Policies & Reports | UNICOHS University College

Privacy Policy

UNICOHS University College · Last updated: 19 August 2026

1. Introduction

UNICOHS University College ("UNICOHS", "we", "us", "our") is committed to protecting the personal information of our students, staff, applicants, and website visitors. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over your information.

This policy applies to all personal data processed by UNICOHS through our website, admissions and enrolment processes, academic and administrative systems, and any other interaction you have with the College.

2. Information We Collect

Depending on how you interact with UNICOHS, we may collect:

Identity information — full name, date of birth, National Registration Card (NRC) or passport number, gender, nationality
Contact information — postal address, email address, phone number
Academic information — prior qualifications, transcripts, examination results, enrolment records, attendance, grades, disciplinary records
Financial information — tuition payment records, sponsorship or scholarship details, billing information (we do not store full payment card details — these are processed securely by our payment providers)
Employment information (for staff and applicants) — CVs, references, qualifications, employment history, bank details for payroll
Technical information — IP address, browser type, device information, and website usage data collected via cookies and analytics tools
Communications — correspondence you send us, including enquiries, complaints, and feedback

3. How We Collect Information

Directly from you, when you apply, enrol, register on our website, or contact us
From third parties, such as previous schools or institutions (for academic records), referees, or accreditation bodies
Automatically, through cookies and similar technologies when you use our website

4. How We Use Your Information

We use personal data to:

Process applications and manage student enrolment and academic records
Deliver teaching, assessment, and academic support
Communicate with students, staff, and applicants about courses, fees, events, and college updates
Manage staff employment, payroll, and human resources functions
Maintain the security of our campus, systems, and website
Comply with legal, regulatory, and accreditation obligations — including reporting to the Higher Education Authority and other relevant Zambian regulatory bodies
Improve our website and services through analytics
Respond to enquiries, complaints, and feedback

We only use personal data for the purposes it was collected for, or for a purpose that is compatible with that original purpose, unless we obtain your consent or are required or permitted to do so by law.

5. Legal Basis for Processing

We process personal data on one or more of the following bases:

Consent — where you have given clear consent (e.g. subscribing to updates)
Contract — where processing is necessary to deliver educational services under an enrolment agreement or an employment contract
Legal obligation — where we must process data to comply with Zambian law or regulatory requirements
Legitimate interests — where processing is necessary for our legitimate interests as an institution (e.g. campus security, fraud prevention), provided this does not override your rights

6. Sharing of Information

We do not sell personal data. We may share information with:

Accreditation and regulatory bodies, where required by law
Examination boards and partner institutions, for academic purposes
IT service providers who host our systems and website, under confidentiality obligations
Payment processors, to facilitate tuition and fee payments
Government authorities, where required by law or a valid legal request
Emergency contacts or next of kin, in the case of a genuine emergency

Any third party we share data with is required to protect it to a standard consistent with this policy.

7. International Transfers

If any of our service providers store or process data outside Zambia (for example, cloud hosting), we take reasonable steps to ensure that data is protected to a standard equivalent to Zambian data protection law, including through contractual safeguards with those providers.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes it was collected for, including:

Academic records: retained for the duration of study and for 10 years afterward to support transcript requests and verification
Applicant data for unsuccessful applications: retained for 2 years
Staff employment records: retained in line with Zambian labour law requirements
Website analytics data: retained per our cookie settings — see Section 11

The retention periods above are indicative defaults pending formal confirmation by the University Council / legal counsel, and should be reviewed before this policy is treated as final.

After the applicable retention period, data is securely deleted or anonymised.

9. How We Protect Your Information

We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including:

Access controls limiting data access to authorised staff on a need-to-know basis
Secure storage of physical and electronic records
Encryption of sensitive data in transit where applicable
Regular review of our systems and processes
Staff training on data protection responsibilities

No system is completely secure, but we take reasonable steps to protect your information against unauthorised access, loss, misuse, or alteration.

10. Your Rights

Subject to applicable law, including the Zambia Data Protection Act No. 3 of 2021, you have the right to:

Be informed about how your data is used
Request access to the personal data we hold about you
Request correction of inaccurate or incomplete data
Request deletion of your data, where applicable
Object to or restrict certain processing
Withdraw consent at any time, where processing is based on consent
Lodge a complaint with the Office of the Data Protection Commissioner of Zambia

To exercise any of these rights, contact us using the details in Section 13.

11. Cookies and Website Analytics

Our website may use cookies and similar technologies to:

Keep the website functioning correctly
Understand how visitors use our website, so we can improve it
Remember your preferences

You can control or disable cookies through your browser settings. Disabling certain cookies may affect how parts of the website function. A dedicated Cookie Policy has not yet been published; this section will be updated with a link once one is available.

12. Children's Information

Where we collect information from prospective students under the age of 18 (e.g. through school outreach or open day registrations), we do so with appropriate parental or guardian involvement and only for legitimate educational purposes.

13. Contact Us

If you have questions about this Privacy Policy, or wish to exercise your data protection rights, contact:

Data Protection Officer / Registrar's Office
UNICOHS University College
Barlastone Park, Plot 874/20, P.O. Box 37865, Lusaka, Zambia
dataprotection@unicohsuniversity.co.zw
+260 977 325 525

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when it was last revised. We encourage you to review this policy periodically.

