Legal
Privacy Policy
How Green Golden Leaf Tobacco collects, uses and protects your personal data.
1. Who We Are
Green Golden Leaf Tobacco (GGLT, “we”, “us”, “our”) is a data controller registered with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) under the Cyber and Data Protection Act [Chapter 12:07] (“the CDPA”). This policy explains how we collect, use, share and protect the personal data of the growers, employees, suppliers, visitors, job applicants and other data subjects we deal with.
2. Personal Data We Collect
What we collect depends on your relationship with us:
| Who You Are | What We Collect | Why |
|---|---|---|
| Website visitors | IP address, browser and device information, pages visited, date and time of visits, approximate location, and information you provide through website forms or other interactions | To operate, secure, maintain, and improve our website, understand how visitors use our website, respond to enquiries, and provide requested services or information |
| Visitors who contact us | Name, email address, telephone number, and any information you include in your enquiry or message | To respond to your enquiry, provide assistance, and communicate with you regarding your request |
| Website visitors who submit forms | Information entered into the relevant website form | To process and respond to your submission and provide the service or information requested |
3. International Transfers
We do not currently transfer personal data outside Zimbabwe, except where a service provider's hosting is confirmed to be located abroad, in which case we carry out an adequacy assessment in line with section 28 of the CDPA before doing so.
4. How Long We Keep Your Data
We keep personal data only as long as necessary for the purpose it was collected, as set out in our internal Data Retention & Disposal Policy:
| Records | Retention Period |
|---|---|
| Website Visitor | 1 year |
Unless a longer period is justified — for example, an ongoing legal or security matter.
5. How We Protect Your Data
We apply technical and organisational measures appropriate to the risk.
6. Your Rights
Under section 14 of the CDPA, you have the right to:
- be informed about how we use your personal data;
- access the personal data we hold about you;
- object to all or part of how we process your personal data;
- ask us to correct personal data about you that is false or misleading; and
- ask us to delete personal data about you that is false or misleading.
If you are unable to exercise these rights yourself due to incapacity, a parent, guardian, or someone designated by a court may exercise them on your behalf. To make a request, contact the DPO using the details in Section 10 — we aim to respond within 30 days, free of charge.
7. Contact Us / Complaints
Not satisfied with our response?
You may lodge a complaint with POTRAZ, Zimbabwe's Data Protection Authority, at regulator@potraz.zw or +263 242 333032/46/48.
8. Changes to This Policy
We may update this policy from time to time, for example if our processing activities change or the law is updated. The current version is always available from the DPO and, once published, on our website and notice board. We encourage you to check back periodically.
Prepared 31 July 2026.