1. Introduction & Overview

The Catholic University of Zimbabwe (CUZ) is committed to protecting the privacy, confidentiality, and security of all personal data collected and processed in the course of our academic, research, and administrative operations. This Privacy Notice explains how CUZ collects, uses, stores, discloses, and safeguards personal information in accordance with the Cyber and Data Protection Act [Chapter 12:07].

2. Scope & Application

This notice applies to all individuals whose personal data is processed by CUZ, including:

• Students and Applicants: Current, former, and prospective students.
• Staff and Job Applicants: Current and former employees, contract workers, attachés, and employment candidates.
• Alumni, Donors, and Benefactors: Supporters and graduates of the University.
• Visitors and Event Attendees: Guests visiting university campuses, facilities, or events.
• Suppliers, Contractors, and Business Partners: External service providers and corporate collaborators.
• Website Users: Visitors interacting with university digital platforms and portals.

3. What Personal Data We Collect

CUZ collects and processes various categories of personal information necessary for its operational and statutory functions, including:

• Identification & Demographic Data: Full name, national ID number, passport number, student/staff ID number, date of birth, gender, marital status, nationality, and biometric data (where applicable).
• Contact Information: Email address, telephone numbers, physical and postal address, and emergency contact/next-of-kin details.
• Academic Records: Qualifications, admission records, transcripts, assessment results, and attendance records.
• Financial Data: Bank account details, fee payment records, sponsorship data, payroll details, and tax/NSSA numbers.
• Employment Data: Work history, performance assessments, references, background checks, and professional registrations.
• Health & Special Category Data: Medical history, disability disclosures, health test/diagnostic data, and vaccination records (processed only where legally authorized or necessary for emergency care).
• Digital & Technical Data: IP addresses, login details, cookies, device metadata, and usage analytics from University platforms.
• Security Data: CCTV footage captured across campus premises for safety and security monitoring.

4. How We Collect Personal Data

We collect personal information through direct interactions and automated means, including:

• Direct Submissions: Application forms, enrolment portals, job applications, feedback forms, and event registrations.
• Official Communications: Physical documents, emails, phone interactions, and written correspondence.
• Automated & Security Systems: Campus CCTV cameras, website cookies, network access logs, and IT portal activity.
• Third Parties: Referees, educational verification bodies, government authorities, and health providers.

5. Lawful Basis for Processing

In compliance with the Cyber and Data Protection Act [Chapter 12:07], CUZ processes personal data based on the following legal grounds:

• Consent: Where explicit permission has been provided for specific purposes (e.g., marketing or optional research).
• Contractual Obligation: Necessary to fulfil contract agreements, such as student enrolment or employment contracts.
• Legal Obligation: Necessary to comply with statutory and regulatory requirements imposed by law or statutory bodies.
• Legitimate Interests: Required for institutional operational objectives, safety, system security, and fraud prevention.
• Public Interest: Necessary to carry out public tasks, academic functions, and community welfare initiatives.
• Vital Interests: Necessary to safeguard the life, health, or physical safety of a data subject or another individual.

6. How We Share Your Personal Data

Where lawful and necessary, CUZ may disclose personal information to approved internal and external recipients, including:

• Internal Departments: Authorized academic, administrative, financial, and security staff carrying out official duties.
• Government Ministries & Regulatory Bodies: Ministry of Higher and Tertiary Education, Innovation, Science and Technology Development; Zimbabwe Council for Higher Education (ZIMCHE); Zimbabwe Revenue Authority (ZIMRA); National Social Security Authority (NSSA); and law enforcement agencies.
• Third-Party Service Providers: IT hosting providers, payment processors, banking institutions, point-of-sale (POS) providers, payroll processors, and mailing systems.
• Academic & Research Collaborators: Partner universities, research institutions, examination bodies, and audit firms.
• Healthcare & Insurance Partners: Medical service providers, emergency healthcare units, and health insurance providers.

7. Cross-Border Data Transfers

CUZ may transfer personal data to international entities for purposes such as international academic partnerships, exchange programs, joint research, or cloud-hosted systems. All cross-border transfers are conducted in compliance with statutory data protection requirements, ensuring adequate technical and organizational safeguards and statutory authorizations.

8. Data Security & Retention

• Security Safeguards: CUZ implements rigorous technical and organizational security measures—including role-based access control, encryption, secure server architecture, physical security, staff training, and periodic vulnerability audits—to safeguard data against unauthorized access, loss, or misuse.
• Data Retention: Personal information is retained only as long as necessary to achieve the specified purpose for which it was collected, or to meet statutory, academic, and legal retention obligations.

9. Data Subject Rights

Under the Cyber and Data Protection Act [Chapter 12:07], individuals possess the following data privacy rights:

• Right to be Informed: Right to know how personal data is being collected and processed.
• Right to Access: Request access to and obtain copies of personal data held by CUZ.
• Right to Rectification: Request corrections to inaccurate, incomplete, or outdated information.
• Right to Erasure (Right to be Forgotten): Request deletion of personal data where legal exceptions do not apply.
• Right to Restrict Processing: Request restrictions on data processing under specific circumstances.
• Right to Data Portability: Obtain personal data in a structured, standard, and machine-readable format.
• Right to Object: Object to processing based on legitimate interests or direct marketing.
• Rights Regarding Automated Decision-Making: Protection against decisions made solely through automated processing or profiling that significantly affect the individual.
• Right to Complain: File a complaint with the Data Protection Officer or directly with the Data Protection Authority (POTRAZ).

10. Contact Details – Data Protection Officer (DPO)

For any questions, requests, or privacy concerns regarding this notice or your personal data, please contact the Catholic University of Zimbabwe Data Protection Officer:

11. Updates to This Notice

CUZ reserves the right to update or revise this Privacy Notice periodically to reflect changes in regulatory standards, institutional practices, or operational needs. The updated notice will be published on the official University website.