Enrol now

Privacy Policy

Glow Academy
Rise and Glow

Last Updated: November 30, 2024
Effective Date: November 30, 2024
Version: 1.0

1. INTRODUCTION

1.1 Our Commitment

Glow Academy (“we,” “us,” or “our”) is committed to protecting the privacy and personal information of our students, prospective students, and website visitors (“you” or “your”). This privacy policy explains how we collect, use, store, share, and protect your personal information in accordance with the laws of Zimbabwe and international data protection standards.

1.2 Legal Framework

This privacy policy complies with the Cyber and Data Protection Act [Chapter 12:07] and the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (SI 155 of 2024). We also align our practices with international standards, including the General Data Protection Regulation (GDPR) for EU citizens, South Africa’s Protection of Personal Information Act (POPIA), and the California Consumer Privacy Act (CCPA).

1.3 Scope and Applicability

This privacy policy applies to:

  • Our website at https://glow.ac.zw/
  • Our mobile applications (if applicable)
  • All offline data collection activities
  • Communications via phone, email, WhatsApp, and social media
  • In-person interactions at our physical location

1.4 Key Definitions

Personal information means information relating to you as an identifiable person, including your name, address, telephone number, email address, national identification number, date of birth, race, gender, photographs, video recordings, biometric data, financial information, and any other information that can identify you.

Data controller means Glow Academy, the entity that determines the purposes and means of processing your personal information.

Data processing means any operation performed on personal information, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, or deletion.

Data subject means you, the individual whose personal information we collect and process.

2. INFORMATION WE COLLECT

2.1 Personal Information Collected Directly

When you enroll in our courses, visit our website, or contact us, we may collect:

Contact Information:

  • Full name
  • Residential address
  • Email address
  • Mobile phone number
  • WhatsApp number
  • Emergency contact details

Identification Information:

  • National identification number
  • Date of birth
  • Gender
  • Nationality
  • Passport number (for international students)

Educational and Professional Information:

  • Educational background
  • Previous training experience
  • Career goals and interests
  • Course preferences
  • Performance records and assessments
  • Portfolios and creative work samples

Financial Information:

  • Payment card details (credit/debit card information)
  • Mobile money account details (EcoCash, OneMoney)
  • Bank account information for ZIPIT transfers
  • Billing address
  • Transaction history
  • Payment receipts

Media and Biometric Information:

  • Photographs and video recordings (for portfolio development and training purposes)
  • Voice recordings (for TV presenting and acting classes)
  • Attendance records captured through facial recognition or fingerprint systems (if implemented)

Health Information (when necessary):

  • Medical conditions that may affect participation in physical training
  • Dietary restrictions for events
  • Accessibility requirements

2.2 Information Collected Automatically

When you visit our website or use our digital platforms, we automatically collect:

Technical Information:

  • IP address
  • Browser type and version
  • Operating system
  • Device identifiers
  • Internet service provider
  • Referring/exit pages
  • Date and time stamps
  • Clickstream data

Cookies and Tracking Technologies:

  • Session cookies
  • Persistent cookies
  • Web beacons
  • Analytics data
  • Social media plugins

2.3 Information from Third Parties

We may receive information about you from:

  • Payment processors (EcoCash, OneMoney, ZIPIT, banks, card payment providers)
  • Social media platforms (Facebook, Instagram, WhatsApp Business)
  • Educational institutions (for verification of qualifications)
  • References provided during the application
  • Marketing partners and advertising networks
  • Public databases and government registries

3. PURPOSE AND LAWFUL BASIS FOR PROCESSING

3.1 How We Use Your Information

We process your personal information for the following purposes:

Service Provision:

  • Processing course applications and enrollments
  • Delivering training programs (TV presenting, Acting for TV, Makeup, Modeling, Film making)
  • Managing student records and academic progress
  • Providing certificates and qualifications
  • Communicating about course schedules, changes, and updates
  • Facilitating practical training sessions and portfolio development

Financial Transactions:

  • Processing tuition payments
  • Issuing receipts and invoices
  • Managing refunds and payment disputes
  • Maintaining financial records for accounting purposes

