Overview

At National Building Society, we are committed to protecting the privacy and confidentiality of our data subject’s personal information. This commitment aligns with Zimbabwe’s Constitution, which guarantees privacy rights for all citizens. We operate in full compliance with the Cyber and Data Protection Act [Chapter 12:07], ensuring that your personal information receives the protection it deserves.

Personal data, under the Cyber and Data Protection Act [Chapter 12:07], refers to any information that can identify an individual. Examples include individual’s names, national identity numbers, contact details, account information, and residential addresses.

Our data processing activities strictly adhere to the requirements of the Cyber and Data Protection Act [Chapter 12:07], reflecting our dedication to responsible information handling.

This Privacy Notice explains how NBS handles your personal data, covering all information types both standard and sensitive personal information that you provide to us or that we obtain from external sources.

We encourage you to review this Privacy Notice thoroughly before sharing any personal information with us. When you provide your personal data to NBS , you agree to the processing methods outlined in this notice and the specific terms and conditions of your chosen products.

This Privacy Notice operates within the framework of applicable legal requirements and cannot override mandatory legal provisions.

If you disagree with any part of this Privacy Notice, please refrain from submitting personal information to us. Without your acceptance of these terms, we may be unable to offer our products and services to you.

Purpose of this Notice

This notice serves to inform you and all our stakeholders about our data handling practices. Specifically, it explains:

• Our purposes for collecting and processing your personal data;
• How we share your information with external parties;
• Our methods for protecting your personal data;
• Our data retention practices; and
• Your individual rights regarding your information.

Applicability of this privacy policy

This Privacy Notice applies to individuals whose personal information is collected and processed by NBS, including:

• Website and Digital Platform Users – Individuals visiting our website or using any NBS digital channels, such as the “transactor’’ app, USSD codes, WhatsApp Banking, and Facebook Banking.
• Clients – Prospective and existing clients who apply for or use NBS products and services, either directly or through our partners and agents.
• Employees and Applicants – Current and potential employees of NBS.
• Third Parties – Natural persons whose personal information we process to provide products and services, including contractors, authorized agents, vendors, approved partners, and suppliers.
• Dependents and Beneficiaries – Individuals whose personal information you provide to us for the purposes of using a product or service, such as spouses, dependents, beneficiaries, and lives assured, where applicable.
• Public Domain Sources – Individuals whose personal information we may obtain from publicly available sources, including public records and social media platforms.

By interacting with NBS, you consent to the collection and processing of your personal information as described in this Privacy Notice.

Understanding Personal Information

Personal information encompasses any information that can identify you as an individual. This includes details you directly provide, information gathered during onboarding, and your marketing preferences. Such data encompasses:

• Individual’s full name, residential address, and contact numbers;
• Racial background, nationality, ethnicity, religious affiliations, or political views or associations;
• Age, gender, marital status, and family composition;
• Official identification numbers or unique identifiers;
• Biometric data including fingerprints and genetic markers;
• Medical history and health-related information;
• Educational background, financial status, and employment records;
• Private correspondence related to personal and family matters;
• Financial information (like your account numbers, income and expenses, credit records/history, investments, assets and financial needs).
• Financial information (like your account numbers, income and expenses, credit records/history, investments, assets and financial needs).
• Your location and online identifiers (this can be internet protocol (IP) addresses or geolocations, browsing habits.

In certain circumstances, we may need to collect sensitive personal information, which includes:

• Religious or spiritual beliefs;
• Philosophical perspectives;
• Professional association memberships;
• Trade union affiliations;
• Personal relationships;
• Criminal, educational, financial, or career history;
• Demographic information including age and family status;
• Health and medical data;
• Any data that could significantly impact your fundamental rights as a data subject.

We only process sensitive personal information with your explicit consent, when legally required, for legitimate legal purposes, or for approved historical, statistical, or research activities.

When do we collect Personal Data

• We will collect your personal information when:
• You visit our website or use any NBS digital channels.
• You apply for a bank account, take out an insurance policy, or use any of our products or services.
• You register or apply for NBS career through our recruitment channels.
• We communicate with you and to act on your instructions when you contact us by phone, WhatsApp, email or social media.
• You voluntarily supply us with optional information e.g. email addresses, opinions, or alternative contact details.
• You perform transactions on your account, we will collect your transaction history and transacting activities.
• You use our products and services or engage with us, and we establish personal preferences or behavioural trends about you.

• NBS may also collect your personal information from agents, partners or other entities with whom it conducts business.
• When you provide us with the personal information of other people (like dependents, beneficiaries, or lives assured), you confirm that you have their permission, where applicable, to share this information with us for the purposes outlined in this Privacy Notice.
• You also agree to indemnify us from any loss or damage that might occur if you share a third party’s information without the necessary consent or proper authorisation.
• If you have an employment application, we may gather additional information about you from various sources. This could include public records, career platforms, social media, and other third parties. For instance, we might obtain insights from your professional or academic references, such as previous employers or educational institutions, as well as through third-party pre-employment background checks.

