Privacy Policy

This Privacy Policy applies to all personal data collected by Chara Media Zambia through:

• Main Website: charamediazambia.com (corporate pages, blog, services)
• Power Presence: Digital subscription platform (magazine issues, reading analytics)
• Client Dashboard: User account management, subscription controls
• Admin Dashboard: Internal management tools (admin users only)
• Event System: RSVP registrations, virtual event access
• Newsletter System: Email marketing and communications

Data Controller: Chara Media Zambia is the data controller responsible for your personal information. Our contact details are in Section 11.

2.1 Information You Provide Directly

We collect data you voluntarily submit when you:

2.2 Information Collected Automatically

When you use our Platform, we automatically collect technical data:

2.3 Information from Third Parties

• Payment Processors (DPO Pay): Transaction confirmations, payment status updates
• Social Media (Optional OAuth): If you log in via Google/Facebook, we receive your name, email, and profile picture (with your consent)
• Email Service (SendGrid): Email delivery metrics (opens, clicks, bounces)

We use your data for the following purposes:

3.1 Service Delivery and Account Management

• Create and maintain your user account
• Process magazine subscriptions and grant content access
• Verify manual bank transfer payments (proof review)
• Send transactional emails (receipts, password resets, subscription confirmations)
• Manage event RSVPs and send event reminders
• Provide customer support and respond to inquiries

3.2 Payment Processing and Fraud Prevention

• Process payments via DPO Pay or verify manual bank transfers
• Detect and prevent fraudulent transactions (duplicate payments, chargebacks)
• Comply with financial regulations and tax requirements (receipt generation)
• Automate subscription renewals for monthly plans

3.3 Platform Improvement and Analytics

• Analyze user behavior to improve content and features (e.g., which articles are most read)
• Monitor Platform performance (page load speeds, error rates)
• Conduct A/B testing for UI/UX enhancements
• Generate aggregated, anonymized reports (e.g., "30% of users prefer mobile reading")

3.4 Marketing and Communications

• Send newsletters about new magazine issues, blog posts, and events (only if you subscribed)
• Notify you of subscription renewals and payment reminders
• Promote relevant content based on your reading history (personalized recommendations)
• Send push notifications for breaking news or event alerts (if you enabled them)
• Note: You can opt out of marketing emails anytime via the unsubscribe link or notification preferences in your dashboard.

3.5 Legal and Compliance

• Enforce our Terms of Service and detect policy violations
• Respond to legal requests (court orders, regulatory inquiries)
• Protect against security threats, hacking, or abuse
• Maintain audit logs for admin actions and payment transactions (90-day retention)

4.1 What Are Cookies?

Cookies are small text files stored on your device by your browser. They help us remember your preferences, keep you logged in, and understand how you use our Platform.

4.2 Types of Cookies We Use

4.3 Managing Cookies

You can control cookies through:

• Browser Settings: Most browsers allow you to block or delete cookies (Chrome: Settings → Privacy → Cookies)
• Opt-Out Tools: Google Analytics Opt-Out
• Note: Blocking necessary cookies may impair Platform functionality (e.g., unable to log in)

4.4 PWA Local Storage

Our Progressive Web App (PWA) uses local storage and service workers to cache magazine issues for offline reading. This data is stored on your device and can be cleared via browser settings or by uninstalling the PWA.

We do NOT sell your personal data to third parties. We only share data in the following limited circumstances:

5.1 Service Providers (Data Processors)

We share data with trusted partners who help us operate the Platform:

• Cloud hosting and infrastructure: Serves the site, sign-in, database, and file storage
• Payment partners: Card and wallet payments (handled under industry security standards)
• Email delivery: Transactional and optional marketing email
• Reliability monitoring: Anonymized error and performance signals to fix issues

All service providers are bound by data processing agreements (DPAs) and only process data per our instructions.

5.2 Legal Obligations

We may disclose your data if required by law:

• Court orders, subpoenas, or regulatory requests
• Investigations of fraud, security breaches, or illegal activity
• Protection of our rights, property, or safety (or that of others)

5.3 Business Transfers

If Chara Media is acquired, merged, or restructured, your data may be transferred to the new entity. You will be notified of any ownership changes via email.

5.4 With Your Consent

We may share data with third parties if you explicitly consent (e.g., sharing testimonials with your name, featuring event photos on social media).