Communication:

  • Responding to inquiries via phone (078 722 1554), email ([email protected]), or website
  • Sending important notices about our programs
  • Providing customer support during business hours (Monday to Saturday, 8:00am to 10:00pm)
  • Conducting surveys and gathering feedback

Marketing and Promotional Activities:

  • Sending information about new courses and programs
  • Sharing success stories and alumni achievements
  • Promoting special offers and discounts
  • Conducting targeted advertising campaigns
  • Managing social media engagement

Legal Compliance:

  • Complying with Zimbabwean laws and regulations
  • Reporting data breaches to POTRAZ within 24 hours as required by the Cyber and Data Protection Act
  • Maintaining records as required by tax and business regulations
  • Responding to legal requests from authorities
  • Protecting against fraud and illegal activities

Operational Purposes:

  • Improving our website and digital platforms
  • Analyzing trends and user behavior
  • Conducting internal research and development
  • Maintaining security and preventing unauthorized access
  • Ensuring the quality of training services

3.2 Lawful Basis

We process your personal information based on the following lawful grounds under the Cyber and Data Protection Act: lawfulness, fairness, transparency, and purpose limitation. 

Specifically, we process your data based on:

  • Consent: You have given clear consent for us to process your personal information for specific purposes
  • Contractual necessity: Processing is necessary to fulfill our contract with you for educational services
  • Legal obligation: Processing is required to comply with Zimbabwean laws
  • Legitimate interests: Processing is necessary for our legitimate business interests, provided these do not override your rights

4. DATA SHARING AND DISCLOSURE

4.1 Third-Party Service Providers

We share your personal information with trusted third parties who assist us in operating our business:

Payment Processors:

  • EcoCash (Econet Wireless Zimbabwe)
  • OneMoney (NetOne)
  • ZIPIT (Zimbabwe Electronic Payment and Settlement System)
  • Commercial banks operating in Zimbabwe
  • International payment card processors (Visa, Mastercard)

Technology and Analytics Providers:

  • Website hosting services
  • Email service providers
  • Customer relationship management (CRM) systems
  • Analytics platforms (Google Analytics, Facebook Pixel)
  • Cloud storage providers

Marketing and Advertising Partners:

  • Social media platforms (Facebook, Instagram, WhatsApp Business)
  • Advertising networks
  • Email marketing services
  • SMS and WhatsApp broadcast services

Professional Service Providers:

  • Legal advisors
  • Accounting and auditing firms
  • Industry partners for practical training placements
  • Photography and videography services for portfolio development

4.2 Legal Disclosures

We may disclose your personal information to POTRAZ and other Zimbabwean authorities when required by law, including for compliance audits, investigations, or legal proceedings. We may also share information with:

  • Law enforcement agencies are investigating criminal activities
  • Regulatory bodies (Zimbabwe Revenue Authority, Companies Registry)
  • Courts and tribunals, as required by legal process
  • Government agencies for national security purposes

4.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you of any such change and the choices you have regarding your information.

4.4 International Data Transfers

We notify POTRAZ before transferring personal data outside Zimbabwe and only transfer data when the destination offers adequate protection or under specific conditions, such as your consent or legal necessity. 

When we transfer your data internationally, we implement appropriate safeguards:

  • Standard contractual clauses approved by data protection authorities
  • Adequacy decisions recognizing countries with comparable data protection laws
  • Binding corporate rules for transfers within corporate groups
  • Your explicit consent for specific transfers

We may transfer data to countries including:

  • South Africa (for SADC regional compliance)
  • European Union member states (for GDPR-compliant services)
  • United States (with appropriate safeguards for CCPA compliance)

5. YOUR RIGHTS AS A DATA SUBJECT

5.1 Right to Access

You have the right to request access to the personal information we hold about you. We will provide you with:

  • Confirmation of whether we process your data
  • A copy of your personal information
  • Details about how we use your information
  • Information about third parties with whom we share your data
  • The retention period for your information

To request access, contact us using the details in Section 12.

5.2 Right to Correction

You have the right to request correction of inaccurate or incomplete personal information. We will update your records promptly upon verification of the corrected information.

