Privacy Policy

Introduction

TEAM Consulting ("we," "us," "our," or "Company") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Culture Storybook platform (the "Service"), whether accessed via our website, mobile application, or other digital channels.

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our Service. By accessing and using the Culture Storybook platform, you acknowledge that you have read, understood, and agree to be bound by all the terms of this Privacy Policy.

1. Information We Collect

We collect various types of information in connection with the services we provide:

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To operate, maintain, and improve the Culture Storybook platform and provide you with requested services.
• User Experience: To personalize your experience, provide tailored content, and recognize you when you return to the platform.
• Analytics & Insights: To analyze platform usage, generate engagement metrics, and create organizational culture insights and reports.
• Leaderboards & Achievements: To generate leaderboards, track achievements, calculate rankings, and recognize user contributions.
• Organizational Reporting: To enable administrators and organizational leaders to access reports, dashboards, and aggregated analytics (in compliance with data protection laws).
• Communication: To send transactional messages, platform updates, maintenance notifications, and support communications.
• Legal Compliance: To comply with legal obligations, enforce our Terms & Conditions, and protect the rights and safety of users and the platform.
• Security: To detect, investigate, and prevent fraudulent transactions, unauthorized access, and other security incidents.
• Improvement & Development: To conduct research, test new features, and develop products and services that better meet user needs.
• Aggregate Statistics: To create anonymized, aggregated data for benchmarking, industry analysis, and research purposes.

3. Legal Basis for Processing

Under Zimbabwe's Data Protection Act and POTRAZ regulations, we process your personal data based on the following legal grounds:

• Contractual Necessity: Processing is necessary to perform our contractual obligations to you and your organization.
• Legitimate Interests: We process data to pursue legitimate business interests, including platform improvement, fraud prevention, and security, where our interests are not overridden by your fundamental rights.
• Compliance with Legal Obligations: Processing is required to comply with applicable law, including tax, employment, and data protection regulations.
• Consent: Where required, we obtain explicit consent for specific processing activities, particularly for marketing communications.
• Vital Interests: Processing may be necessary to protect the vital interests of individuals or organizations using the platform.

4. Data Storage & Hosting Infrastructure

Your data is stored and processed using secure, industry-standard infrastructure:

Data is encrypted in transit using HTTPS/TLS protocols. Supabase implements encryption at rest, regular security audits, and compliance with international data protection standards. For detailed information about Supabase's security practices and certifications, please visit their security documentation.

Note: While we implement comprehensive security measures, no system is completely secure. We cannot guarantee absolute protection against determined cyber attacks or breaches. Users should not expect unconditional security but can be assured that we maintain industry-standard protections.

5. Data Sharing & Disclosure

We may share your personal data in the following circumstances:

• Organizational Administrators: Your organization's administrators and approved managers may access aggregated reports and user management functions as necessary to administer the platform within your organization.
• Service Providers: We share data with third-party service providers who perform functions on our behalf, including hosting, database services, email delivery, and analytics (all bound by confidentiality agreements).
• Legal Requirements: We may disclose your data if required by law, court order, government request, or as necessary to enforce our Terms & Conditions and protect user safety.
• Business Transfers: In the event of merger, acquisition, bankruptcy, or sale of assets, your data may be transferred as part of that transaction (we will notify you of any such change).
• Aggregate & Anonymized Data: We may share anonymized, aggregated data for industry research, benchmarking, and analysis purposes where individuals cannot be identified.
• With Your Consent: We share data with third parties only with your explicit consent, as outlined in specific communications.

Important: We do not sell, rent, or trade your personal data to third parties for marketing purposes.

6. Data Retention

We retain your personal data for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy:

• Active Users: Data is retained during your active use of the platform and for the duration of your organization's subscription.
• Post-Termination: Following account deletion or organizational subscription termination, we retain data for up to 30 days to enable data recovery and ensure system integrity.
• Backup & Archives: Backup copies may be retained for longer periods but are not accessible for regular operations.
• Legal Obligations: We may retain data longer if required by law (e.g., for tax or employment law compliance).
• Legitimate Interests: We may retain anonymized data indefinitely for analytics, trend analysis, and research purposes.

You may request deletion of your personal data at any time by contacting your organization's administrator or emailing info@team.co.zw. We will process deletion requests in accordance with applicable law.

