Privacy Policy

School Reviews ("we", "us", or "our") operates the website schoolreviews.co.zw. This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the Cyber and Data Protection Act, 2021 [Chapter 12:07] of Zimbabwe and the Constitution of Zimbabwe.

1. Data Controller

School Reviews is the data controller responsible for your personal information. We are committed to protecting your privacy and processing your data lawfully, fairly, and transparently as required by the Cyber and Data Protection Act.

2. Information We Collect

We collect the following types of personal information:

• Account Information: Your name, email address, and relationship to a school (e.g. current parent, past parent) when you create an account.
• Review Content: The reviews, ratings, questions, and answers you submit about schools, including whether you choose to display your name or remain anonymous.
• Verification Documents: If you choose to verify your identity, we may collect proof documents such as school fees receipts or letters from the school.
• Contact Information: Your name, email, phone number, and message content when you use our contact form or submit suggestions.
• Usage Data: Technical information such as your browser type, pages visited, and time spent on the site, collected through essential cookies for the functioning of the platform.

3. Legal Basis for Processing

Under the Cyber and Data Protection Act, we process your personal information on the following lawful bases:

• Consent: When you create an account, submit reviews, or provide your contact details, you consent to the processing of that information for the purposes described in this policy.
• Contractual Necessity: Processing necessary to provide you with our platform services as described in our Terms of Service.
• Legitimate Interest: Processing necessary for the operation, security, and improvement of our platform, including content moderation and fraud prevention.

4. How We Use Your Information

• To provide and maintain the School Reviews platform, including displaying your reviews and facilitating Q&A.
• To verify your identity when you request verification as a parent of a school.
• To send you account-related communications, including verification codes and notifications about activity on your reviews or questions.
• To moderate content and ensure reviews comply with our community guidelines and Zimbabwean law.
• To analyse usage patterns and improve the platform experience.
• To comply with legal obligations under Zimbabwean law.

5. How We Share Your Information

We may share your information in the following circumstances:

• Public Reviews: Your reviews, questions, and answers are displayed publicly on the platform. If you choose to show your name, it will be visible to other users. Anonymous reviews display no identifying information.
• Service Providers: We use third-party services to host and operate the platform (including Vercel for hosting and Neon for database services). These providers process data on our behalf and are bound by data processing agreements.
• Legal Requirements: We may disclose your information if required by Zimbabwean law, court order, or to comply with a lawful request from a government authority.

We do not sell, rent, or trade your personal information to any third party for commercial purposes.

6. Data Storage and International Transfers

Your data is stored on secure servers located outside Zimbabwe (in the European Union). In accordance with the Cyber and Data Protection Act, we ensure that any international transfer of your personal data is subject to appropriate safeguards and that the receiving jurisdictions provide adequate data protection. We take all reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy.

7. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected. Account information is retained while your account is active. Reviews and Q&A content are retained to maintain the integrity of the platform. If you request deletion of your account, we will delete your personal information within a reasonable timeframe, except where we are required by law to retain it.

8. Your Rights

Under the Cyber and Data Protection Act, you have the following rights regarding your personal information:

• Right to Be Informed: You have the right to know how your personal data is being collected and used.
• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Correction: You may request that we correct any inaccurate or misleading personal information.
• Right to Deletion: You may request that we delete personal information that is false, inaccurate, or no longer necessary.
• Right to Object: You may object to the processing of all or part of your personal information.

To exercise any of these rights, please contact us at limbikani@gmail.com. We will respond to your request within a reasonable timeframe.

9. Children's Privacy

Our platform is intended for use by adults (persons aged 18 years and older). In accordance with the Cyber and Data Protection Act, we do not knowingly collect personal information from children under the age of 18 without the consent of a parent or legal guardian. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will take steps to delete such information.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal information from unauthorised access, loss, destruction, or alteration. These measures include encrypted data transmission (HTTPS), secure database storage, and access controls. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Data Breach Notification

In the event of a data breach that is likely to pose a risk to your rights and freedoms, we will notify the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) within 24 hours of becoming aware of the breach. If the breach poses a high risk to you, we will notify you within 72 hours, as required by the Cyber and Data Protection Act and its regulations.

12. Cookies

We use essential cookies that are strictly necessary for the operation of our platform. These include session cookies to keep you logged in and locale cookies to remember your language preference. We do not use tracking cookies or third-party advertising cookies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. Continued use of the platform after changes are posted constitutes your acceptance of the updated policy.

14. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at limbikani@gmail.com.

15. Regulatory Authority

The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) serves as the Data Protection Authority under the Cyber and Data Protection Act. If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with POTRAZ.