Privacy policy
What we collect when you use this website, why, where it is kept, and how to ask us to change or delete it.
Last updated: 22 October 2026
1. Who we are
This website is run by Wave Cyber Security Limited ("Wave", "we", "us"), 745/100 Off Kabulonga Road, Ibex Hill, Lusaka, Zambia. We decide how and why the personal data described in this policy is used, so we are the data controller under the Data Protection Act, 2021 of Zambia.
For any question about this policy or your data, email info@wavecyber.co.zm.
2. What we collect and why
We only collect what we need. The website has no accounts, no payments, no newsletter and no advertising.
| Where | What | Why | Basis | Kept for |
|---|---|---|---|---|
| Contact form | Your name, email address, message and the topic you choose. Optionally your organisation and phone number. A record that you agreed, the policy version and the date and time. | To reply to your message. | Your consent, given by ticking the box on the form. | Up to 12 months, then we delete the email. Longer only if you become a client (then our client agreement applies) or if the law requires it. |
| Incident form | Your name, a phone number or email address (or both), how urgent it is, and your description. Optionally your organisation. The same consent record. | To respond to your report. | Your consent, given by ticking the box on the form. | Up to 12 months, then we delete the email, unless you become a client or the law requires us to keep it. |
| Email and phone | What you tell us and your contact details. | To deal with your enquiry. | Your request to us, and our legitimate interest in answering it. | As long as needed to deal with your enquiry, normally no more than 12 months, unless you become a client. |
| Website hosting | Your IP address and basic request details (page requested, browser type, time), processed by our hosting provider (Namecheap) to deliver the pages and keep the service secure. | To show you the website and protect it from abuse. | Our legitimate interest in running a secure website. | Held by the hosting provider under its own terms. We do not use these logs to identify or profile visitors. |
You do not have to give us any of this. If you would rather not use the forms, you can email or phone us instead.
3. What we do not do
- We do not sell your data or share it for advertising.
- We do not add you to a mailing list from a form submission.
- We do not use advertising or social media trackers. This site sets no cookies and loads no fonts, scripts or images from other companies.
- We do not make decisions about you by automated means.
- We do not ask for passwords, keys or other credentials in our forms.
4. Who we share data with
- Namecheap, our web hosting provider. It runs the server that delivers this website and passes what you send through the forms to our mailbox. It acts as our service provider and may only process the data on our behalf.
- Microsoft and Amazon Web Services (AWS). We may use servers and cloud services run by these companies, outside Zambia, to store and process the information you send us. They act as our service providers and may only process the data on our behalf.
- Professional advisers and authorities where we need advice, or where the law requires us to disclose information.
We do not share your data with anyone else unless you ask us to, or the law requires it.
5. Where your data is stored
When you use a form, the website sends your message by email to our mailbox. It does not keep a copy in a database or file on the web server. Our web hosting, and any mailbox it provides, are run by Namecheap on servers outside Zambia. The information we hold may also be stored or processed on other servers outside Zambia, including servers run by Microsoft and Amazon Web Services (AWS). The Data Protection Act, 2021 restricts storing and transferring personal data outside Zambia, so we ask for your consent to this on each form, and you can decline by using email or phone instead.
Email you send us is handled by our email provider, and phone calls by our telephone provider.
6. How long we keep data
We delete enquiry emails 12 months after we receive them, unless you have become a client or the law requires us to keep them. Other data is kept for the periods in the table above.
7. Your rights
Under the Data Protection Act, 2021 you have rights over your personal data, including to:
- be told whether we hold data about you, and why, and to get a copy of it;
- have inaccurate data corrected and incomplete data completed;
- have your data erased where we no longer need it, where you withdraw consent, or where you object on legitimate grounds;
- withdraw your consent at any time, which does not affect what we did before you withdrew it;
- not be subject to a decision made only by automated means (we make none).
To use any of these rights, email info@wavecyber.co.zm. We may need to check who you are before we act, so that we do not give your data to someone else. We aim to reply within 30 days.
8. How we protect your data
- The website is served over HTTPS only.
- The form script only sends an email. It has no database and stores nothing itself.
- Access to the mailbox is limited to named members of staff who need it.
- Form fields have length limits, and we collect no more than the fields listed above.
If a personal data breach affects you, we will tell the Data Protection Commissioner and the people affected as the law requires.
9. Children
This website is for organisations and is not aimed at anyone under 18. We do not knowingly collect data from children.
10. Complaints
Please contact us first so that we can try to put things right. You can also complain to the Office of the Data Protection Commissioner in Zambia.
11. Changes to this policy
If we change this policy in a way that matters to you, we will update the date at the top and, where the law requires, ask for your consent again. Earlier versions are available on request.