Privacy Policy

Personal Data: Any information relating to an identified or identifiable individual.

User Content: Encrypted data you store in Iomux Vault (e.g., passwords, payment card details, bank account details, addresses, contact cards, notes).

Vault Items: The encrypted items comprising your User Content.

Encryption Key / Master Key: A user-defined secret used to encrypt and decrypt Vault Items.

Processing: Any operation performed on Personal Data (collection, storage, use, disclosure, etc.).

This Policy applies to all Users of the Services in Zambia and globally. It governs:

• Personal Data we collect about you as an account holder or website visitor.
• How we process encrypted User Content and metadata.
• Your rights under Zambian law.

We process Personal Data for:

• Account creation, authentication, and management.
• Providing and improving the Services (performance, availability, troubleshooting).
• Processing payments, subscriptions, and renewals.
• Ensuring security, detecting fraud, and complying with cyber security obligations.
• Communicating with you regarding updates, support, or important notices.
• Compliance with legal obligations under Zambian law.

We rely on the following lawful bases under the Data Protection Act, 2021:

• Consent: When you provide explicit consent (e.g., for marketing communications).
• Contractual Necessity: To deliver the Services under our Terms & Conditions.
• Legal Obligation: To comply with regulatory or tax obligations.
• Legitimate Interest: For service improvement, fraud prevention, and security, provided such interest is not overridden by your rights.

We may share Personal Data with:

• Service Providers: Payment processors, hosting providers, customer support platforms.
• Legal and Regulatory Authorities: Where disclosure is required by law, regulation, or lawful request.
• Corporate Transactions: In case of merger, acquisition, or sale of assets, subject to confidentiality safeguards.

If Personal Data is processed outside Zambia (e.g., cloud infrastructure), we will implement safeguards consistent with the Data Protection Act, 2021, including contractual clauses or reliance on adequate protection determinations.

• Account Data: Retained as long as your account is active. Deleted within a reasonable period (typically 30-90 days) after account closure.
• Billing Records: Retained for the period required by tax and financial laws.
• Encrypted User Content: Deleted upon account closure or after prolonged inactivity, subject to technical grace periods.

Our website may use cookies and similar technologies for:

• Essential site functionality.
• Security (session management, fraud prevention).
• Analytics to improve user experience.

You can manage cookies through browser settings. Refusing cookies may affect functionality.

• Encryption: Vault Items are encrypted end-to-end using AES-256.
• Zero Knowledge: We cannot decrypt or recover your Encryption Key/Master Key.
• Transmission Security: Data is encrypted in transit (TLS 1.2+).
• Controls: Access controls, secure coding, penetration testing, and monitoring are employed.

Subject to exceptions, you have the right to:

• Access your Personal Data.
• Rectify inaccurate or incomplete Personal Data.
• Delete/Erase Personal Data when no longer necessary.
• Restrict Processing under certain conditions.
• Data Portability to receive a copy in a structured, machine-readable format.
• Object to certain types of processing.
• Withdraw Consent at any time (without affecting lawfulness prior to withdrawal).

Requests can be made as outlined in Section 14.

Iomux Vault is not directed to children under 18. We do not knowingly collect or process Personal Data from children. If you believe a child has provided data, please contact us for removal.

We may update this Policy periodically. Material changes will be notified via the Services or email. Continued use after the effective date constitutes acceptance of the revised Policy.