This procedure explains how you can exercise your rights over your personal data under the Data Protection Act [Chapter 11:12] of Zimbabwe, how to complain to KFE, and how to escalate to the authorities.
1. Your rights
Under section 14 of the Data Protection Act you may:
- ask what personal data we hold about you (access);
- ask us to correct data that is false or misleading;
- ask us to delete your data where we have no lawful reason to keep it;
- object to processing based on our legitimate interests, and object to direct marketing at any time;
- ask that you not be subject to decisions made solely by automated processing (including profiling) that have a legal or significant effect on you;
- complain to POTRAZ, the Data Protection Authority.
2. How to make a request
Send your request to info@kfe.co.zw with the subject "Data Subject Request". Include your name, the phone number linked to your account, which right you want to exercise, and enough detail for us to find your data.
3. Identity verification
To protect your data, we verify your identity before acting — for example, by confirming a one-time code sent to the phone number on your account. We will not ask for more identification than necessary.
4. Our response
We acknowledge your request promptly and aim to respond fully within 30 days of receiving it and verifying your identity. If your request is complex, we will tell you why and give a revised date. Responses are free of charge. If we refuse or limit your request, we will give reasons and tell you how to complain.
5. Children and guardians
A child's data rights are exercised by the child's legal guardian, who must provide proof of guardianship before we act on a request about a child's data.
6. How to complain to KFE
If you are unhappy with how we handle your data or with any of our services: contact us first at info@kfe.co.zw with the details. We will acknowledge your complaint, investigate, and aim to give you a substantive response. If you are not satisfied, you may escalate as below.
7. Escalation to the authorities
- Data protection: lodge a complaint with POTRAZ (Postal and Telecommunications Regulatory Authority of Zimbabwe), the Data Protection Authority — see potraz.gov.zw for the complaints desk.
- Consumer matters: complain to the Consumer Protection Commission, seek arbitration under section 60 of the Consumer Protection Act (Act No. 5 of 2019), or approach the courts.
8. Reporting a data breach
If you suspect your data, or another person's data, has been exposed or misused on our Platforms, contact us immediately at info@kfe.co.zw. Our breach playbook: we notify POTRAZ within 24 hours of becoming aware of a breach, and notify affected users within 72 hours where the breach is likely to pose a high risk to their rights.
9. Law-enforcement requests
We disclose personal data to law-enforcement or other authorities only where required by law or a lawful order, and only after verifying the authority and scope of the request.
Note: this document is a compliance draft prepared for KFE and should be reviewed by a Harare attorney before being treated as final legal advice.