Privacy policy

Who we are

Eigenstate Systems is based in Harare, Zimbabwe. We build operational AI infrastructure for African enterprise: computer vision, tracking, HR and payroll, AI agents, CRM and workflow systems that run inside our clients’ operations.

This policy explains what personal data we handle, why we handle it, and what rights you have. Personal data means any information that relates to a person who can be identified from it, such as a name, an email address, a photograph or a location record. The person the data is about is called the data subject.

Questions and requests about personal data go to our data protection contact at support@eigenstatesystems.com. You can also write to sales@eigenstatesystems.com or message +263 77 636 6999 on WhatsApp, and we will route your request to the right person.

The law this policy follows

This policy is written under the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe, Act No. 5 of 2021, which we refer to below as the Act. The Act sets out how personal data may be collected and used, gives data subjects rights over their data, sets stricter conditions for sensitive data, requires that breaches be notified, and restricts transfers of personal data out of Zimbabwe.

The regulator under the Act is the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), acting as the Data Protection Authority. Where we serve clients in South Africa, the Protection of Personal Information Act 4 of 2013 (POPIA) applies as well; see the section on client systems below.

This website

This website is deliberately simple about data.

• It sets no cookies.
• It uses Vercel Web Analytics to count page views in aggregate: which pages are visited, the referring site, and the visitor's country and device type. It uses no cookies, does not track visitors across sites, and does not build a profile of anyone. It loads no third-party advertising or tracking scripts.
• The website assistant (the "Ask Eigenstate" chat) sends the questions you type to an AI model through Vercel's AI Gateway so it can answer from this website's content. We do not store the conversation, and you should not type personal or confidential information into it.
• When you submit the contact form, the details you enter (name, company, email, phone, sector and message) are sent to our customer relationship management system, InOne CRM, so we can reply to you. They are used only to respond to your enquiry and, if we work together, to manage that relationship.

Because of this, no cookie banner is needed and none is shown.

The site is hosted by Vercel on servers outside Zimbabwe. As with any website, the host keeps standard server logs, meaning the IP address of the connecting device, the browser type and the time of each request, for the operation and security of the hosting platform. We do not add to these logs or use them to identify visitors.

When you contact us directly

The only personal data this website collects is what you choose to send us through the contact form, by email or on WhatsApp.

What we collect

Your name, the organisation you work for, your email address or phone number, and whatever you tell us about your operation and the problem you want solved.

Why

To answer your enquiry, arrange a briefing, prepare a proposal and, if we work together, to deliver and support the system. We also keep correspondence as a record of what was discussed and agreed.

Lawful basis

The Act requires a lawful basis for processing personal data. For enquiries we rely on our legitimate interest in responding to people who contact us, and on the steps needed to enter into a contract with you. Once we are working together, the contract itself is the basis.

How long

We keep enquiry correspondence for as long as needed to respond to you and, if we work together, for the life of the engagement and for the period afterwards that our business and legal records require. If you contact us and nothing comes of it, you can ask us to delete the correspondence at any time.

The systems we build for clients

Most of the personal data we touch belongs to the clients we build for, not to us. This is the most important section of this policy.

Controller and processor, in plain words

The Act distinguishes the data controller, who decides why and how personal data is processed, from the data processor, who processes it on the controller’s behalf. In the systems we build and operate, the client is the controller and we are the processor. The client decides what data is collected, for what purpose, who may see it and how long it is kept. We act on the client’s documented, written instructions and we do not use the data for our own purposes.

What those systems handle

Depending on the system, the following categories of personal data may be processed:

• Biometric data: facial recognition templates and face matching for access control, derived from CCTV.
• CCTV video and images of workers, visitors and vehicles at plants, gates and workshops.
• Location and telemetry: Bluetooth (BLE) tags on people and assets on site; vehicle GPS, driver behaviour and driver risk scores on the road.
• HR and payroll: clock-ins, hours worked, pay, tax, bank details and approvals, some of which arrive over WhatsApp.
• Customer communications: WhatsApp, email and SMS conversations handled by AI agents, and CRM records.
• Hospitality guest records: reservations, stays, folios and payments.
• Documents and invoices: business records that may contain personal data.
• Ordering and reseller data: customer orders, reseller identities, commissions and payouts.

Where it is held

Data stays in the client’s own environment or in a dedicated tenant set up for that client. Each client’s data is kept separate from every other client’s. Retention periods and access rules are agreed with the client in writing before a system goes live.

Whose notice applies

If you are an employee, visitor, driver, guest or customer of one of our clients, the client’s own privacy notice governs how your data is used. The client is responsible for telling you about the processing and, where the Act requires it, for obtaining your consent. If you send us a request about data in a client system, we will pass it to the client promptly and help the client respond; we cannot act on it independently, because the data is not ours to decide about.

