This policy explains what personal data GodWorks Creative Media (“GWC Media”, “we”) collects through our website, social media pages, advertising and WhatsApp, why we collect it, and the rights you have under the Data Protection Act No. 3 of 2021 of the Republic of Zambia (“the Act”).

Effective date: 9 October 2026

1. Who we are

GodWorks Creative Media (trading as GWC Media) is the data controller for the personal data described in this policy. We are based in Chamba Valley, Lusaka, Zambia.

Email: info@godworkscreativemedia.com
Phone / WhatsApp: +260 97 405 2207
Data protection contact: David Masona, Founder, at the email address above (subject line “Data protection”)

2. What we collect

We collect only what we need to respond to you and to deliver our services.

Information you give us: your name, phone or WhatsApp number, email address, company name, the service you are interested in and anything you write in a message. You give us this through our contact form, our landing pages, WhatsApp, Facebook and Instagram messages, Meta instant forms in our adverts, email or phone calls.
Campaign information: if you reach us through an advert or a shared link, we record where you came from (for example “facebook”, the campaign name and click identifiers such as gclid or fbclid). This tells us which adverts work.
Technical information: when you send a form, our server briefly keeps a one-way scrambled (hashed) form of your IP address and the time, to stop spam and abuse. We do not keep your IP address itself with your enquiry. Our hosting provider also keeps standard server logs (IP address, browser type, pages requested).
Client project information: if you become a client, we hold the contact details, project details and correspondence needed to deliver and invoice the work.

We do not ask for sensitive personal data (such as health, religious or biometric data), and we ask you not to send it to us.

3. How we use it, and our lawful basis

Under section 13 of the Act we may only process personal data on a lawful basis. We use your data for these purposes:

Purpose	Lawful basis
Replying to your enquiry, arranging your free consultation and preparing a quote	Your consent, given when you send us your details, and steps you ask us to take before entering into a contract
Delivering, supporting and invoicing work for clients	Performance of our contract with you
Following up on a quote or consultation (up to three follow-ups)	Your consent and our legitimate interest in responding to people who asked us for help
Measuring which adverts and pages bring enquiries	Our legitimate interest in running our business, using only the campaign information described above
Preventing spam, fraud and attacks on our website	Our legitimate interest in keeping our systems secure
Sending marketing messages (news, offers)	Only with your separate consent, which you can withdraw at any time
Keeping accounting and tax records	Compliance with our legal obligations

We do not sell your personal data, and we do not make decisions about you based solely on automated processing.

We share personal data only with service providers who help us run our business, and only as much as they need:

Our website hosting and email provider, which stores our website, form submissions and email.
Meta Platforms (Facebook, Instagram and WhatsApp), when you contact us through those platforms or submit a Meta instant form. Meta’s own privacy policy also applies to your use of its services.
Professional advisers, such as our accountants or lawyers, where needed.
Authorities, where Zambian law requires us to disclose information.

Our service providers act on our instructions and must keep your data secure and confidential.

5. Transfers outside Zambia

Section 70 of the Act requires personal data to be processed and stored in Zambia unless an exception applies. Some of the platforms we use, including Meta (Facebook, Instagram and WhatsApp), store data on servers outside Zambia. When you contact us through those platforms, or submit a form whose data is held by a provider outside Zambia, you consent to that transfer. We only use providers that apply appropriate safeguards to protect personal data, as section 71 of the Act requires. We never transfer sensitive personal data outside Zambia.

6. How long we keep it

Enquiries that do not become projects: up to 2 years after our last contact, then deleted.
Client records: for the length of our working relationship and then as long as accounting, tax and other legal obligations require.
Spam-prevention records (a hashed IP address and the time of a form submission): kept only briefly for rate limiting; server logs are kept by our hosting provider for a limited period under its own retention policy.

We keep data no longer than necessary for the purpose it was collected for, as section 12 of the Act requires.

7. How we protect it

Our website is encrypted with HTTPS, runs no database and has no public login. Access to enquiries is limited to our team, accounts are protected with strong passwords and two-factor authentication, and we review our security regularly. If a personal data breach occurs, we will notify the Data Protection Commissioner within 24 hours as section 49 of the Act requires, and tell you as soon as practicable if it affects you.

8. Your rights

Under Part VII of the Act you have the right to:

Access the personal data we hold about you and receive a copy (the first copy is free);
Correct data that is inaccurate or incomplete;
Erase your data, for example where you withdraw consent;
Object to our processing, including any direct marketing, at which point we will stop;
Data portability: receive your data in a machine-readable format or have it sent to another organisation;
Not be subject to decisions based solely on automated processing;
Withdraw your consent at any time, without affecting processing that took place before.

To use any of these rights, email info@godworkscreativemedia.com or message us on WhatsApp at +260 97 405 2207. We may ask you to confirm your identity, and we will respond promptly. To stop marketing messages on WhatsApp, simply reply “STOP”.

9. Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can put it right. You also have the right to lodge a complaint with the Data Protection Commissioner of Zambia under section 68 of the Act.

10. Cookies and similar technologies

Our website does not currently use advertising or analytics cookies. When you arrive from an advert, we keep the campaign details in your browser’s session storage until you close the tab, so they can be sent with your enquiry. Nothing is stored after you close the browser tab.

If we add advertising measurement tools such as the Meta Pixel in future, we will update this policy and ask for your consent before they are used.

11. Children

Our services are for businesses and organisations. We do not knowingly collect personal data from anyone under 18. Under section 17 of the Act, a child’s data may only be processed with the consent of a parent or guardian; if you believe a child has sent us their details, contact us and we will delete them.

12. Changes to this policy

We may update this policy as our services or the law change. The effective date at the top shows when it was last updated, and significant changes will be highlighted on our website.

Privacy policy