Privacy Policy

Zhou Forex Academy is a forex education business operating from Salamat Heights, Office 203, Bulawayo, Zimbabwe. When you use our website, portal, WhatsApp service or mobile app, we are the data controller for the information described here — meaning we decide what is collected and why, and we are answerable for it.

We are an education and signals provider. We are not a broker, we do not hold client funds, and we do not execute trades on your behalf. Deposits you make through us fund an account with a third-party broker, and withdrawals are claims we process. That distinction matters for this policy because it limits what financial data we ever see.

We collect only what a specific part of the service needs. If you never request a withdrawal, we never hold a proof of payment; if you never submit KYC, we hold no identity document.

We do not buy personal information about you from anyone else, and we do not sell yours to anyone.

We use your information to do these things and nothing else:

• Run your account — sign you in, keep you signed in, and show you the programmes and signal channels you are enrolled in.
• Deliver the service you paid for — send you trade signals and their updates, run the rooms, and keep your watchlist.
• Move money correctly — process a deposit, assess a withdrawal claim against the evidence you provide, and keep a record of both.
• Meet legal and anti-fraud obligations — verify identity where required, and keep an audit trail of sensitive actions.
• Support you — answer your enquiries by email, WhatsApp or live chat.
• Keep the service working — diagnose crashes and errors.

We rely on your consent for push notifications and marketing email; on the performance of our contract with you for the account, signals and payments; and on our legitimate interest in a secure, working service for audit logs and error reports. You can withdraw consent at any time without affecting anything else.

We share personal information with the service providers below, each only to the extent that provider needs to do its job. They process it on our instructions and may not use it for their own purposes.

We will also disclose information where the law requires it — a court order, a lawful request from a regulator, or where it is necessary to investigate fraud against us or against you.

Anything you post in a room is visible to the other members of that room and to our administrators. Please do not put your account number, a password, or a photograph of an identity document into a chat.

Our systems run on Amazon Web Services in the us-east-1 region, in the United States, and this website is served by Vercel. Uploaded files — KYC documents, proof of payment, images posted in rooms — are held in Amazon S3 in that same region.

This means your information is transferred outside Zimbabwe. We make that transfer on the basis of your consent to this policy and because it is necessary to provide the service you have asked for. Our providers are bound by their own contractual data protection terms.

• Account information — for as long as your account is open, and for a period afterwards so that we can answer questions about past enrolments and payments.
• Payment and withdrawal records — kept as financial records. We will not delete these on request while we are required to hold them.
• KYC documents — kept while your account is open and for the period our obligations require, then deleted.
• Room messages — kept while the room exists.
• Push tokens — deleted when you sign out or turn notifications off.

Trade signals are time-sensitive, so the app asks permission to send notifications and, on iOS, to mark the most urgent ones so they can reach you through a Focus mode. You can refuse, and you can turn them off later in your device settings or on the account screen — the rest of the app carries on working.

A notification's text can appear on your lock screen. If you would rather it did not, hide notification previews for the app in your device settings.

We send service messages about your account and your signals. We will only send marketing messages if you have opted in, and every one of those has an unsubscribe.

We use a small number of strictly necessary cookies to keep you signed in. Your session is held in a cookie that scripts on the page cannot read, which is what stops a malicious script from stealing it. In the mobile app the equivalent token is held in the device keychain instead.

We also store a cache of your signals on your own device so the app opens instantly and works when you are briefly offline. That cache is cleared when you sign out. We do not use advertising or cross-site tracking cookies.

Passwords are hashed, never stored in a readable form. Traffic between your device and us is encrypted in transit. Access to administrative tools is role-based, and sensitive actions are written to an audit log that records who did what and when. Uploaded documents are stored privately and served only through short-lived signed links.

No system is perfectly secure. If a breach occurs that puts your rights at risk, we will tell you and the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) without undue delay.

Under the Cyber and Data Protection Act [Chapter 12:07] you have the right to:

• Ask what we hold about you, and get a copy.
• Correct anything inaccurate — you can change most of it yourself on the account screen.
• Ask us to delete your information, subject to records we are legally required to keep.
• Object to or restrict a particular use, including marketing.
• Withdraw consent you previously gave.
• Complain to POTRAZ as the data protection authority if you believe we have handled your information wrongly.

To exercise any of these, email us at the address below. We will respond within 30 days. We may ask you to confirm your identity first — not to obstruct you, but because handing your information to someone impersonating you would be the worse outcome.

Deleting your account. You can ask us to close and delete your account at any time by emailing us. We will remove your profile, your posts, your device tokens and your uploaded documents, and retain only the financial records we are obliged to keep.

Our services are for adults. You must be 18 or older to open an account. We do not knowingly collect information about anyone under 18, and if we discover we have, we will delete it. If you believe a child has given us their information, contact us and we will act on it.

We will update this page when what we do changes. The effective date at the top always reflects the current version. If a change materially affects your rights we will tell you directly — by email or in the app — rather than relying on you noticing a new date.

For anything in this policy, including a request to see or delete your information:

You can also reach the data protection authority directly: Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), potraz.gov.zw.

General enquiries go here instead.