Customer Consent and Privacy Notice

Introduction

ACE Student Recruitment is committed to protecting the privacy, confidentiality and security of the personal information entrusted to it by prospective students, applicants, current students, parents, guardians, sponsors and other persons who use or interact with its services. This Customer Consent and Privacy Notice explains how ACE Student Recruitment collects, uses, stores, shares, transfers, protects and disposes of personal information in the course of providing student recruitment, education consultancy and related support services.

This Notice is intended to ensure that every data subject understands how their personal information will be handled and the purposes for which it may be processed. ACE Student Recruitment seeks to process personal information fairly, lawfully, transparently and only to the extent necessary for the provision of its services. ACE Student Recruitment operates in accordance with the Cyber and Data Protection Act [Chapter 12:07], Statutory Instrument 155 of 2024 and applicable guidance issued by the Data Protection Authority through POTRAZ. The Regulations require ACCE as data controllers to implement appropriate technical and organisational safeguards and to remain accountable for the manner in which personal information is processed.

About ACE Student Recruitment

ACE Student Recruitment is an education consultancy and student recruitment organisation that assists prospective students with education counselling, university and college selection, programme guidance, application processing, admissions support, enrolment assistance and related pre-departure services. In carrying out these activities, ACE Student Recruitment processes personal information belonging to students and other individuals connected to the application process.

Personal Information We Collect

ACE Student Recruitment may collect personal information directly from the data subject, from a parent or guardian where appropriate, from a sponsor, or from information supplied for the purpose of an application. The information collected may include a person’s full name, date of birth, gender, nationality, residential or postal address, telephone number, email address, National Identity information, passport information, passport photographs, academic qualifications, examination results, certificates, transcripts, educational history, employment history where applicable, preferred programme, preferred institution, study destination, sponsorship information and other details reasonably required for a student application.

Where a parent, guardian or sponsor is involved in the application process, ACE Student Recruitment may also collect their name, relationship to the student, telephone number, email address, residential or contact address, identification details and financial or sponsorship information where required. ACE Student Recruitment does not ordinarily collect or process medical reports, medical certificates, police-clearance certificates or criminal records as part of its normal student recruitment activities.

Purpose for Collecting Personal Information

ACE Student Recruitment collects and processes personal information for legitimate education consultancy and student recruitment purposes. Personal information may be used to assess whether a student meets the entry requirements for a programme or institution, provide counselling and programme guidance, prepare and submit university or college applications, communicate with educational institutions, respond to admissions queries, follow up on applications, manage offers, assist with enrolment, maintain student records and provide pre-departure or related support. Personal information may also be used for administrative purposes, including communicating with the applicant, maintaining internal records, responding to enquiries, monitoring the progress of applications, managing the relationship between ACE Student Recruitment and partner institutions and complying with applicable legal or regulatory obligations. ACE Student Recruitment shall not use personal information for purposes that are materially unrelated to the reason for which it was originally collected unless there is a lawful basis to do so and the data subject is appropriately informed.

Consent to Processing

By providing personal information to ACE Student Recruitment for the purpose of receiving student recruitment or education consultancy services, the data subject acknowledges and consents to the processing of that information for the purposes explained in this Notice. Consent may include permission for ACE Student Recruitment to collect, record, organise, store, retrieve, use, disclose, transmit and otherwise process personal information where such processing is reasonably necessary to provide the requested service.

Where consent is relied upon as the lawful basis for processing, ACE Student Recruitment shall seek to ensure that the data subject understands the nature and purpose of the processing before providing consent. The data subject may withdraw consent where the processing is based solely on consent. However, withdrawal of consent may affect ACE Student Recruitment’s ability to continue providing some services where the relevant information is necessary to process an application or communicate with an institution.

