Zimbabwe Open University Website Privacy Notice

Last updated: 1 August 2026
Applies to: The Zimbabwe Open University public website and the public-facing ZOU online services covered by this notice

1. Introduction and scope

Zimbabwe Open University ("ZOU", "we", "us" or "our") respects your privacy and is committed to handling personal information lawfully, fairly, transparently and securely.

This Privacy Notice explains how ZOU collects, uses, stores, shares and protects personal information when you:

• visit https://www.zou.ac.zw;
• use a public-facing ZOU subdomain or online service covered by this notice;
• create or use a careers account;
• submit a job application;
• take part in a prospective-student application process;
• initiate or confirm a fee payment;
• register as an alumnus or alumna;
• submit information through a website form or communication channel; or
• otherwise interact with the ZOU public website.

Some ZOU systems, including the Student Portal and Learning Management System, may display a separate privacy notice dealing with the additional information processed by that service. Where a service-specific notice applies, it must be read together with this notice. If the two notices conflict, the service-specific notice takes precedence for that service.

The ZOU website may also contain links to, or content provided by, external organisations. Once you leave a ZOU-controlled website or use an independent third-party service, that organisation's privacy notice and terms will apply.

This notice supports ZOU's compliance with the Cyber and Data Protection Act [Chapter 12:07] (the CDPA) and the Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (S.I. 155 of 2024).

2. Data controller and Data Protection Officer

Zimbabwe Open University is the data controller for the personal information described in this notice.

Data controller
Zimbabwe Open University
Corner House, Corner Samora Machel Avenue and Leopold Takawira Street
Harare, Zimbabwe
P.O. Box MP 1119, Mount Pleasant, Harare, Zimbabwe
Telephone: +263 242 793003
Email: info@zou.ac.zw
Website: https://www.zou.ac.zw

ZOU has appointed a Data Protection Officer to oversee compliance with data protection requirements and to handle privacy enquiries, complaints and requests from individuals.

Data Protection Officer
Mr Aldrin Muramba
Email: dpo@zou.ac.zw
Telephone: +263 789 190 894

3. Personal information we collect

The information ZOU collects depends on how you use the website or online service.

3.1 Information you provide

ZOU may collect:

• identity information, including your name, date of birth, national identity or passport details, student number or applicant number;
• contact information, including your email address, telephone number and physical or postal address;
• application and academic information, including programme interests, educational history, qualifications and supporting documents;
• recruitment information, including your curriculum vitae, employment history, qualifications and information submitted with a job application;
• payment-related information, including payment references, confirmation details and information needed to initiate, verify or reconcile a transaction;
• alumni-registration information;
• communications, including enquiries, messages, feedback or other information submitted through website forms or ZOU communication channels; and
• other relevant information that you choose to provide in connection with a particular request or service.

3.2 Sensitive or higher-risk information

Some application, recruitment, alumni or identity-verification processes may require identity documents or other sensitive personal information.

ZOU will process sensitive personal information only where it is necessary and a condition permitted by the CDPA applies. Where written consent is required, ZOU will request it clearly and separately.

3.3 Information collected automatically

When you use the website, ZOU may automatically collect technical information such as:

• your IP address;
• device identifiers;
• browser type and version;
• operating-system information;
• session identifiers;
• website usage or clickstream information; and
• security and technical log information.

4. How we collect personal information

For the website activities covered by this notice, ZOU ordinarily collects personal information directly from you when you browse the website, create an account, complete a form, submit an application, upload a document, initiate a payment, register as an alumnus or alumna, or contact the University.

Technical information is collected automatically when your browser or device interacts with the website.

When you use a linked service, such as a payment platform, the service provider may collect information directly from you under its own privacy notice and may provide ZOU with information required to confirm or reconcile the transaction.

5. How and why we use personal information

ZOU uses personal information only for specified and legitimate purposes. These purposes and the lawful grounds that may apply include:

Where ZOU relies on legitimate interests, it will consider whether those interests are necessary and proportionate and whether they are overridden by your rights and freedoms.

6. Sharing personal information

ZOU does not sell your personal information or disclose it for unrelated commercial purposes.

Where necessary and lawful, ZOU may share personal information with:

• authorised ZOU departments, including Academic Registry, Finance, Alumni Relations, Marketing, Human Resources, ICT and other units responsible for the relevant service;
• payment gateways, banks, payment-switching services and other payment processors for payment initiation, verification, confirmation, reconciliation and fraud prevention;
• technology, hosting, support and security providers that process information on ZOU's behalf;
• auditors, professional advisers and service providers engaged for legitimate institutional purposes;
• regulators, courts, law-enforcement bodies or other public authorities where disclosure is required or authorised by law; and
• another person or organisation where you have directed or authorised ZOU to make the disclosure.

Where a service provider acts as a data processor for ZOU, the University will use a written data-processing agreement, contract or other legal instrument requiring the processor to protect personal information and apply appropriate security measures.

Some recipients, such as independent payment providers, may process information as separate data controllers. Their own privacy notices will explain how they use that information.

7. Cookies and similar technologies

ZOU websites may use cookies or similar technologies for essential website functions, session management, security, performance and service delivery.