Our Reasons for Processing Your Information

At NBS, we collect, use, and store your personal and financial information to provide you with tailored financial products and services. Specifically, we process your data to:

• Verify Your Identity – Ensure compliance with regulatory requirements and prevent fraud.
• Assess Financial Risk – Evaluate the risk of fraud, money laundering, and creditworthiness.
• Establish Relationships – Enter banking, insurance, or employment agreements with you.
• Understand Your Needs – Offer products and services that align with your financial goals.
• Product Development – Create new offerings based on your preferences and feedback.
• Conduct Marketing – Promote relevant products and services to you.
• Perform Research – Carry out market research and client satisfaction surveys.
• Manage Records – Update and maintain accurate records with credit bureaus and government agencies.
• Evaluate Creditworthiness – Assess your ability to receive credit or provide collateral.
• Offer Additional Services – Provide related banking and insurance services.
• Monitor Communications – Record and analyse interactions to improve services and for training purposes.
• Engage with You – Communicate about products that may interest you via various channels.
• Enhance Digital Experience – Assess usage of digital channels to improve client experience.

We only collect information that is necessary and relevant to the services we offer. Your refusal to provide personal information may limit our ability to deliver the required financial services to you.

We may send you direct marketing communications; however, you can unsubscribe at any time by opting out on the relevant platform or by informing us directly.

If we use third-party data providers, we ensure they are lawfully permitted to share your information with us.

NBS processes your personal information based on lawful grounds, including:

• Your Consent – When you have given explicit consent.
• Contractual Necessity – To fulfil obligations under a contract with you.
• Legal Obligation – When required by law.
• Legitimate Interests – To protect your legitimate interests or those of a third party.
• Public Interest – When processing is necessary for public interest or statistical purposes.

We are committed to processing your personal information responsibly and in compliance with applicable laws.

Processing Personal Information of Children and physically or mentally incapacitated individuals

At NBS, we are committed to safeguarding the personal information of all our clients, including children and individuals who are physically, mentally, or legally incapacitated. We adhere to the following guidelines when processing data related to these groups:

• Children – For data subjects under the age of eighteen (18), their rights under this Act may be exercised by their parents or legal guardians. This ensures that decisions regarding the collection, use, and protection of a child’s personal information are made by responsible adults who can act in the child’s best interests.
• Incapacitated Individuals – For data subjects who are physically, mentally, or legally incapable of exercising their rights, these rights may be exercised through a parent, guardian, or as provided by law or designated by a court of competent jurisdiction.

Information Collection Methods

We gather your personal information through various channels:

• Direct collection through account and loan applications, and service requests, except when information is publicly available, you’ve authorized alternative collection methods, direct collection would compromise our legal basis, or direct collection is impractical.
• Indirect collection through your digital interactions with us, including website cookies (detailed separately).
• External sources including public records, data aggregators, financial institutions, credit bureaus, and fraud prevention services, where collection doesn’t compromise your interests or is necessary for service provision.
• Authorized agents and representatives acting on our behalf.
• Property professionals including valuers, surveyors, and legal practitioners for mortgage services.

External sources may include:

• Legal practitioners and conveyancing attorneys;
• Financial institutions and payments service providers;
• Property valuation and surveying companies;
• Real estate agencies;
• Insurance providers;
• Credit rating agencies;
• Law enforcement agencies;
• Regulatory authorities;
• Government departments;
• Property registry offices

Information Sharing Practices

Protecting our institutional interests may require sharing specific information with external parties, such as when payment issues arise. To serve the public interest, we may disclose debt-related information to credit agencies or collection services. We may share your information with:

• Banking and financial service providers;
• Regulatory bodies including the Reserve Bank of Zimbabwe;
• Industry organizations and ombudsman services;
• Legal, conveyancing, and auditing firms;
• Property valuation and surveying professionals;
• Insurance companies;
• Law enforcement authorities;
• Property registry services; and
• Other entities as required by contract, law, or legitimate interest.

For cross border data transfers, we ensure compliance with applicable regulations.

We will never sell your personal information and shall conduct marketing only in accordance with legal requirements and your preferences, using your preferred communication methods when possible.

When we modify, remove, or delete your information, we make reasonable efforts to notify relevant third parties who received your data.

Safeguarding Your Information

We prioritize the security of your information through comprehensive protective measures. Our security framework includes robust physical, digital, and administrative safeguards designed to prevent unauthorized access and disclosure.

All online transactions are protected by encryption, and we store personal information according to recognized international and local financial sector security standards.

Data Retention Policies

At NBS, we are committed to retaining your personal information only for as long as necessary to fulfil lawful business purposes or as mandated by applicable laws, including tax legislation and statutory obligations related to anti-money laundering and combating the financing of terrorism.

If your personal information is retained beyond its immediate necessity, particularly for historical, statistical, or research purposes, we will implement appropriate safeguards to prevent its use for any other purposes. In such cases, we may anonymise or pseudomise the data to ensure it cannot be linked back to you.

