Privacy Policy

Corex Capital (Private) Limited (“Corex Capital”, “we”, “us”, or “our”) is a microfinance institution
operating in Zimbabwe, offering loan and financing products including the Dzidzo Loan,
Pahushamwari Loan, Thuthukisa Loan, SME Loan and KaBooster Loan, through our branches in
Harare, Bulawayo, Marondera, Mutare, Gweru, Gokwe, Kwekwe, Chinhoyi and Masvingo, and
through our website at https://corex.co.zw/ (the “Website”).
We are committed to protecting the privacy and personal information of our clients, prospective
clients, website visitors, guarantors, next-of-kin, employees and other individuals whose personal
information we process (“you”, “data subject”). This Privacy Policy explains what personal
information we collect, why we collect it, how we use, store, share and protect it, and what rights
you have, in compliance with the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe
(the “Act”) and other applicable laws, including the Banking Act, the Microfinance Act [Chapter
24:29] and regulations issued by the Reserve Bank of Zimbabwe and the Postal and
Telecommunications Regulatory Authority of Zimbabwe (“POTRAZ”).
By applying for a loan or other product, visiting our Website, contacting us, or otherwise providing
us with your personal information, you acknowledge that you have read and understood this
Privacy Policy.

2. Who We Are

Data Controller: Corex Capital (Private) Limited, a registered microfinance institution
incorporated in Zimbabwe, determines the purposes and means of processing personal
information described in this Policy.

3. Key Definitions

· “Personal information” means information relating to an identifiable natural person,
including but not limited to a name, national ID number, date of birth, address, phone
number, email, employment or income details, financial and credit information, and
biometric data.
· “Processing” means any operation performed on personal information, including
collection, recording, storage, use, disclosure, transfer or destruction.
· “Data subject” means the individual to whom personal information relates.
· “Consent” means a specific, unequivocal, freely given and informed expression of
will by which you agree to the processing of your personal information.
· “Third party” means any person or entity, other than you and Corex Capital,
involved in the processing of your personal information.

4. Personal Information We Collect

We collect personal information necessary to assess, provide, administer and recover loans and
other financial services, and to operate our website. This may include:

4.1 Identification and contact information
· Full name, national ID number or passport number, date of birth, gender, marital
status
· Residential and postal address, phone numbers, email address
· Photograph and signature, where provided for verification purposes

4.2 Financial and employment information
· Employer details, payslips, proof of income, bank statements
· Loan application details, credit history, credit bureau reports, existing debt obligations
· Bank account and mobile money details for loan disbursement and repayment

4.3 Guarantor, group-loan and next-of-kin information
· For group loans such as the Pahushamwari Loan, and where a guarantor or next of
kin is required, we collect the identification, contact and, where relevant, financial
information of those individuals

4.4 Website and communications information
· Information you submit through our contact and application forms (name, email,
message content)
· Communications sent via WhatsApp, email, telephone or in-branch, including call and
chat records
· Technical information such as IP address, browser type and pages visited, where our
Website or service providers collect this automatically
We do not knowingly collect special/sensitive categories of personal information (such as health
data) unless it is voluntarily provided by you and strictly necessary, for example in support of a
hardship or restructuring request, and we will only process such information with your explicit
consent or as otherwise permitted by law.

5. How We Collect Your Information

· Directly from you, when you apply for a loan, visit a branch, complete a website form,
call, email or message us.
· From guarantors, group members or next of kin whom you nominate in connection
with your application.
· From your employer, for verification of employment and income, where you have
consented or where this is necessary to assess your application.
· From credit reference bureaux and the Reserve Bank of Zimbabwe credit registry, to
assess creditworthiness and manage risk.
· From publicly available sources, where reasonably necessary for verification or fraud
prevention.

6. Purpose of Processing and Legal Basis

We process your personal information only for specified, explicit and legitimate purposes, and in
a manner compatible with those purposes, as required by the Act. Our purposes include:
· Assessing loan and product applications, including affordability and credit-risk
assessment
· Verifying your identity and preventing fraud, money laundering and other financial
crime
· Administering, disbursing, servicing and recovering loans, including contacting
guarantors where necessary
· Communicating with you about your application, account, repayments or our products
and services
· Complying with legal, regulatory and reporting obligations, including those of the
Reserve Bank of Zimbabwe, POTRAZ, and any applicable credit reference or
anti-money-laundering framework
· Improving our products, services and Website, and, where you have consented,
sending you marketing communications
· Protecting the security of our systems, staff, clients and premises

7. Consent

Where our processing relies on your consent (for example, marketing communications or sharing
information with a third party for a purpose not otherwise required by law), we will seek that
consent in a clear, specific and informed manner before processing begins.
You may withdraw your consent at any time by contacting us using the details in Section 15.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal
and may affect our ability to continue providing you with certain products or services, for example
where the information is needed to service an existing loan.

