1. Introduction & Data Controller Identity
Zambuko Trust Microfinance is a registered Microfinance Institution operating in Zimbabwe. We are committed to protecting the privacy, confidentiality, and security of all personal data collected through our website (https://zambukotrust.co.zw) and during the provision of our financial services.
In terms of the Cyber and Data Protection Act [Chapter 12:07] and Statutory Instrument 155 of 2024 (Licensing of Data Controllers and Appointment of Data Protection Officers), Zambuko Trust operates as a registered Data Controller.
Physical Address: Number 6, Aberdeen, Belgravia.
Harare, Zimbabwe
General Enquiries Email: [email protected]
Website: https://zambukotrust.co.zw
2. Data Protection Officer (DPO) Contact Details
In compliance with SI 155 of 2024, Zambuko Trust has appointed a certified Data Protection Officer (DPO) to oversee our data privacy compliance and handle inquiries or access requests regarding your personal information.
If you have any questions, concerns, or requests regarding this Privacy Policy or how your data is processed, please contact our DPO:
Data Protection Officer
Email: [email protected]
Postal Address: P.O. Box, Harare, Zimbabwe
3. What Personal Data We Collect
We may collect and process the following categories of personal information:
- Identity and Contact Data: Name, phone number, email address, physical address, national ID/passport details (for loan/financial product enquiries or KYC compliance).
- Financial & Transactional Data: Income details, employment information, bank account details, and loan repayment histories where submitted through portal applications or interactive forms.
- Technical & Website Usage Data: IP address, browser type, operating system, referral URL, pages visited, and interaction data collected via standard server logs or web analytics.
- User Content & Communications: Messages, comments, or feedback submitted through our website contact forms, comment sections, or newsletter subscription forms.
4. Lawful Basis for Processing Personal Data
We process your personal information strictly under the lawful grounds established in Section 18 of the Cyber and Data Protection Act [Chapter 12:07]:
- Consent: Where you have provided clear, explicit consent (e.g., subscribing to communications or accepting website performance cookies).
- Contractual Necessity: Where processing is required to assess, execute, or manage a loan contract, account, or microfinance service requested by you.
- Legal Obligation: Where processing is mandatory under Zimbabwean financial regulations, Anti-Money Laundering (AML/CFT) laws, or statutory reporting guidelines issued by the Reserve Bank of Zimbabwe (RBZ) or POTRAZ.
- Legitimate Interest: To maintain website security, prevent fraud, prevent spam, and optimize user experience on our portal.
5. Cookies and Web Analytics
Our website uses cookies to enhance user experience and ensure platform functionality:
- Essential Cookies: Required for fundamental site navigation and security functions (e.g., managing session state or login security).
- Comment & Form Cookies: If you leave a comment or fill out a form, cookies may store your name and email address for convenience so you do not need to re-enter them on future visits.
- Analytics Cookies: We may use aggregate tracking tools to evaluate visitor usage and improve web performance. You may disable cookies at any time via your browser settings.
6. Data Retention
We retain personal information only for as long as necessary to fulfill the operational, legal, tax, or regulatory purposes for which it was collected:
- Website Comments & Queries: Retained for the duration needed to resolve the inquiry or indefinitely where required for audit trail purposes.
- Financial & Loan Application Records: Retained for the minimum statutory periods required under Zimbabwean financial and banking laws (typically a minimum of 5 to 7 years post-contract termination).
7. Cross-Border Data Transfers
In providing digital services, hosting our web infrastructure, or processing backups, your personal data may occasionally be hosted on secured cloud servers or managed service platforms located outside Zimbabwe.
Where cross-border data processing occurs, Zambuko Trust ensures appropriate safeguards are in place, in accordance with Section 25 of the Cyber and Data Protection Act [Chapter 12:07] and relevant regulatory authorizations from POTRAZ.
8. Data Security & Protection
We enforce strict organizational, physical, and technical measures—including secure socket layer (SSL) encryption, firewalls, role-based access control, and internal cybersecurity controls—to safeguard personal data against unauthorized access, loss, alteration, or disclosure.
In the event of a personal data breach posing a high risk to your rights, we will notify the Data Protection Authority (POTRAZ) and affected individuals in accordance with statutory notification timelines.
9. Your Statutory Data Subject Rights
Under Sections 20–24 of the Cyber and Data Protection Act [Chapter 12:07], you have the following rights regarding your personal information:
- Right to be Informed: To know what personal data is being collected and how it is used.
- Right of Access: To request a copy of the personal data held by us about you.
- Right to Rectification: To request correction of inaccurate, incomplete, or misleading personal data.
- Right to Erasure/Deletion: To request erasure of your data where processing is no longer justified (subject to statutory financial retention requirements).
- Right to Object & Withdraw Consent: To object to data processing or withdraw previously granted consent at any time.
To exercise any of these rights, please submit a Data Subject Request to our Data Protection Officer at [email protected].
10. Regulatory Complaints (POTRAZ)
If you believe that your personal data has been handled in breach of Zimbabwean data protection laws or if a privacy complaint remains unresolved by our Data Protection Officer, you have the right to lodge a formal complaint with the statutory regulator:
Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ)
Designated Data Protection Authority (DPA)
1008 Performance House, Sam Nujoma Street / A.L. Bamhare Building, Harare, Zimbabwe
Website: https://www.potraz.gov.zw
Email: [email protected] / [email protected]
11. Updates to This Privacy Policy
Zambuko Trust reserves the right to review and update this Privacy Policy to reflect changing legal, operational, or regulatory requirements. Any modifications will be published on this page with an updated effective date.
Last Updated: September 2026
