Legal · Data Protection
AES Privacy Policy
Covers the AES Operations & Finance Management System — admin console, web app, and mobile app.
In short
- This system is for authorised staff of Airflow Environmental Solutions and its client sites only — there is no public sign-up.
- Every account has one role, and that role decides exactly what data it can see — including which mine site's data.
- Financial approvals, payroll runs, and record changes are logged in an append-only audit trail that nobody can edit or delete.
- Payroll and financial records are kept only as long as the law and our contracts with Airflow Environmental Solutions require.
01Introduction & scope
This Privacy Policy explains how Airflow Environmental Solutions ("AES," "we," "us," or "our") collects, uses, discloses, and protects information through the AES Operations & Finance Management System — comprising an admin console, a web application, and a mobile application (together, the "System"). The System was designed and built for AES by VultureNest, which continues to host, maintain, and support it on AES's behalf.
By logging into or otherwise using the System, you agree to the collection and use of information as described in this Policy.
02Who uses this system
The System is an internal operations and finance platform. Every user is issued an account by a System Administrator and assigned exactly one role, which determines what they can see and do:
Site Manager and Site Clerk accounts are additionally scoped to a single site — for example, a Mimosa-scoped account never sees Unki or Zimplats data.
03Information we process
Account & identity data
- Full name, work email address, and password;
- Assigned role and, where applicable, site scope;
- Login activity, session data, and audit-log entries recording who did what and when.
Operational & financial data
- Timesheets, requisitions, travel claims, and petty-cash vouchers you or your site raise;
- Clients, contracts, orders, expenses, budgets, and loans entered into the System;
- Comments, board cards, project updates, and site (SHE) reports.
Much of this is business data belonging to Airflow Environmental Solutions rather than personal data about you — but where it identifies you (e.g. "raised by," "approved by"), it is treated as personal data under this Policy.
04Payroll & statutory data
For users processed through payroll, the System additionally holds employment and payroll information needed to run payroll and meet statutory obligations, including:
- Pay rate, hours worked, overtime, and acting/back-pay adjustments;
- Statutory deduction and contribution records — PAYE, NSSA, ZIMDEF, NEC, AIDS levy, and similar Zimbabwean statutory items — and the returns filed from them;
- Bank or mobile money details used to pay salaries and disburse advances;
- Generated payslips and payroll bank schedules.
This data is entered by Finance Officers, approved by a Finance Director, and — once a payroll run is approved — the run locks and can no longer be edited, preserving an accurate historical record for statutory reporting.
05Mobile app permissions
The AES mobile app is used mainly by Site Managers, Site Clerks, and Operations Staff for field capture — timesheets, requisitions, and project updates — including offline, with data syncing once back online. The app may request:
| Permission | Why we ask |
|---|---|
| Network access | To sync timesheets, requests, and approvals with the System when connectivity is available. |
| Local storage | To keep your work available while offline at a site, so nothing is lost before it can sync. |
| Notifications | To alert you to approvals, requests, and danger alerts assigned to your role. |
06How data is used
We use the information processed by the System to:
- Operate approvals, requisitions, budgets, timesheets, payroll, and financial reporting;
- Enforce segregation of duties, so nobody can approve or settle their own request;
- Compute and file statutory payroll obligations and VAT/tax positions;
- Maintain an audit trail of who created, changed, or approved each record;
- Provide role- and site-specific dashboards, including the Command Centre and danger alerts;
- Secure the platform and investigate suspected misuse.
07Access control & safeguards
The System's data-protection design is built around a small number of hard rules, enforced by the platform itself — not just policy:
Whoever raises a requisition, claim, or withdrawal can never be the one who approves or settles it.
Site-level accounts only ever see their own site's data — enforced server-side, not just hidden in the interface.
Every change is logged with actor and timestamp; entries cannot be edited or deleted, by anyone.
Approved payroll runs and locked timesheet periods cannot be silently edited — reopening requires an explicit, audited unlock.
The Auditor role can view records across the business but cannot create, edit, or approve anything.
Director-confidential boards are filtered out server-side for every non-director role, not merely hidden on screen.
08Sharing & disclosure
We do not sell personal or financial data. Information in the System is shared only:
- Within Airflow Environmental Solutions — to the roles and site scope that legitimately need it, as set out in Section 2;
- With statutory bodies — such as ZIMRA, NSSA, and other relevant authorities, where a payroll or tax return legally requires it;
- With VultureNest — as the developer that hosts, maintains, and provides technical support for the System, under confidentiality obligations to AES;
- Where legally required — to comply with a legal obligation, or to protect the rights, property, or safety of AES, its staff, or others.
09Data retention
Operational data is retained for as long as your account is active and needed to run the business. Financial, tax, and payroll records are retained for the periods required by applicable Zimbabwean statutory and tax record-keeping obligations, even after an account is deactivated. Audit-log entries are retained indefinitely, by design, as an append-only record.
10Your rights & choices
Subject to applicable law, including Zimbabwe's Cyber and Data Protection Act, you may:
- Ask what personal data the System holds about you;
- Ask us to correct inaccurate personal data;
- Ask us to delete personal data that is not subject to a statutory retention requirement (this does not extend to locked payroll, tax, or audit records that AES is legally required to keep);
- Raise a concern about how your data is being used.
Most requests are best directed to your organisation's System Administrator first, since they manage your account; you can also contact us using the details in Section 14.
11Children's privacy
The System is a workplace tool for employees and contractors and is not directed at, or intended for use by, children. We do not knowingly collect personal data from children through the System.
12International transfers
Hosting and technical infrastructure supporting the System may be located outside Zimbabwe. Where this is the case, we take reasonable steps to ensure your information continues to receive an appropriate standard of protection.
13Changes to this policy
We may update this Policy from time to time. We will update the "Last updated" date above and, for material changes, notify affected users through the System or via their System Administrator.
14Contact us
Questions about this Privacy Policy or a data request can be directed to: