Last updated: 1 October 2026
This policy explains what personal data DPO Manager collects, why, and what rights you have over it. It applies to everyone who interacts with the platform: the staff of organizations that use DPO Manager to manage their compliance work, and the clients of those organizations who are given a read-only status link.
Account data — when your organization signs up, we hold the names, usernames, email addresses and phone numbers of the people your organization registers as users, along with a securely hashed version of their passwords (never the password itself).
Compliance data entered by your organization — client names and contact details, compliance checklist progress, notes, records of processing activities, data subject access and breach records, documents generated through the platform, and billing records. This is the data your organization is itself the controller of; we process it only to provide the service.
Technical data — IP addresses and browser information recorded in the audit log against actions taken in the system, for security and accountability purposes.
Processing is carried out under Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] and its regulations. For account data, the basis is performance of the agreement between your organization and Leo-Nath Data Protection Consultancy. For the compliance data your organization enters about its own clients, your organization determines the legal basis as the data controller; our role is limited to processing it as instructed.
Passwords are hashed, never stored in plain text. Two-factor authentication is available on every account. Every organization's data is isolated from every other organization's at the database level. Every meaningful action is recorded in an audit log, including who performed it, from where, and whether it was allowed. Uploaded files are validated and can be scanned for malware. Credentials your organization enters for its own email sending are encrypted at rest.
We retain your organization's data for as long as your account remains active. If your organization's account is deleted, a final export of your data is made available for download for 24 hours before it is permanently removed from our systems — see Terms of Service for details.
We do not share personal data with third parties except: our hosting provider, which stores the application and its data; and, where your organization has configured its own email settings, the email provider your organization has chosen for sending invoices and notifications — a choice your organization makes and controls, not us.
DPO Manager's hosting infrastructure may be located outside Zimbabwe. Where this is the case, we take reasonable steps to ensure data is handled with a standard of protection consistent with the Cyber and Data Protection Act.
Depending on your relationship to the platform, you may have the right to access, correct, erase, or receive a copy of personal data held about you. If you are a client of an organization using DPO Manager, these requests should generally go to that organization first, as the data controller. If you are a user of the platform yourself, contact us directly using the details below.
DPO Manager is a business-to-business compliance tool and is not directed at children. We do not knowingly collect personal data from children through this platform.
We may update this policy from time to time. Material changes will be reflected by updating the date at the top of this page.
Questions about this policy, or about how your personal data is handled, can be directed to:
Email: nmkays@gmail.com
Phone: +263 78 674 9333