PVT Results

PVT Results

Legal & Policies
Home Contact
Home Legal PVT Results Data & Privacy Policy
Legal Document
Terms Privacy

PVT Results Data & Privacy Policy

How PVT Results processes tenant data, account data, evidence, audit logs, and validation records.

Home Contact form
Effective June 2026 ~12 min read Zambia jurisdiction; reviewed against supplied legal sources

Please read this document carefully. By using the PVT Results platform, you agree to be bound by these terms. This document was last updated in June 2026.

1. Introduction and Legal Status

This Data & Privacy Policy explains how PVT Results collects, uses, stores, protects, validates, retains, discloses, and deletes data submitted through the platform.

This Policy has been updated to address legal compliance under Zambian law, including:

  1. the Data Protection Act, No. 3 of 2021, including sections 12, 14, 19, 20, 21, 46, 48, 49, 70, and 71;
  2. the Electoral Process Act, No. 35 of 2016, as amended by the Electoral Process (Amendment) Act, No. 32 of 2021, including section 89(1)(o);
  3. the Cyber Security and Cyber Crimes Act, No. 2 of 2021, including sections 23, 49, 60, 63, 73, and 76;
  4. the Electronic Communications and Transactions Act, No. 4 of 2021, where applicable to electronic records, communications, and transactions;
  5. the Information and Communications Technologies Act, No. 15 of 2009, where applicable to regulated communications services, including sections 67 and 68;
  6. the Constitution of Zambia, 1991, as amended by Act No. 2 of 2016, including Articles 1, 4, 45, 229, and 266.

PVT Results maintains, or will maintain where required, registration as a data controller and data processor with the Office of the Data Protection Commissioner in accordance with Data Protection Act sections 19, 20, and 21.

PVT Results has appointed, or will appoint where required, a Data Protection Officer responsible for compliance oversight, Data Protection Impact Assessments, breach coordination, and data-subject request management in accordance with Data Protection Act sections 46, 48, and 49.

Continued use of the platform after the effective date of this Policy constitutes acceptance of this Policy.

2. Policy Application

This Policy applies to:

  1. tenant organisations;
  2. tenant administrators;
  3. election agents;
  4. polling agents;
  5. verifiers;
  6. readers;
  7. observers and monitors;
  8. account users;
  9. support users;
  10. other authorised users of the platform.

This Policy applies to personal data, tenant data, evidence, audit logs, security data, support data, communications, exports, aggregated data, and validation records processed through the platform.

3. Types of Data We Process

The platform may process the following categories of data.

3.1 Tenant Data

Tenant Data means data submitted, uploaded, generated, reviewed, exported, or stored by an organisation in its workspace, including:

  1. polling-station results;
  2. candidate totals;
  3. rejected-ballot and spoiled-ballot figures;
  4. turnout figures;
  5. polling station, stream, ward, constituency, district, and province references;
  6. evidence sheets, forms, photographs, or scans;
  7. verifier comments;
  8. discrepancy notes;
  9. internal approval status;
  10. reports, exports, dashboards, and aggregates.

Tenant Data may include personal data or sensitive personal data where it contains names, signatures, identifiers, political affiliations, organisational roles, images, or comments relating to identifiable people.

3.2 User Account Data

User Account Data may include:

  1. name;
  2. email address;
  3. phone number where provided;
  4. organisation;
  5. role;
  6. login credentials or authentication identifiers;
  7. invitation status;
  8. access permissions;
  9. consent, acknowledgement, and account-status records.

3.3 Audit and Security Data

Audit and Security Data may include:

  1. login history;
  2. IP address;
  3. device and browser information;
  4. timestamps;
  5. submission history;
  6. edit history;
  7. evidence upload history;
  8. verifier actions;
  9. access logs;
  10. discrepancy flags;
  11. system alerts;
  12. incident and threat records.

3.4 Support and Communication Data

Support and Communication Data may include:

  1. messages;
  2. support requests;
  3. billing communications;
  4. onboarding information;
  5. administrative correspondence;
  6. data-protection requests and responses;
  7. complaint records.

