Privacy Notice

When you register and apply for an airport identification card, we collect:

• Identity details — name, date of birth, gender, nationality, NRC or passport number, place of birth
• Contact details — email address, phone number, postal and physical addresses, residential address history
• Your photograph and signature
• Employment details — employer, position, contract category and dates, previous employer, supervisor
• Permit details — whether you have previously held an airport ID, the previous permit number, the type of access applied for and the reason for the application
• Next of kin name, phone number and relationship
• Security compliance records — vetting history, fingerprint clearance status, awareness training attendance
• Electronic signature records — when you or an approving officer sign a form, we record the signer’s name and role, the exact date and time, the IP address and device used, and a reference that identifies the signature. Your signing PIN itself is stored only as a one-way hash and can never be read back
• Technical records — sign-in times, IP address and device information, and an audit trail of actions taken on your application

We do not store fingerprint images or other biometric templates. Fingerprints are taken and held by the Zambia Police Service; this system records only that clearance took place and when it expires.

We process this data to meet ZACL’s legal obligations under the Aviation Act and the National Civil Aviation Security Programme, and because it is necessary for the legitimate purpose of controlling access to security restricted areas. Where we rely on your consent — for example the consent you give when submitting an application — you may withdraw it, though we may then be unable to issue or maintain your airport ID.

Your personal data is used solely for the following purposes:

• Processing and verifying your application for an airport identification card
• Security vetting and background checks required under the National Civil Aviation Security Programme
• Issuing, renewing, replacing and revoking airport identification cards
• Controlling and auditing access to security restricted areas at ZACL airports
• Managing mandatory awareness training and fingerprint clearance records
• Sending you notifications about your application, card and training by email, SMS or in-app message

We do not use your data for marketing or sell it to third parties.

• Your employer’s authorised signatory and ZACL approval officers, as part of the application workflow
• The Zambia Police Service, for fingerprint clearance
• Service providers who deliver email and SMS notifications on our behalf, who receive only the details needed to deliver the message
• Regulators and law enforcement where the law requires it

Data is held on access-controlled systems. Access is limited by role, every approval and change is recorded in an audit trail, passwords are stored using strong one-way hashing, and connections are encrypted in transit.

We keep application and card records for as long as you hold a valid airport identification card and thereafter for the retention period required by civil aviation security regulations, after which records are securely deleted or anonymised.

Under the Data Protection Act, 2021 you have the right to:

• Access a copy of the personal data we hold about you
• Have inaccurate or incomplete data corrected
• Object to, or request restriction of, processing
• Request deletion of data we no longer have grounds to keep
• Withdraw consent, where processing is based on consent (this may mean we cannot issue or maintain your airport ID)
• Lodge a complaint with the Office of the Data Protection Commissioner

To exercise any of these rights, contact the ZACL Permit Office or write to id@kkia.zacl.zm.