Who We Are
BanjaStay is the trading name of Gerverse Jeje Chelani Lungani (sole proprietor). This Privacy Policy explains how we collect and use information when you use the BanjaStay lodge management software and related websites.
Information We Collect
Lodge Information
Examples include:
- Business name
- Contact details
- Address
- Subscription details
Guest Information Entered by Lodges
Examples include:
- Guest names
- Contact details
- Booking details
- Stay history
- Payment records
Technical Information
Examples include:
- IP address
- Browser and device information
- Usage logs
- Security logs
How We Use Information
BanjaStay uses data to:
- Provide platform functionality
- Process subscriptions
- Improve system performance
- Provide customer support
- Maintain security
- Generate reports
Data Ownership
The lodge remains responsible for guest data entered into BanjaStay.
BanjaStay acts as a service provider processing information on behalf of the lodge.
Data Security & Encryption
We enforce technical & organizational security measures including:
- AES-256-GCM Field-Level Encryption: Sensitive guest PII (such as National Registration Card / Passport numbers and physical addresses) and integration keys are encrypted at rest using AES-256-GCM with unique initialization vectors.
- Role-Based Access Control (RBAC): Multi-tenant scoping prevents unauthorized access across properties.
- Audit Logging: Administrative modifications and access attempts are recorded in immutable audit logs.
Authorized Data Subprocessors
BanjaStay engages authorized third-party service providers (subprocessors) to support platform services. All subprocessors operate under strict data protection agreements compliant with the Zambia Data Protection Act (2021) and global privacy standards:
- MongoDB Atlas (Cloud Database) — Encrypted database infrastructure (US/EU Cloud Regions).
- Twilio / SMS Gateways — Transactional booking & check-in SMS notifications.
- Paddle Billing & DPO Pay — SaaS subscription billing & lodge payment gateway integration.
- Stripe Inc. — Card payment processing and tokenization.
Cross-Border Data Transfers
In accordance with Section 48 of the Zambia Data Protection Act, 2021, personal data processed by BanjaStay may be hosted on secure cloud infrastructure located outside Zambia. Transfers are protected by statutory safeguards, encrypted transit, and contractually binding data processing standards.
Data Subject Rights (ZDA 2021 & GDPR)
Guests and lodge users may exercise their statutory data protection rights:
- Right of Access (DSAR): Request a full structured copy of stored personal records.
- Right to Rectification: Request correction of inaccurate information.
- Right to Erasure / Anonymization: Request PII anonymization for eligible historical bookings.
- Right to Data Portability: Obtain machine-readable data exports (JSON/CSV).