5.3 Right to Erasure

You may request deletion of your personal information under certain circumstances:

  • The information is no longer necessary for the purposes for which it was collected
  • You withdraw consent, and there is no other legal basis for processing
  • You object to processing, and there are no overriding legitimate grounds
  • The information was unlawfully processed
  • Deletion is required for compliance with legal obligations

Limitations: We may retain certain information when required by Zimbabwean law for record-keeping, legal compliance, or to resolve disputes.

5.4 Right to Object

You have the right to object to:

  • Processing based on legitimate interests
  • Direct marketing communications
  • Automated decision-making and profiling

5.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit it to another data controller.

5.6 Right to Withdraw Consent

Where we process your information based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

5.7 How to Exercise Your Rights

To exercise any of these rights:

  1. Submit a written request to [email protected]
  2. Call us at 078 722 1554 during business hours (Monday to Saturday, 8:00am to 10:00pm)
  3. Visit our office at 3840 Sherwood Ave, Malbereign, Harare

We will respond to your request within 30 days. We may request verification of your identity before processing your request.

6. DATA SECURITY

6.1 Security Measures

We implement comprehensive technical and organizational measures to protect your personal information:

Technical Security Measures:

  • SSL/TLS encryption for data transmission on our website
  • Encryption of sensitive data at rest
  • Secure password policies and multi-factor authentication
  • Regular security patches and software updates
  • Firewall protection and intrusion detection systems
  • Secure backup systems with encryption
  • Access controls and authentication mechanisms

Organizational Security Measures:

  • Strict access controls limiting employee access to personal information
  • Confidentiality agreements with all staff and contractors
  • Regular staff training on data protection and security
  • Background checks for employees handling sensitive data
  • Clear data handling policies and procedures
  • Incident response and business continuity plans
  • Regular security audits and risk assessments

Physical Security Measures:

  • Secure storage of physical records in locked cabinets
  • Access control systems at our premises
  • CCTV surveillance
  • Visitor management protocols
  • Secure disposal of physical documents through shredding

6.2 Data Breach Response

In the event of a data breach, we will report the incident to POTRAZ within 24 hours of becoming aware of it. If the breach poses a high risk to your rights and freedoms, we will inform you within 72 hours. 

Our breach response includes:

  • Immediate containment and assessment of the breach
  • Investigation to determine the scope and impact
  • Notification to affected individuals with details of the breach
  • Guidance on steps you can take to protect yourself
  • Implementation of measures to prevent future breaches
  • Documentation and reporting as required by law

7. DATA RETENTION

7.1 Retention Periods

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy and to comply with legal requirements.

Student Records:

  • Active student data: Duration of enrollment plus 7 years
  • Academic transcripts and certificates: Permanently
  • Financial records: 7 years from last transaction (as required by Zimbabwe Revenue Authority)
  • Application materials for unsuccessful applicants: 2 years

Marketing Data:

  • Email marketing lists: Until you unsubscribe or after 3 years of inactivity
  • Social media engagement data: 2 years
  • Website analytics: 26 months

Financial Transaction Data:

  • Payment records: 7 years (tax compliance requirement)
  • Invoice records: 7 years
  • Refund records: 7 years

Communication Records:

  • Email correspondence: 3 years
  • Phone call logs: 2 years
  • WhatsApp messages: 1 year

Technical Data:

  • Server logs: 12 months
  • Security footage: 90 days (unless required for investigation)
  • Cookie data: As specified in our cookie policy (Section 8)

7.2 Secure Destruction

When retention periods expire, we securely destroy personal information through:

  • Secure deletion of electronic files with overwriting
  • Physical shredding of paper documents
  • Degaussing or physical destruction of storage media
  • Certified destruction services for sensitive materials

8. COOKIES AND TRACKING TECHNOLOGIES

9. CHILDREN’S PRIVACY

9.1 Age Requirements

We define a child as anyone under 18 years of age in accordance with the Cyber and Data Protection Act. Our courses are primarily designed for adults aged 18 and above. However, we may accept students aged 16-17 for certain programs with appropriate consent.

