Privacy Policy for Ptrserve Investments Ltd

Effective Date: January 5, 2026

Ptrserve Investments Ltd ("we", "us", or "our") is committed to protecting the privacy and security of your personal information. This policy explains how we collect, use, store, and share your information in compliance with the Cyber and Data Protection Act [Chapter 12:07] of the Laws of Zimbabwe and its accompanying regulations.

1. Contact Details and Data Protection Officer (DPO) Ptrserve Investments Ltd

3 Atkinson Drive, Harare, Zimbabwe
+263 242 747 902
info@ptrserve.co.zw
www.ptrserve.co.zw Data Protection Officer (DPO):
Mercy/Portia
DPO's Contact Information (info@ptrserve.co.zw +263 242 747 902) We are a licensed data controller registered with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).

2. Information We CollectWe collect various types of personal data, which you provide to us voluntarily or which we obtain from other sources as necessary for our services.

• Personal Identification Data: Names, addresses, contact details (email, phone number), date of birth, national ID number, and passport information.
• Financial Data: Income details, loan application information, credit history, bank account details, transaction records, and investment history.
• Employment Data: Employer details, job title, and proof of income.
• Sensitive Personal Data: In some cases, and with your explicit written consent, we may process sensitive data like biometric information for security purposes or health data under specific conditions.
• Technical Data: Information about how you use our website and services, including IP addresses and cookies.

3. How We Collect Your Information We collect information through:

• Direct interactions (e.g., when you apply for a loan or investment, open an account, or contact us).
• Third parties (e.g., credit reference agencies, employers for verification, public databases).
• Automated technologies (e.g., our website, internal systems).
• 
  

4. Purpose and Lawful Basis for ProcessingWe process your data for specific, explicit, and legitimate purposes. The lawful bases for our processing include:

• Contractual Necessity: To provide financial services you have requested, such as processing loan applications and managing investments.
• Legal Obligation: To comply with anti-money laundering (AML), sanctions screening, and other regulatory and legislative requirements in Zimbabwe.
• Legitimate Interests: For business operations, fraud prevention, security enhancements, and improving our services, provided your rights are not overridden.
• Consent: For specific activities like marketing communications or processing sensitive data, where we will obtain your explicit consent, which you can withdraw at any time.

5. Data Sharing and Disclosure We may share your information with third parties only when necessary and in compliance with the law:

• Regulators: With POTRAZ and other financial regulatory bodies as required by law.
• Service Providers: Third-party companies that support our business operations, such as IT services, legal attorneys for bond registrations, and data storage providers.
• Other Financial Institutions: For processing transactions and preventing fraud.

We ensure that all third parties are under strict obligations to protect your data with appropriate security measures.

6. Data RetentionWe will not retain your personal data for longer than is necessary for the purposes for which it was collected, as required by the Act and other relevant financial regulations.

7. Data SecurityWe implement appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, or alteration. These measures include encryption, access controls, and staff training.In the event of a data breach, we will notify POTRAZ within 24 hours, and affected individuals within 72 hours if there is a high risk to their rights and freedoms.

8. Your Rights as a Data SubjectUnder the Cyber and Data Protection Act, you have the following rights:

• Right to be Informed: To know that your data is being processed and why.
• Right of Access: To access your personal information within the statutory timescale.
• Right to Rectification/Erasure: To have inaccurate or misleading data corrected or deleted without undue delay.
• Right to Object: To object to processing in certain circumstances.
• Right to Data Portability: To receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent: To withdraw your consent at any time, free of charge.

To exercise any of these rights, please contact our Data Protection Officer using the details provided above.

9. Complaints ProcedureIf you have concerns about our data processing activities, you can contact our DPO. You also have the right to lodge a complaint with the regulatory authority, the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).

10. International Data TransfersIf we transfer your personal data outside Zimbabwe, we will notify POTRAZ and ensure appropriate safeguards are in place to guarantee an adequate level of data protection.

11. Changes to This PolicyWe may update this policy periodically. We will notify you of significant changes through our website or direct communication.