Privacy Policy.

Zimako Smart Business Solutions (“Zimako”, “we”, “us” or “our”) is the responsible party, as defined in the Protection of Personal Information Act 4 of 2013 (“POPIA”), for the personal information described in this Privacy Policy. This means we decide why and how that information is processed, and we are accountable for protecting it.

Legal name

Zimako Smart Business Solutions

Physical address

Meersig 1, 4th Floor, Upper Lake Lane, Constantia Kloof, Roodepoort, 1724

Telephone

+27 11 846 3678

Email

info@zimako.co.za

Website

zimako.co.za

Our Information Officer can be reached at info@zimako.co.za. Please address any question, request or complaint about your personal information to the Information Officer.

This policy explains how we handle personal information when you:

• visit zimako.co.za (the “Website”);
• contact us by email, telephone or the Website's contact form;
• apply for a job or send us your CV;
• are a contact person at a client, prospective client, supplier or partner organisation; or
• attend a meeting, demonstration or event with us.

Information we process for our clients

Our platforms — including SmartKollect, Kaya AI, YeboPay, Indigent Verification, DCOMS and the Consumer Portal — process personal information on behalf of the municipalities, government bodies and businesses that use them (for example, account holders, debtors, residents or applicants). For that information we act as an operator under POPIA, processing it only on our client's instructions and under a written agreement. The client is the responsible party, and its own privacy notice explains how it uses your information. If you have a question or request about such information, please contact the relevant municipality or organisation; we will assist them in responding.

Information you give us

• Enquiries: your name, email address, organisation, telephone number, the services you are interested in, and anything else you include in your message.
• Job applications: your CV and cover letter, contact details, qualifications, employment history, skills, portfolio or links, references, and any other information you choose to share. See Recruitment.
• Business relationships: names, job titles, work contact details and correspondence of people at our clients, suppliers and partners, plus the information needed to contract, invoice and pay.

The contact form on the Website does not send anything to our servers. It opens your own email application with your message pre-filled; we receive it only if you choose to send it, and from then on it is handled as an ordinary email.

Information collected automatically

We do not use analytics, advertising or tracking cookies, and we do not use third-party tracking pixels, session recording or fingerprinting on the Website.

• Server logs. Like any website, the infrastructure that hosts the Website automatically records technical information about each request — such as your IP address, browser and device type, the page requested, the referring page, and the date and time. These logs are used only to deliver, secure and troubleshoot the Website, and are kept for a limited period.
• Browser storage. The Website stores two small preferences in your own browser. They never leave your device and are not used to identify you:

Because these are strictly necessary for features you choose to use, we do not ask for consent before setting them. You can clear them at any time in your browser settings; the Website will still work.

Our fonts are served from our own domain, so loading the Website does not send your information to a font provider. Third-party services such as Google Maps are contacted only if you click a link to them.

Information from other sources

We may receive personal information from people who refer you to us, recruitment agencies, your employer (if you are a contact at one of our clients), and public sources such as the CIPC register, professional networking profiles and tender publications.

Special personal information and children

We do not ask for special personal information (such as race or ethnic origin, health, religious or political beliefs, trade-union membership, biometric data or criminal history) through the Website. Please do not send it to us unless we specifically request it for a lawful purpose — for example, voluntary employment-equity information, or a background check you have consented to.

The Website is not directed at children under 18, and we do not knowingly collect their personal information. If you believe a child has sent us personal information, please contact us and we will delete it.

POPIA requires us to have a lawful justification for each way we use personal information. We only collect what is adequate, relevant and not excessive for these purposes:

We will not use your personal information for a purpose that is incompatible with the one for which it was collected without telling you and, where required, obtaining your consent.

We do not sell, rent or trade personal information. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

We send electronic marketing only to people who have consented, or to contacts at existing clients about similar products and services, as permitted by section 69 of POPIA. Every marketing message identifies us and tells you how to opt out. You can unsubscribe at any time — free of charge — by using the link in the message or by emailing info@zimako.co.za.

