Privacy Policy

1. WHO WE ARE AND HOW TO CONTACT US

Arson Pixelz (Private) Limited (“Arson Pixelz”, “we”, “us”, “our”) is a company incorporated under the Companies and Other Business Entities Act [Chapter 24:31] of Zimbabwe (Registration Number: 82248A0122026), whose registered address is Harare, Zimbabwe, Zimbabwe. Arson Pixelz operates the educational platform (the “Platform”).

Arson Pixelz is a data controller in terms of the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe (“DPA”) and is required to hold a data controller licence issued by the Postal and Telecommunications Regulatory Authority (“POTRAZ” or the “Authority”) in its capacity as Data Protection Authority.

Data Protection Contact: privacy@arsonpixelz.com

2. WHAT THIS POLICY COVERS

This Privacy Policy explains what personal information we collect from users of the Platform, how we use it, how we protect it, and what rights you have under Zimbabwean law. It applies to all users, including learners, parents or guardians, teachers, and school administrators who access the Platform.

3. INFORMATION WE COLLECT

3.1 Registration Information. When you create an account, we collect your first name, surname, year of birth (not full date of birth), school name, class or form, and a contact email address (for adult users or the parent or guardian of a learner under 18).

3.2 Platform Usage Data. When you use the Platform, we automatically collect login sessions (date and duration), subjects and topics accessed, number and nature of questions submitted, time spent on the Platform, frequency of use, and return rate.

3.3 Assessment Data. Where the Platform includes ZIMSEC-aligned assessments, we collect your responses and scores for the purpose of measuring educational impact.

3.4 Technical and Device Data. We collect the type of device used (smartphone, tablet or computer), browser type, and general geographic location at country or province level only. We do not collect street-level GPS location.

3.5 Feedback Data. If you voluntarily submit feedback via the Platform’s feedback function, we collect the content of that feedback.

3.6 What We Do Not Collect. We do not collect photographs, video or voice recordings, precise GPS location, financial or payment data, school examination results, national identity numbers, or any content from your device outside the Platform.

4. LEGAL BASIS FOR PROCESSING

In terms of the DPA, we rely on the following legal bases:

• (a) Your explicit consent (section 10 and 11 of the DPA): for account registration, collection of learner data, and all processing described in this Policy. Where the user is a child under 18, consent is obtained from the parent or guardian in terms of section 26 of the DPA.
• (b) Legitimate interests (section 10(3)(e) of the DPA): for internal product improvement, platform security, and aggregate educational research, where such interests are balanced against and do not override the rights of data subjects.
• (c) Compliance with a legal obligation: where processing is required to comply with Zimbabwean law, including the DPA and SI 2024-155.

5. HOW WE USE YOUR INFORMATION

5.1 To provide and operate the Platform, including creating and managing your account and delivering ZIMSEC-aligned educational content.

5.2 To measure and report on the educational impact of the Platform, using anonymised and aggregated data.

5.3 To improve the accuracy, quality and safety of our AI systems and curriculum content.

5.4 To provide teacher dashboards with aggregated class-level usage data. Individual question-and-answer exchanges are not visible to teachers.

5.5 To maintain the security and integrity of the Platform and to prevent fraud and misuse.

5.6 To comply with our legal and regulatory obligations under Zimbabwean law.

6. SHARING YOUR INFORMATION

We share your personal information only in the following circumstances:

• (a) Third-party processors: We use secure cloud infrastructure providers (such as Amazon Web Services, Google Cloud, or Microsoft Azure) to host and process data. These providers are bound by written data processing agreements that prohibit them from using your data for their own purposes and require them to maintain appropriate security.
• (b) Legal obligation: We may disclose your information where required to do so by Zimbabwean law or a competent court or regulatory authority.
• (c) Business transfers: If Arson Pixelz is involved in a merger, acquisition, or sale of assets, your information may be transferred to the relevant third party, subject to equivalent data protection obligations.

We will NEVER sell your personal information to any third party, use it for advertising or behavioural profiling, or share individually identified data with any person outside those described above.

7. CROSS-BORDER DATA TRANSFERS

Our cloud infrastructure providers may process data in countries outside Zimbabwe. In terms of section 28 of the DPA, we ensure that any transfer of personal information outside Zimbabwe is protected by adequate contractual safeguards, including written data processing agreements that impose obligations equivalent to those required under Zimbabwean law. We notify the Authority of any intended international transfers in terms of SI 2024-155.

8. DATA SECURITY

In terms of section 18 of the DPA and regulation 16 of SI 2024-155, we implement appropriate technical and organisational measures to protect your personal information, including:

• (a) Encryption of all personal data in transit using HTTPS/TLS 1.2 or higher and at rest.
• (b) Role-based access controls restricting access to authorised personnel on a strictly need-to-know basis.
• (c) Regular security reviews, vulnerability assessments, and data protection impact assessments.
• (d) Written data processing agreements with all third-party processors.

In the event of a security breach affecting your personal data, we will notify POTRAZ within 24 hours as required by section 19 of the DPA and will notify you as promptly as practicable.

9. DATA RETENTION

We retain your personal data for as long as your account remains active and for twelve (12) months thereafter, to complete any impact analysis and reporting obligations. After the retention period, all individually identifiable data is securely and permanently deleted. Anonymised and aggregated data may be retained indefinitely for research and product development purposes.

10. CHILDREN’S DATA

10.1 In terms of section 26 of the DPA and regulation 10(5) of SI 2024-155, the personal data of any user under the age of 18 (a “child”) may only be processed with the explicit written consent of that child’s parent or legal guardian.

10.2 No child under 18 will be permitted to access the Platform until a valid Parent or Guardian Consent Form has been received and verified.

10.3 We do not subject children’s data to automated decision-making that affects their rights, in terms of regulation 10(5)(f) of SI 2024-155.

10.4 We conduct regular data protection impact assessments in respect of our processing of children’s data.

11. YOUR RIGHTS

In terms of section 14 of the DPA, you (and, where you are under 18, your parent or guardian on your behalf) have the following rights:

• (a) Right to be informed: to be told how your personal information is being used.
• (b) Right of access: to receive a copy of the personal information we hold about you within 30 days of a request.
• (c) Right to correction: to have inaccurate or incomplete personal data corrected without delay.
• (d) Right to deletion: to have your personal data deleted. Upon deletion, your account will be deactivated.
• (e) Right to object: to object to any particular use of your personal data described in this Policy.
• (f) Right to withdraw consent: to withdraw consent at any time by writing to privacy@arsonpixelz.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at privacy@arsonpixelz.com. If you believe we have violated your rights under the DPA, you may lodge a complaint with POTRAZ (in its capacity as Data Protection Authority) at the address published on its official website.

12. COOKIES

The Platform uses cookies and similar tracking technologies. Please refer to our Cookie Policy for full details.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Platform or by email. Your continued use of the Platform after the effective date of any change constitutes your acceptance of the updated Policy.

14. CONTACT US

Arson Pixelz (Private) Limited (Registration No. 82248A0122026) | Harare, Zimbabwe, Zimbabwe | privacy@arsonpixelz.com | https://arsonpixelz.com

Data Controller under the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe