Privacy Notice

What we collect, why we collect it, and how to exercise your rights under Zimbabwe's CDPA.

Version 2 · Effective 2026-10-01

1. Who we are and how to contact us

This notice explains how Assegai Analytics of Harare, Zimbabwe ("Assegai", "we", "us") collects and uses personal information through Trident Protect (the platform at trident.assegai.africa), our marketing pages and the services we provide around them. Our company and licence particulars are given on request. We handle personal information in accordance with the Cyber and Data Protection Act [Chapter 12:07] (the "Act"), including its licensing, notification and cross-border requirements.

Our Data Protection Officer can be reached at dposervices@assegai.africa. Write to the DPO about anything in this notice, to exercise your rights, or to raise a concern.

This notice covers personal information we use for our own purposes. When our customers use Trident to manage their compliance records (for example their records of processing, breach registers or data subject requests), the customer is the controller of that information and we process it on their instructions under our Data Processing Addendum. Questions about how a customer uses your information should go to that customer first.

2. The information we collect

When you visit our public pages

Technical information: IP address, browser and device type, pages visited, referring page and approximate location derived from the IP address.
Information from a bot-protection check when you submit a form.

When you contact us, book a demo or ask for a consultation

Name, work email, organisation, role, phone number (if you give it) and your message.
The date and time you choose for a demo or consultation.

When you or your organisation use Trident

Account information: name, work email, job title, the organisation and portal you belong to, your role and permissions.
Sign-in and security information: sign-in times, authentication events, and an audit trail of actions taken in the platform (who did what, and when).
Your preferences, such as layout and view settings.
Content you create or upload: records, assessments, documents, notes and comments. For your organisation's compliance records we act as a processor (see section 1).

When your organisation buys from us

Billing contact details, invoices, payment method type, payment references and proof of payment for bank transfers. Card details are collected and held by our payment provider; we never see or store full card numbers.

When we act as your organisation's Data Protection Officer

The information needed to perform the DPO role: contact details of your people, the records you share with us, correspondence with you and with the Authority, and time records of the DPO work done.

From other sources

Assegai Privacy Lab. If you used our free Privacy Lab assessments and then ask to become a Trident customer, we receive your organisation code, contact details and assessment results through a secure link between the two services.
Your organisation or consultant. Your employer, or a data-protection consultant who manages your organisation on Trident, may create your account and give us your name and work email.

We do not ask for sensitive personal information (as defined in the Act) about you. If a customer stores sensitive information in their own compliance records, it is handled as their processor (see sections 1 and 10).

3. Why we use your information and our legal basis

The Act allows us to process personal information with your consent (section 10(1)), which may be implied where you are an adult with full legal capacity or an organisation (section 10(2)), or without consent where one of the grounds in section 10(3) applies. For each purpose below we name the ground we rely on and, where it differs, who it applies to.

Purpose	Information	Whose information and legal basis under the Act
Create and run an account and provide the platform your organisation has subscribed to	Account, sign-in, content	People who sign up themselves: consent, implied when you sign up and use the service (s.10(1)–(2)). People added by their employer or consultant: our legitimate interest in providing the service that your organisation has contracted for (s.10(3)(e))
Keep the platform secure: prevent fraud, abuse and unauthorised access; keep audit trails	Technical, sign-in, audit trail	Our legitimate interest in protecting the service and our customers' data (s.10(3)(e)); and our legal duty to keep personal information secure (s.10(3)(b); s.18)
Bill, collect payment and keep financial records	Billing contact, payment references	Billing contacts: our legitimate interest in collecting what is owed (s.10(3)(e)); and our legal duty to keep accounting and tax records (s.10(3)(b))
Act as your organisation's Data Protection Officer, where you have appointed us	DPO-service information	People named in DPO-service records: the statutory duties a DPO carries (s.10(3)(b)); our legitimate interest, and your organisation's, in the DPO role being performed (s.10(3)(e))
Answer enquiries, arrange demos and consultations	Contact and enquiry details	Your consent, given when you submit the form (s.10(1))
Send service messages (security alerts, billing notices, changes to terms)	Account email	Legitimate interest in running the service (s.10(3)(e)); where a notice is legally required, s.10(3)(b)
Send news and product updates	Email	Your consent (s.10(1)). You can withdraw it at any time from the link in every message
Understand how our public pages are used, to improve them	Technical information	Our legitimate interest in improving our website (s.10(3)(e)). We use cookieless analytics only
Improve the platform using aggregated, anonymised usage statistics	De-identified usage data	Legitimate interest (s.10(3)(e)). Anonymised statistics no longer identify you
Comply with the law, respond to the Authority, and establish or defend legal claims	Any relevant information	Legal obligation (s.10(3)(b)); legitimate interest (s.10(3)(e))

Where we rely on legitimate interests we have weighed them against your rights and freedoms, as the Authority's guidance requires (CDPG 4 of 2024). You can ask us for that assessment, and you can object to processing based on legitimate interests (section 8).

4. Artificial intelligence

Some Trident features draft or summarise text with an AI model: assessment reports, policies and notices, business continuity plans, AI policy blueprints, policy grading, incident reports and notices, gap-analysis narratives, risk wording, and the wording and change summaries of processing-activity records.

Drafts, not decisions. An AI draft is a proposal for a person to review, edit and approve. Trident does not make any decision about you using AI alone that has legal or similarly significant effects (section 25 of the Act). Scores in Trident are calculated by fixed rules in our software, not by the AI model.
Who processes it. AI drafting is performed by our AI providers, Anthropic and OpenAI, each of which processes the content needed for the draft on our behalf; a given feature uses one of them at a time. Under their commercial terms they may not use that content to train their models, and delete it within 30 days.
No training on your information. We do not use your personal information, or our customers' content, to train AI models, and we do not allow our providers to do so.