7. Your Privacy Rights (Zimbabwe DPA Compliance)

Under the Zimbabwe Data Protection Act and POTRAZ regulations, you have the following rights concerning your personal data:

• Right to Access: You may request access to your personal data and receive a copy of information we hold about you in a structured, commonly used format.
• Right to Correction: You may request correction, amendment, or completion of inaccurate or incomplete personal information.
• Right to Deletion (Right to be Forgotten): You may request deletion of your personal data, subject to legal and operational requirements. Note: We may retain certain data for legal or legitimate business purposes.
• Right to Data Portability: You may request transfer of your personal data to another service provider in a structured, machine-readable format.
• Right to Restrict Processing: You may request that we limit how we process your data in specific circumstances.
• Right to Object: You may object to processing of your data for legitimate reasons, including for marketing and automated decision-making.
• Right Not to be Subjected to Automated Decisions: You have the right not to be subject to automated decision-making that produces legal or similarly significant effects.
• Right to Lodge a Complaint: You may lodge a complaint with the Zimbabwe Data Protection Regulator if you believe your rights have been violated.

To exercise any of these rights, contact us at privacy@team.co.zw or through your organization's administrator. We will respond to legitimate requests within 30 days in accordance with applicable law.

8. Third-Party Services & External Links

The Culture Storybook platform integrates with the following third-party services. Each maintains independent privacy policies:

Each service provider maintains its own privacy policy and terms of service. We are not responsible for their privacy practices. We strongly encourage you to review their policies independently. Our Privacy Policy does not cover third-party services, and we are not liable for their data handling practices.

The Service may contain links to external websites. We are not responsible for the privacy practices of websites outside our control. If you click on a third-party link, you will leave the Culture Storybook platform and are subject to that website's terms and policies.

9. Security Measures

TEAM Consulting implements comprehensive security measures to protect your personal data:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using HTTPS/TLS 1.2 or higher.
• Encryption at Rest: Sensitive data is encrypted in our database using industry-standard encryption algorithms.
• Access Controls: Data access is restricted to authorized personnel on a need-to-know basis with role-based access controls.
• Authentication: We use secure authentication mechanisms including HttpOnly cookies, CSRF protection, and session management.
• Regular Security Audits: We conduct periodic security assessments and penetration testing through third-party auditors.
• Incident Response: We maintain documented incident response procedures and will notify affected users of security breaches as required by law.
• Employee Training: Our team undergoes regular data protection and security training.
• Vendor Management: All third-party service providers are subject to contractual data protection obligations.

Disclaimer: While we implement these protections, no security system is impenetrable. Unauthorized access or data breaches, though unlikely, cannot be completely prevented. You assume the risk of unauthorized access to the extent permitted by law.

10. Children & Minors

The Culture Storybook platform is intended for use by employees and organizational members of participating organizations and is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors.

If we become aware that a minor has provided personal data, we will take steps to delete such information and terminate the minor's account. If you believe a minor has provided data, please contact us immediately at privacy@team.co.zw.

11. International Data Transfers

Your personal data may be stored and processed in Zimbabwe and other countries where our service providers operate. By using the Culture Storybook platform, you consent to the transfer of your data to countries outside Zimbabwe, where data protection laws may differ. We ensure that all international transfers are protected by appropriate safeguards, including contractual data protection terms and security measures. We comply with POTRAZ guidelines regarding data localization and international transfer restrictions.

12. Changes to This Privacy Policy

TEAM Consulting may update this Privacy Policy periodically to reflect changes in our data practices, legal requirements, or other operational reasons. We will notify you of material changes by:

• Posting the updated policy on the Culture Storybook platform with an updated "Last Updated" date.
• Sending email notification to organization administrators of significant changes.
• Requiring acceptance of the updated policy before continued use of the platform.

Your continued use of the platform following the posting of revised Privacy Policy means that you accept and agree to the changes. We encourage you to review this policy periodically to stay informed about how we protect your data.

13. Contact Us & Data Subject Requests

For questions about this Privacy Policy, requests to exercise your privacy rights, data subject access requests, or to report a privacy concern, please contact:

Response Time: We will acknowledge receipt of your request within 5 business days and will make a good faith effort to respond substantively within 30 days in accordance with Zimbabwe's Data Protection Act.

Escalation: If you believe your privacy rights have been violated, you may lodge a formal complaint with the Zimbabwe Data Protection Regulator or applicable regulatory authority in your jurisdiction.