3.5 Sensitive Personal Data

Election-related data may reveal or allow inference of sensitive personal data, including political opinions, political affiliation, campaign roles, observer roles, polling-agent roles, organisational affiliation, or other protected information.

Sensitive personal data is processed only where a lawful condition under Data Protection Act section 14 is satisfied, including explicit consent obtained by the relevant tenant where required, substantial public interest in democratic election integrity with appropriate safeguards, or necessity for the establishment, exercise, or defence of legal claims.

4. Tenant Ownership of Data

Each tenant retains ownership of its Tenant Data.

PVT Results does not claim ownership over polling-station results, uploaded evidence, internal verification notes, or tenant-specific reports.

By using the platform, each tenant grants PVT Results a limited, non-exclusive licence to host, store, process, validate, analyse, secure, display, back up, transmit, export, and retain Tenant Data solely for the purposes set out in this Policy, the Terms of Use, and any applicable service agreement.

This licence is subject to the Data Protection Act, including sections 12 and 14, and to any written agreement that imposes stricter controls.

5. No Sale of Data

PVT Results will not sell Tenant Data, User Account Data, uploaded evidence, audit logs, validation records, or personal data to third parties.

We will not sell data to advertisers, political parties, campaigns, consultants, media organisations, data brokers, or commercial third parties.

This prohibition supports the purpose-limitation and data-minimisation principles in Data Protection Act section 12.

6. Purposes and Legal Bases for Processing

PVT Results processes data for the following purposes:

  1. to provide, operate, secure, and improve the platform;
  2. to create and manage tenant workspaces;
  3. to assign users to polling districts, stations, streams, contests, and roles;
  4. to enable evidence-backed result capture;
  5. to perform arithmetic validation, verifier review, and discrepancy detection;
  6. to perform cross-tenant pooled validation under section 7;
  7. to generate dashboards, reports, and exports for authorised users;
  8. to maintain audit trails and support accountability;
  9. to detect misuse, fraud, manipulation, unauthorised access, credential compromise, and suspicious submission patterns;
  10. to comply with legal, regulatory, audit, contractual, and court obligations;
  11. to provide support and administrative communications;
  12. to investigate breach of the Terms of Use or this Policy.

The legal bases for processing may include:

  1. performance of a contract;
  2. legitimate interests in platform operation, security, evidence integrity, and service delivery;
  3. legal obligation;
  4. tenant-requested services;
  5. public-interest election monitoring where applicable and lawful;
  6. establishment, exercise, or defence of legal claims;
  7. consent or explicit consent where required.

Processing follows the Data Protection Act section 12 principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability.

7. Cross-Tenant Pooled Validation

PVT Results may compare submitted election result data across tenants for the same polling station, stream, contest, ward, constituency, district, province, or election event.

Pooled validation is used only to:

  1. identify inconsistent figures;
  2. detect possible data-entry errors;
  3. flag potential source manipulation or transcription issues;
  4. improve confidence in data accuracy;
  5. generate non-identifying alerts where submissions materially diverge;
  6. protect platform integrity.

Pooled validation is carried out on the basis of legitimate interests in maintaining the integrity and reliability of the platform and, where applicable, the substantial public interest in free, fair, credible, and transparent elections.

One tenant's identifiable submissions, evidence, users, internal comments, or verification records are not disclosed to another tenant through pooled validation unless the tenant authorises disclosure or disclosure is required by law.

The platform may generate alerts such as:

  1. "Your submitted result differs materially from other submissions for this polling station."
  2. "Evidence review recommended."
  3. "Arithmetic mismatch detected."
  4. "Broader divergence detected across comparable submissions."
  5. "Potential source or transcription issue."

A validation flag is a risk indicator only and does not constitute a finding of fraud, manipulation, or wrongdoing.

8. Data Isolation Between Tenants

Tenant workspaces are logically separated.

Users may access data only within their assigned workspace, role, and permissions.

Tenant administrators are responsible for assigning access appropriately and removing access when it is no longer required.

