1. Introduction

amasuku digital (“we”, “us”, “our”) is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, store, and protect personal information when you visit our website at amasuku.com or engage with our services.

We comply with the Zambia Data Protection Act No. 3 of 2021 (the “DPA”) and, where applicable, the European Union General Data Protection Regulation (GDPR). Where there is any conflict between these frameworks, we apply the higher standard of protection.

2. Data Controller

The data controller responsible for your personal data is:

amasuku digital
Lusaka, Zambia
Email: hello@amasuku.com

3. What Data We Collect

We collect the following categories of personal data:

3.1 Information you provide directly

• Contact form submissions: Name, email address, company name (optional), inquiry type, budget range (optional), and message content.
• Newsletter subscriptions: Email address.
• Career applications: Name, email address, location, role interest, portfolio URL, message content, and any CV or résumé files you choose to upload.
• Client engagements: Business contact details, project requirements, and any information you share during the course of our work together.

3.2 Information collected automatically

• Website analytics: We use PostHog for privacy-focused analytics. This may include pages visited, time on site, referral source, device type, browser type, and approximate location (country level). We do not use Google Analytics.
• Cookies: We use only essential cookies required for the website to function (such as theme preference). We do not use advertising cookies or third-party tracking cookies.

4. How We Use Your Data

We use your personal data for the following purposes:

• To respond to your inquiries: When you submit a contact form or send us an email, we use your information to deliver the message to our team, respond, and follow up.
• To deliver our services: When you engage us for a project, we use your information to manage the engagement, communicate with you, and deliver the agreed work.
• To send newsletters: If you subscribe to our newsletter, we use your email address to send you articles and updates. You can unsubscribe at any time.
• To process career applications: If you submit a speculative application, we use your information and any uploaded CV or résumé to assess your suitability for current or future roles.
• To improve our website: We use analytics data to understand how visitors use our website so we can improve it.

5. Legal Basis for Processing

Under the Zambia Data Protection Act 2021 and the GDPR, we process your data based on the following legal grounds:

• Consent: When you submit a form, subscribe to our newsletter, or send us an application, you consent to us processing your data for the stated purpose.
• Contractual necessity: When you engage us for services, we process your data as necessary to perform our contractual obligations.
• Legitimate interest: We process analytics data based on our legitimate interest in understanding website usage and improving our services, balanced against your privacy rights.

6. Data Sharing and Third Parties

We do not sell, trade, or rent your personal data to third parties. We may share your data with the following categories of service providers who process data on our behalf:

• Transactional email: Resend (delivery of contact form and career application submissions, including uploaded attachments where applicable).
• Email services: Buttondown (newsletter delivery).
• Analytics: PostHog (website analytics).
• Hosting: Vercel (website hosting).
• Communication tools: Slack, Notion (client project management).

Each of these providers is bound by their own privacy policies and data processing agreements. We only work with providers that maintain appropriate data protection standards.

7. International Data Transfers

As a distributed team operating across Zambia, South Africa, and Saudi Arabia, and using service providers based in the United States and Europe, your data may be transferred internationally. This includes form submissions routed through providers such as Resend, Buttondown, PostHog, and Vercel. Where data is transferred outside of your jurisdiction, we ensure appropriate safeguards are in place, including standard contractual clauses where required under the GDPR.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact form submissions: Retained for up to 24 months, or until the inquiry is resolved, whichever is longer.
• Newsletter subscriptions: Retained until you unsubscribe.
• Career applications: Retained for up to 12 months after submission, including uploaded CV or résumé files and related correspondence.
• Client project data: Retained for the duration of the engagement plus 36 months for contractual and legal compliance purposes.
• Analytics data: Retained according to PostHog's data retention policies, typically no longer than 24 months.

9. Your Rights

Under the Zambia Data Protection Act 2021 and, where applicable, the GDPR, you have the following rights:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can request that we correct any inaccurate or incomplete data.
• Right to erasure: You can request that we delete your personal data, subject to any legal obligations that require us to retain it.
• Right to restrict processing: You can request that we limit how we use your data in certain circumstances.
• Right to data portability: You can request your data in a structured, commonly used, machine-readable format.
• Right to object: You can object to our processing of your data based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you can withdraw that consent at any time.

To exercise any of these rights, contact us at hello@amasuku.com. We will respond within 30 days.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL.
• Access controls limiting who can view personal data.
• Regular security reviews of our tools and processes.
• Secure authentication for all internal systems.

11. Children's Privacy

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will promptly delete it.

12. Cookies

Our website uses only essential cookies:

• Theme preference: A local storage item that remembers whether you prefer light or dark mode. This is not a tracking cookie and is stored locally on your device.

We do not use advertising cookies, social media tracking pixels, or third-party marketing cookies.

13. Complaints

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the relevant supervisory authority:

• In Zambia: Office of the Data Protection Commissioner, Lusaka, Zambia.
• In the European Union: Your local data protection authority under the GDPR.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, contact us at:

amasuku digital
Email: hello@amasuku.com
Website: amasuku.com