Privacy Policy.

01Who we are and how to reach us

This policy is published by Corelink Consulting Ltd. (“Corelink”, “we”, “us”), a company registered in Zambia. Corelink Consulting Ltd. is also the developer name under which our applications are published on Google Play and the Apple App Store.

• Registered office: Ngwerema Road 5, Olympia Park, Lusaka, Zambia
• Also operating from: DMCC Business Centre, Dubai, United Arab Emirates; and Groningen, the Netherlands
• PACRA BRN: 120220026085  ·  TPIN: 2564304921  ·  D-U-N-S: 665257923  ·  UNGM: 1242403
• Privacy contact: privacy@corelink.co.zm
• General contact: info@corelink.co.zm  ·  +260 96 349 3849

Send any privacy question, request or complaint to the privacy address above, or by post to the registered office marked for the attention of the Privacy Contact. We answer every request, including requests to delete data — see section 12.

02What this policy covers

This policy covers our website at corelink.co.zm, the Corelink platform, and our mobile applications for Android and iOS. It sets each of them out separately, because they do not handle data in the same way.

Controller and processor — why the difference matters to you

For our own website and direct enquiries, Corelink is the data controller: we decide what we collect and why, and this policy governs it.

For the platform and the field applications, the organisation that licensed the software — your employer, your professional body, your fleet operator — is the data controller. They decide what is collected, for what purpose, and how long it is kept. Corelink is their processor: we act on their documented instructions under a written contract. Their own privacy notice governs your data and may give you more than this one does. Where a request concerns data held in their system, we pass it to them and support them in answering it.

For the EduRole student app, Corelink is neither — we are not in the data path at all. That is explained next.

03The EduRole student app

Each institution runs its own EduRole system on its own domain. When you choose your institution and sign in, the app opens an encrypted connection directly to that institution’s system. Your credentials are verified by them, and your results and records are served by them. Corelink does not sit in the middle of that connection and does not keep a copy.

What that means in practice

• We do not store your username, student number, password, results, transcripts, registration records, fee statements or any other academic data.
• Your academic records are held by, and remain under the control of, your institution. They are the data controller for them.
• The app stores a session token on your device so that you stay signed in. Signing out or uninstalling removes it. It never leaves your device except to authenticate you to your own institution.
• We may receive anonymous crash reports and app version information if the app fails, so that we can fix it. These contain neither your credentials nor your academic records.
• To access, correct or delete your academic records, contact your institution directly — they hold the data, not us. We can tell you who to write to if you are not sure.

Because EduRole does not give you an account with Corelink, there is no Corelink account to delete. Uninstalling the app removes everything the app holds. Deleting your institutional record is a matter for your institution.

04Data we handle, and why

The table below is the complete picture across our website, platform and applications. Not every row applies to every app — the EduRole student app is limited to the first row and to anonymous crash data, as set out in section 03.

We do not ask for, and our applications are not designed to collect, government identity numbers, health data, biometric templates, racial or ethnic origin, political opinions, religious belief, trade union membership or sexual orientation — unless a specific regulated deployment requires it, in which case the controlling organisation instructs us in writing and informs the people affected.

05Android permissions we ask for

We ask for a permission only when a feature you are using needs it, and we explain why at the moment we ask. If you decline, the rest of the app keeps working — you simply cannot use the feature that needed it. You can change your mind at any time in Android Settings → Apps → [the app] → Permissions.

The EduRole student app requests only internet access and, if you allow it, notifications. It does not request location, camera, photos, files or contacts.

06Prominent disclosure and consent

Before we request access to location, camera, photos or files, we show an in-app explanation that names the data, says what we will do with it, and asks you to agree — separately from the Android system permission dialog. We do this in the app itself, not only in this policy.

• Permissions are requested in context, at the point the feature needs them, never all at once on first launch.
• Background location is requested on its own, after foreground location, with its own explanation of why a trip log needs it.
• We use data only for the purpose we disclosed. If we ever want to use it for something else, we ask you again.
• We do not nag, mislead or design around a refusal. Declining is a real answer and we honour it.

07How we use data

We use the data described above to:

• sign you in and connect you to the right institution or organisation;
• deliver the features your organisation licensed — forms, approvals, inspections, tracking, records and reporting;
• synchronise work you did offline once you are back on a network;
• send notifications you have opted into;
• keep an audit trail, because regulated bodies are legally required to have one;
• protect accounts and systems against fraud, abuse and unauthorised access;
• diagnose crashes and fix defects;
• meet our legal, tax and regulatory obligations; and
• answer enquiries you send through the website.

Where the law requires a legal basis we rely on: performance of a contract; our legitimate interest in operating and securing our services; your consent, for optional permissions and marketing; and compliance with a legal obligation. Where we rely on consent, you may withdraw it at any time.

