Privacy & Data Protection

Ontech Solutions Limited, a company incorporated in the Republic of Zambia.

• TPIN: 2374025147
• Registered office: Lusaka, Zambia
• Data Protection Commission: Registered Data Controller, certificate DP000394
• General: info@ontech.co.zm  |  +260 211 488 275
• Privacy: privacy@ontech.co.zm
• Data Protection Officer: Ebwalya — ebwalya@ontech.co.zm

For your own account data Ontech acts as Data Controller. For the recipient data you upload and send to, Ontech acts as Data Processor on your instructions — you remain the controller of your contact lists and message content.

Lawful bases (Data Protection Act 2021, s.13): contract performance, legal obligation, legitimate interests (security and fraud prevention), and consent where required.

We do not sell, trade or rent personal data. To deliver messages and process payments we share data only with:

• Mobile network operators — MTN, Airtel and Zamtel (message delivery)
• Mobile-money providers — MTN Mobile Money, Airtel Money, Zamtel Kwacha
• Regulators — Office of the DPC, ZICTA, Bank of Zambia, ZRA, Zambia Cyber Security Agency
• Law enforcement — on a valid order or where required for national security
• Professional advisers — auditors and legal counsel, under confidentiality

Sub-processors are engaged under written agreements as required by s.52. The current list is published at ontech.co.zm/legal/sub-processors.

After the retention period data is securely deleted or irreversibly anonymised, unless a legal obligation or live dispute requires otherwise.

• TLS 1.2+ in transit; encryption at rest for sensitive data
• Role-based access control, least privilege, audit logging, MFA support
• Network segmentation, patch management and periodic penetration testing
• Staff confidentiality undertakings and privacy training

Ontech operates its own production infrastructure at the Infratel Tier III data centre in Lusaka, Zambia. In line with s.70(1), platform data is processed and stored in Zambia, and sensitive personal data is never transferred outside Zambia.

A personal data breach is reported to the Office of the Data Protection Commissioner within twenty-four (24) hours of becoming aware of it (s.49(1)). Where we act as processor for you, we notify you without delay so you can meet your own 24-hour obligation. Affected individuals are notified as soon as practicable where the breach poses a significant risk. Incidents affecting Critical Information Infrastructure are additionally reported to the Zambia Cyber Security Agency under s.17 of the Cyber Security Act, 2025.

Under Part IX of the Data Protection Act 2021 you may request:

• Access (s.58) — a copy of your personal data; the first request is free
• Rectification (s.59) — correction of inaccurate or incomplete data
• Erasure (s.60) — deletion in the circumstances the Act allows
• Objection (s.61) — an absolute right to object to direct marketing
• Human review (s.62) of solely automated decisions with significant effects
• Restriction (s.63) and portability (s.65)
• Withdraw consent at any time, without affecting prior lawful processing

Exercise these via ontech.co.zm/privacy/request or ebwalya@ontech.co.zm. We respond within 30 days; identity verification may be required. You may complain to the Office of the DPC (s.68) and appeal its decision to the High Court within 30 days (s.69).

As the sender, you must not attempt to bypass an opt-out. Marketing traffic is opt-in only and must offer a clear way to unsubscribe.

Governed by the laws of the Republic of Zambia, including the Data Protection Act 2021, Cyber Security Act 2025 and Cyber Crimes Act 2025, subject to the jurisdiction of the Zambian courts.

This policy is reviewed at least annually. Material changes are notified to customers and posted with a revised version number and date.