Privacy policy
We advise organisations on the Cyber and Data Protection Act [Chapter 12:07] and SI 155 of 2024, so we hold ourselves to the same standard we ask of clients. If anything below is unclear, or you want to exercise one of the rights described here, write to contact@keodpo.com and we will answer within the statutory period.
Who is responsible for your data
KeoDPO, part of KeoGlobal SAS, of 4 Loreley Crescent, Msasa, Harare, Zimbabwe, decides why and how the personal data described in this notice is processed, and is therefore the data controller for it.
Questions about this notice, or about how we handle personal data generally, go to our Data Protection Officer at contact@keodpo.com.
What we collect, and why
We only collect what you type into one of the two forms on this site. There is no analytics script, no advertising pixel, no third-party embed and no cookie that tracks you between visits.
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Name, company, email, phone, the services you selected and anything you wrote in the message box | To answer your enquiry and, where it leads somewhere, to prepare a proposal | Steps taken at your request before entering into a contract, and our legitimate interest in responding to people who contact us | 24 months from our last exchange, unless you become a client |
| Email address given to receive the compliance checklist | To send you the checklist, and occasionally to tell you when it is updated | Your consent, which you can withdraw at any time | Until you withdraw consent, or 24 months of no engagement |
| The question you type into the online assistant, and the exchange that follows | To produce an answer and to improve the questions the assistant handles well | Our legitimate interest in providing and improving the service | 12 months, then deleted |
| Server log entries: IP address, browser, page requested, timestamp | Security, abuse prevention and diagnosing faults | Our legitimate interest in keeping the site available and secure | 6 months |
Please do not put personal data about other people into the message box or the assistant window. If you need to discuss a real case, a breach or a data subject request, say so and we will arrange a secure channel first.
Cookies and local storage
This site sets no cookies. It stores one value in your browser, theme, which remembers whether you chose the light or the dark version of the page. That value never leaves your device, is not readable by us, and clearing your browser data removes it.
Who else sees your data
Your data is seen by the KeoDPO team working on your enquiry, and by the following processors, each under a written agreement that limits them to acting on our instructions:
- our hosting provider, which operates the server this site runs on;
- our email provider, which carries the messages the forms generate;
- the provider behind the online assistant, which processes the text of your question in order to produce an answer.
We do not sell personal data, we do not share it for anyone else's marketing, and we disclose it to a public authority only where the law requires it.
Transfers outside Zimbabwe
Some of the providers above process data outside Zimbabwe. Where that happens we carry out a written adequacy analysis of the destination and put contractual safeguards in place, as section 28 of the Act requires. You can ask us for a summary of that analysis.
Your rights
Under the Cyber and Data Protection Act you may ask us to:
- confirm whether we hold data about you, and give you a copy;
- correct anything inaccurate or incomplete;
- delete data we no longer have a reason to keep;
- stop processing that relies on our legitimate interest, where your situation outweighs it;
- withdraw a consent you previously gave, without affecting what was lawful before you withdrew it.
Write to contact@keodpo.com. We answer within the statutory period, and we will ask you to confirm your identity first so that we do not disclose your data to somebody else. There is no charge for a first request.
If you are not satisfied with how we handled your request, you can complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe, which supervises data protection in Zimbabwe.
Security
The site is served over HTTPS. Form submissions are transmitted encrypted, stored on systems with access limited to the people who need it, and covered by our own incident procedure. If a breach affecting your data ever occurs, we notify the Authority within 24 hours of becoming aware of it and tell you directly where the risk to you is high.
Changes to this notice
When this notice changes we update the date at the top. Material changes to how we use data already collected are notified to the people concerned before they take effect.