08Who we share data with

We share personal data only with the following categories of recipient, and only as far as each one needs it:

• Your institution or organisation. They are the controller of your records. For EduRole, your data goes to them and only them.
• Service providers acting for us, under contract and bound to confidentiality — cloud hosting and data centre operators, push notification delivery, mapping and geocoding, email and SMS gateways, payment processors, and crash diagnostics. They may process data only on our instructions.
• Professional advisers — auditors, lawyers and insurers, under a duty of confidence.
• Authorities, where we are required by law, court order or lawful regulatory request, or where it is necessary to protect the rights or safety of a person.
• An acquirer, if the business or part of it is sold or merged. We would notify affected people, and the data would remain subject to a policy no less protective than this one.

09What we never do

10How we protect data

We apply technical and organisational measures appropriate to the sensitivity of the data:

• traffic between the apps and our servers is encrypted in transit using TLS 1.2 or above;
• data at rest is encrypted on our hosted infrastructure;
• access is role-based and granted on least privilege, with multi-factor authentication for administrative access;
• every access to a record is written to an audit trail;
• credentials are never stored in plain text;
• devices enrolled in mobile device management can be locked, wiped remotely and restricted to kiosk mode if lost;
• we follow a secure development lifecycle with code review, dependency scanning and periodic security testing; and
• staff are bound by confidentiality obligations and trained on data protection.

If a breach occurs that is likely to put people at risk, we notify the affected controller without undue delay, and notify the Data Protection Commissioner and affected individuals where the law requires it.

11How long data is kept

We keep personal data no longer than we need it. For platform deployments the retention period is set by the controlling organisation in their contract; the figures below are our defaults.

12Deleting your account and your data

In the app

Where an app creates a Corelink-hosted account for you directly, you can delete it from Settings → Account → Delete account. Deleting the account deletes the associated personal data — it is not merely deactivated or hidden.

EduRole students

You do not have a Corelink account. Signing out or uninstalling the app removes the session token from your device, which is everything the app holds. Your academic record belongs to your institution — ask them directly if you want it changed or erased.

Accounts created by your employer or professional body

If your account was created for you by an organisation, that organisation is the controller and decides whether the underlying record can be deleted — they often have their own statutory duty to keep it. We pass your request to them within 5 working days, tell you who we sent it to, and act on their instruction.

What we may keep, and why

After deletion we may retain a minimal record where the law requires it — transaction and tax records, evidence needed to prevent fraud or abuse, and material we must preserve for a legal claim or a regulator. We also keep aggregated statistics that cannot identify you. Everything else goes.

13Children and students

Our applications are built for enrolled students, employees and members of the organisations that license them. They are not directed to children under 13, and we do not knowingly collect personal data from a child under 13 outside an institutional deployment.

Where an institution deploys a Corelink product to learners who are minors, that institution is the data controller. It is responsible for the lawful basis for processing, including obtaining parental or guardian consent where the law requires it, and we process only on its instructions. In the case of EduRole, the student’s data never reaches us at all.

If you believe a child has provided personal data to us directly, write to privacy@corelink.co.zm and we will delete it.

14Where data is processed

Corelink operates from Zambia, the United Arab Emirates and the Netherlands, and our platform is hosted in Zambian data centres and in cloud regions chosen with the controlling organisation. Support and engineering staff in any of our offices may access data where necessary to run and maintain a service.

Where data moves between countries we do so under contractual safeguards with each provider and each customer, and in line with the Zambia Data Protection Act and, where it applies, the GDPR. Many of our public-sector customers require data residency in Zambia, and those deployments are hosted accordingly.

15Your rights

Subject to the law that applies to you, you may ask us to:

• confirm whether we hold data about you, and give you a copy;
• correct data that is wrong or incomplete;
• delete data — see section 12;
• restrict or object to a particular use;
• provide your data in a portable, machine-readable form; and
• withdraw a consent you previously gave, without affecting what was lawful before you withdrew it.

Send requests to privacy@corelink.co.zm. We do not charge for this and we will not treat you differently for asking. If the data sits in a customer’s deployment, we route your request to that controller and tell you we have done so.

We are subject to the Data Protection Act No. 3 of 2021 of Zambia, and to the GDPR where we process data of people in the European Economic Area. If you are unhappy with our response you may complain to the Data Protection Commissioner in Zambia, or to your local supervisory authority in the EEA.

16Changes to this policy

We update this policy when our products or the law change. The effective date at the top of the page shows the current version. Where a change materially affects how we handle your data, we give notice in the app or by email before it takes effect, and where the law requires it we ask for your consent again.

17Contact

For anything in this policy — a question, a request, or a complaint — contact:

Privacy Contact, Corelink Consulting Ltd.
Ngwerema Road 5, Olympia Park, Lusaka, Zambia
privacy@corelink.co.zm
+260 96 349 3849

We aim to respond to every privacy enquiry within 5 working days.