Effective Date: 04 November 2025
This Privacy Notice outlines how the Manicaland State University of Applied Sciences (“we,” “us,” or “our”) collects, uses, processes, and protects your personal information in compliance with the Zimbabwe Cyber and Data Protection Act [Chapter 12:07] (the “Act”).

Under the Act, personal information is broadly defined as any data relating to an identified or identifiable living individual. This encompasses a wide range of details, including a person’s name, address, and contact information such as telephone numbers and email addresses. It also covers sensitive attributes like race, national or ethnic origin, colour, religious or political beliefs or associations, as well as demographic factors such as age, sex, sexual orientation, marital status, or family status. Personal information may include identifying numbers or symbols assigned to an individual, such as a national ID number, as well as biometric data like fingerprints, blood type, or inheritable characteristics. Additionally, it extends to healthcare history, including physical or mental disabilities, and records of educational, financial, criminal, or employment background. The definition further includes opinions expressed about an individual, their own personal views (unless those views concern someone else), personal correspondence related to home and family life, and digital identifiers such as IP addresses, location data, and device information.

We may collect various categories of your personal information to support our services and operations. These include personal identifiers such as your name, email address, phone number, national ID number, and passport number. We also gather demographic data like your age, gender, and residential address. In certain cases, biometric data may be collected, including DNA profiles, fingerprints, and facial recognition details. Financial information, such as payment details, is processed securely through third-party gateways to ensure confidentiality. Additionally, we collect technical data such as your IP address, browser type, and device information to enhance system functionality and user experience. Other types of data we may collect include your preferences, feedback, and any communications you share with us.

We may process your personal information for a variety of purposes that support our operations and enhance your experience. This includes using your data to provide and continuously improve our services and products, as well as to manage your account and maintain effective communication with you. Your information may also be used to process transactions securely and efficiently. With your consent where required, we may use your details for marketing and promotional activities. Additionally, we strive to personalize your experience based on your preferences and interactions. To protect both you and our systems, we use personal information to ensure security and prevent fraudulent activities. Lastly, we process your data to fulfill our legal and regulatory obligations, ensuring compliance with applicable laws and standards.

The Act requires that we establish a lawful basis before processing your personal information. These legal grounds ensure that your data is handled responsibly and transparently. One such basis is consent, where you have explicitly and freely agreed to the processing of your information for a specific purpose. Another is contractual necessity, where processing is essential for fulfilling a contract to which you are a party. We may also process your data to comply with a legal obligation, such as statutory or regulatory requirements. In some cases, processing may be based on our legitimate interests or those of a third party, provided these do not override your fundamental rights and freedoms. Additionally, we may process your information in the public interest, particularly when carrying out tasks under official authority. Lastly, vital interests may justify processing when it is necessary to protect your life or the life of another individual.

We may share your personal information with specific categories of recipients to ensure the effective delivery of our services and compliance with legal requirements. This includes our employees and authorized personnel who access your data strictly for lawful and legitimate purposes. We also engage third-party service providers such as payment processors, hosting providers, marketing platforms, and medical aid schemes who support us in delivering and maintaining our services. In addition, we may share your information with trusted business partners as part of collaborative operations. Where required by law, we disclose personal data to legal authorities or regulatory bodies to fulfill statutory obligations and uphold public accountability.

We may transfer your personal information to countries outside Zimbabwe, such as South Africa, primarily for purposes like data backup or service provision. These international transfers are conducted with strict adherence to the requirements of the Act, ensuring that your personal data remains secure and protected throughout the process.

To safeguard your privacy, we take steps to confirm that any organization receiving your information complies with applicable data protection laws.

Your Rights Under the Act:
Under the Act, you have certain rights regarding your personal information:
• Right to be Informed: You have the right to be informed about the collection and use of your personal information.
• Right to Access: You have the right to request access to your personal information that we hold.
• Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal information we hold about you.
• Right to Erasure (Right to be Forgotten): You have the right to request the deletion of your personal information under certain circumstances.
• Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal information in certain situations.
• Right to Data Portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance.
• Right to Object: You have the right to object to the processing of your personal information in certain circumstances, including for direct marketing purposes.
• Rights Related to Automated Decision-Making including Profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling,

which produces legal effects concerning you or similarly significantly affects you, unless there is a lawful basis for such processing.

To exercise any of your rights under the Act, please contact us using the details provided in contact us Section. We may require you to provide proof of your identity before we can respond to your request.

You may:
• Access, correct, or delete your data unless the data is required by law.
• Restrict processing or object to marketing.
• Request data portability.
• Withdraw consent

Submit requests using the information in the contact us section below. We will respond within 30 days.

We take data security seriously and have implemented appropriate technical and organizational measures to protect your personal information. These safeguards are designed to prevent unauthorized access, use, disclosure, alteration, or destruction of your data, ensuring its confidentiality, integrity, and availability at all times.

Regarding data retention, we will keep your personal information only for as long as necessary to fulfill the purposes for which it was originally collected. This includes meeting our legal and regulatory obligations. The specific retention period may vary depending on the nature of the information and the context in which it is used, ensuring that data is not held longer than required.

Contact Us:
If you have any questions, concerns, or requests regarding this Privacy Notice or our data protection practices, please contact our Data Protection Officer (DPO) as per the details below: webmaster@msuas.ac.zw

If unsatisfied, lodge a complaint with POTRAZ on the following link: https://www.potraz.gov.zw/?page_id=987

Manicaland State University of Applied Sciences: https://msuas.ac.zw/
We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated notice on our website or through other appropriate communication channels. The “Effective Date” at the top of this notice indicates when it was last updated.

Last Updated: