Privacy

What ZEPRA does not collect

Stated first, because it is the more useful half.

• No advertising, analytics or tracking of any kind. No third-party scripts run on this site.
• No cookies are set for visitors browsing the public register. A session cookie is set only when somebody signs in to the government workspace.
• No personal contact details, bank details, director identities or beneficial-ownership claims about suppliers.
• No profile of what an individual visitor looked at.

What ZEPRA does collect

When you use the contact form

Your name, email address, and the organisation, telephone number and message you choose to provide. This is used to answer your enquiry and, for a data correction, to check the record against its source. Your IP address is not stored: only a keyed hash of it is kept, which is enough to detect a flood of automated submissions but cannot be reversed to an address.

Enquiries are retained for two years so that a correction can be traced to the request that prompted it, then deleted.

When a government workspace user signs in

Name, work email address, role, institution, and job title and telephone number where provided. Sign-in time and IP address are recorded in the audit log, because a public register must be able to show who changed a record and when. Audit entries are retained for seven years.

Server logs

The web server keeps standard request logs for security and fault diagnosis, and they are rotated on a short cycle. They are not used to analyse visitor behaviour.

Information about people in project records

ZEPRA publishes information about institutions and organisations, not individuals. Where a source record happens to contain an individual's name — a contact officer on a tender notice, for example — ZEPRA does not republish it unless the institution published it itself for that purpose. If you find personal information on this site that should not be here, tell us and it will be removed while it is examined.

Security

Traffic is encrypted in transit. Workspace passwords are hashed, administrator accounts require a second factor, sessions expire after a period of inactivity, and every change to a record is logged. Uploaded documents are stored outside the public web root and are served only after their access and scan status have been checked.

Sharing

ZEPRA does not sell or rent personal information, and does not share it with third parties for marketing. Enquiry content is passed to the institution concerned only where that is necessary to answer it — for instance, a data correction that only the publishing institution can make.

Your rights

You can ask what personal information ZEPRA holds about you, ask for it to be corrected, or ask for it to be deleted where there is no continuing need to hold it. Audit records of changes to the public register are an exception: they exist so the register can be held to account and are not deleted on request.

Write to projects@zepra.co.zm or telephone 0211 777 400.

Changes to this notice

Material changes will be recorded in the changelog rather than made quietly.