Privacy notice.

Who we are and how to contact us

Zikomo is an enterprise risk assessment platform operated by [GUUT to supply: registered company name], a company registered in [GUUT to supply: country of registration] under company number [GUUT to supply], with its registered office at [GUUT to supply: registered office address]. In this notice "we", "us" and "GUUT" mean that company.

For any question about this notice or about how we handle personal data, contact our data protection officer at [GUUT to supply: DPO name and email], or write to the registered office above marked for the attention of the data protection officer. Where we are required to be registered with a data protection authority, our registration details are [GUUT to supply: supervisory authority and registration reference].

Who this notice is for

This notice covers three groups of people: visitors to our website, individual users of the Zikomo application whose employer holds a licence, and people who contact us about the product. Where a client institution licenses Zikomo, that institution is the controller of the assessment content its staff enter, and its own privacy notice governs that content. Section 11 explains the split.

What personal data we process

We group the data we hold into three categories, because each is used differently and kept for a different period.

Account data. The information needed to give a named person access to a tenant: full name, work email address, job title, employer, assigned role, department, telephone number where supplied, password hash, multi-factor authentication settings and the record of consent or acceptance of these terms.

Assessment content. The material entered into the platform in the course of an assessment: risk statements, control responses, asset descriptions, asset values, likelihood and impact ratings, treatment decisions, owner assignments, budget flags, comments, and any evidence file a user uploads. Assessment content is about an institution's systems rather than about people, but it routinely names individuals as risk owners, approvers and reviewers, and any evidence file uploaded may contain personal data chosen by the client.

Usage and security logs. Records generated automatically as the service runs: sign-in and sign-out events, IP address, browser and device type, pages and records accessed, and the append-only audit trail of who changed which rating, when, and from what value to what value. These logs exist so that an assessment can be defended to an examiner.

We do not ask for, and Zikomo has no field for, special category data such as health, biometric or political data. We ask clients not to place such data in evidence uploads.

Why we process it, and on what lawful basis

The lawful bases below are drafted against general data protection principles common to Nigeria, Malawi, Kenya, Ghana and the EU. The exact basis in each jurisdiction must be confirmed by counsel.

Where we rely on legitimate interests, we have considered whether our interest is overridden by the rights of the people concerned, and we will provide that assessment on request.

How assessment content is used, and how it is not

Assessment content is used to run the service for the institution that entered it. It is scored, stored, versioned and reported back to that institution. That is the whole of its purpose.

We do not use client assessment content to train, fine-tune or evaluate machine learning models. Not our own models, and not any third party's. Assessment content is not used to build benchmarks, industry averages, marketing material or case studies unless a client asks us in writing to do so and agrees the specific wording.

Assessment content is never shared between tenants. Each licensed institution occupies a logically isolated tenant. Queries are scoped to a tenant identifier at the data layer, and no interface exists, for staff or for clients, that returns another tenant's risks, assets, scores or evidence. A consultant who works with two institutions holds two separate accounts and sees two separate registers.

GUUT staff access a client tenant only where the client has asked for support, or where we must investigate a security incident. That access is role-limited, time-bound and written to the same audit trail the client can read.

Sub-processors

We use a small number of suppliers to run the service. Each is bound by a written contract that imposes confidentiality, security and processing restrictions no weaker than those in this notice. The table below is a template. Every row is a placeholder and none of it should be published until GUUT has confirmed the actual supplier, function and hosting region.

We will maintain the current list at this address and give clients advance notice, of at least [GUUT to supply: notice period] days, before adding or replacing a sub-processor that reaches assessment content, so that a client can object.

International transfers and data residency

Several African data protection regimes restrict the transfer of personal data outside the country, and some financial services regulators go further and require that certain records stay within national borders. Nigeria, Kenya, Ghana, Rwanda and Malawi each impose conditions of this kind, and the conditions are not identical. This is not a formality we can satisfy once and forget.

Our approach is therefore: the hosting region for a tenant is agreed with the client before onboarding and recorded in the contract. Where a client's regulator requires in-country residency, assessment content for that tenant is stored in that country, and we will say plainly at the point of sale if we cannot meet that requirement rather than accept the engagement.

