Privacy Policy
Effective Date: 1 April 2025
Last Updated: 30 March 2026
Version: 1.1
This Privacy Policy explains how Tashapa Consultancy (Private) Limited (“Tashapa”, “we”, “us” or “our”) collects, uses and protects personal data when you visit our website (www.tashapaconsultancy.com), engage our services, or communicate with us. By using our website, you acknowledge you have read and understood this policy.
Contents
- Who We Are
- Information We Collect
- How We Use Your Information
- Legal Bases for Processing
- Cookies & Tracking Technologies
- Third-Party Services
- International Transfers
- Data Retention
- Your Rights
- Security
- Children’s Privacy
- Changes to This Policy
- Contact Us
1
Who We Are
Tashapa Consultancy (Private) Limited is a sustainability consultancy registered in Zimbabwe (Registration No. 79587A0212026). Our registered office is at 2812 Lavenham Road, Bluff Hill, Harare, Zimbabwe.
We provide sustainability awareness training, sustainability reporting training, climate finance advisory, environmental management consulting, and Net Zero / Science-Based Targets (SBT) strategy services to organisations across Zimbabwe, Southern Africa, and internationally.
For the purposes of applicable data protection law, Tashapa Consultancy (Private) Limited is the data controller in respect of personal data processed through this website.
2
Information We Collect
2.1 Information You Provide Directly
- Contact and enquiry data, name, email address, telephone number, job title, organisation name, and the content of your message when you submit a contact form, book a consultation, or email us.
- Lead magnet / download requests, name and email address when you request a guide, assessment, or training resource.
- Training and event registration, name, organisation, job role, and payment details (processed via our third-party payment provider) when you register for a paid training programme.
- WhatsApp communications, when you contact us via the “Click to WhatsApp” button, your WhatsApp profile name, phone number, and the content of your messages.
2.2 Information Collected Automatically
- Usage data, pages visited, time spent on each page, links clicked, scroll depth, referral source, and browser navigation behaviour.
- Device & technical data, IP address (anonymised where required), browser type and version, operating system, screen resolution, and device type.
- Heatmap & session recording data, aggregated mouse movement, clicks, and scrolling behaviour collected by Microsoft Clarity. No keystrokes or personally identifiable data are recorded.
- Cookie data, as described in Section 5 below.
2.3 Information From Third Parties
We may receive information about you from publicly available sources (e.g. LinkedIn), event co-organisers, or referral partners when introduced to you in a professional context. This data is used solely to facilitate the relevant professional relationship.
3
How We Use Your Information
- Responding to enquiries and bookings, to reply to messages, provide consultation quotations, and arrange meetings.
- Delivering services, to provide training, advisory, and consulting services you have engaged us for.
- Sending requested resources, to deliver downloadable guides, assessments, and training materials.
- Marketing communications, to send sustainability insights, event invitations, and service news where you have opted in or where we have a legitimate interest. You may unsubscribe at any time.
- Website analytics and improvement, to understand how visitors use our website and improve content and user experience.
- Security and fraud prevention, to detect and prevent abusive or fraudulent use of our website.
- Legal compliance, to meet our obligations under applicable law, including tax, regulatory, and anti-corruption requirements.
4
Legal Bases for Processing
Where data protection legislation requiring a legal basis applies (including the EU GDPR and equivalent laws), we rely on the following legal bases:
- Contractual necessity, processing is necessary to perform a contract with you or take pre-contractual steps at your request.
- Legitimate interests, processing is necessary for our legitimate interests (improving our website, analysing usage, sending relevant professional communications, fraud prevention), provided those interests are not overridden by your rights.
- Consent, for non-essential cookies or marketing emails where required. You may withdraw consent at any time without affecting the lawfulness of prior processing.
- Legal obligation, processing required to comply with applicable law.
5
Cookies & Tracking Technologies
Our website uses cookies and similar tracking technologies to function correctly and to help us understand how visitors use it. A cookie is a small text file stored on your device by your browser.
5.1 Types of Cookie We Use
- Strictly Necessary, essential for the website to function. Cannot be switched off.
- Functional, enable enhanced functionality such as the WhatsApp widget.
- Analytics / Performance, help us understand visitor behaviour and improve the site. Placed only with your consent.
- Marketing, may be set by third-party services to build a profile of your interests. Placed only with your consent.
