Privacy notice

Who is responsible for your information

Dube & Shandukani Ventures (Private) Limited, incorporated in Zimbabwe on 18 November 2025, is the data controller for information collected through this website.

14 Thornburg Avenue, Groombridge, Mount Pleasant, Harare, Zimbabwe.

Under the Cyber and Data Protection Act [Chapter 12:07] and Statutory Instrument 155 of 2024 the company falls within Tier 1, which covers controllers holding personal information on between 50 and 1,000 people. The company is a registered data controller with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) under Statutory Instrument 155 of 2024.

A Data Protection Officer is appointed. Data protection requests reach the officer at the address above or at info@dubeshandukani.com.

What we collect, and why

We collect only what a specific action requires. There is no advertising, no profiling, and no sale of information to anyone.

If you write to us

If you use the enquiry form, or accept the non-disclosure agreement to receive the company profile, we store what you give us: your name, the company you represent, your email address, and what you wrote. If you email one of the published addresses instead, we hold your message and your address in our mailbox in the same way.

If you message us on WhatsApp instead, that conversation runs on Meta’s service rather than ours, outside Zimbabwe and on Meta’s own terms. We hold your message and your number in that account in the same way.

Every form submission also stores your IP address and the identification string your browser sends. They are kept with the submission to recognise and block abuse of the forms. On the document release they are also part of the evidence of who accepted the agreement and from where. They are held for the same period as the submission they belong to and are deleted with it. They are visible only to the directors, through an account that requires a password and a second factor.

We keep correspondence for two years from our last exchange with you, and then delete it. The period is two years because a conversation in this sector can go quiet and resume, and losing the record of what was discussed would not serve either of us. If you would rather we deleted yours sooner, ask.

A record of a non-disclosure agreement acceptance is different, and we keep it for longer. It is not correspondence. It is the evidence that a named person, in a named role at a named organisation, accepted particular wording on a particular date. It is also the only thing that would settle a disagreement about what was agreed. We keep it for as long as the obligations in that agreement can be enforced rather than for a fixed period, and no fixed period has been set. It holds your name, the organisation you named, your role there, your email address, your confirmation that you were authorised to accept, the time of acceptance, a fingerprint of the exact wording you saw, and your IP address. It cannot be edited by anyone, including us.

When you simply read the site

Our hosting provider records standard technical information, including your IP address, in server logs. Those logs are used to keep the site available and to defend it against attack. They are held for seven days, and records of requests that triggered a security rule are held for twenty-four hours. After that they are deleted by the provider and we cannot retrieve them. That applies to the provider’s own logs only. The IP address stored with a form submission is ours, and the section above describes it.

We do not read those logs to build any picture of you. We have no ability to link them to your name, and we do not try.

The site sets no cookies and stores no identifier on your device, so there is no cookie banner and nothing to consent to. For the launch period it uses Cloudflare Web Analytics, which records page timings and the page visited from the browser. It uses no cookies, stores no identifier on your device and does not fingerprint. Cloudflare is the host named above, and the measurement is switched off after the first month unless this notice says otherwise. The bot check on the forms is the one exception a browser will notice, and it sets nothing that persists after the page closes.

Transfers outside Zimbabwe

This website runs on infrastructure operated by companies based outside Zimbabwe. Under section 28 of the Cyber and Data Protection Act and the POTRAZ cross-border transfer guideline of 13 November 2024, engaging a processor located outside Zimbabwe is a cross-border transfer of your information, regardless of where the data itself is stored.

All four processors are in use. The last row is not a processor we engage. It is a channel you may choose to open, and it is listed because a message sent that way leaves Zimbabwe just the same.

Recipient	What it handles	Where
Cloudflare, Inc.	Website hosting, security, bot protection	United States
Zoho Corporation	Our company mailboxes	United States
Supabase, Inc.	The agreement record and the documents released	Ireland (a United States company; the data is held in its Ireland region)
Plus Five Five, Inc., trading as Resend	Delivery of enquiry emails	Ireland (a United States company; messages are processed in its Ireland region)
Meta Platforms, Inc. (WhatsApp)	Only what you send us if you choose the WhatsApp link	United States, on Meta’s own terms rather than under an agreement with us

A written data-processing agreement is in place with each of the four. Cloudflare, Supabase and Resend each incorporate theirs into the terms accepted when the account was opened, and Resend’s attaches Standard Contractual Clauses. Zoho Corporation processes the company’s mailboxes under a written data-processing agreement with the company, as section 10(4)(f) of Statutory Instrument 155 of 2024 requires.

