PRIVACY POLICY

Acculitax Cloud Accounting

Cloud accounting and business management platform

Effective date: 13 July 2026

Version 1.0

This policy explains how Acculitax collects, uses, stores, shares and protects personal information when providing its website, cloud accounting, inventory, point-of-sale, fiscalisation, support and related services.

Privacy enquiries: sales@acculitax.com | 0718436331 | 0774090142

Prepared with reference to Zimbabwe’s Cyber and Data Protection Act [Chapter 12:07] and applicable regulations and guidance.

Privacy at a glance

Who is responsible?

Acculitax is responsible for account, billing, support, marketing and service-operation data. For business records uploaded by a customer, the customer is generally the data controller and Acculitax generally acts as a data processor.

What do we collect?

Account and contact details, business information, accounting and transaction records, inventory and point-of-sale data, fiscalisation information, device and usage data, and support communications.

Why do we use it?

To provide and secure the platform, process transactions, support users, meet legal and regulatory duties, improve services, and communicate about relevant products and services.

Who receives it?

Authorised personnel, service providers, payment and communications partners, professional advisers, regulators such as ZIMRA and POTRAZ, and others where required by law or authorised by the customer.

Your choices and rights

You may request information, access, correction, deletion of false or misleading information, object to certain processing, withdraw consent where processing is based on consent, and opt out of direct marketing.

This summary is provided for convenience. The full policy below governs how personal information is handled.

1. Introduction

Acculitax is a cloud-based accounting and business management platform (“Acculitax”, “we”, “us” or “our”). This Privacy Policy describes how we process personal information in connection with our websites, applications, cloud accounting services, inventory management, point-of-sale solutions, van sales tools, in-built ZIMRA fiscalisation, integrations, demonstrations, customer support and related services (collectively, the “Services”).

By using the Services, opening an account, requesting a demonstration or quotation, or otherwise providing personal information to us, you acknowledge that you have read this Privacy Policy. Where consent is legally required, we will request it separately and you may withdraw it as described in this policy.

2. Who we are and how to contact us

• Service provider: Acculitax Cloud Accounting
• Country of operation: Zimbabwe
• Email: sales@acculitax.com
• Telephone: 0718436331 or 0774090142
• Privacy contact: The Data Protection Officer or Privacy Lead, through the contact details above

Data controller and data processor roles

Acculitax may act in different legal roles. We act as a data controller for personal information used to administer accounts, billing, support, security, marketing and our own operations. When a business customer uploads or records personal information about its employees, customers, suppliers or other persons in Acculitax, the business customer generally decides why and how that information is used and is therefore the data controller; Acculitax generally processes that information on the customer’s documented instructions as a data processor.

3. Scope of this policy

This policy applies to personal information relating to:

• business owners, directors, authorised representatives and account administrators;
• employees and other users who access Acculitax on behalf of a customer;
• prospective customers who request information, demonstrations or quotations;
• customer and supplier contacts whose information is recorded in the platform by an Acculitax customer;
• users of our website, applications, support channels and integrations; and
• service providers, partners and other business contacts.

This policy does not replace the privacy notice or legal responsibilities of an Acculitax customer in relation to information that the customer controls. Customers must ensure that they have a lawful basis and provide any required notices before entering personal information into Acculitax.

4. Personal information we collect

4.1 Account and identity information

• names, job titles, usernames, passwords or authentication credentials;
• national identification or registration details where required for verification or compliance;
• contact details such as email addresses, telephone numbers and business addresses; and
• authorised-user, role and access-permission information.

4.2 Business and subscription information

• business name, registration details, tax identifiers, industry, branches and authorised representatives;
• subscription plan, licence allocation, invoices, payment status and support entitlement; and
• information supplied in demonstrations, quotations, onboarding forms and contracts.

4.3 Accounting, transaction and operational information

• sales, purchases, invoices, receipts, credit notes, expenses, journals, payments and cash-flow records;
• inventory, stock movements, warehouses, product records, pricing and barcode information;
• point-of-sale and van sales activity, routes, deliveries and customer orders, where enabled;
• customer, supplier, debtor and creditor details entered by the customer; and
• reports, dashboards, audit trails and records created through the Services.

4.4 Tax and fiscalisation information

• tax registration details and information required to create compliant fiscal documents;
• invoice, receipt and transaction information transmitted to or received from ZIMRA through in-built fiscalisation; and
• fiscal device, reference, status and response information required for reconciliation and support.

