Privacy and Cookie Policy

This Privacy and Cookie Policy describes how Africa Leadership and Management Academy ("ALMA", "we", "us", or "our") collects, uses, stores, and protects your personal data in accordance with Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] and applicable data protection principles across the Africa region. By using our website and services, you acknowledge that you have read and understood this policy.

1. Who We Are (Data Controller)

ALMA is the data controller responsible for the personal data you provide through this platform. We are an educational institution registered and operating in Zimbabwe.

• Full legal name: Africa Leadership and Management Academy
• Physical address: 33 Marlborough Dr,Harare, Zimbabwe

We process personal data on the following lawful bases under the Cyber and Data Protection Act:

• Contract performance — processing your application, managing your enrollment, and administering payments.
• Consent — for marketing communications and non-essential cookies (you may withdraw consent at any time).
• Legal obligation — where we are required to retain records by law (e.g., financial records).
• Legitimate interests — improving our services, maintaining security, and internal administration, where these interests are not overridden by your rights.

2. Information We Collect

We collect information you provide directly when you:

• Submit application forms (personal details, educational history, contact information, and supporting documents such as national ID, transcripts, and birth certificates)
• Make payments through our platform (transaction details and billing information — we do not store full card numbers)
• Contact us for support (your name, contact information, and communication content)
• Create an account or log in (username, email address, and access activity)
• Interact with our website (through cookies and similar technologies — see Section 7 below)

We also collect certain data automatically, including IP addresses, browser type, pages visited, and access timestamps for security and system performance monitoring purposes.

3. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy and to comply with our legal obligations. The following are our standard retention periods:

4. Data Security

We are committed to protecting your personal data and implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• SSL/TLS encryption for all data transmission between your browser and our servers.
• Secure storage of personal data on protected servers with restricted, role-based access controls.
• Regular security assessments and monitoring to identify and address potential vulnerabilities.
• Strict internal access controls — only authorised personnel can access personal data, and all access is logged for audit purposes.
• Passwords are stored using one-way cryptographic hashing and are never stored in plain text.

While we implement robust safeguards, no system can be guaranteed as completely secure. In the event of a personal data breach, we will act in accordance with Section 8 of this policy.

5. Sharing Your Information

We do not sell your personal data. We may share your personal information with third parties only in the following circumstances, and always in compliance with the Cyber and Data Protection Act:

• Payment processors (PayNow): To facilitate payment transactions. PayNow processes payment information under their own privacy policy and is obligated to protect your data.
• Hosting and infrastructure providers: Our platform is hosted on third-party infrastructure. These providers act as data processors under our instruction.
• Legal and regulatory requirements: Where required by Zimbabwean law, court order, or lawful authority.
• Protection of rights: To protect the rights, property, or safety of ALMA, our students, staff, or others.
• Institutional transfers: In the event of a merger, acquisition, or restructuring of ALMA, personal data may be transferred to the successor institution subject to equivalent privacy protections.
• With your explicit consent for any purposes not listed above.

All third-party processors are required to maintain appropriate data protection standards and are prohibited from using your data for their own purposes beyond the services they provide to us.

6. Your Rights Under the Cyber and Data Protection Act

In accordance with Zimbabwe's Cyber and Data Protection Act [Chapter 12:07], you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure (Right to be Forgotten): You may request deletion of your personal data where there is no overriding legal requirement to retain it.
• Right to Restriction of Processing: You may request that we limit how we use your data in certain circumstances.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format for transfer to another controller.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with Zimbabwe's supervisory authority for data protection matters.

To exercise any of the above rights, please contact our administration team. We will respond within 30 days and may request proof of identity to protect your data from unauthorised disclosure.

7. Cookies and Similar Technologies

Our website uses cookies and similar technologies to enable core functionality and improve your browsing experience.

We use the following types of cookies:

• Strictly Necessary Cookies: Essential for the website to function — login sessions, form security (CSRF), and access controls. These cannot be disabled.
• Analytical/Performance Cookies: Help us understand how visitors use the site so we can improve it. These are only set with your consent where required.
• Functionality Cookies: Remember your preferences and settings to personalise your experience.
• Targeting/Advertising Cookies: May be used by third-party partners to show relevant content. We do not currently use these for student-facing pages.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair your ability to log in or use key features of the platform.

8. Data Breach Notification

In the event that ALMA experiences a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
• Notify affected individuals directly if the breach is likely to result in a high risk to their rights — this notification will be clear, plain-language, and will include the nature of the breach, data affected, likely consequences, and steps taken to address it.
• Maintain an internal record of all data breaches, their effects, and remedial actions taken.

If you believe your personal data has been compromised or you notice suspicious activity related to your ALMA account, please contact us immediately.

9. Third-Party Services

PayNow is used for payment processing. When you make a payment through our platform, your transaction is handled by PayNow under their own privacy policy. We do not store your full payment card details. Please review PayNow's terms at paynow.co.zw.

We may use other third-party services for website hosting, email delivery, and operational purposes. All third-party processors are bound by data processing agreements that restrict their use of your data to the services they provide on our behalf.

10. Data Protection Contact

If you have questions or concerns about how your personal data is handled, you may contact our team directly:

• Phone: +263 8677 174235

11. Changes to This Policy

We may update this Privacy and Cookie Policy periodically to reflect changes in our practices, services, or legal requirements. When we make significant changes, we will update the page and, where appropriate, notify you directly by email or through a notice on our platform. Your continued use of our services after changes are posted constitutes your acknowledgement of the revised policy.

We encourage you to review this policy periodically to stay informed about how we protect your information.