1. Introduction, Scope, and Legal Applicability

This Privacy Policy ("Privacy Policy") sets out the principles, practices, and legal bases governing how TeamZoro (Private) Limited, together with its affiliates, subsidiaries, and controlled entities ("TeamZoro," "we," "us," or "our"), collects, processes, stores, uses, discloses, and protects personal data in connection with the operation of the TeamZoro platform.

This Policy applies to all interactions with TeamZoro's mobile applications, websites, backend systems, APIs, cloud services, and any related digital or physical interfaces (collectively, the "Platform"). By accessing or using the Platform, you acknowledge that you have read, understood, and agreed to this Privacy Policy. If you do not agree, you must immediately discontinue use of the Platform.

This Policy is intended to comply with applicable data protection laws of Sri Lanka and to align, where relevant, with international standards including GDPR-inspired principles, Apple App Store Review Guidelines, and Google Play Developer Policies.

2. Categories of Users and Applicability Across Roles

TeamZoro operates a multi-sided marketplace. Accordingly, this Privacy Policy applies equally to all categories of users, regardless of whether they interact with the Platform occasionally or on a recurring basis.

Different users may provide different types and volumes of personal data depending on their role, level of activity, and legal requirements applicable to them. However, all personal data collected through the Platform is subject to the protections, limitations, and obligations set out in this Policy.

Covered roles include, without limitation:

• Customers
• Merchants
• Service Providers
• Delivery Partners ("ZoroRunners")
• Authorized representatives and administrators

3. Platform Nature and Data Controller Position

TeamZoro operates as a technology marketplace facilitator and does not itself sell goods or provide services to end users. Transactions occur between customers and independent third-party merchants, service providers, or delivery partners.

For the purposes of applicable data protection laws, TeamZoro acts as a data controller with respect to personal data collected directly through the Platform, as it determines the purposes and means of processing such data. Certain third parties (such as payment processors or cloud infrastructure providers) may act as independent controllers or processors under separate legal arrangements.

TeamZoro does not assume responsibility for the privacy practices of third parties beyond the extent required by law or contractual obligation.

4. Categories of Personal Data Collected

TeamZoro collects only personal data that is reasonably necessary to operate a secure, compliant, and functional marketplace platform. Depending on user role and activity, this may include:

• Identity and verification data (including government-issued identification where required)
• Contact information such as name, email address, telephone number, and physical address
• Account profile and preference information
• Location data necessary to fulfill deliveries or services
• Financial and payout-related information for merchants and service providers
• Device, usage, and technical data related to Platform access
• Communications, support requests, and dispute records

TeamZoro does not collect or process digital-goods payment data subject to app-store in-app purchase rules.

5. Purposes and Legal Grounds for Processing

Personal data is processed strictly for legitimate business purposes and only to the extent necessary to operate the Platform lawfully and efficiently. Processing is conducted on one or more of the following legal bases: contractual necessity, legitimate interests, legal obligation, or user consent where required.

Primary purposes include enabling user participation, verifying identity and eligibility, facilitating transactions, managing payments and payouts, resolving disputes, preventing fraud, improving system security, and complying with applicable laws.

TeamZoro does not process personal data for purposes incompatible with those disclosed in this Policy.

6. Communications, Marketing, and In-Platform Promotions

TeamZoro may communicate with users for operational, legal, and service-related purposes. These communications are necessary for account administration, transaction confirmation, dispute handling, and compliance obligations.

TeamZoro may also conduct in-platform marketing and promotional activities exclusively within the TeamZoro ecosystem. Personal data is not shared with external advertisers, advertising networks, or data brokers.

Users may opt out of non-essential marketing emails at any time. TeamZoro does not send marketing communications via SMS or WhatsApp.

7. Cookies, Analytics, and Platform Monitoring

TeamZoro uses cookies, local storage, and similar technologies strictly to support Platform functionality, security, and performance. These technologies are not used for cross-platform or cross-application tracking.

Analytics and performance monitoring are conducted using Google-provided services only, including Firebase and related tools. Analytics data is used internally to improve reliability, security, and user experience and is not shared externally.

8. Data Storage, Cloud Infrastructure, and Transfers

Personal data is stored using secure cloud infrastructure operated primarily through Google Cloud services, including Cloud Run, Firebase, and Cloud SQL. Data may be processed in multiple jurisdictions as required for operational efficiency and system reliability.

Where cross-border data transfers occur, TeamZoro implements safeguards consistent with industry standards and applicable legal requirements to protect user data.

9. Data Sharing and Lawful Disclosure

TeamZoro discloses personal data only when necessary to operate the Platform or when legally required. This may include disclosures to:

• Payment processors and banking partners
• Cloud infrastructure providers
• Legal, regulatory, or law-enforcement authorities pursuant to valid legal requests

TeamZoro does not sell, lease, or trade personal data to third parties for commercial gain.

10. User Rights and Data Control

Users may request access to, correction of, or deletion of personal data they have directly provided, subject to legal and operational limitations. Certain data, including analytics, compliance, and fraud-prevention records, may not be editable or removable where retention is required by law or legitimate business necessity.

Requests are handled in accordance with applicable laws and reasonable verification requirements.

11. Data Retention and Account Deletion

Personal data is retained only for as long as necessary to fulfill contractual, operational, legal, and regulatory obligations. When an account is deleted, personal data is removed or anonymized unless retention is required for dispute resolution, fraud prevention, financial recordkeeping, or compliance with law.

12. Fraud Prevention, Abuse Detection, and Enforcement

TeamZoro actively monitors Platform activity to detect fraud, abuse, misuse, or violations of Platform policies. Personal data may be reviewed, retained, or disclosed as necessary to investigate and address such matters.

TeamZoro reserves broad discretion to take enforcement actions, including account suspension or termination, consistent with applicable laws.

13. Age, Content Visibility, and Legal Eligibility

TeamZoro does not offer or facilitate any inherently age-restricted services. The Platform does not permit massage services, adult services, or any activities that would require age-based access controls under applicable law.

Certain physical products or services listed by third-party merchants or service providers may, under applicable laws or regulations, be appropriate only for specific age groups. In such cases, TeamZoro may restrict visibility, availability, or discoverability of those listings through Platform-level controls rather than relying on user self-declaration.

TeamZoro does not actively collect age data for general Platform access. Instead, compliance with age-related legal requirements is enforced through content moderation, listing rules, and product or service visibility restrictions implemented at the Platform level.

Users represent and warrant that they are legally capable of entering into binding agreements under the laws applicable to them. TeamZoro reserves the right to restrict access, remove listings, or take enforcement action where legal eligibility concerns arise.

14. Security Measures, Risk Acknowledgment, and Policy Updates

TeamZoro implements reasonable administrative, technical, and organizational measures to safeguard personal data. However, no system can be guaranteed to be completely secure, and users acknowledge inherent risks in electronic data transmission.

TeamZoro may update this Privacy Policy from time to time. Changes become effective upon publication. Continued use of the Platform constitutes acceptance of the updated Policy.

Contact