Lawful Grounds for Processing

ACE Student Recruitment may process personal information on the basis of the data subject’s consent, contractual necessity, compliance with legal obligations or legitimate interests connected with the operation of the organisation. Where an applicant instructs ACE Student Recruitment to submit an application to an educational institution, the processing of relevant personal information may be necessary to take steps requested by the applicant or to perform the agreed service. Where information must be processed or disclosed to comply with a legal or regulatory requirement, ACE Student Recruitment may process the information on the basis of a legal obligation.

Sharing Personal Information

ACE Student Recruitment may share personal information with universities, colleges, admissions departments, authorised education partners and other institutions involved in processing the applicant’s admission. The organisation may also disclose information to relevant government authorities, regulatory bodies, professional advisers or service providers where this is necessary to provide the requested service or comply with applicable legal obligations. ACE Student Recruitment shall seek to disclose only the information reasonably necessary for the relevant purpose. Personal information shall not be sold or disclosed to unrelated third parties for purposes that are inconsistent with the purpose for which it was collected.

International and Cross-Border Transfers

ACE Student Recruitment assists students with applications to educational institutions located outside Zimbabwe. As a result, personal information may need to be transferred from Zimbabwe to universities, colleges or authorised education partners in foreign countries. Depending on the applicant’s selected destination, information may be transferred to institutions in countries including Malaysia, Mauritius, the United Arab Emirates, the United Kingdom, Canada, India, Poland and other destinations selected by the applicant.

The guidance also recognises that cloud storage may constitute an international transfer where the relevant infrastructure is located or accessible outside Zimbabwe. ACE Student Recruitment shall take reasonable steps to ensure that international transfers are made only for legitimate and necessary purposes and in accordance with applicable data protection requirements.

Consent to Cross-Border Transfer

Where personal information must be transferred outside Zimbabwe for the purpose of submitting or processing an application, the data subject acknowledges that such transfer may be necessary to perform the requested service. Where required, ACE Student Recruitment shall inform the data subject of the intended transfer, the purpose of the transfer, the relevant destination and the receiving institution. By signing the consent section of this Notice, the applicant authorises ACE Student Recruitment to transmit relevant personal information to overseas institutions for the purpose of processing the applicant’s education application.

Cloud Storage and Electronic Records

ACE Student Recruitment stores student information and documents electronically in a secured Google Drive environment that is accessible only to authorised personnel. Reasonable access controls are maintained to reduce the risk of unauthorised access, use, alteration, disclosure or loss. Employees and authorised personnel are expected to access student information only where required for their duties. Personal information shall not be copied or stored in unauthorised personal accounts or locations.

Physical Document Security

Where ACE Student Recruitment receives physical documents such as passports, application forms, certificates or other personal records, these documents shall be handled with care and kept in secure lockable cabinets. Access to such documents shall be limited to authorised personnel who require the information for application processing or administrative purposes. Documents containing personal information shall not be left unattended in locations accessible to unauthorised persons.

Data Security

ACE Student Recruitment takes reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, accidental loss, theft, alteration, misuse or destruction. These measures include restricted access to electronic records, password-protected accounts, controlled access to Google Drive, secure storage of physical records, careful handling of personal information and limiting access to staff whose duties require such access as stipulated in Statutory Instrument 155 of 2024.

Confidentiality

ACE Student Recruitment requires all staff and authorised personnel to maintain the confidentiality of personal information obtained through the course of their duties. Personal information shall not be disclosed to friends, family members, unauthorised employees or external persons without a legitimate purpose or lawful basis. The duty of confidentiality continues even after a staff member or authorised person ceases to work with ACE Student Recruitment.

Accuracy of Information

Applicants are responsible for providing accurate, complete and current information when using ACE Student Recruitment’s services. Where the data subject becomes aware that information held by ACE Student Recruitment is inaccurate or outdated, the individual should inform ACE Student Recruitment so that the record can be corrected where appropriate. ACE Student Recruitment shall take reasonable steps to maintain accurate records where the information is being actively used.

