Privacy Policy

1. About this policy

This Privacy Policy explains how Zala handles personal information when you browse its website or applications, create an account, place orders, communicate with support, or use vendor and delivery-related services.

The information collected depends on the services you use. This policy also covers guest sessions where information is collected without a registered account.

2. Information we collect

Zala may collect the following information as relevant to your use of the platform:

• Account information: name, email address, mobile number, authentication information, and an optional profile image.
• Delivery information: recipient details, delivery address, dzongkhag, area, postal information, and delivery instructions. Certain forms may also request identification information, such as a CID number.
• Order information: products purchased, quantities, prices, payment status, delivery records, cancellations, and refund requests.
• Payment and refund information: transaction references, payment-provider responses, relevant bank or account details, and information needed to reconcile payments or arrange refunds.
• Communications: support requests, messages, reviews, and images or documents you choose to submit.
• Device and technical information: IP address, browser or application information, device identifiers, device names, notification tokens, and access or activity records.
• Vendor and delivery-partner information: business, contact, operational, and settlement information needed to provide marketplace and delivery services.

Please provide only information relevant to the service or request. Do not include passwords, banking PINs, or one-time verification codes in support messages or uploaded images.

3. Where information comes from

We receive information directly from you and through your use of Zala.

We may also receive information from vendors, delivery partners, and payment providers—for example, order acceptance, delivery confirmation, or payment results.

If you choose Google or Apple sign-in, we receive the identity information made available through that service, such as a provider identifier and available profile details. Those providers also handle information under their own privacy policies.

4. How we use information

We use information to:

• Create and maintain accounts and authenticate users.
• Process orders, payments, deliveries, cancellations, and refunds.
• Communicate order updates and respond to support requests.
• Enable vendors and delivery partners to fulfil their responsibilities.
• Maintain transaction records and meet applicable legal obligations.
• Detect fraud, investigate misuse, and protect accounts and services.
• Diagnose technical problems and improve platform operation.
• Send promotional communications where permitted and with consent where required.

Information will not be used for an unrelated purpose without any notice, consent, or other authorisation required by applicable law.

5. When information is shared

We share relevant information with:

• Vendors: information needed to prepare and fulfil your order, address complaints, and review refund requests.
• Delivery partners: recipient contact details, delivery addresses, order information, and delivery instructions.
• Vendor systems: relevant order and customer information may be transmitted to a vendor’s connected point-of-sale system.
• Payment providers: information needed to initiate, verify, reconcile, or refund a payment.
• Service providers: providers supporting hosting, communications, push notifications, authentication, and platform operation.
• Authorities or professional advisers: where necessary to comply with law, respond to a lawful request, resolve a dispute, or protect legal rights.

Access should be limited to what is necessary for the relevant purpose. Any additional sharing that requires separate consent will be subject to that consent.

6. Payments

Payments are processed through the methods made available at checkout. Relevant payment providers may collect information directly and apply their own privacy terms.

Zala retains transaction and payment-related information needed for order processing, reconciliation, refunds, fraud prevention, and lawful recordkeeping. This may include financial or account information supplied during the transaction.

7. Cookies, guest sessions, and device permissions

The website uses cookies or similar session technologies to support functions such as sign-in, security, and preferences. Restricting these technologies through browser settings may prevent some features from working.

Guest use may involve a device identifier and activity records even when you have not created a registered account.

The application may request permissions when you use relevant features, such as uploading an image or receiving notifications. You can manage available permissions through your device settings. Disabling a permission may affect the associated feature.

8. Notifications and marketing choices

Zala may send order, payment, delivery, security, and support communications through available channels.

You can manage push-notification permissions through your device settings. You may also request that promotional communications stop through Zala’s support channels. This does not necessarily prevent essential service information from appearing in your account or being sent where necessary and lawful.

9. Information security

Zala uses access controls and other technical and organisational measures intended to protect personal information against unauthorised access, misuse, alteration, or loss.

No online service can guarantee absolute security. Keep your account credentials confidential and notify Zala promptly if you suspect an account or privacy incident.

10. Retention

Information is retained for as long as reasonably needed for the purpose for which it was collected, including fulfilling orders, resolving disputes, maintaining required records, and meeting legal obligations.

Different records may have different retention periods. Information that is no longer required should be deleted or anonymised in accordance with applicable requirements.

11. Access, correction, and account deletion

You may use available account features or Zala’s support channels to request access to, correction of, or deletion of your personal information, subject to applicable law. We may need to verify your identity before acting on a request.

Where account deletion is available, deleting an account does not necessarily remove all transaction records immediately. Some information may need to be retained for legal, accounting, security, or unresolved-dispute purposes. Copies in backups or records held by independent service providers may follow separate lawful retention processes.

Deleting your account does not itself cancel an outstanding order or resolve an existing refund request.

12. Processing outside Bhutan

Some service providers may process information outside Bhutan. Where this occurs, the handling and protection of the information must comply with applicable legal requirements.

13. Children’s information

Zala is not intended for children to make purchases independently. A parent or legal guardian should authorise and supervise a minor’s use involving personal information or transactions.

If you believe a child has provided information improperly, raise the concern through Zala’s support channels so it can be reviewed.

14. Changes and privacy concerns

Zala may revise this policy as its services or legal obligations change. The current version will display its effective date, and material changes will be communicated where required.

You may raise privacy questions or requests through the support options available in the Zala website or application.