PVT Results personnel may access Tenant Data only when necessary for:

  1. platform operation;
  2. technical support;
  3. security monitoring;
  4. discrepancy investigation;
  5. compliance;
  6. legal obligations;
  7. enforcement of the Terms of Use or this Policy;
  8. service improvement consistent with this Policy.

Access is subject to confidentiality, logging, and role-based controls consistent with Data Protection Act section 12 and applicable cybersecurity requirements.

9. Data Retention

Unless a different period is agreed in writing with a tenant, PVT Results may retain Tenant Data, evidence, audit logs, validation records, and related election records for up to 10 years from the date of submission or the relevant election event.

The retention period supports:

  1. auditability;
  2. dispute review;
  3. election-petition or legal-claim support where applicable;
  4. investigation of discrepancies, manipulation, or fraudulent patterns;
  5. institutional memory for tenants;
  6. platform integrity and accountability;
  7. legal, regulatory, contractual, and security obligations.

PVT Results will maintain a documented Data Retention Schedule available on request. The schedule will apply the storage-limitation principle in Data Protection Act section 12 and will provide for periodic review, deletion, anonymisation, or archiving once relevant purposes are fulfilled, subject to legal holds.

Some records may be retained longer where required by law, court order, regulatory obligation, security incident, unpaid account, unresolved dispute, legal claim, or contractual obligation.

10. Personal Data Minimisation

Users and tenants must avoid uploading unnecessary personal data.

Unless expressly required for verification, users and tenants must not upload:

  1. National Registration Card numbers;
  2. full voter personal details;
  3. private home addresses;
  4. unnecessary phone numbers;
  5. biometric data;
  6. sensitive personal information unrelated to election monitoring;
  7. private communications not required for verification.

Where evidence contains unnecessary personal data, tenants should lawfully redact that information before upload where possible. Redaction must not obscure or alter the election result record required for verification.

This minimisation obligation supports Data Protection Act section 12.

11. Sensitive Personal Data

Election-related data may reveal political opinions, political affiliations, campaign roles, observer roles, polling-agent roles, or organisational affiliation.

PVT Results processes sensitive personal data only where a condition under Data Protection Act section 14 is satisfied.

Tenants are responsible for obtaining necessary explicit consent from data subjects, including agents, verifiers, observers, monitors, employees, volunteers, or representatives, before submitting sensitive personal data where consent is required.

Tenants must inform data subjects about the processing purposes, including evidence-backed result capture, audit trails, discrepancy detection, pooled validation, and legal compliance.

PVT Results will apply enhanced technical and organisational safeguards to protect sensitive personal data.

12. Data Protection Impact Assessments

PVT Results will conduct Data Protection Impact Assessments for high-risk processing activities where required, including large-scale processing of election data and cross-tenant pooled validation.

DPIAs will be conducted in accordance with Data Protection Act section 46, including section 46(1), section 46(2)(a)-(c), section 46(4), and section 46(5), where applicable.

Where the Act requires consultation with the Data Protection Commissioner before commencing high-risk processing, PVT Results will consult the Commissioner before that processing begins.

13. User Rights

Subject to applicable law, data subjects may have rights to:

  1. access personal data held about them;
  2. request correction or rectification of inaccurate personal data;
  3. request erasure where legally applicable;
  4. object to certain processing;
  5. restrict processing in certain circumstances;
  6. request portability where applicable;
  7. withdraw consent where processing is based on consent;
  8. complain to the relevant data-protection authority.

Requests should be submitted through the contact form with this message: "For the attention of the Data Protection Officer."

The platform may verify identity before responding.

Some requests may need to be handled through the relevant tenant administrator where the tenant controls the workspace and user relationship.

Responses will be handled in accordance with the Data Protection Act, including applicable rights, request, exemption, and complaint provisions.

14. Security Measures

PVT Results will implement reasonable technical and organisational safeguards to protect data, which may include:

  1. role-based access control;
  2. authentication controls;
  3. encryption in transit;
  4. encryption at rest where supported and appropriate;
  5. audit logs;
  6. access monitoring;
  7. backups;
  8. administrative access controls;
  9. secure development practices;
  10. incident response procedures;
  11. periodic review of security controls.

