Legal

Privacy notice

How Sanctuary Insurance Company collects, uses, protects and shares personal information, and the rights you hold under the Cyber and Data Protection Act.

Version 2, 2026

Introduction

Sanctuary Insurance Company is a Zimbabwean insurance underwriter duly registered by the Insurance and Pensions Commissions (IPEC), trading since 2011. Being an active member of the Insurance Council of Zimbabwe (ICZ) shows the company intends to abide by the ethics and basics of insurance practices in the country and to be compliant with all applicable local and international regulations.

This notice sets out the basis on which we collect and process your personal data through your use of our website, registration for events and/or signing up for services and other marketing activities. It also explains your privacy rights and how the law protects you. As governed by the Cyber and Data Protection Act [Chapter 12:07], (hereinafter “the Act”). By using our services, you agree to the terms of this Privacy Notice. Please read it carefully before you give us your personal information so that you understand how we handle your personal information. You have the right to decline providing your Personal Information; however, doing so may restrict our ability to deliver the products and services you require. We will only request Personal Information that is necessary and relevant to the services or products we offer.

What is personal information?

Personal information is any natural person’s information by which they can be identified. This includes but is not limited to; names, addresses, phone numbers, email addresses, identity number, fingerprints, blood type, physical/mental disability, individuals’ personal views/opinions, correspondence pertaining to home and family life, age, gender, race, colour, religious beliefs/affiliations, political opinions, marital status, professional associations, trade union membership, health care history, physical/mental disability, educational/financial/criminal or employment history, and genetic information.

To whom does the Notice apply?

This Privacy Notice applies to natural persons whose personal information is held by Sanctuary Insurance Company.

What Personal Information do we collect?

The personal information we may collect about you includes name, age, gender, contact numbers, national identity numbers, address, citizenship, date of birth, marital or family status, financial, criminal or employment history, online identifiers. If you submit any Personal Information on behalf of other people, then you must have their permission to do so in accordance with this Privacy Policy.

How do we collect your Personal Information?

We collect Personal Information directly from you or online when you engage with us or use our products and services. We also get your personal information from external third parties, such as when you provide us with the personal information of other people such as next of kin, dependents, beneficiaries, or business partners, you confirm that you have their permission, where applicable, to share this information with us for the purposes outlined in this Privacy Notice.

What we use your personal data for

Data protection legislation in Zimbabwe allows us to collect, use and store information if we have one or more of the following purposes for doing so:

To fulfil a contract with you; or
Where necessary to comply with a legal or regulatory obligation; or
Where necessary for our legitimate interests (provided your interests and fundamental rights do not override these interests); or
For other reasons where you have expressly consented to those purposes.

Below are the ways we will use your personal data to fulfil your contract and/or for our legitimate interests:

How we use your personal information

We may use your information to:

Send you information which you have requested and that may be of interest to you. These may include information about Sanctuary Insurance Company, products and services we offer, promotions of our company’s goods and services.
Send you administrative information such as notifying you of changes to our services, terms, conditions and policies.
To personalise your experience on the website by presenting products and offers tailored to you.
To seek your views or comments on the services we provide;

How do we share or disclose your personal information?

While processing personal information, Sanctuary Insurance Company may disclose certain personal information to both internal and external parties. Internally, personal information may be transferred between Sanctuary Insurance Company business units. Externally, personal information may be transferred to regulatory authorities, law enforcement agencies; service providers, and other third parties as may be required either contractually, by law, or by legitimate interest.

International transfer of Information

Any personal information you provide to Sanctuary Insurance Company, may only be transferred to and stored at a destination outside Zimbabwe, if it becomes necessary or unavoidable to do so as part of operational access to any data storage services (including cloud services) provided by a foreign data storage host. Before transferring the personal information for this purpose, Sanctuary Insurance Company is required to:

report to the Postal and Telecommunications Regulatory Authority of Zimbabwe (“POTRAZ”) on the measures taken to protect the data and submit any data hosting agreements before entering into an arrangement with the foreign data storage host;
ensure that the personal information is encrypted in such a way that it cannot be read by the foreign data storage host;
report to the Postal and Telecommunications Regulatory Authority of Zimbabwe (“POTRAZ”) on the steps taken to protect the data and to submit any data hosting agreements to it before entering the arrangement with the foreign data storage host;

Sanctuary Insurance Company is prohibited from selling, trading or sharing the transferred information.