5.2 Cookie Table
| Cookie / Technology | Provider | Category | Name(s) | Purpose | Duration | Data Sent To |
|---|---|---|---|---|---|---|
| Google Analytics (GA4) | ||||||
| _ga | Google LLC | Analytics | _ga | Distinguishes unique users by assigning a randomly generated client ID. Enables Google Analytics to calculate visits, sessions, and user counts. | 2 years | Google (USA) |
| _ga_<id> | Google LLC | Analytics | _ga_XXXXXXXX | Stores and updates a unique value for each page visited. Maintains session state across GA4 measurement. | 2 years | Google (USA) |
| _gid | Google LLC | Analytics | _gid | Assigns a unique ID to each visitor to count how many times they visit the site in a 24-hour period. | 24 hours | Google (USA) |
| _gat | Google LLC | Performance | _gat | Throttles the rate of requests to Google Analytics servers under high-traffic conditions. | 1 minute | Google (USA) |
| _gcl_au | Google LLC | Marketing | _gcl_au | Used by Google AdSense for advertising efficiency experiments and conversion tracking. | 3 months | Google (USA) |
| Microsoft Clarity | ||||||
| _clck | Microsoft | Analytics | _clck | Persists the Clarity User ID so it is preserved when the user navigates across subdomains. Enables user journey stitching. | 1 year | Microsoft (USA) |
| _clsk | Microsoft | Analytics | _clsk | Connects multiple page views by a user into a single Clarity session recording. | 1 day | Microsoft (USA) |
| CLID | Microsoft | Analytics | CLID | Identifies the first time Clarity saw this user on any site using Clarity, enabling cross-site visit deduplication. | 1 year | Microsoft (USA) |
| ANONCHK | Microsoft | Analytics | ANONCHK | Checks whether click-stream data is stored in anonymous or authenticated mode. Clarity respects browser “Do Not Track” signals. | 10 minutes | Microsoft (USA) |
| SM | Microsoft | Analytics | SM | Registers a unique ID to track users across Microsoft domains, used with Clarity to identify returning visitors. | Session | Microsoft (USA) |
| MR | Microsoft | Performance | MR | Tracks whether to renew the MUID cookie. Contains no personally identifiable information. | 7 days | Microsoft (USA) |
| MUID | Microsoft | Analytics | MUID | Identifies unique web browsers visiting Microsoft sites. Used across the Microsoft advertising and analytics ecosystem. | 390 days | Microsoft (USA) |
| Click to WhatsApp / Meta | ||||||
| WhatsApp redirect | Meta Platforms | Functional | N/A (URL redirect) | The “Click to WhatsApp” button opens a WhatsApp conversation via the wa.me link scheme. No cookie is set on our domain. Meta’s own privacy policy governs data collection from that point. | N/A | Meta / WhatsApp |
| _fbp | Meta Platforms | Marketing | _fbp | If a Meta Pixel is installed, identifies browsers and tracks interactions across Meta products. Only active if Meta Pixel is enabled. | 3 months | Meta (USA) |
| fr | Meta Platforms | Marketing | fr | Used by Meta to deliver, measure, and improve the relevance of ads. Only active if Meta Pixel is enabled. | 3 months | Meta (USA) |
| Essential & Functional (Website Operation) | ||||||
| Cookie Consent | Tashapa Consultancy | Strictly Necessary | cookieconsent_status | Stores your cookie consent preferences so the banner does not appear on every page visit. | 1 year | Our servers (ZW) |
| Session Cookie | Tashapa Consultancy | Strictly Necessary | PHPSESSID | Maintains your session state while navigating the website. Deleted when you close your browser. | Session | Our servers (ZW) |
| CSRF Token | Tashapa Consultancy | Strictly Necessary | _csrf_token | Protects forms against Cross-Site Request Forgery attacks. Required for secure form submissions. | Session | Our servers (ZW) |
5.3 Managing Your Cookie Preferences
When you first visit our website a cookie consent banner will ask for your preferences. You can change your selections at any time by clicking “Cookie Settings” in the site footer.