Data Protection Policy

UNICOHS University College · Last updated: 19 August 2026

1. Purpose

This Data Protection Policy sets out how UNICOHS University College collects, stores, secures, and manages personal data in compliance with the Zambia Data Protection Act No. 3 of 2021 and applicable regulations. It applies to all staff, contractors, and third parties who process personal data on behalf of the College, and covers data relating to students, staff, applicants, alumni, and other individuals.

2. Scope

This policy covers all personal data held by UNICOHS in any format, including:

Digital records held on College systems, databases, and cloud services
Physical/paper records
Data processed by third-party service providers on our behalf

3. Data Protection Principles

UNICOHS processes personal data in accordance with the following principles. Personal data must be:

Processed lawfully, fairly, and transparently
Collected for specified, explicit, and legitimate purposes, and not further processed in a manner incompatible with those purposes
Adequate, relevant, and limited to what is necessary for the purposes it is processed for
Accurate and kept up to date, with reasonable steps taken to correct or erase inaccurate data
Kept no longer than necessary for the purposes for which it is processed
Processed securely, using appropriate technical and organisational measures to protect against unauthorised or unlawful processing, loss, destruction, or damage

4. Roles and Responsibilities

University Council / Executive Management — overall accountability for data protection compliance
Data Protection Officer (DPO) / designated officer — monitors compliance, handles data subject requests, advises on data protection matters, and serves as the point of contact for the Office of the Data Protection Commissioner
Heads of Department — ensure data protection practices are followed within their departments
All staff and contractors — responsible for handling personal data in line with this policy and completing required data protection training

5. Lawful Basis for Processing

Before collecting or processing personal data, staff must identify and document a lawful basis, consistent with Section 5 of the Privacy Policy above (consent, contract, legal obligation, or legitimate interest).

6. Data Collection and Use

Personal data must only be collected for a clear, legitimate purpose connected to UNICOHS's academic, administrative, or employment functions
Data must not be used for a new purpose without assessing whether that purpose is compatible with the original one, or obtaining fresh consent where required
Sensitive personal data (e.g. health information, disability status) must only be collected where strictly necessary and handled with additional safeguards

7. Data Storage and Security

Electronic records must be stored on approved College systems with appropriate access controls and authentication
Physical records containing personal data must be stored in locked cabinets or restricted-access areas
Personal data must not be stored on personal devices or personal cloud accounts unless explicitly authorised and secured in line with College standards
Access to personal data is granted on a need-to-know basis and reviewed periodically
All systems handling personal data must have up-to-date security measures, including passwords, encryption where appropriate, and regular backups

8. Data Sharing

Personal data may only be shared internally with staff who require it for legitimate College purposes
External sharing (e.g. with regulators, examination boards, or service providers) must be limited to what is necessary and, where ongoing, governed by a written agreement that includes data protection obligations
Staff must not share personal data informally (e.g. via personal email or messaging apps) unless no other secure channel is available and the disclosure is necessary

9. Data Retention and Disposal

Each category of personal data must have a defined retention period, documented in the College's records retention schedule
Data must be securely disposed of at the end of its retention period — physical records shredded, electronic records permanently deleted from all systems and backups where feasible
Retention periods must balance legal, academic, and administrative needs against the principle of not holding data longer than necessary

10. Data Subject Rights

UNICOHS will respond to requests from individuals seeking to exercise their rights (access, correction, deletion, objection, or withdrawal of consent) within the timeframes required by the Zambia Data Protection Act. Requests should be directed to the Data Protection Officer / Registrar's Office and will be verified before being actioned.

11. Data Breach Management

In the event of a suspected or confirmed personal data breach:

Staff must report the incident immediately to the Data Protection Officer / IT Department
The DPO will assess the scope, risk, and impact of the breach
Where required by law, the Office of the Data Protection Commissioner and affected individuals will be notified within the applicable statutory timeframe
The College will take immediate steps to contain the breach and prevent recurrence
A record of the breach, its impact, and remedial action will be maintained

12. Third-Party Service Providers

Any third party processing personal data on behalf of UNICOHS (e.g. hosting providers, payment processors, software vendors) must:

Be assessed for adequate data protection practices before engagement
Enter into a written agreement setting out their data protection obligations
Process data only on the College's documented instructions
Notify UNICOHS promptly of any data breach

13. Training and Awareness

All staff who handle personal data will receive periodic data protection training covering their responsibilities under this policy and applicable law.

14. Policy Review

This policy will be reviewed at least annually, or sooner if there are significant changes to applicable law or College practices, by the Data Protection Officer and approved by the University Council.

15. Contact

Data Protection Officer / Registrar's Office
UNICOHS University College
Barlastone Park, Plot 874/20, P.O. Box 37865, Lusaka, Zambia
dataprotection@unicohsuniversity.co.zw
+260 977 325 525

Strategic Plan

Our 2024–2028 Strategic Plan, "Towards Improving Excellence in Service in Higher Education Beyond 2040," is built on seven key pillars:

Enhance Excellence in Teaching and Learning (including e-learning platform development)
Enhance Excellence in Research and Publishing
Promote Community Outreach and Beneficial Partnerships
Enhance the University Corporate Brand
Invest in and Maintain Physical and Virtual Infrastructure (including a new state-of-the-art campus)
Enhance Financial Sustainability
Enhance Governance and Management Support Functions