# DIREKT Zambia Legal and Regulatory Research

**Status:** Open; qualified Zambian legal review required.  
**Warning:** This document organizes questions and evidence. It does not provide legal advice.

## 1. Legal-review scope

DIREKT plans to process identity, contact, business, qualification, location, review, complaint, audit and potentially payment data. The legal review must address the complete lifecycle: collection, verification, use, public display, sharing, retention, correction, suspension and deletion.

## 2. Authority and source hierarchy

Use:

1. enacted Zambian statutes and current statutory instruments;
2. official regulator/authority guidance;
3. written authority confirmation or approved agreements;
4. qualified Zambian legal advice;
5. case law or formal decisions where relevant;
6. secondary commentary only as research support.

Do not implement from news articles or generic international templates.

## 3. Personal-data and privacy questions

Legal counsel must confirm:

- DIREKT’s role for each data flow;
- lawful basis for identity, contact, location, certificate, complaint and audit processing;
- whether consent is required, sufficient or inappropriate for particular processing;
- registration or notification obligations with the data-protection authority;
- privacy notice and policy-version requirements;
- sensitive or special-category data treatment;
- children and vulnerable-person restrictions;
- automated decision-making or profiling implications;
- data subject access, correction, objection, restriction and deletion rights;
- processor/vendor contracts;
- cross-border hosting and transfer requirements;
- breach reporting and notification obligations;
- retention and deletion periods;
- public-repository and prototype constraints.

## 4. Identity and credential verification

Confirm:

- accepted identity documents and permitted verification methods;
- whether document images may be stored and for how long;
- whether identifiers may be partially displayed;
- access rules for official registries;
- permitted use of PACRA, NCC, TEVETA or other authority information;
- whether written data-sharing arrangements are required;
- whether DIREKT may state that a record matched an official source;
- correction and appeal obligations after mismatch;
- liability for stale, incorrect or unavailable source records;
- impersonation and forged-document reporting obligations.

## 5. Location and field verification

Confirm:

- collection and use of precise coordinates;
- provider consent and notice for premises visits;
- photography of premises, signage, tools and documents;
- rights of household members, employees, neighbours and landlords;
- home-based provider privacy;
- public map publication;
- field-agent identification and safety;
- retention of field routes and visit evidence;
- recording refusals, absence and disputed locations;
- lawful sharing with customers or authorities.

## 6. Consumer and marketplace representations

Review all trust language, including:

- “identity checked”;
- “business registration matched”;
- “qualification checked”;
- “premises visited”;
- “customer reviews from tracked interactions”;
- “check expired”;
- “not independently confirmed”.

Confirm:

- misleading or unfair commercial-practice risks;
- warranties and disclaimers;
- platform responsibility for provider conduct;
- duty to act after complaints or safety reports;
- sponsored-listing disclosure;
- pricing and subscription disclosures;
- cancellation/refund rights;
- complaint and dispute obligations;
- record retention for disputes;
- terms for customer-provider contracts formed off-platform.

No disclaimer may contradict the actual product or excuse negligent platform operations.

## 7. Defamation, reviews and complaints

Confirm:

- moderation and notice processes;
- provider right to respond or appeal;
- publication of ratings and complaint-derived restrictions;
- handling unproven allegations;
- suspension pending investigation;
- emergency disclosure;
- reviewer anonymity;
- evidence standards;
- retention after profile removal;
- authority-reporting obligations.

DIREKT should publish neutral factual states and avoid declaring criminality or incompetence without an appropriate legal basis.

## 8. Sector and category regulation

For each pilot category determine:

- mandatory individual qualification;
- contractor/business registration;
- professional registration;
- project-value or grade limitations;
- local-authority licences;
- safety permits;
- insurance requirements;
- protected titles;
- renewal and disciplinary status;
- activities that DIREKT should exclude from MVP.

Electrical, construction, borehole/water and other safety-sensitive categories require specific review rather than generic “trade verified” wording.

## 9. Payments and communications

Confirm:

- permitted provider-subscription collection methods;
- payment-service-provider licensing/approval dependencies;
- customer-funds handling restrictions;
- refund, reconciliation and receipt requirements;
- tax and invoicing obligations;
- mobile-money data handling;
- SMS/OTP and electronic-communications rules;
- marketing consent and unsubscribe requirements;
- call/recording consent;
- WhatsApp or other third-party platform terms;
- transaction and communications retention.

DIREKT must not hold customer service payments or advertise escrow before the legal and operational model is approved.

## 10. Worker and field-agent model

Confirm:

- employment versus independent contractor classification;
- field-agent vetting and training;
- occupational safety duties;
- insurance and incident response;
- use of agent location and performance data;
- confidentiality obligations;
- conflict of interest, bribery and anti-corruption controls;
- authority to inspect and photograph premises;
- handling of original documents and cash.

## 11. Intellectual property and public repository

Confirm:

- DIREKT brand and trademark strategy;
- licence status for public repository content;
- contribution terms;
- map, icon, font, image and SDK licences;
- provider portfolio image rights;
- customer review ownership and reuse;
- authority logo and registry-data use;
- open-source notices in Android, backend and admin clients.

## 12. Legal research tracker

| ID | Question | Authority/source | Status | Owner | Required before |
|---|---|---|---|---|---|
| LEG-001 | Lawful basis and authority obligations for identity/certificate/private-location evidence | Data protection law, authority guidance, counsel | OPEN | Legal lead | production evidence collection |
| LEG-002 | Permitted PACRA business-search use and public display | PACRA terms/written confirmation/counsel | OPEN | Partnerships/legal | automated business verification |
| LEG-003 | NCC registration applicability by pilot category and job scope | NCC law/guidance/counsel | OPEN | Trust/legal | construction claims |
| LEG-004 | TEVETA credential confirmation and display | TEVETA guidance/agreement/counsel | OPEN | Trust/legal | qualification claims |
| LEG-005 | Public map/premises claims and field photography | privacy/property/consumer law | OPEN | Legal/operations | field verification |
| LEG-006 | Review, complaint, suspension and appeal framework | consumer/defamation/platform law | OPEN | Legal/support | public reviews |
| LEG-007 | Provider subscription, receipts, tax and refunds | payment/tax/consumer law | OPEN | Finance/legal | paid pilot |
| LEG-008 | SMS/OTP and marketing communications | communications/privacy rules | OPEN | Security/legal | authentication/notifications |
| LEG-009 | Cross-border cloud, Firebase and analytics processing | data-protection rules/vendor terms | OPEN | Privacy/security | staging with real users |
| LEG-010 | Terms, privacy notice and provider agreement | counsel | OPEN | Legal/product | external pilot |

## 13. Legal gate

Before Phase 11 pilot, the repository must contain a reviewed compliance checklist recording:

- legal reviewer and scope;
- source versions/dates;
- decisions and conditions;
- required registrations/agreements;
- approved public copy;
- retention schedule;
- processor/vendor list;
- unresolved risks accepted by the owner;
- re-review triggers.

Phase 1A may identify and prioritize these questions but must not fabricate answers.