Data Retention

ACE Student Recruitment shall retain personal information only for as long as it remains reasonably necessary for the purpose for which it was collected, for legitimate administrative purposes or where retention is required by law, contract or regulation. Active student records may be retained throughout the application and admission process. Where an application has been completed, withdrawn or discontinued, the information shall be retained in accordance with ACE Student Recruitment’s Data Retention Policy. When personal information is no longer required and there is no lawful or legitimate reason for continued retention, electronic records shall be securely deleted and physical records shall be securely destroyed. POTRAZ’s cross-border guidance specifically states that organisations should ensure that personal information transferred to external processors is not retained for longer than necessary.

Rights of the Data Subject

ACE Student Recruitment recognises the rights of individuals in relation to their personal information. Subject to applicable law, an individual may request information regarding the personal data held about them, request correction of inaccurate or incomplete information, raise an objection or concern regarding the processing of their information, request deletion where there is no lawful reason for continued retention, or withdraw consent where processing is based on consent. ACE Student Recruitment shall consider such requests in good faith and respond in accordance with applicable data protection requirements. The Regulations require data controllers to put measures in place that facilitate the exercise of the rights of data subjects.

Children and Applicants Under the Age of Majority

Where ACE Student Recruitment processes personal information relating to a child or minor, the organisation shall take additional care to protect that information. Where required, consent shall be obtained from a parent or legal guardian before personal information belonging to a child is processed. The Regulations require data controllers processing children’s personal information to make reasonable efforts to verify parental or guardian consent and to give particular attention to privacy risks and data protection principles when processing children’s information.

Marketing and Communication

ACE Student Recruitment may communicate with applicants regarding their applications, available programmes, admissions updates, educational opportunities, institutional events, education fairs and other information reasonably connected to its services. Where marketing communications are based on consent, the recipient may request that such communications be stopped. A request to stop optional marketing communication shall not affect necessary communications relating to an active application, admission process or service requested by the applicant.

Communication Consent

By providing their contact details to ACE Student Recruitment, clients consent to being contacted regarding their enquiries, applications, admissions, university updates, document requirements, appointments and other services relevant to their study-abroad process. ACE Student Recruitment may communicate with clients through telephone calls, WhatsApp messages and email, using the contact details provided by the client.

Such communication may include application updates, reminders, requests for documents, university information, intake updates, event invitations and other information directly related to ACE Student Recruitment’s services. Clients may request that optional promotional communications be stopped at any time. However, ACE Student Recruitment may continue to send necessary communications relating to an active application, enquiry or service being provided.

Data Breaches

ACE Student Recruitment shall take reasonable measures to prevent and respond to personal data breaches. Any suspected loss, unauthorised access, unauthorised disclosure, theft or misuse of personal information shall be reported internally and assessed promptly. Where a personal data breach occurs, ACE Student Recruitment shall take appropriate steps to contain the incident, investigate its cause, limit possible harm and comply with applicable notification requirements. Statutory Instrument 155 of 2024 requires data controllers to report qualifying personal data breaches to the Data Protection Authority within 24 hours of becoming aware of the breach and, where the breach is likely to result in high risk to individuals, to inform affected data subjects within 72 hours.

Responsibilities of the Applicant

Applicants should take reasonable precautions when providing personal information to ACE Student Recruitment. Applicants should ensure that documents submitted are accurate and genuinely belong to them or that they are authorised to provide the documents. Applicants should promptly notify ACE Student Recruitment where their contact details, passport information, academic information or other relevant details change during an active application. Applicants should also avoid unnecessarily sharing account passwords, PINs or other confidential authentication information unless specifically required and handled through an appropriate authorised process.

Changes to this Privacy Notice

ACE Student Recruitment may review or amend this Customer Consent and Privacy Notice from time to time to reflect changes in legislation, regulatory guidance, technology, operational practices or the organisation’s processing activities. Where changes materially affect the way personal information is processed, reasonable steps shall be taken to communicate the relevant changes to affected individuals.