Skip to content

Privacy policy

Last updated 29 September 2026

This policy explains what personal information the TEVET Fund holds, why, who can see it, how it is protected and the rights you have.

1. Who we are

The TEVET Fund Management Information System (TFMIS) is operated by the Technical Education, Vocational and Entrepreneurship Training Authority (TEVETA), which administers the TEVET Fund under the Technical Education, Vocational and Entrepreneurship Training Act. TEVETA is the data controller for the personal data described here, within the meaning of the Data Protection Act No. 3 of 2021 of Zambia.

Questions about this policy or your data: info@osabox.cc

2. What this policy covers

This policy covers the TEVET Fund website and the TEVET Fund Management Information System (TFMIS): the public pages, the accounts of institutions and Fund staff, applications, contracts, payments, monitoring and reporting, and the integration interface used by other systems.

3. The information we hold

  • Accounts — your name, email address, role and institution; your password is stored only as a one-way hash, and a two-step verification secret (if you enable it) is stored encrypted.
  • Institutions — name, category, accreditation, province and district, and a contact person, telephone and email (the contact details are stored encrypted).
  • Applications and projects — proposals, the documents you upload, evaluation results, contracts, milestones, invoices, payments and reports.
  • Beneficiaries — people trained with Fund support: name, national registration (NRC) number, gender, province, programme, dates and outcome. Names and NRC numbers are stored encrypted.
  • Monitoring visits — findings, photographs and, when the officer's device provides it, the location where the visit was recorded.
  • Messages sent within the system (stored encrypted).
  • Security records — sign-in attempts, the IP address and browser of each action in the audit trail, and requests to the integration interface.

4. Why we use it, and on what basis

We use personal data to register institutions and users; to receive, evaluate and decide on applications; to contract, pay and monitor funded projects; to check that no one is funded twice for the same purpose (the co-funding check); to report on the Fund's results; to keep the system secure; and to meet audit and legal obligations.

We rely on the performance of TEVETA's statutory functions and on legal obligations (including public finance and audit requirements). Where we rely on consent — for example for optional information — you may withdraw it at any time.

5. Who can see it

  • TEVET Fund staff, each only as far as their role requires; access is controlled by role and every action is recorded in a tamper-evident audit trail.
  • Evaluators appointed to assess proposals, who see the proposals assigned to them.
  • Your own institution: an institution's users see only that institution's records.
  • Auditors and public authorities where the law requires or permits it.
  • Service providers who help us run the system — hosting, email and SMS delivery — under confidentiality obligations and only for that purpose. The site is delivered through Cloudflare, whose cookieless Web Analytics gives us anonymous visit totals (see the cookie policy).
  • Connected systems authorised by TEVETA, through the integration interface, limited to the specific information each is permitted; NRC numbers are withheld unless expressly authorised.

We do not sell personal data, and we do not use it for advertising.

6. How we protect it

Sensitive fields are encrypted in the database with a key held separately from it; connections are encrypted in transit; accounts are protected by strong passwords, lock-out after repeated failures and optional (for some roles, required) two-step verification. The audit trail is sealed so that any alteration can be detected. Backups are checksummed and restore procedures are tested regularly.

7. How long we keep it

  • Applications, contracts, payments, reports and beneficiary records are kept for as long as TEVETA's records-retention obligations for public funds require.
  • The audit trail is kept permanently, as a record of accountability.
  • Database backups are kept for 30 days; integration request logs for 90 days.
  • A registration that is not approved is kept only as long as needed to record that decision.

8. Your rights

Under the Data Protection Act you may ask to access the personal data we hold about you, to have it corrected, to have it erased or its use restricted where the law allows, and to object to its use. Some records — for example those needed to account for public funds — cannot be erased while we are required to keep them; we will tell you if that applies.

To exercise a right, write to info@osabox.cc. We may need to confirm your identity first, and will respond within the time the law allows. If you are not satisfied, you may complain to the Data Protection Commissioner.

9. Cookies

We use only the cookies the system needs in order to work. See the cookie policy.

10. Changes to this policy

We will update this policy when the system or the law changes; the date at the top shows the latest version. Significant changes will be announced when you sign in.