non-erasable form that is difficult to locate. Promptly after receiving your request, information in the databases we actively use and in other readily searchable media will be updated, corrected or deleted as soon as, and to the extent, reasonably and technically practicable.

13. Personnel

If you are a Choto worker or applicant, we collect the information you voluntarily provide and use it for human-resources purposes, such as administering benefits and screening applicants. You may contact us to update or correct your information, change your preferences, or receive a record of the information we hold about you, subject to the same limitations described above.

14. Sale of Business & Corporate Affiliates

We reserve the right to transfer your information to a third party in the event of a sale, merger or other transfer of all or substantially all of the assets of Choto or its Corporate Affiliates, or in the event of bankruptcy or a similar proceeding, provided the third party agrees to adhere to this Privacy Policy.

For the purposes of this policy, a Corporate Affiliate means any person or entity that directly or indirectly controls, is controlled by, or is under common control with Choto. Any information we provide to a Corporate Affiliate will be treated in accordance with this Privacy Policy.

15. Children's Privacy

The Choto Service is not directed to children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us. If we become aware that we have collected personal information from a child under 13 without verified parental consent, we will take steps to remove that information from our systems.

16. Cookies & Tracking Technologies

Cookies

Choto uses cookies to identify the areas of the Platform you have visited and to enhance its performance and functionality. Most browsers can be set to disable cookies; however, if you do, certain functionality may become unavailable or you may be required to enter your login details each time you visit. We never place personally identifiable information in cookies.

Blocking and disabling cookies

You may set your browser to block cookies and similar technologies, but doing so may block essential cookies and prevent parts of the Platform from working properly, and you may lose saved information such as login details and site preferences. Disabling a cookie does not delete it from your browser; you can remove cookies through your browser's help menu.

Tracking technologies we use

Google Maps API — used to display maps, locate nearby energy hubs and plan routes. Google Maps API may collect information from you and your device for security purposes, held in accordance with Google's privacy policy.
Local storage — sometimes known as DOM storage, this allows the Platform to store data on your device to support persistent features, similar to cookies but with greater capacity.

17. Advertising

The Platform may contain third-party advertisements and links to third-party sites. Choto makes no representation as to the accuracy or suitability of the information in those advertisements or sites and accepts no responsibility for their content, conduct or the products or services they offer. Third-party advertisements and links are not endorsements by Choto.

Cookies for advertising

Advertising cookies collect information over time about your activity on the Platform and other services to make advertisements more relevant to you — known as interest-based advertising. They also help prevent the same ad from repeatedly appearing and ensure ads display correctly, and provide advertisers with aggregate reporting on how ads performed.

18. Payment Details

In respect of any card, mobile-money or other payment details you provide, we commit that this confidential information will be stored and processed in the most secure manner possible, through our payment providers and consistent with Section 10.

19. Information for EEA Users (GDPR)

If you are located in the European Economic Area (EEA), the General Data Protection Regulation (GDPR) may apply to our collection and use of your personal information. We apply GDPR-aligned controls as a baseline standard across our operations, regardless of where our customers are located, because we believe your data privacy is important.

What is personal data?

Under the GDPR, personal data is any data relating to an identifiable individual — extending beyond a name or email address to include information such as financial details, IP addresses, physical address, and other identifiers that, alone or combined, could identify a person.

Data-protection principles

These principles require, among other things, that personal data be processed fairly, lawfully and transparently; collected only for a specified purpose and used only for that purpose; held no longer than necessary; and made accessible to the individuals it concerns.

Your GDPR rights — access, portability and deletion

We are committed to helping EEA users exercise their data-subject rights, including the right to access, correct, port and delete their personal data. We process and store personal data through vetted, data-processing-agreement-compliant vendors. Where you request deletion or delete your account, we dispose of your personal data in accordance with our Terms & Conditions and this Privacy Policy, subject to any retention required by law.

20. Links to Other Websites & Third-Party Services

This Privacy Policy applies only to the Choto Service. The Platform may contain links to, or make available content from, websites and services not operated or controlled by Choto. We are not responsible for the content, accuracy or practices of those third parties, and this Privacy Policy no longer applies once you follow a link away from the Platform. Your use of any third-party website or service is subject to that party's own terms and privacy practices, and such parties may use their own cookies or other methods to collect information about you.

21. Governing Law

This Privacy Policy is governed by the laws of Zimbabwe, without regard to its conflict-of-laws provisions. You consent to the exclusive jurisdiction of the courts of Zimbabwe in connection with any action or dispute arising under or in connection with this Privacy Policy. Your use of the Platform may also be subject to other local, national or international laws that apply to you.

22. Changes to This Privacy Policy

We may change our Service and policies, and may need to update this Privacy Policy to reflect those changes. Unless otherwise required by law, we will notify you (for example, through the Platform) before material changes take effect and give you an opportunity to review them. If you continue to use the Service after changes become effective, you will be bound by the updated Privacy Policy. If you do not agree to an updated policy, you can delete your account.

Your consent

By using the Platform, registering an account, or making a purchase, you consent to this Privacy Policy and agree to its terms.

23. Contact Us

If you have any questions about this Privacy Policy or how we handle your information, please contact us:

Email: choto.energy@gmail.com

Web: www.chotoenergy.co.zw

Operator: Galactic Renewables, 54 Jason Moyo, Harare, Zimbabwe