National University of Science and Technology Privacy Notice
Effective Date: 01 May 2025
This Privacy Notice outlines how the National University of Science and Technology ("we," "us," or "our") collects, uses, processes, and protects your personal information in compliance with the Zimbabwe Cyber and Data Protection Act [Chapter 12:07] (the "Act").
- What is Personal Information?
Under the Act, "personal information" is broadly defined as any information relating to an identified or identifiable living individual. This includes, but is not limited to:
- Name, address, and contact details (telephone number, email address).
- Race, national or ethnic origin, colour, religious or political beliefs or associations.
- Age, sex, sexual orientation, marital status, or family status.
- Identifying numbers, symbols, or other particulars assigned to you (e.g., national ID number).
- Fingerprints, blood type, or inheritable characteristics.
- Information about your healthcare history, including physical or mental disabilities.
- Information about your educational, financial, criminal, or employment history.
- Opinions expressed about you.
- Your personal views or opinions (unless about someone else).
- Personal correspondence pertaining to your home and family life.
- Online identifiers, IP addresses, location data, and device information.
- What Personal Information Do We Collect?
We may collect the following categories of your personal information:
- Personal Identifiers: Name, email, phone number, ID number, passport number
- Demographic Data: Age, gender, address
- Biometric data (DNA, fingerprints, facial recognition)
- Financial data : Payment details (processed securely via third-party gateways).
- Technical data : IP address, browser type, device information
- Other data: Preferences, feedback, or communications.
- How We Use Your Personal Information (Purposes of Processing):
We may process your personal information for the following purposes:
- To provide and improve our services/products.
- To manage your account and communicate with you.
- To process your transactions.
- For marketing and promotional purposes (with your consent where required).
- To personalize your experience.
- To ensure the security of our systems and prevent fraud.
- To comply with legal and regulatory obligations.
- Lawful Basis for Processing:
The Act requires that we have a lawful basis for processing your personal information. These bases may include:
- Consent: Where you have freely given your explicit consent for a specific purpose.
- Contract: Where processing is necessary for the performance of a contract with you.
- Legal Obligation: Where processing is necessary for compliance with a legal obligation.
- Legitimate Interests: Where processing is necessary for our legitimate interests or the legitimate interests of a third party, provided your interests and fundamental rights do not override those interests.
- Public Interest: Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
- Vital Interests: Where processing is necessary to protect your vital interests or those of another person.
- Who We Share Your Personal Information With (Recipients):
We may share your personal information with the following categories of recipients:
- Our employees and authorized personnel for lawful and legitimate purpose.
- Third-party service providers who assist us in delivering our services (e.g., payment processors, hosting providers, marketing platforms).
- Business partners.
- Legal authorities or regulatory bodies when required by law.
- Transfer of Personal Information Outside Zimbabwe:
We may transfer your personal information to countries outside Zimbabwe, such as South Africa for backup or service provision. We will ensure that such transfers comply with the Act and that your personal information is adequately protected, for example, through ensuring that the companies that we share your information with comply with the local data privacy laws such as the South African Protection of Personal Information Act 2013.
- Your Rights Under the CDPA:
Under the Act, you have certain rights regarding your personal information:
- Right to be Informed: You have the right to be informed about the collection and use of your personal information .
- Right to Access: You have the right to request access to your personal information that we hold.
- Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal information we hold about you.
- Right to Erasure (Right to be Forgotten): You have the right to request the deletion of your personal information under certain circumstances.
- Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal information in certain situations.
- Right to Data Portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance.
- Right to Object: You have the right to object to the processing of your personal information in certain circumstances, including for direct marketing purposes.
- Rights Related to Automated Decision-Making including Profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless there is a lawful basis for such processing.
- How to Exercise Your Rights:
To exercise any of your rights under the CDPA, please contact us using the details provided in Section 11. We may require you to provide proof of your identity before we can respond to your request.
You may:
- Access, correct, or delete your data unless the data is required by law.
- Restrict processing or object to marketing.
- Request data portability.
- Withdraw consent
Submit requests using the information in the contact us section below. We will respond within 30 days .
- Data Security:
We have implemented appropriate technical and organizational measures to safeguard your personal information against unauthorized access, use, disclosure, alteration, or destruction.
- Data Retention:
We will retain your personal information for as long as necessary to fulfill the purposes for which it was collected and to comply with our legal and regulatory obligations. The retention period may vary depending on the type of personal information and the specific purposes.
- Contact Us:
If you have any questions, concerns, or requests regarding this Privacy Notice or our data protection practices, please contact our Data Protection Officer (DPO) as per the details below:
Ms Novuyo N. T. Bobo
+263719114467
If unsatisfied, lodge a complaint with POTRAZ on the following link:
National University of Science and Technology: https://www.nust.ac.zw/
- Changes to this Privacy Notice:
We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated notice on our website or through other appropriate communication channels. The "Effective Date" at the top of this notice indicates when it was last updated.