Data Processing Information

Last updated: 1 October 2026

This page sets out the data processing relationship between your organization and DPO Manager, for organizations evaluating or already using the platform under Zimbabwe's Cyber and Data Protection Act [Chapter 12:07].

1. Roles

Your organization is the data controller for the personal data it enters about its own clients — their names, contact details, compliance records, and related documentation. Leo-Nath Data Protection Consultancy, operating DPO Manager, acts as your data processor: we process that data only on your organization's instructions, as expressed through your use of the platform's features.

2. What Processing We Perform

• Storing the compliance data your organization enters, in a database isolated from every other organization's data.
• Generating documents, invoices, and reports from that data when your organization requests them.
• Making a read-only summary available to your clients, only when your organization generates and shares that link.
• Sending email on your organization's behalf — invoices, reminders — only where your organization has configured its own email settings to do so.

We do not use your organization's client data for any purpose beyond providing the service, and we do not share it with any third party except as described below.

3. Security Measures

The following measures are in place on the platform:

• Passwords hashed with scrypt; never stored or logged in plain text.
• Optional two-factor authentication (TOTP) on every account, with one-time recovery codes.
• Every organization's data is isolated at the database level — access checks run on every request, not just in the interface.
• A full audit log of every meaningful action: who, what, when, from which address, and whether it was allowed or denied.
• Session security: secure, HTTP-only cookies; a password change immediately invalidates every other active session for that account.
• Login protection against repeated password-guessing attempts, by both account and source address.
• Uploaded files are checked against their claimed type and can be scanned for malware.
• Any email credentials your organization provides are encrypted at rest.
• Standard web security headers and CSRF protection on every action that changes data.

4. Sub-Processors

We use the following categories of sub-processor:

• Hosting infrastructure — to run the application and store its database and files.
• Your own email provider — where your organization configures SMTP settings for automated invoicing or notifications, that provider is your organization's own choice; we do not select or substitute it on your behalf.

5. Assisting With Your Obligations

As the controller, your organization is responsible for responding to data subject requests and notifying breaches under the Act. DPO Manager provides tools to log and track both — due-date tracking for access requests, and notification-deadline tracking for breaches — so your organization can meet its own obligations, but the judgment and the notification itself remain your organization's responsibility.

6. Data Return and Deletion

If your organization's engagement ends, a complete export of your data is prepared and made available for download for 24 hours before permanent deletion. See Terms of Service for the full process.

7. Questions

As a certified Data Protection Officer, Nelson Kandemiri is available to answer specific questions about this processing relationship, including for due diligence ahead of signing up:

Email: nmkays@gmail.com
Phone: +263 78 674 9333