Privacy policy
What Pabasa records, who can see it, and when it is deleted.
Pabasa is a product of Statotech Systems, Harare, Zimbabwe. This page is written from what the software actually does. Last updated 15 October 2026.
Who is responsible for the data
Pabasa is used by organisations that run field teams. The organisation that deploys it (the “customer”) decides who is enrolled, which shops are in scope and how long records are kept for payroll, and it is the controller of its people’s data. Statotech Systems processes that data on the customer’s behalf, to run the service, and for nothing else. If you are a merchandiser using the app, your employer or contracting company is the first place to ask about your records; we will help them answer.
What is collected
- Accounts. Name, work email address, role (merchandiser, store manager or super admin) and a hashed password. Passwords are never stored in plain text.
- Location, only during a shift. When a merchandiser checks in, the phone sends its GPS fix, the fix’s reported accuracy and the time. The server decides whether the fix falls inside the shop’s geofence. A location sent outside an open shift is refused and is not stored.
- Device and network signals. To tell a genuine fix from a replayed or spoofed one, the app also records nearby Wi‑Fi network identifiers and a device registration for the phone. These are used for the verdict on a check-in, not to identify a person beyond their account.
- Checklists and photos. Where a customer configures a checklist, answers and any photos taken for it are stored with the check-in they belong to. Photos are of shop shelves and displays, taken deliberately by the merchandiser; the app does not take pictures on its own.
- The ledger. Every check-in verdict, break and correction is appended to a record. A correction is added beside the original and never overwrites it, so the month can be audited.
What is not collected
- No location outside an open shift. The app may ask for background location permission so a check-in works while the phone is in a pocket, but the server refuses and discards samples that arrive outside a shift.
- No contacts, messages, call logs or browsing history.
- No advertising or analytics trackers, on this site or in the app.
Who can see it
Three roles only. A merchandiser sees their own record. A store manager sees the merchandisers and shops assigned to them. A super admin at the customer sees the customer’s whole tenancy. Nobody at one customer can see another customer’s data, and Statotech staff look at a customer’s records only when the customer asks for help with a specific problem.
Where it is kept, and for how long
- Data is stored on servers Statotech operates, currently hosted in the United States, and reached over HTTPS only. Photos are kept in a private object store that refuses unsigned requests.
- Raw location samples are purged after 90 days by a scheduled job; the purge itself is written to the ledger.
- Check-in verdicts, checklist answers and photos are kept for as long as the customer’s agreement requires, which is normally the period the customer must keep payroll and attendance records.
- When a customer leaves, its data is exported to it on request and then deleted.
Your rights
You can ask what is held about you, ask for it to be corrected, and ask for it to be deleted where the customer’s legal duties allow. Write to your organisation first, or to contact@statotec.com and we will route the request. Zimbabwe’s Cyber and Data Protection Act [Chapter 12:07] is the law this policy is written against.
Changes
If how the software handles data changes, this page changes with it and the date at the top moves. Material changes are told to customers before they take effect.