This notice explains how TACEGATE handles personal data in Tacegate, under the Data Protection Act No. 3 of 2021 of Zambia (the Act). It covers people who use the service and people whose data our customers put into it.
1. Who is responsible for your data
TACEGATE, a company registered in Zambia under number [Company registration number], with its registered office in Lusaka, Zambia, operates Tacegate. We are registered with the Data Protection Commission as a data controller and a data processor, registration number [DPC registration number].
We are the controller of data we collect to run our own business: the accounts of people who use the service, billing contacts, support requests, and security logs.
Each customer organisation is the controller of the data it puts into the service, such as its employees, customers and suppliers. We act as its processor and follow its instructions under our Data Processing Agreement. If your data is in a customer's records, for example as an employee, contact that organisation first. We will pass on requests we receive to the right organisation.
2. What data we process
Account data: name, email address, phone number, password (stored only as a one-way hash), authenticator secret (encrypted), roles, language and notification preferences.
Billing data: organisation name and details, billing contacts, invoices, payments and plan history.
Usage and security data: sign-in times, failed sign-ins, IP address, browser details, request identifiers, and the audit trail of actions taken in the service.
Consent records: which version of the terms and this notice each user accepted, and when.
Customer data, processed for our customers: business records that may contain personal data about employees, contacts of customers and suppliers, drivers, technicians, delivery recipients (including names, signatures and photos as proof of delivery), and addresses and locations.
Human resources and payroll data, processed for our customers: employment details, date of birth, leave, attendance, salary, deductions and payslips, and the identifiers described in section 3.
Driver records, processed for our customers: licences, and medical documents where a customer uploads them.
3. Sensitive personal data
Payroll needs identifiers and financial details: National Registration Card (NRC) or passport number, ZRA Taxpayer Identification Number (TPIN), NAPSA and NHIMA numbers, date of birth, bank account details and salary. Fleet records may hold drivers' medical documents. We treat all of these as sensitive personal data.
Payroll identifiers and bank details are encrypted separately in the database, only users with a specific high-risk permission and recent multi-factor authentication can see them, and every view of them is recorded in the audit log. Drivers' medical documents need a separate permission even to read. Our support staff cannot see any of them.
The customer, as employer and controller, is responsible for its lawful basis to process this data, which is usually a legal obligation under Zambian tax and social security law.
4. Why we use data and our lawful basis
To provide the service under our contract with the customer: running accounts, signing users in, processing the customer's records. Basis: performance of a contract.
To bill customers and keep accounting and tax records. Basis: contract and legal obligation.
To keep the service secure, detect abuse, and investigate incidents. Basis: legitimate interests in protecting the service and our customers, and legal obligation to secure personal data.
To send service emails, such as invitations, verification, password resets, payslips and documents the customer chooses to send, and notices about the service. Basis: contract.
To record acceptance of these documents and of any cross-border transfer. Basis: legal obligation and consent.
We do not sell personal data, use it for advertising, or make decisions about people based solely on automated processing.
5. Where data is stored
Data in the service is stored by our hosting provider in a secure data centre. Where that is outside Zambia, the transfer is made under sections 70 and 71 of the Act.
Apart from our hosting provider, only the services in section 6 receive personal data.
6. Transfers outside Zambia
Email delivery: we send email through Resend, Inc., in the United States of America. Resend receives the recipient's email address and name and the content of each email, which may include invitations, verification and password reset links, notifications, and payslips and documents (such as invoices and quotes) that a customer sends by email.
Address lookup and routing: when address lookup is turned on, we send the address text typed into address fields, and the coordinates of locations and trip stops, to Google Maps Platform, provided by Google LLC in the United States of America, to find coordinates and plan routes. Google may process this data in other countries where it operates.
Website analytics: if you accept analytics cookies on tacegate.com, Google Analytics, provided by Google LLC in the United States of America, receives information about your visit: the pages you view, your device and browser, your approximate location worked out from your IP address, and a random identifier stored in a cookie. Analytics stays off until you accept, and you can change your choice at any time with Cookie settings at the bottom of every page of the website. Google Analytics keeps this data for two months. The Tacegate service itself does not use analytics cookies.
We make these transfers under section 71 of the Act, on the basis of your consent, given when you accept this notice (and, for website analytics, in the cookie banner), and of contractual safeguards with each provider.
You can avoid sending payslips and documents by email by downloading them in the service instead. A customer that does not want addresses sent to Google can contact us to discuss options.
7. Who else sees data
Data is shared only with: our hosting provider, which stores it for us; Resend and Google as described in section 6; our staff, who need it for their work and are bound by confidentiality; professional advisers under a duty of confidence; and authorities when the law requires it.
Our staff see a customer's records only in a support session approved by that customer's Owner, as described in the Terms of Service.
8. How long we keep data
Customer data: for as long as the customer's subscription lasts. After it ends, the organisation is read-only for 90 days, then its data is deleted. Deleted data leaves our backups within 35 days.
Audit archive: records of actions in the service, which contain names, user identifiers, IP addresses and redacted details of changes, are kept in write-once storage for 7 years and then deleted. They cannot be changed or deleted earlier.
Deletion record: after deletion we keep only the organisation name, identifier and the dates of its subscription and deletion.
Our billing records with customers: for [6] years after the end of the financial year they relate to, as required by Zambian tax law.
Account data of a user who is removed from every organisation: deleted within [period], except what is in the audit archive.
Security logs: [90] days.
Payroll and accounting records: the customer decides how long they stay in the service while subscribed. Zambian law requires employers to keep payroll and tax records for a set number of years. The customer must export and keep them before its data is deleted.
We may keep data longer under a legal hold, when a court, regulator or the law requires it.
9. How we protect data
Data is encrypted in transit with TLS and encrypted at rest. Payroll identifiers, bank details and authenticator secrets have an extra layer of encryption.
Each organisation's data is kept apart by checks in the application and in the database. Access within an organisation follows roles and permissions and is denied by default.
Multi-factor authentication is required for administrators and high-risk permissions. Passwords are stored only as strong one-way hashes. Sessions expire after inactivity.
Changes, sign-ins, exports and support sessions are recorded in an audit log that ordinary users cannot change.
Staff access to production systems is limited and recorded.
10. Your rights
Under the Act you have the right to: be told how your data is used; get a copy of your data; have wrong or incomplete data corrected; have data deleted or its use restricted where the law allows; object to processing; receive your data in a portable form; withdraw consent at any time, without affecting what was done before; and not be subject to a decision based solely on automated processing.
To use a right about your own account, email [email protected]. If your data is in a customer's records, contact that organisation, which decides on the request; we help it do so.
We may ask you to prove your identity. We answer within [30] days.
Withdrawing consent to the transfers in section 6 may mean we cannot send you email from the service.
You may complain to the Data Protection Commission of Zambia at [DPC contact address and website]. We ask that you contact us first so we can try to help.
11. Data breaches
If a breach of security affects personal data, we notify the Data Protection Commissioner within 24 hours of becoming aware of it.
We notify affected customers without undue delay, so they can meet their own duties and inform the people affected where needed.
12. Contact and data protection officer
Our data protection officer is [DPO name]. Contact: [email protected], +260 776 836 233, Lusaka, Zambia.
We will update this notice when our processing changes. Each version has a number, and you will be asked to accept a new version when you next sign in.