When you apply for a role, we use your information to assess your suitability, communicate with you, arrange interviews and, if you are successful, prepare an offer and your employment records. Applications are seen only by the people involved in hiring for that role.

For shortlisted candidates we may, with your prior consent, verify qualifications, check references, and carry out criminal-record or credit checks where they are relevant to the role and permitted by law.

If your application is unsuccessful, we keep it for up to 12 months in case the outcome is challenged or a similar role opens, then delete it. We will keep it for longer only if you ask us to keep you in mind for future vacancies.

We share personal information only where necessary, and only with:

• Service providers (operators) who process information on our behalf — such as email and productivity software, cloud hosting, IT support, and background-screening providers — under written agreements that require them to keep it confidential and secure, as section 21 of POPIA requires;
• Professional advisers such as auditors, attorneys and insurers, who are bound by confidentiality;
• Regulators, courts and law enforcement when the law requires it, or to protect our rights, property or safety, or those of others; and
• A successor business if all or part of Zimako is restructured, merged or sold, in which case your information will remain protected by this policy.

Some of our service providers store or process information on servers outside South Africa. We transfer personal information across borders only in line with section 72 of POPIA — that is, where the recipient is subject to a law, binding corporate rules or a binding agreement that provides protection substantially similar to POPIA, where you have consented, or where the transfer is needed to perform a contract with you or in your interest.

We take appropriate, reasonable technical and organisational measures to prevent loss of, damage to, unauthorised destruction of, and unlawful access to or processing of personal information, as section 19 of POPIA requires. These include:

• encryption of data in transit (the Website is served only over HTTPS);
• role-based access controls and the principle of least privilege;
• multi-factor authentication on the systems that hold personal information;
• confidentiality obligations for all staff and contractors; and
• regular review of our safeguards against new risks.

No method of transmission or storage is completely secure. If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires.

We keep personal information only for as long as we need it for the purpose it was collected, or as the law requires, in line with section 14 of POPIA. As a guide:

When information is no longer needed, we securely delete or destroy it, or de-identify it so that it can no longer be linked to you.

Under POPIA you have the right to:

• Access — ask whether we hold personal information about you and request a copy of it (POPIA s23, read with the Promotion of Access to Information Act 2 of 2000);
• Correction and deletion — ask us to correct, update or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s24);
• Object — object, on reasonable grounds, to processing based on our legitimate interests (s11(3));
• Withdraw consent — where we rely on your consent, withdraw it at any time, without affecting processing that already took place;
• Opt out of direct marketing at any time (s11(3)(b) and s69); and
• Complain to the Information Regulator, and to institute civil proceedings (s99).

To exercise a right, email info@zimako.co.za. We will need to verify your identity before acting on a request, and we will respond within a reasonable time and within any period set by law. Requests for access may be subject to the prescribed fees under PAIA, and we will tell you in advance if a fee applies. The prescribed forms are available from the Information Regulator.

If you are unhappy with how we have handled your personal information, please tell us first so that we can try to put it right. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator:

Regulator

The Information Regulator (South Africa)

Address

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Email

enquiries@inforegulator.org.za

Website

inforegulator.org.za

Complaint forms and current contact details are published on the Regulator's website.

The Website links to sites we do not control, such as Google Maps. This policy does not apply to them, and we are not responsible for their privacy practices. Please read their privacy notices before giving them your information.

We may update this policy to reflect changes in the law, our services or how we process personal information. The “last updated” date at the top of this page shows when it last changed. If we make a material change, we will take reasonable steps to bring it to your attention, such as a notice on the Website or by email where we have your address.

For any question about this policy or your personal information, contact our Information Officer at info@zimako.co.za, by phone on +27 11 846 3678, or by post or hand delivery to Meersig 1, 4th Floor, Upper Lake Lane, Constantia Kloof, Roodepoort, 1724.