Data Protection and Privacy Policy

  1. Introduction
    Nuttah Mumbi Consultancy (“Consultancy,” “we,” “us,” or “our”) is committed to protecting the privacy and security of personal data collected from clients, investors, and other stakeholders. This Data Protection and Privacy Policy (“Policy”) outlines how we collect, use, store, and protect personal data in compliance with the Data Protection Act No. 3 of 2021 and other applicable laws.
  2. Scope of the Policy
    This Policy applies to all personal data collected by the Consultancy through its website, email communications, contracts, and other interactions with clients, investors, employees, and third parties, whether in electronic or physical form.
  3. Types of Personal Data Collected
    We may collect the following types of personal data:
    i. Identity Information: Name, national registration card (NRC) number, passport number, and other identification details.
    ii. Contact Information: Physical address, email address, phone number, and other communication details.
    iii. Financial Information: Bank account details, payment information, and transaction history. Real Estate Information: Details related to property ownership, transactions, and investment activities.
    iv. Technical Information: IP address, browser type, and other data collected through our website or digital platforms.
  4. Purposes of Data Processing
    4.1. Personal data is collected and processed for the following purposes:
    4.1.1. To provide real estate consultancy and investment services.
    4.1.2. To comply with legal and regulatory obligations under Zambian law.
    4.1.3. To communicate with clients, investors, and other stakeholders.
    4.1.4. To improve our services, website functionality, and customer experience.
    4.1.5. To conduct marketing and promotional activities (with consent, where required).
    4.2. Clients and stakeholders may opt out of receiving marketing communications at any time by contacting us or clicking the ‘unsubscribe’ link in our emails.
  5. Legal Basis for Processing
    We process personal data based on one or more of the following legal grounds:
    i. Consent: The data subject has given clear and explicit consent for the processing.
    ii. Contractual Necessity: Processing is necessary for the performance of a contract with the data subject.
    iii. Legal Obligation: Processing is necessary to comply with Zambian laws and regulations.

iv. Legitimate Interests: Processing is necessary for the legitimate interests of the Consultancy, provided such interests do not override the rights and freedoms of the data subject.

  1. Data Sharing and Disclosure
    6.1. We may share personal data with the following parties, where necessary:
    6.1.1. Third-Party Service Providers: Legal advisors, accountants, IT service providers, and other professionals assisting in our operations.
    6.1.2. Government Authorities: As required by law, including the Zambia Revenue Authority (ZRA) and other regulatory bodies.
    6.1.3. Business Partners: Real estate developers, agents, and other parties involved in property transactions.

6.2. We ensure that all third parties comply with data protection laws and maintain confidentiality. Personal data will not be sold or disclosed for unrelated purposes without consent.

  1. Data Security
    7.1. We implement appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, or destruction. These measures include:
    7.1.1. Encryption of sensitive data.
    7.1.2. Regular security audits and updates.
    7.1.3. Restricted access to personal data on a need-to-know basis.
    7.1.4. Training staff on data protection best practices.
    7.2. In the event of a data breach, the Consultancy will assess the impact and notify affected individuals and relevant authorities within 24 hours and inform affected individuals as soon as practicable as per the Data Protection Act No. 3 of 2021.
  2. Data Retention
    Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected or as required by Zambian law. Retention periods may vary depending on the type of data and legal obligations.
    i. Financial records may be retained for up to 7 years as required by tax laws.
    ii. Client contracts and transaction records may be retained for the duration of the business relationship and a reasonable period thereafter.
  3. Data Subject Rights
    Under the Data Protection Act No. 3 of 2021, data subjects have the following rights:
    i. Right to Access: To request a copy of their personal data held by the Consultancy.
    ii. Right to Correction: To request correction of inaccurate or incomplete personal data.
    iii. Right to Erasure: To request deletion of personal data, subject to legal limitations.
    iv. Right to Object: To object to the processing of personal data for specific purposes.
    v. Right to Restrict Processing: To request restriction of processing under certain
    circumstances.

vi. -Right to Data Portability: To receive personal data in a structured, commonly used format.
To exercise these rights, data subjects may contact us using the details provided in Section 11 below.

  1. International Data Transfers
    Personal data transferred outside Zambia will be protected through binding contractual agreements with international service providers to ensure compliance with Zambian data protection standards.
  2. Changes to This Policy
    We reserve the right to update this Policy at any time to reflect changes in legal requirements or our data processing practices. Any updates will be communicated to data subjects through our website or direct communication.
  3. Contact Information
    12.1. For questions, concerns, or requests regarding this Policy or your personal data, please
    contact:
    Nuttah Mumbi Consultancy
    Address: ZAMBIA
    Email: info@nuttah.co
    Phone: +260 950625811

    12.2. The Data Protection Officer (DPO) will oversee compliance with this Policy, handle stakeholder data requests, and ensure that data protection best practices are implemented.
    The DPO may be any staff member who has received specialised training in data protection and may perform this role in addition to other responsibilities, provided they can maintain the independence necessary to oversee compliance effectively
  4. Complaints
    If you believe that your data protection rights have been violated, you may lodge a complaint with the Office of the Data Protection Commissioner in Zambia or seek legal recourse as
    provided under the Data Protection Act.
    Version Control
    Version 1- April 2025