Privacy Policy

1. Who we are

RentBook ZM is operated by Dongo Intelligence, a company incorporated in Zambia ("we", "us", "our"). Our registered contact address is Lusaka, Zambia.

For the purposes of the Zambia Data Protection Act No. 3 of 2021, Dongo Intelligence is the data controller for personal data collected through this service.

2. What personal data we collect

Data you provide directly (landlord account holders)

• Full name and email address (account registration)
• Business name, TPIN, and NRC number (landlord profile)
• Contact details — phone, WhatsApp, address
• Password (stored as a one-way hash; we cannot read it)

Tenant data entered by landlords

Landlords enter personal data about their tenants including names, contact details, NRC numbers, and tenancy information. Landlords are responsible for ensuring they have appropriate authority to enter and process their tenants' data. RentBook ZM acts as a data processor for this information on behalf of the landlord.

Data collected automatically

• Session cookies (required for login — expire when you close your browser)
• Server logs including IP address and browser type (retained for up to 30 days for security purposes)

We do not use third-party analytics, advertising trackers, or social media pixels.

3. How we use your data

• Providing the service — managing your account, properties, leases, invoices, and payments
• Transactional emails — sending invoices, payment receipts, and system notifications to you and your tenants
• Support — responding to help requests you submit
• Security — detecting and preventing unauthorised access
• Legal compliance — meeting obligations under Zambian law including the Data Protection Act and ZRA requirements

We do not use your data for marketing to third parties, and we do not sell or rent personal data to anyone.

4. Lawful basis for processing

Under Section 17 of the Zambia Data Protection Act, we rely on the following lawful bases:

• Contract — processing necessary to provide the service you signed up for
• Legitimate interests — security monitoring and fraud prevention
• Legal obligation — retaining financial records as required by ZRA and applicable tax law
• Consent — where you have explicitly agreed, such as receiving optional communications

5. Data retention

• Account data — retained for as long as your account is active, plus 12 months after closure to allow for disputes
• Financial records (invoices, payments) — retained for 7 years in line with ZRA requirements
• Server logs — 30 days
• Deleted accounts — personal identifiers anonymised within 90 days of account deletion request, unless retention is required by law

6. Who we share data with

We do not sell or share your personal data with third parties for their own purposes. We use the following service providers who may process data on our behalf:

• Email delivery — transactional emails (invoices, receipts, system notifications) are sent via an SMTP relay service
• Hosting — the application runs on a server located in the region

All service providers are contractually bound to process data only as instructed by us and to maintain appropriate security measures.

We may disclose personal data if required by law, court order, or a lawful request from a Zambian regulatory authority.

7. Cross-border data transfers

Our primary server infrastructure is located in or near the region serving Zambia. Where any data is processed outside Zambia (for example, via email delivery infrastructure), we ensure appropriate safeguards are in place in accordance with Section 33 of the Data Protection Act.

8. Your rights

Under the Zambia Data Protection Act, you have the following rights in relation to your personal data:

• Right of access — request a copy of the data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data (subject to legal retention requirements)
• Right to restrict processing — ask us to limit how we use your data
• Right to data portability — receive your data in a portable format (available via Account → Export my data)
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at info@dongointelligence.com. We will respond within 30 days.

9. Cookies

RentBook ZM uses the following cookies:

• Session cookie — keeps you logged in during your browser session. Required for the service to function. Expires when you close your browser or after an idle period.
• CSRF token — protects form submissions from cross-site request forgery attacks. Required for security.
• Theme preference (rl-theme) — stores your display theme choice (crimson/light/dark) in your browser's local storage. Not transmitted to our servers.

We do not use advertising cookies, tracking cookies, or any third-party cookies.

10. Security

We implement appropriate technical and organisational measures to protect your data including:

• TLS encryption for all data in transit (HTTPS)
• Passwords stored using one-way cryptographic hashing
• Access controls limiting data access to authorised personnel
• Regular software updates and security patching

No system is completely immune to security risks. In the event of a data breach that is likely to result in risk to your rights, we will notify affected users and ZICTA as required under the Data Protection Act.

11. Tenant data — note for landlords

When you enter your tenants' personal data into RentBook ZM, you are acting as a data controller for that information. You are responsible for:

• Having a lawful basis to collect and process your tenants' data
• Informing your tenants that their data is stored in this system
• Responding to any data rights requests your tenants make to you

If a tenant contacts us directly, we will direct them to you as the relevant data controller.

12. Children's data

RentBook ZM is not directed at children under the age of 18 and we do not knowingly collect personal data from minors. If you believe a minor's data has been submitted in error, please contact us for removal.

13. Changes to this policy

We may update this privacy policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify registered users by email. Continued use of the service after changes are posted constitutes acceptance of the updated policy.

14. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with ZICTA (Zambia Information and Communications Technology Authority), the supervisory authority for data protection in Zambia.

ZICTA contact: www.zicta.zm

15. Contact us