Last updated · 2026-08-06
Zimbabwe Agricultural Society (ZAS) Data Privacy Notice
Effective Date: 01 May 2026
The Zimbabwe Agricultural Society (ZAS) is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Notice explains how we collect, use, process, store, and protect your personal data in compliance with the Zimbabwe Cyber and Data Protection Act [Chapter 12:07] (“the Act”).
ZAS acts as the Data Controller in respect of your personal information.
1. What is Personal Information?
Under the Act, personal information means any information relating to an identified or identifiable natural person.
This includes, but is not limited to:
• Name, address, telephone number, and email address
• National ID number, passport details, or other identifiers
• Age, gender, marital or family status
• Race, nationality, ethnic origin, or beliefs
• Financial and transactional data
• Online identifiers such as IP address or device information
2. Personal Information We Collect
We may collect personal information directly from you when you interact with our events, services, or digital platforms, including:
• Identity and Contact Data: Name, surname, ID/passport number, email, phone number, nationality
• Authentication Data: Usernames, passwords, and login credentials
• Demographic Data: Age, gender, address
• Financial Data: Payment details (processed securely via PCI-compliant third-party providers)
• Technical Data: IP address, browser type, device information, cookies, and usage logs
• Preferences and Communications: Feedback, marketing preferences, customer support queries
• Media Data: Photographs and video recordings taken during ZAS events
3. How We Use Your Personal Information
We process your personal information for the following purposes:
• To provide, manage, and improve our services, exhibitions, and events
• To process registrations, transactions, and payments
• To communicate with you regarding services, updates, and support
• To personalise your experience
• To ensure system security and prevent fraud
• To comply with legal and regulatory obligations
• For marketing and promotional purposes (where consent is required)
• For event documentation and promotion, including use of photographs and videos
Some images used in our materials may also be generated using artificial intelligence (AI) tools for illustrative purposes.
4. Lawful Basis for Processing
We process your personal information based on one or more of the following lawful grounds:
• Consent: Where you have given clear permission
• Contract: To fulfil a contract or provide requested services
• Legal Obligation: To comply with applicable laws
• Legitimate Interests: To operate and improve our services, provided your rights are not overridden
• Public Interest: Where required for official or public functions
• Vital Interests: To protect life or safety
5. Event Photography and Videography
• Photography and videography take place at ZAS events
• Notices are displayed at event entrances
• By attending, you acknowledge and consent to being recorded
• Media may be used for marketing, promotional, and archival purposes
6. Sharing of Personal Information
We do not sell your personal data. We may share it with:
• Employees and authorised personnel
• Trusted third-party service providers (e.g., IT, payment processors, event platforms)
• Business partners, sponsors, or exhibitors (only with your explicit consent)
• Exhibitors, where you allow badge scanning at events
• Regulatory authorities or law enforcement where required by law
Exhibitors who receive your data are independently responsible for their compliance with applicable data protection laws.
7. Cross-Border Transfers
Your personal information may be transferred outside Zimbabwe (e.g., to South Africa). Where this occurs, we ensure appropriate safeguards are in place and that recipients comply with applicable data protection laws, including the South Africa Protection of Personal Information Act, 2013.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal information, including:
• Encryption of data in transit and at rest
• Access controls and authentication measures
• Regular security monitoring and reviews
In the event of a data breach, we will notify the relevant authority and affected individuals in accordance with the Act.
9. Data Retention
We retain personal information only as long as necessary:
• Registration data: up to 3 years after the event or for as long as necessary for administrative, audit, and legal purposes related to the event, whichever is longer.
• Financial records: up to 7 years in compliance with applicable tax, audit, and statutory requirements, or longer where required by law or ongoing audit, dispute, or regulatory obligation.
• Security/CCTV data: up to 30 days unless required for investigation, incident management, or legal proceedings, in which case it is retained for as long as necessary for those purposes.
• Marketing data: retained and used only while consent remains valid. Where consent is withdrawn, the individual is removed from active marketing lists and may be retained on a suppression list to ensure future communications are not sent.
• Media (photos/videos): retained for archival and documentation purposes for a reasonable period. Any use of identifiable individuals for promotional or marketing purposes is based on consent. Where consent is withdrawn, such media will no longer be used for promotional purposes and will be removed from active marketing channels where reasonably practicable.
Data is securely deleted or anonymised when no longer required.
10. Your Rights
Under the Act, you have the right to:
• Be informed about how your data is used
• Access your personal data
• Request correction of inaccurate data
• Request deletion (where applicable)
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Object to direct marketing
• Not be subject to solely automated decision making with significant effects
11. How to Exercise Your Rights
To exercise your rights, please contact us using the details below. We may require proof of identity and will respond within 30 days.
12. Contact Details
Data Protection Officer (DPO):
Mr. Paddington Majembwa
📧 dpo@zas.co.zw
📞 +263 242 780 964–6
If you are not satisfied with our response, you may lodge a complaint with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ):
https://www.potraz.gov.zw/?page_id=987
13. Changes to This Notice
We may update this Privacy Notice from time to time. Significant changes will be communicated through our official channels.
Governing Law
This Privacy Notice is governed by the laws of Zimbabwe, including the Cyber and Data Protection Act [Chapter 12:07].