We implement industry-standard security measures to protect your data:

6.1 Technical Safeguards

• Encryption: All data transmitted via HTTPS (TLS 1.3). Data at rest encrypted by our cloud providers (e.g. AES-256).
• Authentication: Passwords hashed with industry-standard password hashing. Optional 2FA for enhanced security.
• Firestore Security Rules: Database access restricted by user role (users can only read/write their own data).
• Rate Limiting: Prevents brute-force attacks (5 login attempts per 15 minutes).
• Regular Updates: Dependencies patched monthly for security vulnerabilities.

6.2 Organizational Safeguards

• Admin access restricted to authorized personnel only (role-based access control)
• Audit logs track all admin actions (user role changes, payment approvals)
• Employee training on data protection best practices
• Incident response plan for data breaches (notification within 72 hours per Zambian law, if applicable)

6.3 Limitations

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. You are responsible for:

• Keeping your password confidential (do not share with others)
• Using strong, unique passwords (password manager recommended)
• Reporting suspicious activity immediately (e.g., unexpected password reset emails)

We retain your data only as long as necessary:

Note: You can request early deletion of your data by contacting us (see Section 8 for your rights).

Under Zambian data protection principles and international best practices, you have the following rights:

8.1 How to Exercise Your Rights

To exercise any of these rights, contact us at legal@charamediazambia.com with:

• Your full name and registered email address
• Description of your request (e.g., "Delete my account")
• Proof of identity (for security: last 4 digits of phone number or transaction ID)

We will respond within 30 days. If we cannot fulfill your request (e.g., legal obligation to retain data), we will explain why.

Chara Media operates primarily in Zambia, but some service providers (hosting, payment, email) store data on servers outside Zambia, including:

• United States: selected cloud subprocessors, DPO Pay
• European Union: Vercel edge nodes, SendGrid

We ensure these transfers comply with international data protection standards through:

• Standard Contractual Clauses (SCCs): Legal agreements approved by EU regulators
• Adequacy Decisions: US companies participating in EU-US Data Privacy Framework
• Encryption: All data encrypted in transit and at rest

By using the Platform, you consent to these international transfers necessary for service provision.

Our Platform is not intended for children under 18. We do not knowingly collect personal data from minors without parental consent.

If you are under 18 and wish to use the Platform:

• You must have a parent/guardian create an account and supervise your use
• Parents are responsible for managing subscriptions and payment methods

If we discover we have inadvertently collected data from a child under 18 without parental consent, we will delete it immediately. Parents can contact us at legal@charamediazambia.com to request deletion.

For privacy-related questions, concerns, or to exercise your rights:

11.1 Response Times

• General inquiries: 5 business days
• Data access/deletion requests: 30 days (per legal requirements)
• Security incidents: Immediate acknowledgment, resolution within 72 hours

11.2 Complaints

If you believe we have mishandled your data, please contact us first. We are committed to resolving issues amicably.

If unsatisfied with our response, you may lodge a complaint with Zambian regulatory authorities (contact details will be provided upon request as data protection regulations evolve in Zambia).

We may update this Privacy Policy periodically to reflect:

• Changes in our data practices or Platform features
• Updates to legal or regulatory requirements
• Feedback from users or privacy audits

12.1 Notification of Material Changes

For significant changes (e.g., new data collection practices, third-party sharing), we will notify you via:

• Email to your registered address (30 days before changes take effect)
• Prominent banner on the Platform homepage
• In-app notification in Client Dashboard

12.2 Reviewing Changes

Always check the "Last Updated" date at the top of this page. We recommend reviewing this policy every 6 months. Continued use after updates constitutes acceptance. If you disagree with changes, cancel your subscription and stop using the Platform.

13.1 Third-Party Links

Our Platform may contain links to external websites (e.g., social media, partner sites, YouTube embeds). We are not responsible for their privacy practices. Please review their policies before sharing data.

13.2 Social Media Integrations

If you share content via social media buttons (Facebook, Twitter, LinkedIn), those platforms may track this activity per their own privacy policies.

13.3 Data Breach Notification

In the event of a data breach compromising your personal data, we will:

• Notify affected users within 72 hours via email
• Describe the nature of the breach and data involved
• Provide steps to mitigate harm (e.g., password reset)
• Report to authorities if legally required

13.4 Automated Decision-Making

We use limited automated processing for:

• Fraud detection (flagging suspicious transactions)
• Content recommendations (suggesting articles based on reading history)

These systems do not make decisions with legal or significant effects without human review. You can request manual review of any automated decision.