Data Protection Compliance

At OrangeGrey Consulting Limited, we are committed to ensuring the highest standards of data protection, privacy, and security. In alignment with the Zambia Data Protection Act No. 3 of 2021 (the "DPA"), this page outlines how we fulfill our obligations as a registered data controller and processor, and how we safeguard your rights.

1. Core Principles of Data Processing

Under Section 12 of the Zambia DPA, we process all personal data in accordance with the following mandatory principles:

• Lawfulness, Fairness, and Transparency: We only process data with your clear, informed consent, or under legally defined grounds (such as contract fulfillment).
• Purpose Limitation: Personal data is collected for specific, explicit, and legitimate business purposes and is not processed in a manner incompatible with those purposes.
• Data Minimization: We only collect, request, and retain the exact data necessary to provide our consulting services.
• Accuracy: We take reasonable steps to keep personal data accurate, complete, and up to date.
• Storage Limitation: We retain data in identifiable forms for no longer than is strictly necessary for its collected purpose or as required by statutory retention laws.
• Security, Integrity, and Confidentiality: We deploy enterprise-grade technical and organizational safeguards to protect your information against unauthorized access, loss, destruction, or disclosure.

2. Your Rights as a Data Subject

The Zambia Data Protection Act grants individuals robust rights over their personal information. As a client, partner, or visitor of OrangeGrey Consulting, you have the right to:

• Right to Information: Request confirmation of whether we process your data and obtain clear explanations of how it is utilized.
• Right to Access: Receive copies of your personal data held in our systems.
• Right to Rectification: Demand immediate correction of inaccurate, incomplete, or outdated data.
• Right to Erasure (Right to be Forgotten): Request the permanent deletion of your data when it is no longer necessary for the purpose it was collected.
• Right to Object: Object at any time to the processing of your data for direct marketing or profiling purposes.
• Right to Data Portability: Obtain and transfer your personal data in a structured, commonly used, and machine-readable format to another service provider.
• Right to Withdraw Consent: Withdraw any processing consent you previously granted us without penalty.

3. Cross-Border Data Transfers & Sovereignty

In compliance with Part XI of the Zambia DPA, OrangeGrey Consulting prioritizes local storage for sensitive personal data within the Republic of Zambia. Any cross-border transfers of personal data to international servers or partners are only executed where:

• The recipient country provides an adequate level of data protection equivalent to Zambian laws.
• We have obtained your explicit, written, and informed consent.
• The transfer is legally necessary for the execution of your advisory contract.

4. How We Secure Your Data

We employ rigorous administrative, physical, and digital infrastructure to prevent data breaches. These protocols include encrypted data transmission (SSL/TLS), access restriction controls, firewalls, regular system vulnerability audits, and mandatory data privacy training for all consulting associates.