Privacy Policy

1. Who We Are

ComzAfrica is a technology company committed to delivering innovative solutions across the African continent. We provide a range of digital platforms and services designed to empower businesses and individuals.

We respect your privacy and are dedicated to handling your personal data responsibly, transparently, and in accordance with applicable data protection laws and the requirements of ISO 27001:2022.

This Privacy Notice explains:

• What personal data we collect about you
• Why we collect it and the legal basis for doing so
• How we use, store, and protect it
• Your rights as a data subject and how to exercise them

2. Personal Data We Collect

ComzAfrica processes a minimal set of personal data strictly necessary to deliver our services. We collect the following categories:

2.1 Mobile Subscriber Identifiers (MSISDNs)

We process mobile phone numbers (MSISDNs) in connection with our telecommunications-related services. This data is used solely to identify and route service interactions to the correct subscriber.

2.2 Electricity Meter Numbers

We process electricity meter numbers in connection with energy-related services. A meter number on its own does not directly identify an individual; however, we treat it as personal data where it can be linked to a specific person or household.

2.3 Website Login Credentials

For our company websites and platforms that require authentication, we collect:

• Username or registered email address
• Hashed passwords (we never store passwords in plain text)

Credentials are used exclusively to authenticate authorised users and maintain the security of our platforms.

3. How We Collect Your Data

We collect personal data through the following means:

• Directly from you - when you register or log in to one of our platforms, your username/email and hashed password are collected at the point of account creation or authentication
• From service systems - MSISDNs and meter numbers are received through integrations with telecommunications and utility service systems as part of delivering the requested service
• Automatically - limited technical data (such as login timestamps and session tokens) may be recorded to maintain platform security and detect unauthorised access

4. Purpose and Lawful Basis for Processing

We only process personal data where we have a valid lawful basis. The table below outlines our primary processing purposes:

5. Data Sharing and Third Parties

ComzAfrica does not sell your personal data to any third party. We may share data only in the following limited circumstances:

• Service providers and sub-processors - companies that assist us in delivering our services (e.g., cloud hosting, payment gateways, analytics). All such parties are bound by confidentiality obligations and data processing agreements.
• Business partners - where collaboration is required to provide a service you have requested, and only to the extent necessary.
• Regulators and authorities - where disclosure is required by law, court order, or regulatory authority.

All third parties with whom we share data are required to maintain appropriate technical and organisational security measures consistent with the ISO 27001:2022 standard.

6. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law and regulation. Our retention periods are determined by:

• The nature of the service provided and the ongoing relationship with you
• Statutory retention requirements (e.g., tax, financial records)
• Legitimate business need to resolve disputes or enforce agreements

Once the applicable retention period expires, personal data is securely deleted, anonymised, or destroyed in a manner that prevents reconstruction or recovery.

7. How We Protect Your Data

The security of your personal data is a priority. As an organisation operating in alignment with ISO 27001:2022, we have implemented a comprehensive Information Security Management System (ISMS) that includes:

• Encryption - sensitive data is encrypted both in transit (TLS) and at rest
• Access controls - role-based access and multi-factor authentication to limit data access to authorised personnel only
• Secure network infrastructure - firewalls, intrusion detection, and continuous monitoring
• Regular audits and assessments - internal and external reviews of our security posture
• Staff awareness training - all employees receive regular data protection and security training

While we apply robust safeguards, no system is entirely immune to risk. We encourage you to protect your account credentials and notify us immediately of any suspected unauthorised access.

8. Your Data Subject Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

To exercise any of the above rights, please contact our Data Privacy team using the contact details in Section 10. We will respond within 30 days. We may request proof of identity before processing your request.

If you are unsatisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.

9. Cookies and Tracking Technologies

Our websites use a limited set of cookies strictly necessary for the operation and security of the platform. We do not use cookies for advertising, marketing, or cross-site tracking.

Cookies We Use

• Session cookies - maintain your authenticated session while you are logged in. These are deleted automatically when you close your browser.
• Security cookies - help detect and prevent unauthorised access attempts, such as CSRF protection tokens.

Managing Cookies

Because we only use essential and security cookies, disabling them via your browser settings may prevent you from logging in or using core platform functionality. We do not serve any optional cookies that require your consent.

10. International Data Transfers

ComzAfrica operates across Africa and may transfer personal data to countries outside your country of residence. Where such transfers occur, we ensure adequate safeguards are in place, including:

• Standard contractual clauses approved by relevant data protection authorities
• Agreements with sub-processors that meet equivalent data protection standards

We will not transfer your data to a jurisdiction that does not provide an adequate level of protection without first ensuring appropriate safeguards are in place.

11. Changes to This Privacy Notice

We review this Privacy Notice at least annually, or whenever a significant change occurs to our processing activities or applicable law. Any updates will be posted on our website with a revised “Last Updated” date. Where changes are material, we will notify you directly by email or a prominent notice on our platform.

12. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Notice or how we handle your personal data, please reach out to our team:

© 2026 ComzAfrica. All rights reserved.