PRIVACY POLICY

Effective date: 15 September 2026

Puku Solutions (referred to as “Puku Solutions”, “we”, “us” or “our”) respects privacy and is committed to handling personal data responsibly, lawfully and securely. This Privacy Policy explains how we collect, use, store, share and protect personal data when you visit our website, submit an enquiry, apply for a vacancy, register for training or events, engage us for professional services, or otherwise interact with us.

This Policy is designed with reference to the Data Protection Act No. 3 of 2021 of Zambia, the Data Protection (General) Regulations, 2024, applicable registration and licensing requirements, and other applicable Zambian laws governing electronic communications and transactions.

1. Who we are

Puku Solutions is a Zambia-based human resource and management consulting business providing services that may include HR and general consultancy, outsourced HR and payroll support, recruitment and selection, workforce solutions, skills development and training, coaching and mentorship, wellness services, job evaluation, HR audits, immigration support and related professional services.

Website: www.pukusolutions.com
Privacy contact: enquiries@pukusolutions.com
Location: Lusaka, Zambia

2. Scope of this Policy

This Policy applies to personal data processed through our website and digital channels, and to personal data we receive in connection with enquiries, recruitment, training, consulting assignments, client engagements and other business relationships. Separate or supplementary notices may apply to employees, contractors, clients, candidates, event participants or other specific categories where appropriate.

3. Personal data we may collect

Depending on how you interact with us, we may collect the following categories of information:

• Identity and contact information, such as name, title, organisation, postal or physical address, email address, telephone number and other contact details.
• Recruitment and career information, such as curriculum vitae, employment history, qualifications, professional memberships, references, salary expectations and information supplied in job applications.
• Client and service information, including instructions, contracts, correspondence, meeting notes, project records, HR records supplied by clients, payroll-related information and other information necessary to deliver agreed services.
• Training, coaching, mentorship and event information, including registration details, attendance records, assessments, feedback and certification information.
• Financial and transaction information, such as invoicing details, payment references and records needed for accounting or contract administration. We do not intentionally request full payment-card details through ordinary website enquiry forms.
• Technical and usage information, such as IP address, browser type, device information, referring pages, pages visited, date/time information and cookie or similar-technology data, where enabled.
• Communications and preferences, including enquiries, complaints, survey responses, consent records and marketing preferences.
• Sensitive personal data where it is genuinely necessary and lawful to process it for a specific service, legal obligation, recruitment process, wellness engagement or client instruction. We seek to limit collection of sensitive data to what is necessary.

4. How we collect personal data

• Directly from you when you complete a form, send us an email or message, register for a service or event, submit a CV, enter into a contract, or communicate with us.
• From a client, employer, prospective employer, referee, training sponsor or other person who is authorised or lawfully permitted to provide the information.
• From publicly available and professional sources, where lawful and relevant to our services.
• Automatically through website technologies such as server logs, cookies or similar technologies, subject to applicable consent requirements.
• From service providers that support our website, communications, recruitment, learning, payment, hosting, analytics or business operations, where permitted by law.

5. Purposes and lawful bases for processing

We process personal data only where we have a lawful basis. Depending on the circumstances, the basis may include consent, performance of a contract, steps taken at your request before entering into a contract, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest where applicable, or our legitimate interests where those interests are not overridden by your rights and freedoms.

We may use personal data to:

• Respond to enquiries, prepare proposals and manage prospective client relationships.
• Provide, administer and improve our HR, recruitment, training, coaching, wellness, consulting, workforce and related services.
• Manage recruitment processes, candidate databases, interviews, assessments, references and placement activities.
• Administer contracts, invoicing, payments, accounting, audits, quality management and internal business operations.
• Operate, secure, troubleshoot and improve our website and digital services.
• Communicate service updates, invitations, thought leadership or marketing information where lawful, and honour opt-out requests.
• Comply with statutory, regulatory, professional, contractual, audit, tax, employment and legal obligations.
• Prevent or investigate fraud, misuse, security incidents, legal claims or other unlawful activity.
• Establish, exercise or defend legal rights and protect Puku Solutions, our clients, staff, users and other persons.

6. Recruitment and candidate information

Where you apply for a job or submit a CV to Puku Solutions, we may process your information for recruitment, talent-pool, client-placement or related professional purposes. Where Puku Solutions acts for a client in a recruitment process, relevant candidate information may be shared with that client or authorised assessment/service providers. We will seek to use only information reasonably relevant to the recruitment or placement purpose.

Submitting a CV does not guarantee an interview, placement or employment. Puku Solutions may verify information supplied by a candidate, including qualifications, references and professional history, where lawful and appropriate.

7. Client data and our role as controller or processor

In some engagements Puku Solutions determines why and how personal data is processed and therefore acts as a data controller. In other engagements, particularly outsourced HR, payroll, recruitment administration or similar services, we may process personal data on documented instructions from a client and act as a data processor. Where required, the parties will enter into a written data-processing arrangement that addresses the nature, purpose, duration and safeguards applicable to the processing.