When your personal information is no longer required, we will take all reasonable steps to securely destroy it, in compliance with relevant data protection laws. This includes securely deleting electronic records and securely destroying physical documents.

You have the right to request the deletion or destruction of your personal information at any time. To exercise this right, please submit a completed data subject access request form (DSAR) to us, and we will process your request in accordance with applicable laws and regulations.

Your Data Protection Rights

The following rights are available to you under applicable data protection laws. We encourage you to familiarize yourself with these rights and contact us if you wish to exercise any of them. Our Data Protection Officer is available to assist you with any questions or requests related to your privacy rights.

Right	Description
Right to access	You have the right to request a copy of the personal information we hold about you. Please contact us at 263 8677004603 or email dpo@nbs.co.zw. We aim to provide this information within thirty working days.
Right to rectification/correction	If you discover that any of your personal information is inaccurate or incomplete, you have the right to request correction or completion.
Right to be Informed	You have the right to know what specific types of personal data are being collected, why it is being collected, how it will be used, and how it will be stored. This information is provided in this Privacy Notice.
Right to consent	You have the right to give and withdraw your consent for processing your personal information. Please note that withdrawing consent may affect our ability to provide certain services to you.
Right to deletion	You have the right to request the deletion of false or misleading information we hold about you. Please note that requesting deletion may affect our ability to provide certain services to you.

Managing Your Preferences

By submitting your personal information, you agree to its collection, use, and sharing in accordance with our Privacy Notice. You retain the right to update your preferences or withdraw consent for certain data uses at any time which is either through your account settings or by contacting us at dpo@nbs.co.zw.

Your Data, Your Choice

You have full control over how your personal information is utilized, including the ability to opt out of:

• Third-party data sharing.
• Marketing communications (e.g., emails, promotions).

How to Adjust Your Preferences

1. Cookie Settings: Use the cookie consent banner on our website to disable non-essential tracking.
2. Account Settings: Access your privacy preferences directly via your account dashboard.
3. Email Request: Contact our Data Protection Officer at dpo@nbs.co.zw to update your preferences.

For further details, please review our Privacy Policy or reach out to our support team.

Automated Decision-Making

Under certain circumstances, the bank adopts automated processing which may be required to offer you services. You have the right not to be subject to automated decision-making. Please note that if you request that we no longer use automated processing on your personal information, we may fail to provide you with the services you may have requested and may have to suspend the operation of your account and/or the products and services we provide to you.

Complaints

You may submit complaints about the processing of your Personal Information by calling the NBS Contact Centre on 263 8677008484 and +263 772 565 555; +263 778 167 167 (Direct calls to WhatsApp, during business hours) or sending an email to dpo@nbs.co.zw. Or, if you are not satisfied with the way we have dealt with your complaints, you can contact the Data Protection Authority at Lodge a Complaint – Postal and Telecommunications Regulatory Authority of Zimbabwe.

Data Subject Access Request Form (DSAR) – To uphold your data privacy rights, please complete the DSAR form with the required information and submit it to our data privacy team: dpo@nbs.co.zw for processing. By clicking https://drive.google.com/file/d/11RJK-L5a_TzzEqIPfJ4kPk6EZgb1ElGW/view?usp=drive_link , you will be directed to the DSAR Form. This enables you to request access to your personal information in line with data protection regulations. Protecting your privacy is a priority. We handle your personal data with transparency and in compliance with data protection laws.

Our Contact Details

The contact details of the Data Protection Officer are: Data Protection Officer Gladys Mutanga Physical Address: 14th Floor Social Security Center, Cnr Sam Nujoma Street/ Julius Nyerere Way, Harare, ZimbabweTel: +263 8677004603 Email: dpo@nbs. Website: www.nbs.co.zw.

Website Cookies Policy

• A cookie is a small text file stored on your device that helps websites or apps recognize your device and store information like login details and preferences.
• We use cookies to personalise your repeat visits to our website by determining how you use the site.
• We also use cookies to identify which pages on our website are being used. This helps us to analyse data about web page traffic and improve our website to meet your needs.
• We use this information for statistical analysis purposes only, after which the data is removed from our system.
• Overall, cookies help us give you a better website by enabling us to monitor which pages you find useful. A cookie does not give us access to your computer or any information about you other than the data you choose to share with us.
• You can choose to accept or decline cookies. Most web browsers accept them automatically, but you can modify your browser settings if you prefer to decline cookies. However, this may prevent you from taking full advantage of our website.

About National Building Society (NBS)

NBS operates as a Financial Institution dedicated to providing housing finance and banking services to our customers. We specialize in assisting our customers achieve homeownership through innovative mortgage products and competitive banking services solutions.

Our service portfolio includes:

• Mortgage financing
• Retail Banking services products
• Corporate & Institutional banking services
• Treasury Investments

We strive to be Zimbabwe’s premier building society, delivering accessible and innovative housing finance solutions while maintaining exceptional service standards and financial integrity.