Privacy Policy

Last updated: 13 October 2026

This Privacy Policy explains how the Institute of Chartered Tax Accountants of Zimbabwe (“ICTAZ”, “we”, “us”, or “our”) handles personal information when you visit https://mail.icta.org.zw, use our member and student portal, apply for membership or programmes, make payments, or sign in with Google.

1. Who we are

ICTAZ is Zimbabwe’s professional body for Chartered Tax Accountants. Our public website and portal support membership, education, CPD, events, payments, verification services, and related professional administration.

Contact for privacy enquiries:
Email: admin@icta.org.zw
Address: 11 Morton Jaffray Drive, Eastlea, Harare, Zimbabwe

2. Information we collect

Depending on how you use our services, we may collect:

• Identity and contact details — name, email address, phone number, postal or physical address, membership or student numbers, and related profile information.
• Account and authentication data — login credentials you create, multi-factor authentication settings, and, if you use Google Sign-In, your Google account identifier and the verified email, name, and profile picture Google shares with us for sign-in.
• Application and professional data — membership pathways, education records, CPD submissions, certificates, exam entries, documents you upload, and correspondence with ICTAZ.
• Payment and billing data — invoice details, payment references, amounts, currency, and status. Card or mobile-money processing is handled by our payment providers; we do not store full card numbers on ICTAZ servers.
• Technical and usage data — IP address, browser type, device information, pages visited, session logs, and security or error diagnostics needed to operate and protect the portal.
• Communications — messages sent through contact forms, support channels, newsletter subscriptions, and similar enquiries.

3. Google Sign-In

If you choose Continue with Google, we use Google’s OAuth / Sign in with Google service to authenticate you. Google may share with ICTAZ:

• your Google account unique ID;
• your verified email address;
• basic profile information such as your name (and profile image, if provided by Google).

We use this information only to match and sign in an existing ICTAZ portal account that already uses the same verified email address, or to link Google Sign-In to that account after successful authentication. We do not create new portal accounts solely from a Google login, and we do not use Google Sign-In to access your Gmail, Drive, contacts, or other Google services beyond the basic identity scopes required for sign-in.

Google’s own processing of your information is governed by Google’s Privacy Policy.

4. How we use information

We use personal information to:

• operate the website and portal, including secure login and account management;
• administer membership, student records, CPD, examinations, certificates, and professional registers;
• process applications, invoices, and payments;
• respond to enquiries and provide member or student support;
• send important service notices (and newsletters where you have opted in);
• protect against fraud, abuse, and security incidents;
• comply with legal, regulatory, and professional obligations.

5. Legal bases and necessity

We process personal information where it is necessary to provide our services to you, to perform a contract or membership relationship, to meet our legitimate interests in running a professional body securely and efficiently, to comply with law, or where you have given consent (for example, certain marketing preferences). Where consent is the basis, you may withdraw it subject to any legal or contractual limits.

6. Sharing of information

We do not sell your personal information. We may share information with:

• Service providers who host our systems, process payments, deliver email, or provide security and analytics under contractual confidentiality and purpose limits;
• Authentication providers such as Google when you choose Google Sign-In;
• Professional or regulatory bodies where required for verification, standards, or statutory reporting;
• Authorities when required by law, court order, or to protect rights, safety, and the integrity of the Institute.

7. Retention

We retain personal information for as long as needed to provide portal and membership services, meet professional record-keeping requirements, resolve disputes, and comply with legal obligations. Authentication logs and security records may be kept for a shorter operational period unless a longer retention is required for investigations or law.

8. Security

We apply administrative, technical, and organisational measures appropriate to the sensitivity of the information we hold, including encrypted transport (HTTPS), access controls, and monitoring. No method of transmission or storage is completely secure; please keep your password confidential and enable multi-factor authentication where available.

9. Your choices and rights

Subject to applicable law and Institute rules, you may request to:

• access or correct personal information we hold about you;
• update your portal profile where self-service is available;
• unlink Google Sign-In by contacting ICTAZ support (password sign-in may still be required);
• ask questions about how your information is used.

To make a request, contact admin@icta.org.zw or use our Contact page. We may need to verify your identity before responding.

10. Cookies and similar technologies

Our site uses cookies and similar technologies that are necessary for sessions, security (including CSRF protection), and remembering preferences. Disabling essential cookies may prevent login and other core features from working.

11. Children’s privacy

Our services are directed to adult professionals, students, and applicants. We do not knowingly collect personal information from children for marketing purposes. If you believe a child has provided information inappropriately, please contact us so we can take appropriate action.

12. International transfers

Our primary operations are in Zimbabwe. Some infrastructure or service providers (including authentication or hosting partners) may process data in other countries. Where that occurs, we take steps intended to protect the information in line with this policy and applicable requirements.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the website or portal after an update constitutes notice of the revised policy, except where applicable law requires additional consent.

14. Related documents

Please also read our Terms of Service and visit About ICTAZ for more about the Institute.