9.2 Parental Consent

We process a child’s personal data only with the consent of a parent or legal guardian, who may also exercise the child’s rights under the Act. 

For applicants under 18, we require:

  • Written consent from a parent or legal guardian
  • Verification of guardian identity and relationship
  • Guardian contact information for all communications
  • Guardian signature on enrollment documents

9.3 Special Protections

We conduct data privacy impact assessments when processing children’s data as required by the Cyber and Data Protection Act and Regulations. 

Additional safeguards for children include:

  • Age verification during the application process
  • Limited data collection to what is strictly necessary
  • Enhanced security measures for children’s records
  • Restricted sharing of children’s information
  • Special consent requirements for photographs and videos
  • Supervision requirements for certain activities

9.4 Rights of Parents and Guardians

Parents and legal guardians have the right to:

  • Access their child’s personal information
  • Request correction or deletion of information
  • Withdraw consent at any time
  • Object to the processing of their child’s data
  • Receive notifications about data practices

10. AUTOMATED DECISION-MAKING AND PROFILING

10.1 Limited Use of Automation

We may use automated processing for:

  • Course recommendations based on expressed interests
  • Personalized marketing communications
  • Fraud detection in payment transactions
  • Website personalization

10.2 Your Rights

You shall not be subjected to a decision based solely on automated processing which produces legal effects concerning you without your consent or based on a provision established by law. 

You have the right to:

  • Request human intervention in automated decisions
  • Express your point of view
  • Obtain an explanation of the decision
  • Challenge the decision

11. COMPLIANCE AND REGULATORY INFORMATION

11.1 Data Controller Licensing

Glow Academy is registered with POTRAZ as a data controller and maintains a valid data controller license as required by SI 155 of 2024. 

License Details:

  • Data Controller License Number: [To be obtained]
  • License Tier: [To be determined based on data subjects processed]
  • License Validity: 12 months from issuance
  • Renewal: Applied for three months before expiration

11.2 Data Protection Officer

Glow Academy has appointed a qualified Data Protection Officer (DPO) who possesses skills in data science, information security, or relevant fields and has undergone certification training as required by SI 155 of 2024. 

DPO Contact Information:

  • Name: [To be appointed]
  • Email: [email protected]
  • Phone: [To be provided]
  • Office Hours: Monday to Saturday, 8:00am to 10:00pm

DPO Responsibilities:

  • Monitoring compliance with data protection laws
  • Managing internal data protection activities
  • Ensuring protection of data subjects’ rights
  • Serving as a point of contact for POTRAZ
  • Conducting regular compliance audits
  • Providing staff training on data protection

11.3 Regular Compliance Activities

We conduct:

  • Quarterly privacy policy reviews
  • Annual data protection impact assessments
  • Regular security audits
  • Staff training sessions on data protection
  • Monitoring of regulatory changes
  • Internal compliance audits

12. CONTACT INFORMATION AND COMPLAINTS

12.1 How to Reach Us

For questions, concerns, or requests regarding this privacy policy or your personal information:

Glow Academy
3840 Sherwood Ave, Malbereign, Harare
Zimbabwe

Phone: 078 722 1554
Email: [email protected]
Website: https://glow.ac.zw/

Business Hours: Monday to Saturday, 8:00am to 10:00pm

12.2 Data Protection Officer

For specific data protection matters:

Email: [email protected]
Phone: [To be provided upon appointment]

12.3 Complaints Procedure

If you believe we have not handled your personal information properly:

Internal Complaint:

  1. Submit a written complaint to [email protected] or [email protected]
  2. We will acknowledge receipt within 5 business days
  3. We will investigate and respond within 30 days
  4. If complex, we will inform you of the delay and expected resolution time

External Complaint:

If you are unsatisfied with our response, you may complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), which serves as the Data Protection Authority. 

POTRAZ Contact Details: Postal and Telecommunications Regulatory Authority of Zimbabwe
P.O. Box MP 843, Mt Pleasant
Harare, Zimbabwe

Website: www.potraz.gov.zw
Email: [POTRAZ contact email]
Phone: [POTRAZ contact number]

You also have the right to seek civil remedies through Zimbabwean courts for data protection violations.

