Privacy Policy
Last updated: 17 September 2026
This policy explains how Elitrasmart Ltd handles personal information when you use the SMART 2026 National Quiz ticketing platform. We are the data controller for that information.
Information we collect
When you create an account or buy a ticket we collect:
- your name, email address and, if you give it, your telephone number;
- your order and payment details: what you bought, for which day, how much, the payment method, and the payment reference;
- for Mobile Money payments, the Mobile Money number you pay from and the provider you chose;
- technical information such as your IP address and browser type, recorded in our security and audit logs;
- ticket records, including whether a ticket has been used at the entrance, and when.
We never ask for, receive or store your Mobile Money PIN. The PIN is entered on your own handset as part of your provider's approval process. Payments are processed by PawaPay, our payment service provider, and we receive only the outcome and reference of the transaction.
When you do something that affects your order - starting or cancelling a payment, asking us to check a payment status, requesting a refund - we record it against your account with the date, your IP address and your browser type. This is the audit trail that lets us answer "what happened to my money?" with facts rather than a guess, and it is kept for the same period as the money records it describes.
Why we use it
- to create your account and issue, deliver and validate your tickets;
- to take payment and to keep an accurate record of what was paid, refunded or confirmed;
- to contact you about your order, including tickets, confirmations and refunds;
- to keep the platform secure and to prevent fraud and abuse;
- to meet accounting, tax and audit obligations.
What we email you
We send email only about your account and your orders: address verification, ticket delivery with the PDFs, receipts, and the things that change an order's state - a payment that failed, a hold that expired, a cancellation, a refund request and its outcome. There is no newsletter and no marketing list; you cannot be subscribed to one by buying a ticket, and we do not send email to addresses that do not hold an account or an order.
Who we share it with
We share the minimum necessary with the organisations that help us run the platform:
- PawaPay and the Mobile Money provider you choose, to process a Mobile Money payment. Refunds are not processed through them: Elitrasmart returns refund money itself, so a refund is not a reason we share your details with PawaPay;
- our email provider, to deliver tickets and account emails to you;
- our hosting provider, which stores the platform and its database.
We do not sell your personal information, and we do not share it for advertising.
How long we keep it
Ticket and payment records are kept for as long as we need them for accounting and audit purposes and to resolve disputes, and after that they are deleted. Account information is kept while your account is open. Audit and security logs are kept for a limited period and then deleted.
You can delete your account yourself from your settings at any time, and you are told which of two things happened. If nothing is attached to the account - no order, no ticket, no history - it is deleted outright. If you have bought something, the account is instead closed and anonymised: your name, email address and telephone number are erased, the email is replaced with an address on a domain that cannot receive mail, your password is replaced with one that cannot be used, and you can no longer sign in.
The orders, payments and tickets stay in that case, because we have to account for money that changed hands and a ticket has to remain checkable at the entrance. Any ticket you still hold stays valid - the PDF we emailed you is yours to use - and the records no longer name you.
Security
We protect your information with encryption in transit, access controls, and a full audit trail of the actions staff take on orders and payments. Payment credentials, including any provider API tokens, are held in server-side configuration and are never exposed to your browser.
Your rights
Under the Zambian Data Protection Act No. 3 of 2021 you may ask for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it where we are not required to keep it, and object to certain uses. To make a request, email elitrasmartltd@gmail.com.
Please tell us if you believe we have handled your information incorrectly and we will investigate. You may also raise a concern with the Data Protection Commissioner of Zambia.
Cookies
We set four cookies, all of them ours and all of them needed to run the site: the session, a security token for the forms you submit, a "remember me" cookie if you ask for one, and one that records that you have read the cookie notice. There is no analytics product, no advertising and no third-party cookie. See our Cookie Policy for each one by name and lifetime.
Changes
If we change this policy we will update the date at the top and, where the change is significant, tell account holders by email.
Contact
Elitrasmart Ltd
Email: elitrasmartltd@gmail.com
Website: https://www.elitrasmartltd.com/