Privacy policy

Last updated 11 November 2026

1. What this covers

Spindle Software Limited (“Spindle”, “we”) is a company in Kitwe, Zambia. This policy explains what personal data we collect through this website and, in outline, through our software products, and what we do with it. We follow the Data Protection Act, No. 3 of 2021, of Zambia.

For our products there are two roles. For the people who sign up (a school administrator, a shop owner, a lender) we are the controller of their account details. For the records those customers enter about other people (pupils, parents, customers, borrowers) the customer is the controller and we are the processor: we hold and process the data on the customer’s instructions.

2. This website

What we collect

• Contact form: your name, email address, phone number if you give it, what the message is about, and the message itself. We also record the sending address of the device, to stop abuse.
• Server logs: our web host keeps standard logs of requests (address, page, time, browser) for a short period, for security.

What we do not do

• We do not run advertising or tracking scripts, and we do not use analytics cookies on this site. The site sets no cookies of its own.
• Fonts are loaded from Google Fonts, which means Google’s servers see your device’s request for the font files. No other third-party scripts run on the page.

Why we use it

We use what you send through the contact form to answer you and, if we go on to work together, to prepare a proposal. We keep the conversation so we can refer back to it. We do not add you to a mailing list unless you ask.

3. Our products

Each product has its own privacy notice, shown at sign-up. In outline:

• Account data (name, email, phone, organisation, payment references) is used to run the account, bill it and support it.
• Customer records (pupils, results, parents’ numbers, sales, stock, borrowers, loans) are processed only to provide the service to the customer who entered them. We do not use them for anything else, and we do not sell or share them.
• SMS and payments: to send a text or collect a payment, the necessary details (a phone number, an amount, a reference) go to the service that carries them, such as Zamtel for SMS and Lipila or Lenco for mobile-money collections.
• Support access: our staff can see a customer’s data when needed to fix a problem or to help, and those sign-ins are recorded.

4. Where data is kept

This website and our products are hosted with Hostinger. Depending on the product, data may be stored on servers outside Zambia. Where a product stores data outside Zambia, we ask for explicit consent at sign-up, as the Act requires. Backups are encrypted and kept separately from the live server.

5. Who we share data with

Only with the services needed to provide what you asked for: our hosting provider, the SMS gateway, the payment providers named above, and our email provider for messages. We do not share personal data with advertisers or data brokers. We will disclose data if a Zambian court or authority lawfully requires it, and we will tell the customer concerned where the law allows.

6. How long we keep it

• Contact-form messages: as long as the conversation is useful, and no longer than three years after our last exchange.
• Product data: for as long as the account is open. Within 30 days of a confirmed request to close an account, the data is deleted, except for records we must keep for tax and accounting, which are kept for the period the law sets.
• Server logs: up to 90 days.

7. Your rights

Under the Data Protection Act you can ask us what personal data we hold about you, ask for it to be corrected or deleted, object to how it is used, and ask for a copy in a usable form. Write to [email protected] and we will answer within 30 days. If you think we have handled your data badly, you can complain to the Office of the Data Protection Commissioner of Zambia.

If your data is in one of our products because a customer entered it (for example your child’s school), ask that customer first; they are the controller. We will help them meet your request.

8. Security

Connections to this site and to our products are encrypted. Passwords are stored hashed, never in plain text. Access to customer data is limited by role and recorded in an audit log. Backups are taken nightly, encrypted and stored away from the live server. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the Commissioner as the Act requires.

9. Contact

Spindle Software Limited, 1038 Accra Road, Second Class, Kitwe, Copperbelt, Zambia · [email protected] · +260 771 216 339. We may update this policy; the date at the top shows the current version.