Who we are
Zimbabwe National Roads Administration (ZINARA) (ZINARA) is the data controller for ZEBS, the Zinara Enterprise Business Suite. Questions go to the Data Protection Officer: dpo@zinara.co.zw, ZINARA Head Office, Harare, Zimbabwe.
What we collect
Your name, EC number, work email, job title, department, grade, contact details and photograph; leave, attendance, performance, training and benefit records; transport, fuel and procurement requests you make or approve; your electronic signature image and signing history; sign-in records (time, device and network address); and passkey public keys. We do not store your fingerprint or face: your device checks those and tells ZEBS only that it succeeded.
Why we use it
To employ and pay you, run HR and approval workflows, keep ZINARA's records, secure accounts, meet legal duties (for example audit and statutory returns), and improve the service.
Lawful basis
Performing your employment contract, ZINARA's legal obligations, ZINARA's legitimate interest in running and securing its systems, and your consent where we ask for it (for example optional notifications). This follows Zimbabwe's Cyber and Data Protection Act.
Who sees it
Only staff who need it for their role, as set by ZEBS roles and approval chains. Other ZINARA systems (careers portal, Toll Site Manager, Disbursement Management System) receive only the work identity and HR facts they need, never your password.
Where it goes
Some processing happens on servers outside Zimbabwe. See the data hosting and cross-border transfer notice for providers, purposes and safeguards.
How long we keep it
Employment records for the period required by law and ZINARA's retention schedule; sign-in and audit logs for the period set by ICT security policy. Records past their period are deleted or anonymised.
Your rights
You may ask to see, correct, restrict or delete your data, object to processing, withdraw consent, and complain to the Zimbabwe data protection authority (POTRAZ). Write to dpo@zinara.co.zw. Some HR and audit records cannot be deleted while the law requires ZINARA to keep them.
Security
Encrypted connections, password and one-time-code or passkey sign-in, role-based access, audit logging, and signed single-use tokens between ZINARA systems.
Changes
We will update this page when practice or the law changes. Last updated 12 October 2026.