This Data Protection Policy explains the technical and organisational measures AI Workforce Africa applies to protect personal information handled through the platform, in line with the Zambian Data Protection Act, 2021.
1. Principles
- Process personal data lawfully, fairly and transparently.
- Collect only what is needed for the stated purpose (data minimisation).
- Keep data accurate and up to date.
- Retain data only as long as necessary or as required by law.
- Protect data against unauthorised access, alteration, loss or disclosure.
2. Roles
Customers act as data controllers for employee records they upload. AI Workforce Africa acts as their data processor and follows their documented instructions.
3. Technical safeguards
- Encryption in transit (TLS 1.2+) and at rest.
- Role-Based Access Control and row-level security in the database.
- Principle of least privilege for staff and automated services.
- Continuous secret scanning, dependency scanning and code review.
- Audit logging of privileged administrator actions.
4. Organisational safeguards
- Staff are onboarded with data-protection training.
- Access is granted on a need-to-know basis and reviewed regularly.
- Sub-processors are vetted before onboarding and bound by written agreements.
5. Incident response
We maintain an incident-response process. In the event of a personal data breach we will notify affected Customers without undue delay and, where required, notify the Data Protection Commissioner within the statutory timeframe.
6. Data subject requests
Employees should raise access, correction, deletion or portability requests with their employer. Employers can raise requests via privacy@workforceafrica.live. We will respond within 30 days.
7. Retention & deletion
We keep payroll records for as long as the Customer's account is active and for at least the retention periods required by Zambian tax and labour law. On written request after account closure we securely delete or anonymise the data.