8. Sharing and disclosure of personal data

We do not sell personal data. We may disclose personal data only where lawful and reasonably necessary, including to:

• Clients, prospective employers or authorised counterparties where disclosure is part of an agreed recruitment or professional service and the individual has been appropriately informed or another lawful basis applies.
• Website hosts, cloud service providers, software vendors, communications providers, professional advisers, trainers, assessors, consultants and other suppliers that support our operations and are subject to appropriate obligations.
• Banks, payment providers, auditors, insurers, legal advisers or professional bodies where necessary.
• Regulators, courts, law-enforcement bodies, public authorities or other persons where disclosure is required or permitted by law.
• A buyer, investor, financier or successor in connection with a genuine restructuring, merger, acquisition, financing or transfer of all or part of our business, subject to appropriate confidentiality and legal safeguards.

Where the law requires consent or prior notice before a disclosure, we will take the steps required by law.

9. International transfers and storage

Some technology or service providers may store, access or process information outside Zambia. Where personal data is transferred or stored outside Zambia, Puku Solutions will take steps required by applicable law, which may include obtaining regulatory authorisation, using appropriate contractual safeguards, confirming an adequate level of protection, obtaining consent where appropriate, or applying another lawful transfer mechanism. We will not intentionally make a cross-border transfer in circumstances prohibited by applicable law.

10. Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to meet contractual and professional obligations, to comply with legal, tax, audit or regulatory requirements, or to establish, exercise or defend legal claims. Retention periods vary by record type. When information is no longer required, we will take reasonable steps to delete, anonymise, archive or securely dispose of it in accordance with our retention practices and applicable law.

11. Security of personal data

We use reasonable and proportionate administrative, technical and organisational safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access or other misuse. Measures may include access controls, role-based permissions, password practices, secure hosting, backups, confidentiality commitments, staff awareness and supplier controls, depending on the nature of the processing.

No website, email, internet transmission or storage system can be guaranteed to be completely secure. Accordingly, while we take reasonable steps to protect personal data, we cannot guarantee absolute security. You are responsible for using secure devices, safeguarding passwords and avoiding transmission of unnecessary sensitive information through unsecured channels.

12. Data breaches

Where we become aware of a personal-data security breach, we will assess and respond to the incident and, where required by applicable law, notify the Data Protection Commission and/or affected individuals within the legally applicable timeframe. Our response may include containment, investigation, remediation, risk assessment and steps to reduce recurrence.

13. Your rights

Subject to applicable law and any lawful exemptions, you may have rights concerning your personal data, including the right to:

• Be informed about the collection and use of your personal data.
• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete information.
• Object to or request restriction of certain processing.
• Withdraw consent where processing is based on consent, without affecting the lawfulness of prior processing.
• Request erasure where the legal conditions for erasure are met.
• Request data portability where applicable.
• Object to certain direct marketing communications.
• Seek protection from certain solely automated decisions where applicable.
• Lodge a complaint with the Data Protection Commission or pursue another remedy available under law.

To exercise a right, contact enquiries@pukusolutions.com. We may need to verify your identity and may request additional information reasonably necessary to process the request. Rights are not absolute and may be limited where the law permits or requires continued processing.

14. Direct marketing

We may send information about Puku Solutions services, events, publications or opportunities where permitted by law. Where consent is required, we will seek it. You may opt out of electronic marketing at any time using the unsubscribe mechanism provided in the message, where available, or by contacting enquiries@pukusolutions.com. Service, contractual, legal or administrative messages are not marketing and may still be sent where necessary.

15. Cookies and similar technologies

Our website may use cookies and similar technologies. Essential cookies may be used where necessary to operate, secure or deliver the website. Non-essential analytics, functionality or advertising cookies should be used only in accordance with applicable consent requirements. Please see the Cookies Policy in this document for further information.

16. Third-party websites and services

Our website may contain links to websites, platforms or services operated by third parties. Those third parties are responsible for their own privacy practices. Puku Solutions does not control and is not responsible for the privacy, security, availability or content of external websites merely because we provide a link. You should review the privacy notices of third parties before providing personal data to them.

17. Children

Our general website and professional services are not directed at children. We do not knowingly seek to collect personal data from children through general website enquiry forms without appropriate authority. Where a specific service lawfully involves children or learners, we will apply additional safeguards and obtain consent or authorisation from a parent, guardian, school, sponsor or other authorised person where required by law.

18. Accuracy of information supplied to us

You should provide accurate and up-to-date information and should not provide personal data about another person unless you are authorised or otherwise lawfully permitted to do so. If information you have provided changes, please notify us where the change is relevant to an ongoing relationship or service.

19. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time to reflect changes in law, guidance, technology, our services or our processing practices. The updated version will be posted on our website with a revised effective date. Material changes may also be communicated through other appropriate channels. Continued use of the website after an update does not waive any consent requirement imposed by law.

20. Governing law and complaints

This Privacy Policy is governed by the laws of the Republic of Zambia, without limiting any mandatory rights that may apply to an individual under another applicable law. If you have a concern about our handling of personal data, please contact us first at enquiries@pukusolutions.com so that we can investigate and respond. You may also lodge a complaint with the Data Protection Commission of Zambia or another competent authority where applicable.

21. Legal status of this Policy

This Privacy Policy is a transparency notice describing our privacy practices. It does not create contractual rights beyond rights that arise under a contract or applicable law, and it does not limit or exclude any responsibility that cannot lawfully be limited or excluded.

22. Contact us

For privacy questions, requests or complaints, contact:
Puku Solutions
Email: enquiries@pukusolutions.com
Website: www.pukusolutions.com
Location: Lusaka, Zambia