1. Scope and responsibility
VerityCore Consultancy (Pvt) Ltd (“VerityCore”, “we”, “our” or “us”) respects privacy and is committed to handling personal information responsibly. This policy applies to website visitors, prospects, customers, authorised users, suppliers, partners, applicants and other individuals whose information we process.
Where an organisation determines why and how information is processed in a system we support, that organisation will ordinarily be responsible for the information and VerityCore will process it under authorised instructions. VerityCore is ordinarily responsible for information used in its own administration, sales, billing, recruitment, marketing and support activities. The applicable role depends on the particular arrangement and law.
2. Information we process
Depending on your relationship with us and the service involved, we may process:
- identity and contact details, including names, roles, organisations, email addresses and telephone numbers;
- account identifiers, access permissions and authentication-related records;
- enquiries, proposals, contracts, support requests and correspondence;
- billing, payment-reference, accounting and compliance information;
- technical information such as logs, IP addresses, devices, browsers and diagnostic records;
- information submitted for recruitment or another authorised business purpose; and
- records placed in customer-managed systems where required to deliver an agreed service.
We obtain information directly from individuals, their organisations, authorised users, service interactions, integrations and lawful public business sources. Organisations providing information to us are responsible for having the necessary authority and notices in place.
3. How and why we use information
We process personal information where appropriate to respond to enquiries, assess requirements, prepare proposals, administer agreements, configure and support services, authenticate users, manage billing, communicate service information, protect systems, investigate incidents, improve reliability, manage personnel and suppliers, and meet lawful obligations.
Processing may rely on an agreement, a legal obligation, legitimate interests balanced against individual rights, consent where required, or another lawful basis. Promotional communications include an appropriate way to opt out.
4. Customer-managed systems
Organisations generally control the business and personal records entered into their own environments. VerityCore accesses or processes that information only for authorised implementation, support, maintenance, integration, security or related service purposes.
Customer administrators are responsible for appropriate user access, source-data accuracy, lawful collection and the notices or permissions required for the people represented in their records. Additional data-processing terms may define instructions, confidentiality, security, incident cooperation, international transfers and the return or deletion of information.
5. Technology and service providers
VerityCore uses third-party technology and infrastructure providers to support its services, such as for hosting, communications, payments, backups, analytics, customer support and assisted functionality where applicable to a particular deployment.
The providers, locations and technical arrangements used can vary by service and customer agreement. We assess appropriate confidentiality, security, contractual and transfer safeguards where a provider processes personal information on our behalf. Deployment-specific provider information may be supplied in the relevant agreement or through an authorised request, subject to security and confidentiality considerations.
6. Sharing, regulatory disclosures and transfers
We may share information with authorised personnel, contractors, professional advisers, technical and financial service providers, customer-designated integrations, and public authorities where required by law. Where a service supports statutory reporting or regulated transactions, relevant information may be transmitted to authorised technology providers or competent authorities for that lawful purpose.
We do not sell personal information or provide customer information to unrelated parties for independent advertising without an appropriate lawful basis and any required authorisation.
Information may be stored or accessed outside Zimbabwe where technical infrastructure or support arrangements require it. Applicable contractual, legal and organisational safeguards are assessed for relevant cross-border transfers.
7. Security, incidents and retention
We implement or arrange technical and organisational measures proportionate to the information and processing risks. Depending on the environment, these may include access controls, authentication, encrypted transport, administrative restrictions, logging, backups, updates, confidentiality obligations and incident-response procedures.
No online environment can be guaranteed completely secure. If a personal-information incident occurs, we investigate, contain and communicate it to the responsible organisation, authority or affected individuals where applicable law or an agreement requires this.
Information is retained only for as long as reasonably required for its authorised purpose, agreements, legal obligations, security, recordkeeping and dispute resolution. Return, export, deletion and backup expiry for customer information follow the relevant agreement and lawful instructions.
8. Individual rights and choices
Depending on applicable law, individuals may have rights to request information about processing, access or correct personal information, object to certain uses, request deletion where applicable, withdraw consent, or exercise other statutory rights.
Requests about information controlled by a customer organisation should usually be directed to that organisation. We may verify identity or authority before responding, and lawful exemptions or recordkeeping requirements may apply.
Websites and online services may use essential storage technologies for security, sessions and preferences. Where non-essential analytics or marketing technologies require consent, appropriate notice and controls will be provided.
9. Updates and contact
We may update this policy to reflect legal, technical, organisational or service changes. The current version and effective date will be published on this page.
For privacy enquiries, authorised requests or concerns, email support@veritycore.co.zw or use our contact page.
