Zentry Authenticator Privacy Policy

Effective Date: 12 September 2026
Version: 1.0

1. Introduction

Zentry Authenticator is a mobile authentication application forming part of the Zentry workforce identity and access management suite.

Domiveon Limited (“Domiveon”, “we”, “us” or “our”) owns and operates Zentry.

This Privacy Policy explains how information is collected, used, stored, disclosed and protected when you use the Zentry Authenticator mobile application for Apple iOS or Google Android.

Zentry Authenticator is designed primarily for employees, contractors, consultants, and other authorised users of organisations that use the Zentry platform to secure access to corporate applications, systems, and resources.

We design Zentry according to the principles of privacy by design, data minimisation, purpose limitation and security by default.

2. Zentry’s Role and Your Organisation’s Role

Because Zentry is a workforce identity platform, responsibility for personal data may differ depending on how Zentry Authenticator is used.

Where your employer, customer, institution or other organisation provides you with access to Zentry, that organisation will normally determine why your workforce identity information is processed and will generally act as the Data Controller for that information.

Domiveon may process such information on the organisation’s behalf as a Data Processor or service provider.

Domiveon may separately act as a Data Controller for limited information necessary to:

operate and secure the Zentry platform;
maintain the reliability and integrity of the service;
detect security threats, fraud and abuse;
manage Zentry licensing and subscriptions;
provide technical support;
comply with applicable legal obligations; and
administer our contractual relationship with Zentry customers.

Where your organisation controls your Zentry workforce account, you may need to submit certain privacy requests relating to that account directly to your organisation.

3. Information Zentry Authenticator May Process

Zentry Authenticator is designed to collect only the information reasonably necessary to provide secure authentication and related identity services.

Depending on the Zentry features your organisation enables, the application may process the following categories of information.

3.1 Identity and Account Information

This may include:

your Zentry username or user identifier;
your organisation or Zentry tenant identifier;
your corporate email address, where supplied by your organisation;
account status;
authentication methods associated with your account; and
identifiers assigned to your Zentry account.

Zentry Authenticator is not intended to collect personal information unrelated to authentication or workforce identity management.

3.2 Device Registration Information

When a device is enrolled for authentication, Zentry may process information necessary to associate the device with your Zentry account, such as:

device registration identifier;
device type;
operating system and operating system version;
Zentry Authenticator version;
device security capability information;
cryptographic device identifiers generated by Zentry;
push-notification registration tokens; and
device enrolment status.

Zentry does not require access to persistent telecommunications identifiers such as your IMSI or SIM serial number for normal authentication functionality.

3.3 Authentication Information

When you authenticate using Zentry Authenticator, we may process information such as:

authentication request identifier;
date and time of authentication;
authentication method used;
authentication success or failure;
device registration involved in the request;
application or service requesting authentication;
authentication challenge and response metadata;
security and risk indicators; and
information necessary to generate, validate or manage authentication credentials.

Authentication secrets, cryptographic keys and similar security material are protected using appropriate cryptographic controls and secure storage mechanisms appropriate to the relevant authentication method.

3.4 Network and Security Information

For security, auditing and fraud-prevention purposes, Zentry services may process technical information associated with communications between Zentry Authenticator and the Zentry platform, including:

IP address;
connection timestamps;
network request metadata;
security events;
failed authentication attempts;
suspicious activity indicators; and
approximate geographic region inferred from an IP address where required for security or risk analysis.

Zentry Authenticator does not require precise GPS location for its standard authentication functionality.

If Zentry introduces a feature that requires precise device location, that feature will require appropriate permission and disclosure before accessing such information.

3.5 Diagnostic Information

Where required to diagnose errors, maintain application stability or respond to support requests, limited diagnostic information may be processed, including:

application crashes;
error codes;
application performance information;
application version;
device model; and
operating system information.

Zentry does not use diagnostic information for advertising or behavioural marketing.

4. Camera Access and QR Code Scanning

Zentry Authenticator may request access to your device camera when you choose to enrol an authentication account by scanning a QR code.

