Privacy Policy for Miss Coco’s Reading Club
Last Updated: September 2025
Who we are: Miss Coco’s Reading Club, Zimbabwe
Contact: +263 788 669 278 | info@misscococlub.com
This Privacy Policy explains how we collect, use, share and protect personal information when you or your child engage with Miss Coco’s Reading Club in Zimbabwe, including through our website, WhatsApp, phone, email and in-person sessions.
1. The law that applies to us
We follow Zimbabwe’s Data Protection Act [Chapter 11:22] No. 5 of 2021 and related instruments. The Act establishes data protection rules, defines a child as anyone under 18, and designates POTRAZ as the Data Protection Authority. It also restricts transfers of personal data outside Zimbabwe unless adequate protection is ensured.
Note: Zimbabwe has introduced regulations and guidance around licensing, DPO appointments and breach notifications to POTRAZ. If those apply to us as a controller, we will comply with them.
2. The information we collect
We only collect what we need to run assessments and provide reading support.
-
Parent or guardian details: name, phone number, WhatsApp number, email
-
Child details: name, age, school and grade, learning history, assessment results, reading goals, progress notes
-
Operational data: bookings, attendance, payment confirmations, consent forms
-
Communications: messages you send via WhatsApp, SMS, email or website forms
-
Media: photos or short videos of sessions only with written parental consent
-
Website data: form entries and basic analytics or error logs
Special category data is not intentionally collected. If you disclose medical or learning support information so we can keep your child safe and supported, we will record it carefully and keep it private.
3. Why we use your information
We process personal information for these purposes:
-
To deliver services including assessments, learning plans, lessons and progress feedback
-
To communicate about bookings, schedules, updates and payments
-
To improve services through lesson planning and programme development
-
To meet legal duties including child safeguarding and accounting
-
To market our services carefully such as sending you club updates if you opted in, with an easy way to opt out
4. Our legal grounds for processing
Under Zimbabwe’s Data Protection Act we rely on one or more of the following:
-
Consent from a parent or legal guardian for a child’s participation, communications and any photos or videos
-
Contract to provide assessments and tutoring you request
-
Legitimate interests to manage operations, quality, safety and security while respecting your rights
-
Legal obligation where we must keep records or report safeguarding concerns
Where consent is the basis, you can withdraw it at any time and we will stop that processing unless another basis applies.
5. Children’s information
We only enrol children with the knowledge and authority of a parent or legal guardian. We explain activities in age-appropriate ways and keep records minimal yet sufficient to support learning and safety. The Act defines a child as under 18.
6. How we share information
We do not sell personal information. We share it only when needed:
-
Service providers that help us run the club, for example website hosting, email, form tools or secure document storage. They must keep it confidential and use it only to provide their service to us.
-
Payment confirmation details with your chosen provider such as EcoCash or InnBucks so we can reconcile payments.
-
Safeguarding or legal reasons if we believe a child is at risk or if the law requires us to share information with authorities or to defend legal claims.
-
Publicity such as testimonials, photos or videos only with explicit written parental consent.
7. International transfers
Some of our tools may store data outside Zimbabwe. For example, website forms, email, cloud storage or messaging backups may be hosted abroad. We will assess each transfer and only proceed where there is an adequate level of protection or appropriate safeguards in place, as required by section 28 of the Act. If we cannot ensure adequate protection, we will not transfer or we will use alternatives hosted in Zimbabwe.
8. Data security
We use reasonable technical and organisational measures to protect information. Examples include device passcodes, least-access permissions, secure cloud storage, limited retention and staff guidance on safeguarding and confidentiality.
If there is a data breach that risks your rights or your child’s rights, we will take steps to contain it, inform POTRAZ in line with applicable requirements and notify affected individuals when required.
9. How long we keep information
We keep data only as long as needed for the purpose collected, to provide services, to meet legal or accounting duties and to resolve disputes. After that we delete or anonymise it. Where you withdraw consent and no other legal basis applies, we delete related data.
10. Your rights
Under Zimbabwe’s Data Protection Act you may have rights to:
-
Access your personal information
-
Be informed about how we process it
-
Rectify inaccurate information
-
Object to certain processing or withdraw consent
-
Deletion where the law allows
-
Complain to the Data Protection Authority
These rights are not absolute and may be limited in some cases, for example where we must keep records for safeguarding. Section 14 of the Act sets out data subject rights. zimbabwe.misa.org
To exercise your rights, contact us using the details below.
11. Using WhatsApp and social media
If you contact us via WhatsApp or Instagram, your data is processed under those platforms’ privacy terms. We will not discuss sensitive information in public channels. For children’s photos or videos we always require written parental consent and will limit distribution.
12. Contact us
If you have questions about this policy or want to exercise your rights, contact:
Miss Coco’s Reading Club
Phone or WhatsApp: +263 788 669 278
Email: to be confirmed on launch
13. Complaints
You can raise concerns with us first. You also have the right to complain to the Data Protection Authority (POTRAZ) about how we handle personal information. See the Authority’s website for contact information and guidance.
14. Changes to this policy
We may update this notice to reflect changes in law or our services. We will post the new version with a new effective date. Significant changes will be highlighted on the website.