4.5 Technical, device and usage information

• internet protocol address, device type, browser, operating system and approximate location derived from network data;
• login times, pages or features used, system events, error logs and security records;
• cookies, local storage and similar technologies used on our websites and applications; and
• integration, application programming interface and synchronisation logs.

4.6 Support and communications information

• emails, telephone calls, chat messages, helpdesk tickets, training records and feedback;
• records of demonstrations, service requests, complaints and issue resolution; and
• marketing preferences and responses to campaigns or events.

Payment information

Where payments are made through a bank, mobile-money provider, payment gateway or other payment partner, that provider may collect and process payment credentials under its own privacy notice. Acculitax may receive limited information such as payment status, amount, date and transaction reference. We do not store full card credentials unless expressly stated at the point of payment.

5. How we collect personal information

We may obtain personal information:

• directly from you when you register, subscribe, request a quotation, contact support, attend training or use the Services;
• from the business or organisation that creates an account for you or authorises your access;
• from information entered or uploaded by an Acculitax customer;
• automatically from devices, browsers, applications and system logs;
• from payment, messaging, fiscalisation, banking, identity-verification and other integration partners;
• from publicly available sources and professional or business directories, where lawful; and
• from regulators, public authorities or other persons where required or permitted by law.

6. Why we use personal information

The lawful basis that applies will depend on the particular processing activity and relationship. Where we rely on consent, you may withdraw it at any time without affecting processing that was lawful before withdrawal.

7. Customer-controlled information in Acculitax

• the customer is responsible for deciding the purpose of processing and for providing legally required privacy notices;
• the customer must ensure that data entered into Acculitax is lawful, accurate, relevant and not excessive;
• Acculitax processes the information to provide the Services and in accordance with the customer’s documented instructions, contract and applicable law;
• requests from an individual about customer-controlled data may need to be directed to the relevant customer; and
• we may assist customers with access, correction, export, deletion, security and incident-response requests where technically and legally possible.

8. In-built ZIMRA fiscalisation

How fiscalisation affects your data

Where a customer enables Acculitax’s in-built ZIMRA fiscalisation, information required to create, transmit, validate, reconcile or support fiscal documents may be exchanged with the Zimbabwe Revenue Authority and its authorised systems. This may include business and tax identifiers, invoice or receipt details, transaction amounts, product information, customer information where legally required, timestamps, device or fiscal references, and response or status information.

We process and disclose fiscalisation information to perform the customer’s contract, comply with tax and fiscalisation obligations, maintain accurate records, prevent misuse, and respond to lawful regulatory requests. ZIMRA and other public authorities may process information under their own legal powers and privacy obligations.

9. When we share personal information

• authorised Acculitax employees, contractors and support personnel who require access for their duties;
• cloud hosting, backup, cybersecurity, software, analytics and technical service providers;
• banks, payment gateways, mobile-money providers and billing partners;
• email, SMS, telecommunications and customer-support providers;
• ZIMRA, POTRAZ, courts, law-enforcement agencies and other public authorities where required or permitted by law;
• auditors, accountants, insurers, legal advisers and other professional advisers;
• implementation, integration and business partners acting under contract or the customer’s instructions;
• a prospective buyer, investor or successor in connection with a merger, restructuring, financing or sale, subject to confidentiality and lawful processing; and
• other persons where you or the relevant customer has authorised the disclosure.

We do not sell personal information. We require service providers that process personal information for us to use it only for agreed purposes and to implement appropriate security and confidentiality measures.

10. International transfers

Some hosting, backup, communications, support or technology providers may process information outside Zimbabwe. Where personal information is transferred internationally, we will take reasonable steps to ensure that the transfer is lawful and that an adequate level of protection or other permitted safeguard applies. Depending on the circumstances, safeguards may include contractual protections, security measures, the individual’s unambiguous consent, or another lawful transfer basis.

11. Data retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide the Services, meet contractual commitments, comply with tax, accounting, regulatory and legal requirements, resolve disputes, maintain security records, and establish or defend legal claims.

Retention periods may depend on:

• the duration of the customer relationship and subscription;
• the type, sensitivity and volume of the information;
• legal, tax, audit, fiscalisation and contractual requirements;
• the risk of harm from unauthorised use or disclosure;
• whether the information is needed for security, support, backup or dispute resolution; and
• the customer’s lawful instructions and account-closure arrangements.

When information is no longer required, we will delete it, anonymise it, securely archive it where legally required, or restrict further use. Data in backups may remain for a limited cycle before secure deletion or overwriting.

