Effective Date: 10 September 2026 · Governed by the Laws of the Republic of Zambia · Supervised by the Office of the Data Protection Commissioner (ODPC), Lusaka.
Regulatory Compliance Commitment
Contour Real Estate Operations System (“Contour”, operated by Banya Labs) is engineered from the ground up to uphold the highest standards of data sovereignty under the Zambia Data Protection Act No. 3 of 2021 (DPA), the Electronic Communications and Transactions (ECT) Act No. 4 of 2021, and the Lands and Deeds Registry Act (Cap 185).
01.Data Controller & Data Processor Roles
Under Section 15 of the Zambia DPA 2021:
The Real Estate Agency: Functions as the primary Data Controller responsible for collecting personal data from clients, specifying the conveyancing or tenancy purpose, and determining lawful processing grounds.
Contour (Banya Labs): Functions as the specialized Data Processor providing multi-tenant encrypted cloud infrastructure, document vaults, and automated workflows on behalf of the Data Controller.
02.Categories of Personal Data Collected
In the ordinary course of real estate conveyancing, leasing, and agency management, Contour processes:
Standard Personal Data
Full legal names, email addresses, WhatsApp telephone numbers, residential physical addresses, and tax identifiers (TPIN).
Sensitive Personal Data (§22)
National Registration Card (NRC) numbers, biometric passport scans, Certificate of Title deeds, stand survey diagrams, and bank account remittance details.
03.Legal Grounds for Processing (Section 21)
We process your personal information strictly under one or more of the following lawful grounds:
Contractual Necessity: Essential to execute tenancy agreements, sole mandate sales, and property conveyance.
Statutory Obligation: Compliance with the Financial Intelligence Centre (FIC) Act for Anti-Money Laundering (AML) diligence and Zambia Revenue Authority (ZRA) audit reporting.
Explicit Digital Consent: Captured prior to client document upload via tokenized links with timestamp, client IP, and user-agent logging.
Real estate transaction documentation (including Title Deeds, NRC scans, and signed leases) is retained for seven (7) years following the completion of a transaction or lease termination, matching Zambian tax and property audit standards.
Archived Listing Protection: When a property listing is marked archived or deleted, its document vault enters a custodial read-only state. Uploads and deletions are locked, while documents remain accessible for authorized legal verification.
05.Security Measures & 15-Minute Presigned Tokens
Contour employs technical and organizational safeguards complying with Section 27 of the DPA:
AES-256 Bucket Encryption: All binary files reside in self-hosted, tenant-partitioned MinIO S3 storage buckets.
Zero Permanent Download URLs: Document access is strictly governed by single-use, 15-minute presigned URLs that expire automatically.
Immutable Audit Logs: Every document view, upload, download, and verification event is recorded in an immutable ledger with masked PII.
06.Your Data Subject Rights (Sections 28-33)
As a data subject in Zambia, you possess the legal right to:
Right of Access (DSAR): Request a complete export of all personal data held about you by contacting your agent or via our DSAR endpoint.
Right to Rectification: Request correction of inaccurate NRC, passport, or contact information.
Right to Erasure: Request deletion of data subject to mandatory statutory retention under conveyancing laws.
Right to Withdraw Consent: Cancel pending upload invitations before files are uploaded.
07.Regulatory Oversight & Lodging Complaints
If you believe your personal information has been processed in violation of the Zambia Data Protection Act, you have the statutory right to file a complaint with the regulatory authority:
08.Authorized Cloud Subprocessors & Cross-Border Transfer Adequacy
Contour engages vetted cloud infrastructure subprocessors under strict confidentiality and data protection addendums complying with Sections 34-36 of the Zambia DPA 2021:
Contour integrates AI capabilities for semantic listing search:
Strict Tenant Scoping: Vector embeddings are strictly isolated per tenant organization. Your agency's listing data and client requirements are never exposed to other agencies.
Zero Foundational AI Training: Neither Contour nor its subprocessors use client Title Deeds, NRC scans, or transaction contracts to train public generative AI models.
Human Oversight (The Seam): Rental statement payout calculations require human staff approval before legal execution.