Privacy Policy

1. Who is responsible for your data

Dziko Digital is the data controller for personal data collected through this website. We are a company registered in Malawi (company registration number BRN-R6SPPEDL), operating from Blantyre, Malawi.

Contact us about anything in this policy at info@dziko.digital or +265 882 092 624.

2. What we collect

Information you give us. Our contact form asks for your name, email address, phone number and a message. We use this only to respond to your enquiry and, if we go on to work together, to run the engagement. Submissions are delivered to our email inbox.

Our chat assistant. The chat window on this site is an AI assistant, not a person. Your messages are sent to our AI provider so it can reply. We only keep a record of a conversation if you choose to give us your contact details. In that case we save your name and email address, any phone number, company and role you share, a short summary of what you need, and the conversation itself, so we can follow up. If you don’t share your details, we don’t keep a copy of the conversation; it stays in your browser tab and is cleared when you close it. To prevent abuse, we keep a pseudonymised record of your IP address for up to 24 hours to limit how many messages can be sent.

How we follow up. If you leave your details through the form or the chat, we contact you once and may send up to three follow-up messages. If we don’t hear back after that, we stop contacting you.

Information collected automatically. When you visit, we receive standard technical data: IP address, browser and device type, pages viewed, time on page, and the site that referred you. This comes from our analytics tools and our web server logs.

We do not ask for and do not want sensitive personal data through this website. Please do not send financial details, identity documents or health information through the contact form or the chat.

3. Why we process it, and on what basis

• To answer your enquiry and provide services. Basis: taking steps at your request before entering a contract, and performing that contract once agreed.
• To understand how the site is used and improve it. Basis: our legitimate interest in running and improving our own website.
• To keep the site secure and working. Basis: our legitimate interest in protecting the service.
• To meet legal and accounting obligations. Basis: compliance with a legal obligation.

4. Analytics

We use Google Analytics 4 (measurement ID G-MP6MX2DBW9), connected through Google Site Kit, to see which pages people find useful. Google processes this data on our behalf and as a controller for its own purposes under its own terms.

We also use Google PageSpeed Insights to measure site performance. Full detail of the cookies involved is in our Cookie Policy, which also explains how to opt out.

5. Who else handles your data

We keep the list of third parties short and use reputable providers:

• Hostinger, our web host, which stores the site and its server logs.
• Google, for analytics, performance measurement and the web fonts this site loads, and Google Sheets, where we keep the list of enquiries we are following up.
• Our email provider, which receives and stores contact form submissions and chat enquiries.
• Anthropic, which provides the AI model behind our chat assistant and processes chat messages on our behalf to generate replies.
• Unsplash, which serves some images on our Solutions page directly to your browser.

Loading fonts and images from Google and Unsplash means your IP address is visible to them as part of that request. We do not sell personal data, and we do not share it with advertisers.

6. Data leaving Malawi

Our hosting, analytics, email and AI providers operate servers outside Malawi. This means your personal data may be transferred to and stored in other countries. We choose established providers that offer contractual data protection commitments, and we transfer no more than the service requires.

7. How long we keep it

• Enquiries that do not become projects (from the contact form or the chat): normally up to 24 months, then deleted. Chat enquiries stored on our website are deleted automatically after 24 months.
• Chats where you don’t leave contact details: not kept by us.
• Client records: for the length of the engagement and afterwards as long as we need them for legal, tax and accounting purposes.
• Analytics data: according to the retention period set in Google Analytics.
• Server logs: a short rolling period set by our host.

8. Your rights

Under the Malawi Data Protection Act, 2024 you have the right to:

• ask what personal data we hold about you and get a copy;
• have inaccurate data corrected;
• ask us to delete data where we no longer have grounds to keep it;
• object to, or ask us to restrict, processing based on our legitimate interests;
• receive data you gave us in a portable format; and
• withdraw consent at any time, where we relied on consent.

To exercise any of these, email info@dziko.digital. We will respond within the period the Act requires. If you are not satisfied with our response, you can complain to the Malawi Communications Regulatory Authority (MACRA), which is the data protection authority for Malawi.

9. Client data we handle during projects

When we build automations, we often work inside systems that hold your customers' personal data. In that situation you remain the data controller and we act as your data processor. We:

• connect only the data a given automation actually needs;
• work within your existing accounts and permission structures, so you keep control of access;
• use your data only to deliver the work you have asked for; and
• document what a system touches, so you can account for it.

Where the law requires a written processing agreement between us, we will put one in place.

10. Dziko Clip Publisher, YouTube API Services and Instagram

What it is. Dziko Clip Publisher is an internal tool, run on our own self-hosted automation server, that uploads short videos we own or are authorised to post from our Google Drive to our own YouTube channel (as YouTube Shorts) and our own Instagram account (as Reels). It is used only by Dziko Digital, for our own accounts. It is not offered to the public or to clients, and it never connects to anyone else’s YouTube or Instagram account.

YouTube API Services. Dziko Clip Publisher uses YouTube API Services. By using it, you agree to be bound by the YouTube Terms of Service. Google’s handling of data is described in the Google Privacy Policy.

What it accesses and why. With our authorisation through Google sign-in (OAuth), the tool:

• reads the video files we place in a designated Google Drive folder, so it can upload them;
• uploads each video to our YouTube channel and sets its title, description and privacy status; and
• reads back the ID of the video it just uploaded, so it can build the link to the published Short.

It does not read, collect or store any information about viewers, subscribers, commenters or any other YouTube user. It does not read our channel analytics, does not display YouTube content to anyone, does not serve third-party content or advertising, and does not set cookies or collect device information.

How it is stored. The Google sign-in token is stored encrypted on our automation server, which is hosted by DigitalOcean. The only YouTube data the tool keeps is the ID and link of each video it uploads, held in the server’s workflow logs for no more than 7 days and then deleted automatically. Video files are not copied anywhere except to YouTube and Instagram.

Who it is shared with. No YouTube API data is sold or shared with advertisers. After a post goes live, the public links to the new Short and Reel are sent to our own WhatsApp number through the CallMeBot messaging service, so we can submit them to the campaign we are posting for. Nothing else is shared.

Instagram. The same tool publishes Reels to our own Instagram account through Meta’s Instagram API, using an access token stored encrypted on the same server. Meta’s handling of data is described in the Meta Privacy Policy.

Revoking access and deleting data. Access granted to Dziko Clip Publisher can be revoked at any time on the Google security settings page. If access is revoked through our own tool, we delete all stored authorised data, including tokens and video IDs, within 7 days. If it is revoked through Google’s security settings, we delete all related API data within 30 days. You can also ask us to delete this data at any time by emailing info@dziko.digital.

Questions or complaints about this tool can go to info@dziko.digital or +265 882 092 624.

11. Security

We use encrypted connections (HTTPS) on this site, limit who can access client systems, and prefer providers with their own strong security practices. No system is perfectly secure, but if a breach affects your personal data we will notify you and MACRA as required by the Act.

12. Children

This site is aimed at businesses and is not directed at children. We do not knowingly collect data from anyone under 16.

13. Changes to this policy

We update this policy when our practices or the law change. The date below shows the current version. Material changes will be noted clearly on this page.

14. Contact

Dziko Digital, Blantyre, Malawi. Email info@dziko.digital, phone +265 882 092 624.