No system can guarantee absolute security against all risks or threats. Users and tenants must protect credentials and report suspected compromise without delay.

Security controls are informed by the Data Protection Act section 12 and by the Cyber Security and Cyber Crimes Act, including sections 49, 60, 63, and 73. If any platform component is declared or treated as critical information infrastructure, incident reporting and controls will also be handled with reference to Cyber Security and Cyber Crimes Act section 23.

15. Breach Notification

If PVT Results becomes aware of a personal data breach, it will investigate promptly and take appropriate remedial action.

Where required by Data Protection Act section 49, PVT Results will notify the Data Protection Commissioner within 24 hours of becoming aware of the breach and will notify affected tenants or data subjects as legally required.

Tenants must promptly notify PVT Results if they suspect unauthorised access, credential compromise, data leakage, evidence manipulation, unauthorised export, or misuse of the platform.

16. Service Providers and Sub-Processors

PVT Results may use trusted service providers or sub-processors to host, secure, operate, maintain, analyse, or support the platform.

Service providers may process data only as authorised by PVT Results and must be subject to confidentiality, security, and data-protection obligations consistent with the Data Protection Act.

PVT Results will conduct appropriate due diligence and maintain contractual safeguards for service providers.

Where regulated communications services are involved, service quality, consumer information, and complaint-handling expectations may be informed by the Information and Communications Technologies Act, sections 67 and 68.

17. International Storage and Transfers

Where data is stored, processed, backed up, externalised, transferred, or accessed outside Zambia, PVT Results will take reasonable steps to ensure that the transfer or processing is lawful and protected by appropriate safeguards.

Cross-border transfer of personal data will be handled subject to Data Protection Act sections 70 and 71.

PVT Results will use one or more lawful transfer conditions where required, which may include:

  1. an adequate level of protection in the destination jurisdiction;
  2. prior informed consent of the data subject where applicable;
  3. standard contractual clauses or equivalent safeguards approved where required;
  4. encryption and transfer-impact assessment where appropriate;
  5. another condition or exception expressly permitted by law.

Tenants with specific data-residency requirements must enter into a written agreement with PVT Results.

PVT Results will assess whether any processing or dataset constitutes critical information or critical information infrastructure under the Cyber Security and Cyber Crimes Act and will align with applicable localisation, security, or incident-reporting obligations where required.

18. Aggregated, Anonymised, and De-Identified Data

PVT Results may use aggregated, anonymised, or de-identified data to:

  1. improve platform performance;
  2. improve validation rules;
  3. understand system usage;
  4. improve election workflow design;
  5. produce non-identifying statistical insights;
  6. strengthen discrepancy detection;
  7. support research into electoral processes and integrity in anonymised form.

Such data will not reasonably identify a tenant, user, agent, observer, monitor, candidate representative, or other individual unless permitted by the tenant, required by law, or necessary for security, enforcement, or legal claims.

19. Disclosure of Data

PVT Results may disclose data only where:

  1. authorised by the tenant;
  2. necessary to provide the platform;
  3. required by law, court order, statutory obligation, or lawful authority;
  4. necessary to investigate misuse, fraud, manipulation, unlawful public-result announcements, or security incidents;
  5. necessary to enforce the Terms of Use or this Policy;
  6. necessary to protect the rights, safety, or integrity of the platform, tenants, users, or the public;
  7. part of a merger, acquisition, restructuring, or transfer of the platform, subject to appropriate safeguards.

PVT Results will not disclose one tenant's private workspace data to another tenant merely because submissions relate to the same polling station.

Disclosures to ECZ, the Data Protection Commissioner, ZICTA, law-enforcement agencies, courts, or other competent authorities may be made in response to lawful requests, court orders, regulatory obligations, or statutory requirements.

Disclosure will be handled consistently with the Data Protection Act, the Electoral Process Act, the Cyber Security and Cyber Crimes Act, and any applicable court order or statutory requirement.

20. Data Export and Deletion

Tenants may request export of their Tenant Data in a reasonable format supported by the platform.

