Purpose and legal framework
In Coatings Investments is committed to protecting personal information, maintaining the confidentiality, integrity and availability of information systems, and using information and communication technologies lawfully and securely. This policy explains how personal information is collected, used, stored, disclosed, protected and deleted.
The policy is structured with reference to the Constitution of Zimbabwe, the Cyber and Data Protection Act [Chapter 12:07], S.I. 155 of 2024, and applicable implementation guidelines issued by Zimbabwe’s Data Protection Authority, POTRAZ.
Data protection principles
- Lawful, fair, necessary and transparent processing.
- Specified, explicit and legitimate purposes.
- Data minimisation and accuracy.
- Retention only for as long as necessary.
- Accountability and demonstrable compliance.
Information we may collect and use
Depending on the interaction, information may include names, company details, email addresses, telephone or WhatsApp numbers, enquiry/project details, quotations, correspondence, transaction records, IP addresses and system/security logs. Sensitive information is processed only where necessary and where the stricter legal conditions are met.
Information may be used to respond to enquiries, prepare quotations, provide services, manage projects, maintain business records, protect systems from cyber threats, comply with law, and conduct permitted marketing subject to applicable rights and consent requirements.
Data subject rights
Subject to the Act and lawful limitations, data subjects may be informed about use of their information, access information held about them, object to processing, request correction, request deletion of false or misleading data, object to direct marketing, and exercise applicable rights concerning significant decisions based solely on automated processing.
Children’s rights are exercised by a parent or legal guardian. The website is not intentionally designed to collect children’s personal information.
Cybersecurity and information-security controls
In Coatings Investments applies technical and organisational measures proportionate to risk, including risk assessment, access control, least privilege, secure authentication, system patching, malware protection, secure configurations, backups and recovery, security monitoring, physical safeguards, supplier controls, staff awareness and incident-response procedures. Appropriate controls are selected to protect the security, confidentiality, integrity and availability of personal information.
Personal data breach response
Security incidents are assessed, contained, documented and remediated promptly. A qualifying security breach affecting personal data is notified to POTRAZ/Data Protection Authority within 24 hours as required by section 19 of the Act. Where a detected breach is likely to create a high risk to individuals’ rights and freedoms, affected data subjects are informed within 72 hours in accordance with S.I. 155 of 2024. Breach records are retained and investigations are handled in accordance with applicable regulatory requirements.
Sharing, processors and cross-border transfers
Personal information is shared only to the extent necessary with authorised staff, service providers, project partners, professional advisers or competent authorities. Processors acting for the company are subject to appropriate written contractual or legal requirements for security and authorised processing.
Personal information will not be transferred outside Zimbabwe unless the requirements of sections 28 and 29 of the Act and applicable POTRAZ guidance are satisfied, including adequate protection or a lawful exception/safeguard.
Licensing, Data Protection Officer and regulatory obligations
S.I. 155 of 2024 establishes licensing/registration obligations for data controllers and requirements concerning appointment and notification of a Data Protection Officer. In Coatings Investments will assess and maintain its licensing, DPO and regulatory-notification position as required by law. Publication of this policy is separate from those regulatory records.
Contact and complaints
For privacy or data-protection enquiries, contact violet@incoatingsinvestments.co.zw or fytone@incoatingsinvestments.co.zw. Data subjects may also lodge a complaint with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) in its capacity as the Data Protection Authority.
Full policy and legal references
The downloadable PDF contains the complete policy, including detailed cybersecurity controls, retention, consent, processor agreements, children’s data, cross-border transfers, breach handling and legal references to the Act, S.I. 155 of 2024 and relevant POTRAZ implementation guidance.
Open Full Policy PDF