8. Disclosure and Sharing of Your Information

We do not sell your personal information. We may share your personal information, on a
need-to-know basis and subject to appropriate safeguards, with:
· Guarantors and, in the case of group loans, other members of your loan group, to the
extent necessary for the loan arrangement
· Credit reference bureaux and the Reserve Bank of Zimbabwe credit registry, for
credit assessment and reporting
· Debt collection agents and legal advisors, where necessary to recover amounts owed
to us
· Service providers who support our operations, such as IT hosting, SMS/WhatsApp
messaging and payment processing providers, bound by confidentiality and data
protection obligations
· Regulators and government authorities, including the Reserve Bank of Zimbabwe,
POTRAZ, the Zimbabwe Revenue Authority, law enforcement agencies and courts,
where required or permitted by law
We require all third parties to respect the security of your personal information and to treat it in
accordance with the law. We do not allow our service providers to use your personal information
for their own purposes.

9. Cross-Border Transfer of Personal Information

Where it is necessary to transfer your personal information outside Zimbabwe (for example,
where a service provider’s servers are located abroad), we will only do so where an adequate
level of protection is ensured in the recipient country or organisation, or where another safeguard
recognised under the Act applies, such as your explicit consent to the proposed transfer, and
only to the extent necessary to carry out the relevant task.

10. How We Protect Your Information

We implement appropriate technical and organisational security measures to protect your
personal information against unauthorised access, alteration, disclosure, loss or destruction, in
line with the requirements of the Act. These measures include:
· Access controls restricting personal information to authorised staff on a need-to-know
basis
· Secure storage of physical files and encryption of sensitive electronic data
· Password-protected systems and regular review of our security practices
· Staff training on data protection and confidentiality obligations
While we take reasonable steps to protect your information, no method of transmission or
storage is completely secure, and we cannot guarantee absolute security.

11. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which
it was collected, including for the purpose of satisfying any legal, accounting, regulatory or
reporting requirements. This generally means we retain client and loan records for the duration of
your relationship with us and for a further period thereafter, as required by the Reserve Bank of
Zimbabwe, POTRAZ and other applicable laws, after which the information is securely deleted or
anonymised.

12. Your Rights as a Data Subject

Subject to the provisions of the Act, you have the following rights in relation to your personal
information:
· Right to be informed: to be told when we collect your personal information, who we
are, and why and how we will use it
· Right of access: to request confirmation of whether we process your personal
information and to obtain a copy of it
· Right to rectification: to request that inaccurate or incomplete personal information
be corrected
· Right to erasure: to request deletion of your personal information where it is no
longer necessary for the purpose it was collected, subject to our legal and regulatory
retention obligations
· Right to object: to object to processing carried out for direct marketing or on another
legitimate basis, on reasonable grounds
· Right to withdraw consent: to withdraw consent previously given
· Right to lodge a complaint: to lodge a complaint with us and, if unresolved, with
POTRAZ as the supervisory Data Protection Authority
A data subject who is physically, mentally or legally incapable of exercising these rights may do
so through a parent, guardian or other person designated by law or by a court of competent
jurisdiction, in line with the Act.
To exercise any of these rights, please contact us using the details in Section 15. We may need
to verify your identity before responding and will respond within the timeframes required by the
Act.

13. Marketing Communications and Website Cookies

Where you have consented, we may send you information about our products and services by
SMS, WhatsApp, email or telephone. You may opt out of marketing communications at any time
by contacting us or following the unsubscribe instructions provided.

14. Data Breach Notification

In the event of a security incident that is likely to result in a risk to your rights and freedoms, we
will assess the breach and, where required by the Act, notify POTRAZ and affected data subjects
without undue delay, together with information on the nature of the breach and the measures
taken or proposed to address it.

15. Data Protection Officer and Contact Details

If you have questions, requests or complaints about this Privacy Policy or how we handle your
personal information, please contact us:
Email: privacy@corex.co.zw
Phone / WhatsApp: 0771 639 770
Physical address: Hungwe House, 2nd Floor, 69 Jason Moyo Avenue, Harare, Zimbabwe
Or visit any Corex Capital branch (Harare, Bulawayo, Marondera, Mutare, Gweru, Gokwe,
Kwekwe, Chinhoyi, Masvingo)
If you are not satisfied with our response, you may lodge a complaint with the Data Protection
Authority:
Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), Data Protection
Authority

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our
products, or legal and regulatory requirements. Any changes will be posted on our website at
https://corex.co.zw/ with an updated effective date. We encourage you to review this Policy
periodically