13. POLICY UPDATES AND CHANGES

13.1 Review and Updates

We review this privacy policy regularly to ensure compliance with evolving legal requirements and business practices. We update the policy:

  • At least annually
  • When there are material changes to our data processing activities
  • When required by changes in Zimbabwean or international law
  • When new technologies are implemented
  • Following significant data security incidents

13.2 Notification of Changes

When we make material changes to this privacy policy, we will notify you through:

  • Email notification to registered students and contacts
  • Prominent notice on our website homepage
  • Pop-up notification when you log into your account
  • SMS or WhatsApp message for significant changes
  • Social media announcements

13.3 Acceptance of Changes

By continuing to use our services after changes take effect, you accept the updated privacy policy. If you do not agree with the changes, you may:

  • Withdraw your consent
  • Request deletion of your personal information (subject to legal retention requirements)
  • Discontinue use of our services

13.4 Version Control

Current Version: 1.0
Effective Date: November 30, 2024
Last Updated: November 30, 2024
Next Scheduled Review: November 30, 2025

Previous versions of this privacy policy are available upon request.

14. ADDITIONAL INFORMATION

14.1 Language

This privacy policy is provided in English. Upon request, we can provide translations in Shona or Ndebele for your convenience. In case of any discrepancy, the English version prevails.

14.2 Accessibility

We are committed to making this privacy policy accessible to all users. If you require this policy in an alternative format (large print, audio, or other accessible formats), please contact us at [email protected].

14.3 Links to Third-Party Websites

Our website may contain links to third-party websites, including:

  • Social media platforms (Facebook, Instagram, YouTube)
  • Payment processors
  • Partner organizations
  • Industry resources

We are not responsible for the privacy practices of these third-party sites. We encourage you to read their privacy policies before providing any personal information.

14.4 Social Media

When you interact with us on social media platforms:

  • The platform’s privacy policy applies to data collected by them
  • We may collect publicly available information from your social media profiles
  • Your interactions may be visible to other users
  • We may use social media analytics to improve our services

14.5 Professional Recording and Media Use

As a training institution for TV presenting, acting, makeup, modeling, and filmmaking, we regularly create photographs, videos, and audio recordings. These materials may be used for:

  • Educational purposes during training
  • Portfolio development for students
  • Marketing and promotional activities
  • Social media and website content
  • Industry showcases and demonstrations

Your Consent: During enrollment, you will be asked to provide specific consent for the use of your image and recordings. You may:

  • Consent to all uses
  • Limit consent to specific purposes
  • Withdraw consent at any time
  • Request removal of specific content

14.6 Alumni and Success Stories

With your permission, we may feature your achievements and success stories in our marketing materials. You have the right to:

  • Approve content before publication
  • Request updates or corrections
  • Withdraw permission at any time
  • Request removal of published content

15. ACKNOWLEDGMENT AND CONSENT

By enrolling in Glow Academy programs, using our website, or providing your personal information to us, you acknowledge that you have read, understood, and agree to this privacy policy.

You consent to:

  • Collection and processing of your personal information as described
  • Sharing of information with third parties, as outlined
  • Transfer of data internationally, where necessary
  • Use of cookies and tracking technologies on our website
  • Communication from us via email, phone, SMS, and WhatsApp
  • Processing for the purposes stated in this policy

You understand your rights and how to exercise them as outlined in Section 5.

16. GOVERNING LAW

This privacy policy is governed by and construed in accordance with the laws of Zimbabwe. This includes the Cyber and Data Protection Act [Chapter 12:07], SI 155 of 2024, and other applicable Zimbabwean legislation. 

Any disputes arising from this privacy policy or our data processing activities shall be subject to the exclusive jurisdiction of the Zimbabwean courts.

Thank you for trusting Glow Academy with your personal information. We are committed to protecting your privacy while delivering exceptional training in TV presenting, acting for TV, makeup, modeling, and filmmaking.

Rise and Glow with confidence in our data protection practices.

Scroll to Top