Moonlight Provident Associates (Private) Limited (“Moonlight”, “we”, “us”, or “our”) is committed to safeguarding the privacy and integrity of your personal information. As a registered and licensed data controller under the Data Protection Authority of Zimbabwe—the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ)—we process personal information in strict accordance with the Cyber and Data Protection Act [Chapter 12:07] (“the Act”) and Statutory Instrument 155 of 2024 (“the Regulations”).

1. Scope of This Notice

This Privacy Notice applies to all data subjects (policyholders, beneficiaries, corporate clients, site visitors, and job applicants) whose personal information we collect and process through our website, mobile platforms, physical branches (over 40 branches across Zimbabwe), and manufacturing divisions (such as J. Davis & Company).

2. Categories of Personal Information We Collect

Depending on your relationship with us, we collect the following personal information:

• Basic Identification Data: Full names, National Identification / Passport numbers, dates of birth, sex, and marital status.
• Contact Information: Physical addresses, email addresses, and telephone numbers.
• Financial & Employment Data: Banking details, payment methods, transaction history, employer names, and employment history (for Group Policies or career applications).
• Sensitive Personal Data: Relational data (family status and proof of relationship for beneficiaries), and circumstances surrounding deaths (for funeral service execution and repatriation/expatriation).
• Technical Data: IP addresses, browser types, technical device identifiers, and site interaction statistics collected via cookies when navigating our website.

3. Lawful Basis for Processing

In compliance with Section 18 of the Act, we process personal data under the following legitimate grounds:

• Performance of a Contract: To generate quotes, administer individual and group funeral policies, process claims, and execute funeral and manufacturing services.
• Explicit Consent: When you voluntarily share data via our “Get A Quote”, “Member Login”, or newsletter subscription channels.
• Legal Obligation: To satisfy statutory requirements defined by IPEC (Insurance and Pensions Commission) and tax authorities in Zimbabwe.
• Legitimate Interests: To prevent fraud, manage risk, secure our digital systems, and optimize customer service.

4. How We Use Your Information

Your data is processed strictly for specified, clear, and legitimate business operations:

• Processing applications for Cash, Church, Community, Group, and Individual Funeral Plans.
• Facilitating cross-border services, including repatriation and expatriation logistics.
• Managing corporate group accounts and handling client portal logins.
• Sending out administrative announcements, service updates, and newsletter distributions (where opted-in).

5. Data Disclosure and Third-Party Sharing

We do not sell your personal information. We only share your data with verified recipients where strictly necessary:

• Service Providers: Partners carrying out logistics, local coffin manufacturing, and specialized transport.
• Regulatory & State Authorities: Law enforcement or insurance regulators when legally mandated.
• Cross-Border Transfers: If handling repatriation/expatriation requests (e.g., via Moonlight SA), data may transit across borders. In accordance with Section 28 and 29 of the Act, we ensure the destination country provides adequate data protection levels and notify POTRAZ prior to data transfer.

6. Data Security and Technical Safeguards

Pursuant to Section 18 of the Act and the rigorous guidelines of SI 155 of 2024, Moonlight deploys technical and organizational security protocols to protect your data against accidental loss, unauthorized access, destruction, or alteration. These include secure encryption protocols for web forms, access controls across our internal branch network, and regular cyber-risk vulnerability testing.

7. Data Breach Notifications

In the unlikely event of a data security breach that impacts your personal information:

• We will report the incident to POTRAZ within 24 hours of discovery, as required by SI 155 of 2024.
• If the breach poses a high risk to your personal rights and freedoms, we will notify you directly within 72 hours detailing the nature of the breach and mitigation steps taken.

8. Your Data Subject Rights

Under Part III of the Act, you possess the following rights regarding your personal information:

• Right to be Informed: Transparent information on how your data is used.
• Right of Access: The right to request a copy of the personal data we hold about you.
• Right to Rectification: The right to request immediate correction of inaccurate or incomplete personal records.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your data where there is no longer a lawful justification for its retention.
• Right to Object & Restrict Processing: The right to object to processing based on legitimate interests or direct marketing purposes.
• Right to Withdraw Consent: Where processing is consent-based, you may withdraw it at any time without affecting prior lawfulness.

9. Retention Period

We retain your personal data only as long as required to fulfill the operational purposes detailed in this policy, or to comply with institutional statutory retention timelines mandated under Zimbabwean financial and insurance legislation.

10. Contact Our Data Protection Officer

We have appointed a certified Data Protection Officer (DPO) in compliance with the mandates of SI 155 of 2024. For any questions regarding this Privacy Notice, or to exercise your rights, please reach out via:

• Email: info@moonlight.co.zw
• Head Office Phone: 0242 781341–2 / +263 713445250
• Physical Address: Moonlight Provident Associates Head Office, Harare, Zimbabwe.