12. Security of personal information

We use reasonable and appropriate technical and organisational measures designed to protect the confidentiality, integrity and availability of personal information. These measures may include:

• role-based access controls, user permissions and authentication safeguards;
• encryption in transit and, where appropriate, encryption or equivalent protection at rest;
• logging, monitoring, vulnerability management and incident-response processes;
• backups, disaster recovery and business-continuity measures;
• confidentiality obligations, staff training and access reviews;
• vendor due diligence and contractual security requirements; and
• physical and environmental controls for relevant systems and workplaces.

Your security responsibilities

Keep login credentials confidential, use strong and unique passwords, enable available security features, restrict user access to what is necessary, promptly remove former users, verify recipients before exporting data, maintain secure devices and networks, and notify us immediately if you suspect unauthorised access or misuse.

13. Security incidents and data breaches

We maintain procedures to identify, contain, investigate and respond to suspected security incidents. Where a breach affects personal information, we will assess the risk and make notifications to POTRAZ, affected customers, data subjects or other authorities as required by applicable law. Zimbabwe’s Cyber and Data Protection Act requires a data controller to notify the Authority within twenty-four hours of a security breach affecting data it processes.

Customers must notify Acculitax promptly if they become aware of any compromised account, lost device, unauthorised access, suspicious activity or other incident involving the Services.

14. Your data protection rights

Subject to applicable law and the nature of the processing, you may have the right to:

• be informed about how your personal information is used;
• request access to personal information held about you;
• request correction of inaccurate, false or misleading information;
• request deletion of false or misleading information and, where applicable, other information that is no longer lawfully required;
• object to all or part of certain processing, including direct marketing;
• withdraw consent at any time where processing is based on consent;
• request information about significant decisions based solely on automated processing and object where applicable; and
• lodge a complaint with POTRAZ as the Data Protection Authority.

To exercise a right, contact us using the details in section 2. We may ask for reasonable information to verify your identity and authority, protect other persons, and locate the relevant records. If the information is controlled by an Acculitax customer, we may refer the request to that customer or assist it in responding. Rights may be limited where an exception applies, information must be retained by law, or disclosure would adversely affect another person’s rights.

15. Direct marketing and communications

We may send service communications that are necessary to operate an account, including security notices, support updates, fiscalisation or integration alerts, billing messages and changes to terms or policies. These are not marketing communications and may be required while the account remains active.

We may also send relevant marketing communications where permitted by law. You may object or opt out at any time by using the unsubscribe method in the communication or contacting us. Opting out of marketing does not stop necessary service communications.

16. Cookies and similar technologies

Our websites and applications may use cookies, local storage, software development kits and similar technologies to operate essential features, maintain sessions, remember preferences, protect accounts, measure performance and understand use of the Services. Where legally required, we will request consent before using non-essential cookies or similar technologies.

You can control cookies through browser or device settings, but disabling essential technologies may prevent parts of the Services from working correctly.

17. Children

The Services are intended for businesses and authorised adult users and are not directed to children under eighteen. We do not knowingly create accounts for children. If customer-controlled records include information about a child, the customer must ensure that the information is lawfully processed and that any required consent or representation by a parent or legal guardian has been obtained.

18. Third-party services and links

The Services may integrate with or contain links to third-party websites, banking services, payment platforms, communications providers, ZIMRA systems or other applications. Third parties process information under their own terms, legal powers and privacy notices. We encourage users to review those notices. Acculitax is not responsible for a third party’s independent privacy practices, except to the extent required by law or contract.

19. Changes to this policy

We may update this Privacy Policy to reflect changes in our Services, technology, legal requirements or business practices. The revised policy will show a new effective date. Where a change is material, we may provide additional notice through the Services, by email or through another appropriate channel.

20. Questions, requests and complaints

Please contact us first so that we can try to resolve any privacy question, request or complaint promptly.

• Email: sales@acculitax.com
• Telephone: 0772393308 or 0779776602
• For the attention of: Data Protection Officer / Privacy Lead

You may also lodge a complaint with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), which is designated as Zimbabwe’s Data Protection Authority. Current contact channels are published on the POTRAZ website: www.potraz.gov.zw.

21. Legal framework and reference materials

This policy has been prepared with reference to the following Zimbabwean legal and regulatory materials:

• Cyber and Data Protection Act [Chapter 12:07] (No. 5 of 2021)
• Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (Statutory Instrument 155 of 2024)
• POTRAZ implementation guidance for data controllers and data protection officers