Deletion requests may be subject to:

  1. the retention policy in section 9;
  2. legal obligations;
  3. audit requirements;
  4. unresolved disputes;
  5. security investigations;
  6. backup retention cycles;
  7. contractual obligations;
  8. court orders or regulatory holds.

Where immediate deletion is not possible, access may be restricted, data may be archived, or data may be anonymised where appropriate.

Deletion and export requests will be handled in accordance with the Data Protection Act and any applicable enterprise agreement.

21. Tenant Administrator Responsibilities

Tenant administrators must:

  1. assign roles carefully;
  2. remove users who no longer require access;
  3. ensure agents and verifiers understand data submission and evidence requirements;
  4. obtain required consents, including explicit consent for sensitive personal data where required;
  5. inform data subjects of processing purposes, including pooled validation;
  6. avoid uploading unnecessary personal data;
  7. apply lawful redaction where appropriate without obscuring required election records;
  8. verify data before organisation-wide release or public use;
  9. report suspected misuse, unauthorised access, credential compromise, data leakage, or evidence manipulation immediately;
  10. ensure public communications based on platform data are lawful, accurate, and include required methodology and disclaimers.

These responsibilities support Data Protection Act sections 12 and 14 and the electoral compliance obligations described in section 22.

22. Electoral Compliance and Unauthorised Result Announcements

Under Electoral Process Act section 89(1)(o), as inserted by the Electoral Process (Amendment) Act, No. 32 of 2021, a person must not announce and declare election results without lawful authority.

PVT Results data, validations, discrepancy flags, reports, dashboards, exports, or pooled insights must not be used to announce, declare, or represent results as official election results, or to mislead the public or any person into believing that platform output is official or authoritative.

Platform data and tools are provided strictly for internal verification, parallel tabulation, evidence preservation, and discrepancy detection by authorised or accredited organisations, agents, observers, and monitors.

Any public statement based on platform data must:

  1. identify the tenant making the statement;
  2. explain methodology, coverage, sample size, confidence level, or limitations where applicable;
  3. state that the work is an independent parallel exercise;
  4. state that it is not an official declaration;
  5. include the mandatory disclaimer required by the Terms of Use.

Violation of this section may result in immediate suspension or termination of access, withholding of data or exports, preservation of records, indemnity exposure, and reporting to ECZ, Zambia Police, the Data Protection Commissioner, ZICTA, or another relevant authority where required or authorised by law.

23. Children and Minors

The platform is not intended for use by children.

Tenants must not create accounts for minors unless they have lawful authority and PVT Results has expressly approved such use in writing.

For purposes of this Policy, a child is understood consistently with the Constitution of Zambia, Article 266, as a person who is below or has attained the age of eighteen years.

24. Changes to this Policy

PVT Results may update this Policy from time to time to reflect changes in law, technology, platform operations, security practices, accepted practices, or legal advice.

Material changes will be communicated through the platform, website, email, or another reasonable method.

Continued use of the platform after the effective date of an updated Policy constitutes acceptance of the updated Policy.

25. Contact

For privacy, data-protection, access, correction, deletion, consent, complaint, or other data-subject requests, contact:

contact form

For Data Protection Officer attention, contact the office using the contact form and include this message: "For the attention of the Data Protection Officer."

26. Version, Governing Law, and Acknowledgement

This Policy is Version 2.0, updated on June 16, 2026, for alignment with the Data Protection Act, the Electoral Process Act as amended by Act No. 32 of 2021, the Cyber Security and Cyber Crimes Act, applicable electronic communications and transactions law, the Information and Communications Technologies Act where applicable, and the Constitution of Zambia.

This Policy and any disputes arising from it are governed by the laws of the Republic of Zambia, unless a signed agreement states otherwise.

By using the platform, each user and tenant confirms that they have read, understood, and agree to be bound by this Policy, including the electoral compliance obligations in section 22 and the PVT Results Terms of Use.

© 2026 PVT Results — Hashcode Fibration

Terms of Use Privacy Policy Home Contact form