Privacy Policy

1. Who we are

RentBook ZM is operated by Dongo Intelligence, a company incorporated in Zambia ("we", "us", "our"). Our registered contact address is Lusaka, Zambia.

For the purposes of the Zambia Data Protection Act No. 3 of 2021, Dongo Intelligence is the data controller for personal data collected through this service.

2. What personal data we collect

Data you provide directly (landlord account holders)

• Full name and email address (account registration)
• Business name, TPIN, and NRC number (landlord profile)
• Contact details — phone, WhatsApp, address
• Password (stored as a one-way hash; we cannot read it)

Tenant data entered by landlords

Landlords enter personal data about their tenants including names, contact details, NRC numbers, and tenancy information. Landlords are responsible for ensuring they have appropriate authority to enter and process their tenants' data. RentBook ZM acts as a data processor for this information on behalf of the landlord.

Data collected automatically

• Session cookies (required for login — expire when you close your browser)
• Server logs including IP address and browser type (retained for up to 30 days for security purposes)

We use Google Analytics (GA4) to understand how visitors use this site. This collects anonymised usage data including pages visited, session duration, and approximate location (country/city level). This data does not identify you personally. We do not use advertising trackers or social media pixels.

3. How we use your data

• Providing the service — managing your account, properties, leases, invoices, and payments
• Transactional emails — sending invoices, payment receipts, and system notifications to you and your tenants
• Account lifecycle communications — informing you before a trial ends, when your account moves to read-only, and before any purge takes place
• Support — responding to help requests you submit
• Security — detecting and preventing unauthorised access
• Legal compliance — meeting obligations under Zambian law including the Data Protection Act and ZRA requirements

We do not use your data for marketing to third parties, and we do not sell or rent personal data to anyone.

4. Lawful basis for processing

Under Section 17 of the Zambia Data Protection Act, we rely on the following lawful bases:

• Contract — processing necessary to provide the service you signed up for
• Legitimate interests — security monitoring and fraud prevention
• Legal obligation — retaining financial records as required by ZRA and applicable tax law
• Consent — where you have explicitly agreed, such as receiving optional communications

5. Data retention and account lifecycle

Your data is retained according to the lifecycle of your account:

• Trial (first 30 days) — all data retained while you decide whether to continue.
• Active — retained for as long as your paid plan is in force.
• Read-only (90-day grace) — when a trial ends without upgrade, or a paid plan expires without renewal, your account moves to read-only. You retain login access to view, export, and download data. No new writes are accepted. ZRA submissions are paused.
• Purge — at the end of the 90-day read-only period, non-statutory personal data (tenants, leases, properties, maintenance records, documents) is permanently deleted. ZRA-related records (invoices, payments, fiscalised tax invoices) are retained for 6 years with personal identifiers anonymised, in line with Zambian tax law.
• Backups — encrypted nightly backups retain a copy of your data for 7 days. Purged data may persist in those backups for up to 7 days after purge, after which it is overwritten in the normal backup rotation.
• Server logs — 30 days.
• Active-lease hold — if active tenancies exist when your account would otherwise be purged, the account is held in admin review and we will contact you before any purge action.

6. Who we share data with

We do not sell or share your personal data with third parties for their own purposes. We use the following service providers who may process data on our behalf:

• Email delivery — transactional emails (invoices, receipts, system notifications, lifecycle notices) are sent via an SMTP relay service
• Hosting — the application runs on a server located in the region
• Analytics — we use Google Analytics (GA4), operated by Google LLC, to analyse site usage. Data is anonymised. See Google's privacy policy.

All service providers are contractually bound to process data only as instructed by us and to maintain appropriate security measures.

We may disclose personal data if required by law, court order, or a lawful request from a Zambian regulatory authority.

7. Cross-border data transfers

Our primary server infrastructure is located in or near the region serving Zambia. Where any data is processed outside Zambia (for example, via email delivery infrastructure), we ensure appropriate safeguards are in place in accordance with Section 33 of the Data Protection Act.

8. Your rights

Under the Zambia Data Protection Act, you have the following rights in relation to your personal data:

• Right of access — request a copy of the data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data (subject to legal retention requirements)
• Right to restrict processing — ask us to limit how we use your data
• Right to data portability — receive your data in a portable format (available via Account → Export my data)
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, use our contact page and select "Data protection request". We will respond within 30 days.

9. Cookies

RentBook ZM uses the following cookies:

• Session cookie — keeps you logged in during your browser session. Required for the service to function. Expires when you close your browser or after an idle period.
• CSRF token — protects form submissions from cross-site request forgery attacks. Required for security.
• Theme preference (rl-theme) — stores your display theme choice (crimson/light/dark) in your browser's local storage. Not transmitted to our servers.
• _ga, _ga_* (Google Analytics) — set by Google Analytics to distinguish unique users and sessions. These cookies do not identify you personally. _ga expires after 2 years; _ga_* after 1 year. You can opt out via Google's opt-out tool.

We do not use advertising cookies or social media tracking cookies.

10. Security

We implement appropriate technical and organisational measures to protect your data including:

• TLS encryption for all data in transit (HTTPS)
• Passwords stored using one-way cryptographic hashing
• Sensitive personal fields (NRC, TPIN, contact details) encrypted at rest
• Access controls limiting data access to authorised personnel
• Regular software updates and security patching
• Daily encrypted off-site backups with a 7-day retention window

No system is completely immune to security risks. In the event of a data breach that is likely to result in risk to your rights, we will notify affected users and ZICTA as required under the Data Protection Act.

11. Tenant data — note for landlords

When you enter your tenants' personal data into RentBook ZM, you are acting as a data controller for that information. You are responsible for:

• Having a lawful basis to collect and process your tenants' data
• Informing your tenants that their data is stored in this system
• Responding to any data rights requests your tenants make to you

If a tenant contacts us directly, we will direct them to you as the relevant data controller.

Tenant data on landlord purge. If your account proceeds through the read-only grace period to purge, tenant records you have entered are deleted along with the rest of your non-statutory data. Tenant data appearing on ZRA-related invoices is anonymised but retained for the 6-year statutory window. There is no separate "tenant claim" path — if a tenant of yours wishes to exercise data rights, they should contact you directly.

12. Children's data

RentBook ZM is not directed at children under the age of 18 and we do not knowingly collect personal data from minors. If you believe a minor's data has been submitted in error, please contact us for removal.

13. Changes to this policy

We may update this privacy policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify registered users by email. Continued use of the service after changes are posted constitutes acceptance of the updated policy.

14. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with ZICTA (Zambia Information and Communications Technology Authority), the supervisory authority for data protection in Zambia.

ZICTA contact: www.zicta.zm

15. Contact us