Privacy Policy

We use your information to:

• Provide and improve our education, technology, and career services.
• Arrange and run your tutoring or consultation.
• Talk to you about your bookings, appointments, and deadlines.
• Send service updates and scheduling reminders.
• Answer your questions and provide support.
• Meet our legal and regulatory obligations.

We use cookies and similar technologies, such as local storage, and we ask first. Non-essential cookies only load after you actively accept them. There are three categories:

• Essential: needed for the site to work, including remembering your cookie choice. Always on.
• Analytics: Google Analytics 4 and Vercel Analytics help us see how the site is used. Loaded only with your consent.
• Marketing: for advertising and remarketing. Not currently in use, and it would only run with your consent.

Cookies and storage we set

Vercel Analytics and Sentry do not use cookies: Vercel counts visits with a temporary hash that is discarded after 24 hours, and our Sentry error monitoring stores nothing on your device. You can change your choices at any time with the Cookie Preferences control in the footer or mobile menu. Our Cookie Policy has the full detail.

We use appropriate technical and organisational measures to guard your information against unauthorised access, alteration, disclosure, or loss:

• Encrypted data transmission (SSL/TLS).
• Secure storage of physical and digital records.
• Access limited to authorised people only.
• Regular security reviews and updates.
• Confidentiality agreements with our staff and contractors.

We share your information only where it is needed to deliver our services:

• Paynow: Zimbabwe's payment gateway, to process tuition and fee payments made in the Onilaz student portal. It receives your email, your phone number (for mobile money such as EcoCash and OneMoney), and the amount due.
• Professional bodies: such as ACCA and CIMA, for student registration.
• Service providers: hosting, email, and analytics partners, all working under data processing agreements.

Onilaz Professional Services (Private) Limited is the data controller for your information. Entity No. 79174A0212026, Private Limited Company, Zimbabwe. You can reach us at info@onilaz.co.zw.

We operate under Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] (Act No. 5 of 2021), regulated by the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as the Data Protection Authority. For clients abroad, we voluntarily align our practices with:

• The EU General Data Protection Regulation (GDPR) and the UK GDPR, for EU and UK data subjects.
• The Protection of Personal Information Act, 2013 (POPIA), for South African data subjects.

Your rights

You always have the right to be told how your information is used, which is what this policy is for. You can also ask us to:

• Give you a copy of the personal information we hold about you.
• Correct (rectify) anything that is inaccurate or misleading.
• Delete your information, subject to legal retention requirements.
• Stop or restrict how we use it, or object to a particular use.
• Withdraw your consent at any time, without affecting what was lawful beforehand.
• Receive your data in a portable, machine-readable format (for EU/UK data subjects, under GDPR Article 20).

We keep your information only as long as we need it to provide our services and meet legal obligations. By category:

• Contact and enquiry records: 3 years from your last interaction.
• Academy enrolment and course records: 7 years from completion.
• CV, career, and employment documents: 1 year, unless you ask us to keep them.
• Technology project files: 2 years from project completion.
• Website analytics (GA4): up to 14 months (the standard GA4 maximum; we do not set a longer period).

To run our services we use trusted providers that may process your data outside Zimbabwe:

• Vercel (United States): website hosting and content delivery across a global edge network.
• Resend (United States): delivery of the enquiry email generated when you submit the contact form.
• Google Analytics 4 (United States): website analytics, only with your consent, under Google's Standard Contractual Clauses and the EU-US Data Privacy Framework.
• Sentry (United States): error monitoring and performance diagnostics.
• Upstash (United States): short-lived request metadata used for rate limiting and abuse prevention on our forms.

Each provider is required to maintain appropriate safeguards for international transfers, such as Standard Contractual Clauses, under the GDPR and Zimbabwe's CDPA.

With your consent, given when you enquire or enrol, we may send you relevant information:

• Service updates and offers, by email.
• Study tips and educational content, by WhatsApp broadcast.
• Appointment reminders and deadline alerts, by SMS.

You can opt out any time: reply STOP to any message, use the unsubscribe link in any email, or email info@onilaz.co.zw. Opting out of marketing does not affect essential messages about a service you are using.

If a personal data breach is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay.

Our notice will explain the nature of the breach, the categories of data affected, and the steps we are taking to deal with it.

To ask about this policy or to exercise your data rights, reach us at:

• Email: info@onilaz.co.zw
• Phone: +263 773 042 532
• Address: Harare, Zimbabwe