By accessing or using any AU digital platform, you agree to the terms of this Privacy Notice.

This Notice applies to personal information collected through:

• Official website (www.africau.edu)
• Acacia ERP and student/staff portals
• Learning Management System (LMS)
• Self-Service Password Reset (SSPR) and email systems
• Clinic Management System
• Library (Koha)
• Online payment/e-commerce platforms
• Any AU-operated mobile or web application

It covers students, staff, alumni, donors, parents/guardians, service providers, visitors, and other users of AU services.

• Identification: Name, date of birth, national ID/passport, student/staff number.
• Contact: Address, email, phone, emergency contact.
• Academic/Professional: Enrolment, grades, qualifications, employment details.
• Financial: Bank details, payment history, scholarships/sponsorships.
• Health & Wellness: Medical data where applicable (e.g., campus clinic).
• ICT & Access: Credentials, login activity, device IDs, IPs, access logs.
• Media & Communications: Photos, videos, testimonials, messages.
• Other: Voluntary data via forms, surveys, or services.

• Manage student/staff records, admissions, teaching, research, and examinations.
• Process billing, payments, scholarships, and sponsorships.
• Deliver online learning and digital services.
• Provide healthcare and wellness support.
• Secure ICT systems, authentication, and account management.
• Send institutional updates and opportunities.
• Comply with legal, regulatory, and accreditation requirements.
• Improve user experience and platforms.

Consent; contractual necessity; legal obligation; legitimate interests (including campus safety and service improvement); and vital interests in emergencies.

We share data with authorised AU staff; regulators; service providers (e.g., cloud and payment processors); partner institutions; and law enforcement/public authorities where required. Third-party processors are contractually bound to handle data securely and lawfully.

Where data is transferred outside Zimbabwe, AU uses appropriate safeguards (e.g., contractual clauses or equivalent legal mechanisms).

We retain personal data only as long as necessary for stated purposes or as required by law, after which it is securely deleted or anonymised.

• Encryption and secure transmission (HTTPS, TLS)
• Access control and authentication
• Security audits and vulnerability assessments
• Backup and disaster recovery
• Staff awareness and data protection training

Rights under the Cyber and Data Protection Act include: to be informed; access; rectification; erasure; restriction; portability; objection; and to lodge a complaint with the Data Protection Authority (POTRAZ).

We may use cookies and similar technologies to enhance functionality and analyse usage. You can manage cookie preferences through your browser settings.

External sites have their own privacy notices; AU is not responsible for their practices.

We do not knowingly collect data from children under 16 without parental/guardian consent unless permitted by law.

We may update this Notice to reflect legal or operational changes. The latest version will be available at www.africau.edu/privacy with the effective date indicated.

Data Protection Officer (DPO)
Africa University, P.O. Box 1320, Mutare, Zimbabwe
Email: dpo@africau.edu
Web: www.africau.edu/privacy-policy