5. Who we share your information with

We do not sell personal information. We share it only as follows:

Our service providers (processors), who act on our instructions under written contracts that require them to keep it secure (section 18(4)–(5) of the Act). The providers that process customers' compliance data or billing information are listed, with what each does and where it processes data, in Annex 3 of our Data Processing Addendum: Supabase (database, sign-in, file storage), Vercel (hosting), Anthropic and OpenAI (AI drafting), Stripe (card payments), Resend (email), Sentry (error monitoring) and Cloudflare (bot protection). Providers that serve only our public website — Plausible (cookieless analytics), Cal.com (demo booking) and Google Fonts — do not receive customers' compliance data.
Your consultant. If a data-protection consultant manages your organisation on Trident, they can see your organisation's account and billing information.
The Data Protection Authority, when you have asked us to file on your behalf, when the Act requires a notification, or when the Authority lawfully requests information.
Professional advisers (lawyers, auditors) under a duty of confidence.
Law enforcement or courts, only where the law requires it.
A buyer or successor of our business, under equivalent protections, with notice to you.

6. Transfers outside Zimbabwe

Trident is hosted in the European Union (Frankfurt), and some of our providers process information in other countries, including the United States. These are cross-border transfers under sections 28 and 29 of the Act.

We transfer personal information only where the destination provides an adequate level of protection, assessed as the Authority's guidance requires (the legal framework, data subject rights, security and international commitments — CDPG 4 of 2025). Where that is not established, we rely on a written data processing agreement with the provider containing standard data protection clauses equivalent to those the Authority recognises, or another safeguard the Act permits, together with the security measures in section 7. We assess each transfer before it starts, keep a record of it, and make the notifications the Authority's guidance requires. You can ask the DPO for a summary of the safeguards that apply.

7. How we keep your information secure

Every customer's data is separated inside the database by row-level security, so one organisation cannot read another's records.
Information is encrypted in transit (TLS) and at rest by our hosting provider.
Access by our staff is limited to what their role needs and is logged; administrative actions leave an audit trail.
Payment card data is handled only by our payment provider.
Sign-ups from disposable email domains are blocked, and forms are protected against bots.
We monitor errors and security events continuously, and we have a breach response plan. We notify the Data Protection Authority of a breach within the times the Act requires (24 hours, section 19). If a breach affecting your personal information is likely to result in a high risk to you, we will tell you without undue delay and within 72 hours (SI 155 section 17(3)).

No system is completely secure. If you believe your account has been compromised, contact dposervices@assegai.africa immediately.

8. Your rights

Under section 14 of the Act you have the right to:

be informed that your personal information is being collected, and why;
access the personal information we hold about you;
object to the processing of your personal information;
correct personal information that is false or misleading; and
have deleted personal information that is false or misleading.

Where we rely on your consent you may withdraw it at any time, as easily as you gave it and free of charge; this does not affect processing already done. You also have the right not to be subject to a decision based solely on automated processing that significantly affects you (section 25).

To exercise a right, email dposervices@assegai.africa or use the contact route in your Trident account. We may need to confirm your identity. We respond within 30 days and do not charge for a reasonable request. If your request concerns a customer's compliance records that we hold as processor, we will pass it to that customer and help them respond.

9. Cookies and similar technologies

Our cookie posture explains exactly what we set. In short: the signed-in platform uses only what it needs to work (keeping you signed in and remembering your layout); our analytics are cookieless; we do not use Google Analytics or any advertising or cross-site tracking; and if we ever add a cookie that is not strictly necessary, we will ask for your opt-in first and update the cookie posture before we do.

10. Children and sensitive information

Trident is a service for organisations and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact the DPO and we will delete it.

We do not ask for sensitive personal information about you. Where a customer records sensitive information or children's information in their own compliance records, the customer is responsible, as controller, for obtaining the written consent the Act requires (sections 11 and 12; CDPG 2 of 2024), and we process it only on their instructions.

11. Concerns and complaints

If you have a concern about how we use your personal information, please contact our DPO first at dposervices@assegai.africa; we will acknowledge it promptly and aim to resolve it within 30 days.

You also have the right to complain to the Data Protection Authority — the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ, www.potraz.gov.zw (opens in a new tab)) — at any time.

12. How long we keep information

We keep personal information only as long as we need it for the purpose it was collected for, or as the law requires, and then delete or anonymise it:

Account profile (name, work email, job title, role) — while the account is active, then up to 12 months after the organisation's subscription ends (to allow reactivation and final data export), then deleted.
Customer compliance records — held as processor and returned or deleted as set out in the Data Processing Addendum: 30 days to export after the subscription ends, deletion from our active systems within a further 60 days, and from backups as they are overwritten in the normal cycle (no longer than 35 days).
Billing and payment records — 6 years after the financial year they relate to, to meet accounting and tax record-keeping duties.
Audit trails and security logs — up to 24 months.
Enquiries, demo and consultation requests — up to 24 months after our last contact, unless you become a customer.
Our records of DPO work done — where we act as your DPO, we keep our own record of the work we did (advice given, time spent, correspondence with the Authority) for the term of the appointment and 6 years after it ends, so that we can evidence our work if the Authority or a court asks. This does not extend how long we keep your organisation's compliance records, which follow the Data Processing Addendum.
Marketing preferences — until you withdraw consent, after which we keep a record of the withdrawal so that we do not contact you again.

13. Changes to this notice

We review this notice at least once a year and whenever our processing changes. We publish each version here with its effective date. If a change is material, we will tell signed-in users in the platform and email account owners at least 14 days before it takes effect, unless the change is required sooner by law.

Questions? Email dposervices@assegai.africa.