You can also control or delete cookies through your browser:
- Google Chrome, Settings → Privacy and security → Cookies and other site data
- Mozilla Firefox, Options → Privacy & Security → Cookies and Site Data
- Microsoft Edge, Settings → Cookies and site permissions
- Safari, Preferences → Privacy
Opt out of specific services directly:
- Google Analytics, Google Analytics Opt-out Add-on
- Microsoft Clarity, Microsoft Privacy Dashboard
- Meta / WhatsApp, Meta Privacy Policy
6
Third-Party Services
6.1 Analytics
Google Analytics 4 (Google LLC, USA), website usage analytics processed under Google’s standard contractual clauses. IP anonymisation is enabled. Google Privacy Policy.
Microsoft Clarity (Microsoft Corporation, USA), session replay and heatmap analytics. Clarity does not record passwords, credit card numbers, or sensitive form fields. Microsoft Privacy Policy.
6.2 Communications
WhatsApp / Meta (Meta Platforms, Inc., USA), when you use our Click to WhatsApp feature, any conversation you initiate is governed by Meta’s WhatsApp Privacy Policy. We do not share your contact details with Meta; the link merely opens a conversation.
Email service provider, we use a reputable email platform to send marketing and transactional emails. Your name and email address are stored on their servers under our data processor agreement.
6.3 Hosting & Infrastructure
Our website is hosted on secure servers. All data transmitted between your browser and our website is encrypted using TLS (HTTPS).
6.4 Payment Processing
Where training fees or consultancy deposits are collected online, payments are processed by a PCI-DSS compliant third-party payment processor. We do not store or have access to your full card number.
Note: We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We only share data with processors acting on our documented instructions.
7
International Transfers
As a Zimbabwe-based organisation serving clients across Africa and internationally, some third-party service providers we use are located outside Zimbabwe, including in the United States and the European Economic Area.
Where personal data is transferred outside Zimbabwe or the EEA, we ensure appropriate safeguards are in place, such as:
- Standard Contractual Clauses (SCCs) approved by the relevant regulatory authority;
- The recipient country being recognised as providing an adequate level of protection; or
- The transfer being necessary for the performance of a contract with you.
8
Data Retention
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law:
- Contact and enquiry records, up to 3 years from last contact, unless a contract is entered into.
- Client and service records, 7 years from the end of the engagement (accounting and regulatory obligations).
- Marketing preferences and email lists, until you unsubscribe, or 3 years from last engagement, whichever is sooner.
- Analytics data, default 14 months for GA4; 90 days for Clarity session replays.
- Cookie data, see duration column in the Cookie Table above.
When data is no longer required it is securely deleted or anonymised.
9
Your Rights
Depending on your jurisdiction, you may have the following rights in relation to your personal data:
- Right of access, to obtain a copy of the personal data we hold about you.
- Right to rectification, to request correction of inaccurate or incomplete data.
- Right to erasure, to request deletion of your data where there is no compelling reason for continued processing.
- Right to restriction of processing, to request that we limit how we use your data in certain circumstances.
- Right to data portability, to receive your data in a structured, commonly used, machine-readable format.
- Right to object, to object to processing based on legitimate interests or for direct marketing.
- Right to withdraw consent, where processing is based on consent, to withdraw it at any time without affecting prior processing.
To exercise any of these rights, please contact us using the details in Section 13. We will respond within 30 days and may need to verify your identity before processing a request.
If you are located in the EU/EEA, you also have the right to lodge a complaint with your local data protection supervisory authority.
10
Security
We implement appropriate technical and organisational security measures, including:
- HTTPS / TLS encryption for all data in transit between your browser and our website;
- Access controls and role-based permissions for staff who handle personal data;
- Regular review of our security practices and third-party data processor agreements;
- Secure deletion or anonymisation of data at the end of its retention period.
No method of transmission over the internet is 100% secure. If you believe your personal data has been compromised, please contact us immediately.
11
Children’s Privacy
Our website and services are directed at business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 16. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.
12
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The “Last Updated” date at the top of this page will indicate when changes were last made.
Where changes are material, we will take reasonable steps to notify you: for example, by placing a prominent notice on our website or contacting you by email. Continued use of our website after updates are published constitutes your acceptance of the revised policy.
13
Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a complaint about how we handle personal data, please contact us:
Data Controller, Tashapa Consultancy (Private) Limited
📍 2812 Lavenham Road, Bluff Hill, Harare, Zimbabwe
📧 privacy@tashapaconsultancy.com
Company Registration No. 79587A0212026 | Registered in Zimbabwe