Where a transfer out of the country of origin does take place, it is made only on a lawful basis recognised by that country, which may include the data subject's consent, an adequacy determination, contractual safeguards approved by the supervisory authority, or an authorisation issued to us. The specific mechanism relied on for each tenant is recorded in the data processing agreement described in section 11.

How long we keep data

Retention differs by category, and one difference deserves to be stated clearly rather than buried.

Account data is kept for the life of the user's account, and deleted within [GUUT to supply] days of the account being closed, except where we must keep contract or billing records for a statutory period.

Assessment content is kept for as long as the client's licence is in force. On termination, the client may export its content as described in the terms of service, after which we delete it within [GUUT to supply] days from live systems and within [GUUT to supply] days from encrypted backups as those backups age out.

Audit events are retained separately from the records they describe, and they survive the deletion of those records. The audit trail is append-only: it has no update path and no delete path, by design. When a client record is deleted, the audit events describing who created it, who scored it and who approved it remain, because an assessment that can be silently erased cannot be defended to an examiner or a regulator. Audit events are retained for [GUUT to supply: retention period, to be set against the client's regulatory record-keeping obligations]. They contain the acting user's identifier, the timestamp, the field changed and the before and after values. Where a data subject's rights require it, and where the client's own record-keeping obligations allow, we will pseudonymise the actor identifier in an audit event rather than destroy the event.

Your rights

Subject to the law that applies to you, you may ask us to: confirm whether we hold personal data about you and give you a copy; correct data that is inaccurate or incomplete; delete data where there is no longer a good reason for us to hold it; restrict or object to a particular use, including any use based on legitimate interests; provide your data in a portable, machine-readable form; and withdraw consent where consent was the basis we relied on, without affecting anything done before you withdrew it.

If you are a user of Zikomo through your employer, the quickest route is usually your employer's own data protection contact, because your employer controls the assessment content. Write to us at [GUUT to supply: DPO email] if you would rather come to us directly, and we will respond within the period the applicable law requires, and in any event within [GUUT to supply] days. We do not charge for a first request. We may ask you to verify your identity before we act, so that we are not handing your data to someone else.

How we protect data

Data is encrypted in transit and at rest, access is granted by role and reviewed periodically, administrative access requires multi-factor authentication, and every change to a risk rating is written to an append-only audit trail. Backups are encrypted and restoration is tested. We operate a documented incident response process and will notify affected clients and, where required, the relevant supervisory authority within the period the applicable law sets.

The full description of our technical and organisational measures, along with our responsible disclosure process, is set out on the security page. If you believe you have found a vulnerability, please follow the process at responsible disclosure rather than emailing sales.

Controller, processor and data processing agreements

Cookies

The Zikomo application uses only strictly necessary session cookies. They keep you signed in, hold your cross-site request forgery token, and remember which tenant you are working in. They are not used to profile you. There are no advertising cookies, no behavioural tracking pixels and no third-party marketing tags in the application, so there is nothing in the application to consent to and no cookie banner to dismiss.

Session cookies expire when your session ends or when the inactivity timeout is reached. Blocking them will stop you signing in, because the sign-in itself depends on them.

This marketing website is covered by the same position, subject to confirmation by GUUT before publication: [GUUT to supply: confirm whether any analytics is in use on the marketing site, and if so name the provider, the cookie lifetime and the consent mechanism].

Children

Zikomo is a business tool sold to financial institutions. It is not directed at children and we do not knowingly collect data about anyone under the age of majority in their country. If you believe we hold such data, tell us and we will delete it.

Changes to this notice

We update this notice when the service changes or when the law does. The version number and the last updated date at the top of this page always reflect the current text. Where a change materially affects how we use personal data, we will notify tenant administrators by email at least [GUUT to supply] days before it takes effect, and we will keep the previous version available on request so that a change can be compared rather than taken on trust.

Complaints

If you are unhappy with how we have handled your data, tell us first at [GUUT to supply: DPO email]. We would rather fix it than have you discover we would not.

You also have the right to complain to the data protection supervisory authority in your country. The authority relevant to GUUT's own establishment is [GUUT to supply: name, address and contact details of the supervisory authority]. If you are in another country, your local authority can normally take your complaint whether or not we are established there.