Retention of your personal information

We will keep your personal information only for as long as we need it for lawful business purposes or as required by law. We will hold your personal information on our systems for as long as is necessary for the relevant activity, or if is set out in any relevant contract you hold with us. Thereafter we may keep it for longer to respond to any questions or complaints and to maintain necessary records to satisfy legal, accounting or reporting requirements. When the personal information is no longer required, we will dispose it in terms of our retention policy.

Measures in place to protect your personal information

We use appropriate technical, and organisational measures to safeguard your personal information from unauthorised access.

Data protection rights

Data protection is premised on the protection of the right to human dignity and privacy as enshrined in the Zimbabwean Constitution. Your data protection rights are:

Right to be informed: You have the right to be informed on the personal information that we collect, why we collect it, how it will be used and where it will be stored.
Right to give and withdraw consent: You have the right to agree to processing of your personal information and to withdraw the consent.
Right to access your personal information: You have the right to seek confirmation on the personal information that is being processed, to access the information and receive updates about the processing activities.
Right to object to processing of your personal information: You have the right to object to processing of your personal information for protecting your legitimate interest for pursuing our legitimate interest or that of a third party and we will no longer process your information
Right to correction/rectification of your personal information: You have the right to request rectification of inaccurate or incomplete personal information.
Right to deletion of your personal information: You have the right to request deletion of misleading information.
Rights related to automated processing: you have the right not to have automated decisions on your personal information.
Right to complain: You have the right to submit a complaint to the Data Protection Authority if you have any concerns on processing of your personal information.

How to exercise your rights

You can exercise any of your data protection rights to;

Access, correct, or delete your data unless the data is required by law.
Restrict processing or object to marketing.
Request data portability.
Withdraw consent.

Submit requests through the contact information indicated below and we will respond within 30 days.

How we use cookies.

Cookies are small pieces of text sent to your browser by a website you visit. They help our website remember information about your visit, which can both make it easier to visit the site again and make the site more useful to you.

Purposes of cookies

Functionality

Cookies and similar technologies used for functionality purposes allow you to access features that are fundamental to a service. These cookies are used in order to deliver and maintain site services.

Security

Our website uses cookies and similar technologies for security purposes to protect you as you interact with a service by authenticating users, protecting against spam, fraud and abuse, and tracking outages.

Analytics

Our website uses cookies and similar technologies for analytical purposes to understand how you interact with a particular service. These cookies and similar technologies help collect data that allows us to measure audience engagement and site statistics.

Advertising

Our website uses cookies for advertising purposes, including showing personalized advertisements (ads) , serving and rendering ads, and personalizing ads (depending on your chosen settings.

Personalization

Cookies and similar technologies are used for the purpose of showing personalized content. These cookies help enhance your experience on our website by providing personalized content and features, depending on your settings.

To protect the privacy of users and visitors to our website, they may choose whether to enable or disable such cookies during their site visit.

Privacy Notice Changes

We regularly review the Policy Notice and in the event of changes, the update version will be put on our website and other communication channels.

Contact us

If you have any questions, concerns, requests or complaints on handling of your personal information by Sanctuary Insurance Company, please contact the Data Protection Officer on +263 712 400 500 or send an email to dpo@sanctuary.co.zw. You can also visit our offices at 4 Fairman Close, Mt Pleasant, Harare.

If you are not satisfied with the way we handle your queries, concerns, requests or complaints you can contact the Data Protection Authority on their website at https://www.potraz.gov.zw; regulator@potraz.co.zw, or visit their offices at 1008 Performance Close, Mount Pleasant Business Park, Mount Pleasant, Harare.