Some cookies may be strictly necessary for the website to function. Others may be optional. Where consent is required for a non-essential cookie, ZOU will request that consent before using it.

You can control some cookies through your browser settings or a cookie-preference tool where one is provided. Disabling essential cookies may affect website functionality.

Embedded media, maps, forms, chat features or other third-party content may allow the relevant provider to receive technical information, such as your IP address and browser information, that is needed to deliver the content or service. The provider's privacy notice will apply to its processing.

8. International transfers

ZOU will not transfer personal information outside Zimbabwe unless the transfer is lawful, necessary and appropriately protected.

Where a transfer outside Zimbabwe is required, ZOU will comply with sections 28 and 29 of the CDPA and applicable regulatory requirements. This may include assessing whether the recipient provides an adequate level of protection, applying appropriate contractual and security safeguards, relying on another lawful transfer condition, and making any notification required by the Data Protection Authority.

9. Data security

ZOU uses appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, disclosure or destruction.

Measures used in the website environment include, where appropriate:

• HTTPS and valid security certificates;
• role-based administrative access;
• strong passwords and multi-factor authentication for administrators;
• malware protection;
• vulnerability scanning and security patching;
• security logging and monitoring;
• regular backups; and
• encryption in transit and at rest where appropriate.

ZOU may also use intrusion-detection or prevention controls and a web application firewall. Access to personal information is limited to people who need it for authorised duties.

No internet service can guarantee absolute security. You should protect your account credentials, use secure devices and notify ZOU promptly if you suspect unauthorised use of your information or account.

10. Personal data breaches

ZOU maintains procedures for detecting, recording, investigating and responding to personal data breaches. The Data Protection Officer assesses whether a breach must be reported and coordinates any notification required by law.

Where required, ZOU will notify the Data Protection Authority and affected individuals within the applicable statutory timeframes.

11. Data retention

ZOU keeps personal information only for as long as it is needed for the purpose for which it was collected or as required by law, audit, records-management, dispute-resolution or security obligations.

The Website Privacy Policy establishes the following working retention periods:

Other website records are retained in accordance with the applicable ZOU retention schedule and operational requirements. When information is no longer required, it will be securely deleted, destroyed or anonymised in accordance with approved procedures.

12. Children's privacy

Persons under the age of 18 may access the public website. However, minors are not permitted to submit applications directly through the website.

Where ZOU processes a child's personal information, it will apply appropriate safeguards and obtain the involvement or consent of a parent or legal guardian where required by law. A parent or legal guardian may exercise the child's data-protection rights on the child's behalf.

If you believe that a child has submitted personal information contrary to these requirements, please contact the Data Protection Officer.

13. Automated decision-making and profiling

ZOU does not use automated decision-making or profiling in the public website journeys covered by this notice.

In particular:

• the website does not profile users based on browsing behaviour;
• applicants are not automatically screened through the public website;
• users are not segmented for targeted marketing through the public website; and
• website chatbots are informational and do not make decisions affecting users.

If ZOU introduces automated processing that could produce legal or similarly significant effects in the future, it will ensure that the processing is lawful, provide the required information and safeguards, and respect the rights available under the CDPA.

14. Your rights

Subject to the CDPA and any lawful limitations, you may have the right to:

• be informed about how ZOU collects and uses your personal information;
• request access to personal information ZOU holds about you;
• request correction of inaccurate, incomplete, outdated, false or misleading information;
• object to particular processing where the law allows;
• request deletion or restriction in appropriate circumstances;
• withdraw consent at any time, without explanation and free of charge, where processing is based on consent;
• object to direct marketing;
• not be subject to certain solely automated decisions that produce legal or similarly significant effects; and
• raise a complaint about unlawful or unfair processing.

These rights are not absolute. ZOU may need to retain or continue processing certain records to meet legal, academic, examination, employment, financial, audit or public-record obligations.

To exercise a right, contact the Data Protection Officer using the details in section 2. ZOU may ask you to verify your identity or authority before acting on a request. Requests may be logged and tracked for security and compliance purposes.

15. Consent

Where consent is the lawful basis for processing, ZOU will ask for consent in a clear and specific manner. You may withdraw that consent at any time by using the method provided when consent was obtained or by contacting the Data Protection Officer.

Merely browsing the website does not amount to consent to optional marketing, non-essential cookies or unrelated uses of personal information.

Withdrawing consent does not affect processing that was lawful before the withdrawal, and it does not prevent ZOU from continuing processing where another lawful ground applies.

16. Questions and complaints

If you have a question, concern or complaint about ZOU's use of your personal information, please contact the Data Protection Officer:

• Email: dpo@zou.ac.zw
• Telephone: +263 789 190 894

ZOU will investigate your concern and respond through the appropriate process.

You may also lodge a complaint with the Data Protection Authority, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), if you believe your data-protection rights have been infringed.

• Website: https://www.potraz.gov.zw

17. Changes to this Privacy Notice

ZOU may update this Privacy Notice to reflect changes in law, technology, risk, website functionality or University practices.

The updated notice will be published on the relevant ZOU website with a revised "Last updated" date. Where a change affects processing that depends on consent, ZOU will request fresh consent where required.