Customers share their phone numbers and email addresses with you because they trust you. Marketing responsibly means keeping that trust. In Zambia it is also the law: the Data Protection Act No. 3 of 2021 sets out how organisations may collect, store and use personal data, and the Office of the Data Protection Commissioner oversees it.
This article is a practical overview for marketing teams, not legal advice. For questions about your own obligations, speak to your legal adviser.
The principle: permission before promotion
A phone number or email address is personal data. Using it to send marketing messages needs a lawful basis. For direct marketing, that basis is almost always the person's consent. In practice that means:
- the customer actively agreed to receive marketing, rather than having it assumed;
- they knew who would contact them and roughly what about;
- you can show when and how they agreed.
A number collected for a delivery, or written on a visitor book, is not automatically permission to send promotions.
Collecting consent the right way
Ask clearly. "Would you like to receive offers and updates from us by SMS?" is clear. A pre-ticked box buried in terms and conditions is not.
Ask per channel where it matters. Some customers welcome SMS reminders but do not want WhatsApp promotions. Recording consent per channel lets you respect that.
Record it. Note the date, the source (website form, in-store sign-up, USSD, call centre) and the wording the person agreed to.
Keep it current. If you start sending a very different kind of message, ask again.
Make leaving easy
Every marketing message should tell people how to stop receiving them, for example with "Reply STOP to opt out" for SMS or an unsubscribe link for email. When someone opts out:
- stop marketing to them promptly;
- keep a record of the opt-out so they are not re-imported later from an old spreadsheet;
- do not make them explain themselves or call a number to leave.
An opt-out is not a failure. A smaller list of people who want your messages will always beat a large list of people who do not.
Look after the data
Consent covers using the data. You also need to protect it:
- limit who in your organisation can export contact lists;
- avoid passing lists around by email or on flash drives;
- delete data you no longer need;
- only work with platforms that store data securely and let you control access.
Transactional or marketing?
Not every message is marketing. A bank alert about a transaction, a delivery update or an appointment reminder is service communication, and the rules are different. Be honest about the difference, though. Adding a promotion to the bottom of a payment reminder turns it into marketing.
How BalloAds helps
BalloAds is built with consent in mind. Each contact carries its own opt-in status per channel, and campaigns only go to contacts who have opted in to that channel. Before a campaign goes out, you can check which recipients are eligible. Compliance becomes part of the workflow instead of an afterthought.
