- Introduction
Hwange Colliery Company Limited Holdings and its subsidiaries, including but not limited to our Hwange Mining and Processing Company, Hwange Medical Company, Hwange Property Company, Hwange Medical Fund, Hwange Khula Fund, Hwange Lubimbi Energy Company and Hwange Zambezi Agriculture Company, as well as our joint venture companies Eland Coal Mines (Private) Limited, ZimHwange Coal Mine, Hwange Chaba Coal (Private) Limited and Hwange Malasha (Private) Limited (collectively, “we,” “us,” “our,” or “the Company”), are committed to protecting your privacy and ensuring the security of your personal information.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you interact with us, in compliance with the Cyber and Data Protection Act [Chapter 12:07] and its associated regulations, including S.I. 155 of 2024.
By engaging with our companies, services, websites, and facilities, you consent to the data practices described in this policy.
2. Who We Are and Our Role as a Data Controller
Hwange Colliery Company Limited Holdings is a licensed Data Controller as required by Zimbabwean regulations. This means we determine the purpose and means of processing your personal data across our various subsidiaries. We are accountable for ensuring that your data is processed lawfully, fairly, and transparently.
- Information We Collect
We may collect the following categories of personal information:
- Personal Identifiers: Name, address, telephone number, email address, national ID number, passport number.
- Demographic Information: Age, gender, marital status.
- Employment and Financial Information: Employment history, salary, bank account details, loan application data, credit history, and medical fund contributions.
- Health and Sensitive Data (for Medical and Medical Aid Subsidiaries): Medical history, health insurance claims, biometric data (e.g., for patient identification or access control), genetic data, and other information concerning your physical or mental health.
- Property and Tenancy Data (for Property Subsidiary): Lease agreements, payment history, contact details.
- Agricultural Data (for Agriculture Subsidiary): Farm details, production data, supplier information.
- Technical Data: IP address, browser type, operating system, and information about your use of our websites (collected via cookies and similar technologies).
- How We Use Your Information (Purposes of Processing)
We process your personal data for specified and legitimate purposes, including:
- To provide and manage our services (e.g., coal supply, medical treatment, property rental, loan facilities, agricultural products).
- To process payments, contributions, and claims.
- To manage our employment relationships.
- To comply with our legal and regulatory obligations.
- To communicate with you regarding our services, updates, and important notices. For internal purposes such as auditing, data analysis, and system improvements.
- To ensure the security of our personnel, facilities, and data.
5. Legal Basis for Processing
We will only process your personal information where we have a valid legal basis, which includes:
- Your explicit consent (especially for sensitive data like health information).
- The performance of a contract with you.
- Compliance with a legal obligation.
- To protect your vital interests or those of another person.
- For the legitimate interests pursued by us, provided such interests are not overridden by your fundamental rights and freedoms.
6. Sharing and Disclosing Your Information
We may share your personal data with:
- Our subsidiaries and joint venture companies for internal administrative purposes and to provide you with integrated services.
- Our trusted Data Processors who process data on our instructions (e.g., IT service providers, cloud storage providers) under a written contract that ensures data security. Regulatory authorities, law enforcement agencies, and other bodies as required or permitted by law.
- Third parties in the event of a merger, acquisition, or sale of all or a portion of our assets.
We will not transfer your personal information outside Zimbabwe unless the destination country ensures an adequate level of protection, or we have implemented appropriate safeguards as required by law, and we have notified the Data Protection Authority.
- Data Security
We have implemented appropriate technical and organisational security measures to protect your personal information from accidental loss, unauthorised access, use, alteration, or disclosure. These measures include encryption, access controls, secure servers, and regular security assessments.
8. Data Subject Rights
In accordance with the law, you have the following rights regarding your personal data:
- The Right to be Informed: You have the right to know how we use your personal information, as outlined in this policy.
- The Right of Access: You can request a copy of the personal data we hold about you.
- The Right to Rectification: You can request correction of inaccurate or incomplete data.
- The Right to Erasure (Deletion): You can request the deletion of your personal data in certain circumstances.
- The Right to Object: You can object to the processing of your personal data, particularly for direct marketing.
- The Right to not be subject to Automated Decision-Making: We will not make decisions based solely on automated processing, including profiling, which significantly affects you, without your explicit consent or unless authorised by law.
To exercise any of these rights, please contact our Data Protection Officer using the details in Section 12.
- Data Retention
We will not retain your personal information for longer than is necessary for the purposes for which it was collected or as required by applicable laws and regulations, and we will do so as detailed in our Data Retention Policy.
- Use of Children’s Data
We do not knowingly process the personal data of children without the verifiable consent of a parent or legal guardian. We pay special attention to the protection of children’s data and conduct regular impact assessments where children’s data is processed.
- Security Breach Notification
In the event of a personal data breach affecting the data we process, we are required to notify the Data Protection Authority within twenty-four (24) hours of becoming aware of the breach. If the breach is likely to result in a high risk of adversely affecting your rights and freedoms, we are obligated to inform you without delay and, in any event, within seventy-two (72) hours. You have the right to be informed about how we handle such incidents, which guarantees your right to know how your personal information is used. Should you be dissatisfied, you may lodge a complaint with the Data Protection Authority, which is empowered to investigate complaints and ensure compliance. If you suspect or become aware that your personal data may have been compromised, please contact us immediately so that we may take prompt action as required by law.
- Contact Us & Data Protection Officer
We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions about this privacy policy and our data protection practices.
If you have any questions, concerns, or requests regarding this policy or your personal data, please contact our DPO at:
Data Protection Officer
Hwange Colliery Company Holdings
01 Coronation Drive, Hwange dpo@hwangecolliery.co.zw
0773902136
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The latest version will always be posted on our websites with the effective date clearly indicated. We encourage you to review this policy periodically to stay informed about how we are protecting your information.
