Privacy Policy | Credibility Factory Afrique

1. Who We Are

Credibility Factory Afrique (CFA), trading as CredibilityIQ, is a credibility training and consulting company registered in Zimbabwe. We operate the CredibilityIQ platform ("the Platform") at credibilityfactory.net.

Data Controller: Credibility Factory Afrique, 354 Chelternham Way, Melfort Park, Harare, Zimbabwe.
Contact: info@credibilityfactory.net | +263 242 006 784

2. Legal Basis

This policy is prepared in compliance with:

Zimbabwe Cyber and Data Protection Act, Chapter 12:07 (2021)
Zimbabwe Access to Information and Protection of Privacy Act (AIPPA)
Kenya Data Protection Act, 2019 (for Kenyan data subjects)
South Africa POPIA, 2013 (for South African data subjects)

3. What Data We Collect

a. Organisation Administrators

Name and email address (account registration)
Company name, industry, and annual revenue (for credibility scoring)
Login timestamps and IP addresses (security audit logs)

b. Anonymous Survey Respondents

Credibility scores (1–10) per value dimension — no names or emails collected
Optional respondent role (e.g. "Manager") — self-described, no verification
IP address — used solely to prevent duplicate submissions; not linked to identity

c. Technical Data

Server logs (IP, user agent, page accessed, timestamp)
Session cookies (HttpOnly, expiry 120 minutes)

4. How We Use Your Data

Provide and operate the CredibilityIQ assessment platform
Calculate CFA Credibility Lifecycle Continuum (CLC) scores
Send password-reset emails (when requested)
Detect and prevent fraud, abuse, and unauthorised access
Comply with legal obligations

We do not sell your data. We do not use survey data for advertising profiling.

5. Data Sharing

We share data only as necessary:

Hosting provider — your data is stored on servers in our cPanel hosting environment
Email service — reset-link emails are sent via our configured SMTP provider
Legal requirements — if required by a court order or lawful authority in Zimbabwe

6. Data Retention

Assessment and scorecard data: retained for the lifetime of the organisation account
Audit logs: retained for 12 months, then auto-purged
Survey IP records: retained for 90 days after the assessment closes
Account data: deleted within 30 days of account termination upon written request

7. Your Rights

Under the Zimbabwe Cyber and Data Protection Act 2021, you have the right to:

Access — request a copy of your personal data
Rectification — correct inaccurate data
Erasure — request deletion of your data (subject to legal retention obligations)
Portability — receive your data in a machine-readable format (CSV export available in-platform)
Objection — object to processing for direct marketing

Submit requests to: info@credibilityfactory.net

8. Security

We implement appropriate technical and organisational measures including:

HTTPS encryption in transit (TLS 1.2+)
Bcrypt password hashing
CSRF token protection on all state-changing requests
Rate limiting on login and survey submission endpoints
Multi-tenant data isolation — each organisation can only access their own data
Activity audit logs for administrative actions

9. Cookies

We use essential session cookies only. No third-party tracking cookies are set. The session cookie (credibilityiq_session) is HttpOnly, SameSite=Lax, and expires after 120 minutes of inactivity.

10. Changes to This Policy

We will notify registered administrators of material changes via email at least 14 days before they take effect. Continued use of the platform after notification constitutes acceptance.

11. Contact & Complaints

For privacy concerns, contact our Data Protection Officer:

Credibility Factory Afrique
354 Chelternham Way, Melfort Park, Harare, Zimbabwe
info@credibilityfactory.net
+263 242 006 784

Zimbabwean data subjects may lodge complaints with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the designated supervisory authority under the Cyber and Data Protection Act.