Privacy Policy

Castel Code ("we," "us," or "our") is a software development company registered and operating in Lusaka, Zambia. We operate under the brand name Castel Code — Center of App and Software, accessible via castelcode.tech and related digital platforms.

We provide mobile app development, web development, AI/ML solutions, robotics, automation consulting, and online programming education services. This Privacy Policy applies to all services, websites, applications, and online learning platforms operated by Castel Code.

We collect information you provide directly, automatically through your use of our services, and occasionally from third parties.

• →
  Identity Data: Full name, username or similar identifiers, date of birth (where required for age verification).
• →
  Contact Data: Email address, phone number (including WhatsApp), physical address.
• →
  Payment Data: Transaction amounts, mobile money references (e.g. MTN MoMo, Airtel Money). We do not store full card details.
• →
  Technical Data: IP address, browser type and version, device identifiers, operating system, time zone, cookies.
• →
  Usage Data: Pages visited, features used, session duration, click paths, error reports.
• →
  Communications: Messages sent via email, WhatsApp, or our contact forms for support or enrollment inquiries.
• →
  Educational Data: Course enrollments, lesson attendance, project submissions, and progress records for online learning sessions.

We use your personal data only for lawful purposes and only to the extent necessary. Specifically, we use it to:

• ✓
  Enroll you in and deliver online programming courses and sessions.
• ✓
  Process payments and issue course completion certificates.
• ✓
  Communicate with you about session schedules, updates, and support requests.
• ✓
  Improve our services, content, and user experience through analytics.
• ✓
  Send promotional materials about new courses — only with your consent.
• ✓
  Comply with legal obligations under Zambian law and applicable regulations.
• ✓
  Prevent fraud, abuse, and ensure the security of our platforms.

We do not sell, rent, or trade your personal information. We may share it only in the following limited circumstances:

• →
  Service Providers: Trusted third-party tools (e.g. Google Workspace, Firebase, payment processors) that help us operate our services, bound by data protection agreements.
• →
  Legal Requirements: When required by Zambian law, court order, or regulatory authority.
• →
  Business Transfers: In the event of a merger or acquisition, your data may transfer subject to the same protections.
• →
  Your Consent: With your explicit, informed consent for any other sharing purpose.

Our website and apps may use cookies and similar tracking technologies to enhance your experience.

• →
  Essential Cookies: Required for core functionality like session management and security. Cannot be disabled.
• →
  Analytics Cookies: Help us understand how users interact with our platforms (e.g., Google Analytics). You can opt out.
• →
  Preference Cookies: Remember your settings and preferences to personalise your experience.

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law.

• →
  Course enrollment and payment records: retained for 5 years for legal and accounting purposes.
• →
  Communications and support inquiries: retained for 2 years.
• →
  Analytics data: retained in aggregated, anonymised form indefinitely.
• →
  Inactive accounts: reviewed and purged after 3 years of inactivity.

Depending on your location and applicable law, you have the following rights regarding your personal data:

• ✓
  Right of Access: Request a copy of the personal data we hold about you.
• ✓
  Right to Rectification: Request correction of inaccurate or incomplete data.
• ✓
  Right to Erasure: Request deletion of your data where there is no legal basis for retention.
• ✓
  Right to Restrict Processing: Ask us to limit how we use your data.
• ✓
  Right to Data Portability: Receive your data in a structured, machine-readable format.
• ✓
  Right to Object: Object to processing based on legitimate interests or direct marketing.
• ✓
  Right to Withdraw Consent: Withdraw consent at any time where processing is consent-based.

To exercise any right, contact us at castelcode.tech@gmail.com. We will respond within 30 days.

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include:

• →
  Encrypted data transmission using HTTPS/TLS across all our web services.
• →
  Secure cloud infrastructure via Firebase and other certified providers.
• →
  Role-based access controls limiting who can access user data internally.
• →
  Regular security reviews and updates to our systems and dependencies.

Our programming courses welcome students of various ages. For users under the age of 16, we require verifiable parental or guardian consent before collecting or processing personal data.

We do not knowingly collect personal data from children under 13 without parental consent. If you believe a child has provided personal data without consent, please contact us immediately and we will delete it.

Our platforms may contain links to third-party websites, tools, or services (e.g. GitHub, YouTube tutorial links, payment gateways). We are not responsible for the privacy practices of those third parties.

We encourage you to review the privacy policies of any third-party service you interact with through our platforms.

Castel Code operates primarily in Zambia. However, some of our service providers (such as Google Firebase, Google Analytics) may process data outside of Zambia, including in the European Union and United States.

Where data is transferred internationally, we ensure appropriate safeguards are in place — such as standard contractual clauses or adequacy decisions — to protect your data to the same standard as this policy.

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal requirements. When we make significant changes, we will:

• →
  Update the "Last Updated" date at the top of this page.
• →
  Notify registered users via email or in-app notification.
• →
  Post a notice on our website for at least 30 days before changes take effect.

Your continued use of our services after changes become effective constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

We aim to respond to all privacy-related enquiries within 30 business days.