Privacy Policy
Last Updated: • Compliant with Zimbabwe Cyber Security & Data Protection Act [Cap 12:07] & GDPR
Mabasa (operated by HOIST Inc.) does not sell, rent, or monetize your personal data. Bookmarks and job application tracker states are stored securely in our database (DB) solely to provide your personal career workspace.
1. Introduction & Data Controller Identity
Welcome to Mabasa, operated by HOIST Inc. ("we", "our", or "us"). We prioritize user data protection and privacy transparency across our free job search aggregation feed, database-backed bookmark engine, and Kanban application tracker.
This Privacy Policy details how we collect, handle, store, and safeguard your personal information when you access or use our platform in Zimbabwe and internationally.
2. Information We Collect & Process
We process minimal personal data necessary to deliver candidate workspace functionality:
- Database-Stored Bookmarks & Tracker Records: When you bookmark a job posting or move an application to your Kanban pipeline (Applied, Interview, Offer, Rejected), these records are securely stored in our backend Database (DB) linked to your session identifier or user account.
- Session & Authentication Telemetry: Session tokens, encrypted authentication parameters, IP addresses, browser types, and device telemetry required for account persistence and security protection.
- Aggregated Search Data: Filter parameters, search queries, and source click-through metrics processed in anonymized form to optimize system performance.
3. Compliance with Zimbabwe Cyber Security & Data Protection Act
For job seekers in Zimbabwe, our processing adheres strictly to the Cyber Security and Data Protection Act [Chapter 12:07] enforced by the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ):
- Lawful & Fair Processing: We collect and store data exclusively with a lawful, transparent basis.
- Purpose Specification: Candidate database records are processed strictly for job search organization and candidate workspace features.
- Cross-Border Transfer Protection: Any international database replication or backup uses encrypted cloud architecture under Standard Contractual Clauses (SCCs).
4. Lawful Basis & Non-Sale Guarantee
Under GDPR, CCPA, and global frameworks, we process data based on:
- Contractual Performance: Processing required to maintain your saved bookmarks and application pipeline in our database.
- Legitimate Interests: Maintaining platform stability, preventing scraping abuse, and securing API endpoints.
Strict Non-Sale Guarantee: We do not sell, trade, or share your personal data, saved bookmarks, or browsing history with third-party data brokers or advertising networks.
5. Database Security & Retention
All database records are encrypted in transit using TLS 1.3 and at rest using AES-256 enterprise encryption standards. Bookmarks and application tracker records remain active while your account or session is active.
You may request deletion of your stored database records at any time. Upon receiving an erasure request, all corresponding database records will be permanently purged within 30 days.
6. Your Privacy Rights & Contact
You retain rights to access, port, rectify, or request deletion of your personal data stored in our database.
To exercise your privacy rights or contact our Data Protection Officer, please email: