Privacy Policy

Last updated: June 2026 | POTRAZ Cyber and Data Protection Act, 2021 compliant

1. Introduction

Back to Eden Health ("we," "us," "our") operates backtoedenhealth.co.zw (the "Website"). This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the Cyber and Data Protection Act [Chapter 12:07] of 2021 of Zimbabwe, as licensed and enforced by the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).

By using this Website, you consent to the data practices described in this policy. If you do not agree, please discontinue use of the Website.

2. Data Controller Information

Entity: Back to Eden Health Coach
Address: Karoi, Zimbabwe
Email: [email protected]
Website: backtoedenhealth.co.zw

3. Legal Basis for Processing (Section 5 of the Act)

Under Zimbabwe's Data Protection Act, we process personal data only when one or more of the following applies:

Consent: You have given clear, affirmative consent for a specific purpose (e.g., newsletter subscription)
Legitimate interest: Processing is necessary for our legitimate interests (responding to your inquiries) and does not override your privacy rights
Contractual necessity: Processing is necessary to fulfill a request you have made (e.g., processing a book order inquiry)

4. Personal Data We Collect

We practice data minimisation — we only collect what is strictly necessary:

4.1 Data You Provide Directly

Newsletter form: First name (optional), email address
Contact form: Name, email address, subject, message

4.2 Data Collected Automatically

Server logs: IP address, browser type, pages visited, date/time of visit, referring URL
This data is anonymised and used solely for Website security, performance monitoring, and aggregate analytics

4.3 What We Do NOT Collect

No financial or payment information
No health or medical information (no sensitive personal data)
No biometric or genetic data
No children's data (persons under 18)
No cookies for advertising or tracking
No third-party analytics trackers

5. Purpose of Processing

We use your personal data only for the specific, legitimate purposes for which it was collected:

Email newsletter: To send you health insights, recipes, and wellness guides you subscribed to
Inquiry responses: To reply to messages sent via our contact form
Website operation: To maintain security, prevent abuse, and ensure correct site function
Legal compliance: To meet obligations under Zimbabwean law

We never sell, rent, share, or trade your personal data with third parties for marketing or commercial purposes.

6. Data Storage and Security

As required by Section 8 of the Act (integrity and confidentiality), we implement appropriate technical and organisational security measures:

SSL/TLS encryption: All data transmitted between your browser and our server is encrypted via HTTPS
Minimal retention: We only retain personal data as long as necessary for the purpose it was collected, or as required by law
Server location: Our Website is hosted via Cloudflare (CDN) with global edge servers. Data may be processed at edge locations worldwide, but is not stored permanently on CDN caches
Access control: Only the data controller (Baba Fermi) has access to submitted personal data

7. Data Subject Rights (Section 6 of the Act)

Under Zimbabwe's Cyber and Data Protection Act, you have the following rights regarding your personal data:

Right of access: Request a copy of the personal data we hold about you
Right to rectification: Request correction of inaccurate or incomplete data
Right to erasure ("right to be forgotten"): Request deletion of your personal data
Right to object: Object to processing of your personal data at any time
Right to withdraw consent: Withdraw consent for newsletter or any processing at any time, without explanation
Right to data portability: Request your data in a structured, commonly used format
Right to lodge a complaint: Complain to POTRAZ if you believe your data rights have been violated

To exercise any of these rights, contact us at: [email protected]

8. Cross-Border Data Transfers

Our Website uses Cloudflare's global CDN for performance and security. This means data may transit through or be temporarily cached on servers outside Zimbabwe. In compliance with the Act:

We have assessed that Cloudflare provides adequate data protection safeguards
Cloudflare's DPA (Data Processing Addendum) ensures data is processed only on our instructions
No personal data is permanently stored outside our control

9. Data Breach Notification

In the event of a personal data breach, we will:

Notify POTRAZ within 24 hours of becoming aware of the breach (as required by the Act)
Notify affected individuals within 72 hours if the breach poses a high risk to your rights
Provide details of the breach, likely consequences, and measures taken to address it

10. Third-Party Services

This Website contains links to third-party services:

YouTube (youtube.com): Our embedded videos and channel links are subject to Google's Privacy Policy. We are not responsible for data collected by YouTube

We do not integrate any third-party advertising, analytics, or social media tracking scripts.

11. Cookies

This Website does not use:

Tracking cookies
Advertising cookies
Third-party analytics cookies (no Google Analytics, no Facebook Pixel)
Persistent session cookies

Cloudflare may set a strictly necessary security cookie (__cf_bm) for bot protection. This cookie does not track you and expires within 30 minutes.

12. Children's Privacy

This Website is not directed at children under 18 years of age. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Changes are effective when posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

14. Contact & Complaints

For any privacy-related questions, to exercise your data rights, or to request access to your data:

Email: [email protected]

If you are not satisfied with our response, you have the right to lodge a complaint with:

POTRAZ (Postal and Telecommunications Regulatory Authority of Zimbabwe)
Website: www.potraz.gov.zw