Each of them engages its own sub-processors under those agreements and publishes a list of them.

What they do to protect it. Each recipient encrypts your information in transit and at rest, restricts access to staff who need it, and publishes its own security documentation. Our own access to enquiry and agreement records requires a password and a second factor from an authenticator app, and the database enforces that requirement rather than the website alone.

The company has notified POTRAZ of these transfers under section 10(2) of Statutory Instrument 155 of 2024.

Your choice. The enquiry form and the document release both ask for your consent to these transfers, and you may decline. Declining means we cannot process the enquiry or release the document, because there is no alternative route that keeps your information inside Zimbabwe. Writing to us by email instead is always open to you.

Your rights

Under the Cyber and Data Protection Act you may:

• ask what personal information we hold about you, and get a copy
• ask us to correct anything inaccurate
• ask us to delete information, where we are not required to keep it
• object to processing, or withdraw a consent you previously gave
• complain to POTRAZ

Write to us at the address above. We will respond within 30 days.

There is one limit. A record of a non-disclosure agreement acceptance is evidence of an agreement you entered into. We will correct inaccuracies in it, but we will not delete it while it is needed to establish that agreement.

Complaints

If you are not satisfied with how we have handled your information, you may complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe: dataprotectionunit@dpa.zw or regulator@potraz.zw, +263 242 333032/46/48.

Security

Access to enquiry and agreement records requires a password and a second factor from an authenticator app. That requirement is enforced by the database itself, not only by the website, so a session that has not passed the second check cannot read any records at all.

Documents are released through links that expire, rather than as permanent addresses that can be forwarded on indefinitely.

Changes

If this notice changes materially we will update the effective date above. The version you accepted alongside any non-disclosure agreement is recorded against that acceptance and does not change retrospectively.

4 September 2026, fourth revision. Two statements that described work in hand now record work done. The data-processing agreement with Zoho Corporation is signed, so all four processors are covered by one, and the notification to POTRAZ of the company’s processing activities and its cross-border transfers has been made under section 10(2) of Statutory Instrument 155 of 2024. Both rest on the company’s confirmation of 4 September 2026. Nothing else moved, and no collection, purpose, recipient, retention period or right changed with them.

4 September 2026, third revision. A site-wide copy edit reset every sentence in this notice into formal plain English. The wording changed and the meaning did not, so the effective date above stands and nothing recorded against an earlier acceptance is affected. What changed: long sentences were split, colon-led explainers were rewritten as sentences, and the analytics paragraph was separated into what is recorded and what is not. No collection, purpose, recipient, retention period or right was added, removed or altered.

4 September 2026, second revision. The retention of agreement acceptance records is stated separately from the two-year correspondence period, and the consent wording on the document release now says the same thing. The single sentence that stood before said two years of both, which was right about correspondence and wrong about the acceptance record, and that sentence was fingerprinted into every record it misdescribed. The acceptance record also now lists what it holds, including the role and the confirmation of authority added to the request form on the same day.

4 September 2026. For the launch month the site uses Cloudflare Web Analytics, described under What we collect; no cookies and no identifiers are involved.

3 September 2026. The company’s registration as a data controller with POTRAZ and the appointment of a Data Protection Officer are stated; the entity number moved to the compliance page; the registered office is given as filed.

1 September 2026, second revision. The enquiry form and the document release are now live, so this notice describes a site that collects rather than one that does not. What changed: the “If you write to us” section now covers form submissions; all four processors are marked in use; the consent paragraph describes a choice you can actually make; and the security section no longer says no records exist.

1 September 2026. Added the retention periods for server logs: seven days for request records, twenty-four hours for records of requests that triggered a security rule. The previous version said what was collected and why, but not for how long. Also corrected three places where this notice described how the site will work rather than how it works: the transfer table now says which processors are actually in use, the consent paragraph no longer implies a form you can fill in, and the security section says plainly that no records exist yet. Added a retention period for correspondence, two years, and a description of the security measures each recipient applies. Both are required by paragraph 3.2 of the POTRAZ cross-border transfer guideline.