eToll Privacy Notice

1. Who this notice covers

This Notice applies to business Account contacts, administrators, drivers, employees, contractors, vehicle owners and other persons whose information is processed when a vehicle or Card uses the eToll platform in Zambia. It applies regardless of nationality or residence, including cross-border fleets travelling through Zambia.

2. Information we process

Depending on use, DCZ may process:

• Account information: business identity, contact details, authorised users, administrators and account settings.
• Vehicle and toll information: registration number, make, model, toll classification, Card identifier and status, toll point, date, time, amount and related journey or location inferences.
• Payment information: top-up, payment, refund, reversal, negative-balance and dispute records, together with payment references and status information supplied by banks or payment providers.
• Technical information: login, device, security, authentication, cookie and platform-use records.
• Support and fraud information: enquiries, complaints, fraud reports, evidence, investigation records and communications.
• AI information: eToll AI prompts, responses and related technical metadata where the feature is used.

3. Why and on what basis

DCZ processes information where necessary to perform or administer the eToll service and customer contract; comply with legal, tax, accounting and regulatory duties; pursue legitimate interests in securing the platform, preventing fraud, improving service and establishing or defending claims; and on consent or another lawful basis where the Data Protection Act, 2021 requires it. DCZ does not rely on consent where another lawful basis is more appropriate.

4. Sources, payment handling and sharing

Information may come from the Account Holder, authorised users, drivers, Cards and devices, Toll Operators, the National Road Fund Agency, payment providers, public authorities and fraud investigations. Payment providers may process payment credentials and supply DCZ with transaction references, status and reconciliation information. Users must enter payment credentials only through an approved payment interface and must not send full payment-card details through support, complaints, fraud reports or eToll AI.

DCZ may share relevant information with Amazon Web Services for infrastructure, hosting and email delivery; Africa's Talking for SMS notifications; Anthropic for eToll AI; NRFA and public-private toll operators for toll settlement; banks and payment providers; professional advisers; regulators; and law-enforcement authorities where necessary, lawful and proportionate.

5. International processing

The platform is hosted on AWS infrastructure in a region outside Zambia, and eToll AI interactions are processed internationally through Anthropic's Claude service. Accordingly, personal data is stored, transferred or accessed outside Zambia. DCZ obtains and maintains any authorisation required by the Data Protection Act, 2021 and applies appropriate processor contracts, transfer assessments, security measures and data-minimisation controls to that processing. Cross-border vehicle use does not remove protections that otherwise apply under Zambian law.

6. Retention

Financial and Transaction records are retained for 6 to 10 years where required for tax, corporate, accounting, audit, dispute and legal purposes. eToll AI interaction logs are retained for 12 months. Vehicle registration, toll-location, timestamp, support, fraud and security information is retained in accordance with DCZ's documented retention schedule: while needed to provide and secure the service, and thereafter only for an applicable statutory, fraud-prevention, complaint, audit or claims period. Closing an Account does not require immediate deletion where continued retention is necessary for one of those purposes. DCZ securely deletes or anonymises information when the applicable period expires.

7. Security

DCZ uses reasonable administrative, technical and organisational safeguards, including access controls, monitoring and Card controls. No system is completely secure. Account Holders must safeguard credentials, limit access and promptly report suspected compromise.

8. Your rights and how to exercise them

Subject to applicable law, a person may request access, correction, deletion or restriction; object to certain processing; withdraw consent where relied upon; request human review of a decision based solely on automated processing where the law provides that right; and complain to the Data Protection Commission. To exercise a right, email privacy@dotcomzambia.com and describe the request and the relevant Account, vehicle or interaction. DCZ may request information reasonably necessary to verify identity and authority before acting. DCZ will respond within the period required by applicable law. Some requests may be limited by another person's rights, fraud prevention, legal duties or the need to establish or defend claims.

9. AI, automated processing and cookies

eToll AI is powered by an Anthropic Claude Haiku-class model. Prompts, outputs and related logs are processed outside Zambia, retained for 12 months and are not used to train the underlying model. Users should not submit unnecessary personal, confidential or sensitive information. Unless DCZ expressly identifies and enables a transactional function, eToll AI provides informational assistance only. DCZ does not rely solely on eToll AI to make a decision producing legal or similarly significant effects. DCZ may use cookies or similar technologies that are necessary to operate, secure and authenticate the platform. DCZ will not activate non-essential analytics or cookies unless it first provides an appropriate notice and obtains consent where required.

10. Contact