DIREKT Zambia Legal and Regulatory Research

Status: Open; qualified Zambian legal review required.
Warning: This document organizes questions and evidence. It does not provide legal advice.

DIREKT plans to process identity, contact, business, qualification, location, review, complaint, audit and potentially payment data. The legal review must address the complete lifecycle: collection, verification, use, public display, sharing, retention, correction, suspension and deletion.

2. Authority and source hierarchy

Use:

  1. enacted Zambian statutes and current statutory instruments;
  2. official regulator/authority guidance;
  3. written authority confirmation or approved agreements;
  4. qualified Zambian legal advice;
  5. case law or formal decisions where relevant;
  6. secondary commentary only as research support.

Do not implement from news articles or generic international templates.

3. Personal-data and privacy questions

Legal counsel must confirm:

  • DIREKT’s role for each data flow;
  • lawful basis for identity, contact, location, certificate, complaint and audit processing;
  • whether consent is required, sufficient or inappropriate for particular processing;
  • registration or notification obligations with the data-protection authority;
  • privacy notice and policy-version requirements;
  • sensitive or special-category data treatment;
  • children and vulnerable-person restrictions;
  • automated decision-making or profiling implications;
  • data subject access, correction, objection, restriction and deletion rights;
  • processor/vendor contracts;
  • cross-border hosting and transfer requirements;
  • breach reporting and notification obligations;
  • retention and deletion periods;
  • public-repository and prototype constraints.

4. Identity and credential verification

Confirm:

  • accepted identity documents and permitted verification methods;
  • whether document images may be stored and for how long;
  • whether identifiers may be partially displayed;
  • access rules for official registries;
  • permitted use of PACRA, NCC, TEVETA or other authority information;
  • whether written data-sharing arrangements are required;
  • whether DIREKT may state that a record matched an official source;
  • correction and appeal obligations after mismatch;
  • liability for stale, incorrect or unavailable source records;
  • impersonation and forged-document reporting obligations.

5. Location and field verification

Confirm:

  • collection and use of precise coordinates;
  • provider consent and notice for premises visits;
  • photography of premises, signage, tools and documents;
  • rights of household members, employees, neighbours and landlords;
  • home-based provider privacy;
  • public map publication;
  • field-agent identification and safety;
  • retention of field routes and visit evidence;
  • recording refusals, absence and disputed locations;
  • lawful sharing with customers or authorities.

6. Consumer and marketplace representations

Review all trust language, including:

  • “identity checked”;
  • “business registration matched”;
  • “qualification checked”;
  • “premises visited”;
  • “customer reviews from tracked interactions”;
  • “check expired”;
  • “not independently confirmed”.

Confirm:

  • misleading or unfair commercial-practice risks;
  • warranties and disclaimers;
  • platform responsibility for provider conduct;
  • duty to act after complaints or safety reports;
  • sponsored-listing disclosure;
  • pricing and subscription disclosures;
  • cancellation/refund rights;
  • complaint and dispute obligations;
  • record retention for disputes;
  • terms for customer-provider contracts formed off-platform.

No disclaimer may contradict the actual product or excuse negligent platform operations.

7. Defamation, reviews and complaints

Confirm:

  • moderation and notice processes;
  • provider right to respond or appeal;
  • publication of ratings and complaint-derived restrictions;
  • handling unproven allegations;
  • suspension pending investigation;
  • emergency disclosure;
  • reviewer anonymity;
  • evidence standards;
  • retention after profile removal;
  • authority-reporting obligations.

DIREKT should publish neutral factual states and avoid declaring criminality or incompetence without an appropriate legal basis.

8. Sector and category regulation

For each pilot category determine:

  • mandatory individual qualification;
  • contractor/business registration;
  • professional registration;
  • project-value or grade limitations;
  • local-authority licences;
  • safety permits;
  • insurance requirements;
  • protected titles;
  • renewal and disciplinary status;
  • activities that DIREKT should exclude from MVP.

Electrical, construction, borehole/water and other safety-sensitive categories require specific review rather than generic “trade verified” wording.

9. Payments and communications

Confirm:

  • permitted provider-subscription collection methods;
  • payment-service-provider licensing/approval dependencies;
  • customer-funds handling restrictions;
  • refund, reconciliation and receipt requirements;
  • tax and invoicing obligations;
  • mobile-money data handling;
  • SMS/OTP and electronic-communications rules;
  • marketing consent and unsubscribe requirements;
  • call/recording consent;
  • WhatsApp or other third-party platform terms;
  • transaction and communications retention.

DIREKT must not hold customer service payments or advertise escrow before the legal and operational model is approved.

10. Worker and field-agent model

Confirm:

  • employment versus independent contractor classification;
  • field-agent vetting and training;
  • occupational safety duties;
  • insurance and incident response;
  • use of agent location and performance data;
  • confidentiality obligations;
  • conflict of interest, bribery and anti-corruption controls;
  • authority to inspect and photograph premises;
  • handling of original documents and cash.

11. Intellectual property and public repository

Confirm:

  • DIREKT brand and trademark strategy;
  • licence status for public repository content;
  • contribution terms;
  • map, icon, font, image and SDK licences;
  • provider portfolio image rights;
  • customer review ownership and reuse;
  • authority logo and registry-data use;
  • open-source notices in Android, backend and admin clients.
ID Question Authority/source Status Owner Required before
LEG-001 Lawful basis and authority obligations for identity/certificate/private-location evidence Data protection law, authority guidance, counsel OPEN Legal lead production evidence collection
LEG-002 Permitted PACRA business-search use and public display PACRA terms/written confirmation/counsel OPEN Partnerships/legal automated business verification
LEG-003 NCC registration applicability by pilot category and job scope NCC law/guidance/counsel OPEN Trust/legal construction claims
LEG-004 TEVETA credential confirmation and display TEVETA guidance/agreement/counsel OPEN Trust/legal qualification claims
LEG-005 Public map/premises claims and field photography privacy/property/consumer law OPEN Legal/operations field verification
LEG-006 Review, complaint, suspension and appeal framework consumer/defamation/platform law OPEN Legal/support public reviews
LEG-007 Provider subscription, receipts, tax and refunds payment/tax/consumer law OPEN Finance/legal paid pilot
LEG-008 SMS/OTP and marketing communications communications/privacy rules OPEN Security/legal authentication/notifications
LEG-009 Cross-border cloud, Firebase and analytics processing data-protection rules/vendor terms OPEN Privacy/security staging with real users
LEG-010 Terms, privacy notice and provider agreement counsel OPEN Legal/product external pilot

Before Phase 11 pilot, the repository must contain a reviewed compliance checklist recording:

  • legal reviewer and scope;
  • source versions/dates;
  • decisions and conditions;
  • required registrations/agreements;
  • approved public copy;
  • retention schedule;
  • processor/vendor list;
  • unresolved risks accepted by the owner;
  • re-review triggers.

Phase 1A may identify and prioritize these questions but must not fabricate answers.