South African clients

Where a client is subject to POPIA, we take on the role POPIA calls an operator, and the obligations POPIA places on operators are addressed in our data processing agreement with that client.

Sensitive data and biometrics

The Act treats certain categories of personal data as sensitive data and imposes stricter conditions on processing them. Biometric data, meaning data derived from a person’s physical characteristics that can identify them, is sensitive data under the Act, alongside genetic data, health data and other listed categories.

Some of the systems we build use facial recognition for access control. A facial recognition template is a mathematical representation of a face, used to match a person against a list of people permitted entry. It is not a photograph, but it is biometric data, and we treat it as sensitive.

These are the safeguards we practise:

• Templates are created, stored and matched only on the client’s written instruction and only for the access control purpose the client has defined.
• Templates are not used for any other purpose and are not shared with anyone outside the client’s system.
• Access to the templates and to the matching system is controlled and limited to the people who need it.
• Retention is agreed with the client in writing before the system goes live, and templates are deleted in line with that agreement.
• Templates live in the client’s environment or dedicated tenant, never in a pool shared between clients.

The client, as controller, is responsible for notifying the people whose faces are processed and, where the Act requires it, for obtaining their consent before enrolment. We advise clients on what the Act requires, but the decision to deploy facial recognition, and the duty to make it lawful, rests with the client.

Sharing and transfers outside Zimbabwe

We do not sell personal data. We do not share it with anyone for marketing. We do not share one client’s data with another client.

We share personal data only:

• with the client whose system it is, and the people the client authorises;
• with service providers who help us run our own business (for example hosting, email and messaging) or, as sub-processors, a client system, under written terms that require them to protect the data;
• where the law requires it, for example under a lawful order of a court or a regulator.

The Act restricts moving personal data out of Zimbabwe. This website is hosted outside Zimbabwe, and the email and messaging services we use to receive enquiries may hold copies of messages outside Zimbabwe. Where a client’s system or dedicated tenant is hosted outside Zimbabwe, that is done on the client’s written instruction; the client, as controller, remains responsible for ensuring the transfer is lawful under the Act, and we support the safeguards it chooses.

To operate our business and support our clients, we may transfer information to our distributed team members located in South Africa and Australia. We ensure these transfers comply with the Act by relying on the adequate statutory protections of those jurisdictions, such as POPIA in South Africa and the Privacy Act in Australia.

Security

We protect personal data with measures appropriate to its sensitivity. In general terms:

• Each client’s data is kept in its own environment or tenant, separated from other clients.
• Access is restricted to the people who need it for the work and is removed when it is no longer needed.
• This website is served over an encrypted connection.
• Retention and access rules for each client system are agreed in writing before go-live, and we operate to them.
• Service providers and sub-processors are engaged under written terms.

No system is perfectly secure. This describes what we do, not a guarantee, and we keep it under review as the systems and the threats to them change.

Your rights

Under the Act you have the right to:

• Access: ask whether we hold personal data about you and receive a copy of it.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have data deleted where there is no longer a lawful reason to keep it.
• Objection: object to processing, including any processing for direct marketing.
• Complaint: lodge a complaint with POTRAZ, as the Data Protection Authority, if you believe we have processed your data unlawfully.

While a dispute about your data is being resolved we will, on request, limit how it is used.

To exercise a right, email support@eigenstatesystems.com with enough detail for us to find the data and confirm your identity. We will acknowledge your request and respond without undue delay; if a request is complex we will tell you why we need longer. We do not charge for a request.

If your request concerns data in a client’s system, we will forward it to the client, who as controller must answer it, and we will assist the client in doing so.

If there is a data breach

A data breach is a security incident that leads to personal data being lost, altered, disclosed or accessed without authorisation. If we become aware of a breach affecting personal data we hold as controller, we will contain it, assess the risk to the people affected, notify POTRAZ where the Act requires, and tell the people affected where the risk to them warrants it.

If a breach affects a client system, we will notify the client without undue delay, give it the information it needs to meet its own obligations under the Act, and support its response. We record every breach and what we did about it.

Children

This website and our services are directed at businesses, not at children, and we do not knowingly collect personal data from children through this website. A client system such as CCTV or access control at a site may record anyone present, including children accompanying visitors. In those systems the client’s notice governs, and we process only on the client’s instruction.

Changes to this policy

We will update this policy when our practices or the law change. The current version is always at eigenstatesystems.com/privacy, and material changes will be noted here with the date they took effect.

This version is dated 13 September 2026.