Camera access is used only for QR code scanning and related authentication-enrolment functionality.

Zentry does not use the camera to continuously monitor users, collect photographs, record video or perform surveillance.

Where supported by the operating system, you may also manually enter enrolment information instead of scanning a QR code.

5. Biometric Authentication

Zentry Authenticator may allow you to protect access to the application or approve authentication requests using biometric mechanisms provided by your device, including technologies such as:

Apple Face ID;
Apple Touch ID; or
Android biometric authentication.

Domiveon does not receive, collect or store your fingerprint, facial template or other biometric template used by your device’s operating system.

The operating system or device security subsystem performs biometric matching. Zentry Authenticator receives only an indication that the biometric authentication was successfully or unsuccessfully completed.

Your device manufacturer and operating system provider independently control how biometric information is stored and protected on your device.

6. Push Notifications

Where push authentication is enabled, Zentry Authenticator may use:

Apple Push Notification Service (“APNs”) on iOS; and
Google Firebase Cloud Messaging or another supported notification service on Android

to notify your device of authentication requests.

A push-notification token or similar technical identifier may therefore be shared with the relevant platform provider to deliver notifications.

Authentication secrets, passwords and unnecessary personal information should not be included within push-notification payloads.

Use of the underlying notification infrastructure may also be subject to Apple’s or Google’s privacy terms, as applicable.

7. How We Use Information

Information processed through Zentry Authenticator may be used to:

enrol and register devices for authentication;
generate or validate multi-factor authentication credentials;
deliver authentication requests;
allow users to approve or reject authentication requests;
support time-based one-time passwords and other authentication methods;
associate authorised devices with workforce identities;
prevent unauthorised account access;
detect suspicious or potentially fraudulent authentication activity;
enforce organisational security policies;
maintain authentication and security audit trails;
investigate security incidents;
troubleshoot technical problems;
maintain application performance and reliability;
provide customer and technical support;
protect Zentry, its customers and users from abuse or attack; and
comply with applicable legal, regulatory and contractual obligations.

We do not use information collected through Zentry Authenticator to create advertising profiles.

8. Legal Basis for Processing

Depending on your location, your organisation’s relationship with Domiveon and the purpose of processing, personal data may be processed where:

processing is necessary to provide the Zentry service;
processing is necessary for performance of a contract;
processing is required to comply with a legal obligation;
processing is necessary to protect Zentry systems and users;
your organisation has a lawful basis for processing workforce identity information;
you have provided valid consent where consent is required; or
another lawful basis permitted under applicable data-protection legislation applies.

Where consent is the applicable basis for processing, you may withdraw that consent subject to applicable legal, contractual and security requirements.

Withdrawal of consent may prevent certain Zentry functionality from operating where the relevant processing is necessary to provide that functionality.

9. Information Visible to Your Organisation

If your Zentry account is provided by an employer or other organisation, authorised administrators of that organisation may have access to information concerning your Zentry account and authentication activity.

Depending on the organisation’s configuration and administrator permissions, this may include:

your Zentry account identity;
enrolled authentication methods;
registered devices;
device status;
enrolment history;
authentication timestamps;
authentication successes and failures;
applications or services accessed using Zentry;
security or risk events associated with authentication; and
administrative actions performed against your account.

This information is intended to help organisations administer identity services, enforce security controls, investigate incidents and protect their systems.

Your organisation’s own privacy notices and employment or acceptable-use policies may also govern its use of this information.

10. Information We Do Not Sell

Domiveon does not sell personal information collected through Zentry Authenticator.

We do not use Zentry Authenticator authentication data for third-party advertising.

We do not allow third-party advertising networks to use Zentry authentication activity for targeted or behavioural advertising.

Zentry Authenticator is an identity-security application, and information processed through the application is used for authentication, security, service delivery and legitimate administrative purposes.

11. Sharing of Information

Domiveon may disclose information only where reasonably necessary for the operation, security or administration of Zentry, including to:

Customer Organisations

Where Zentry is provided through your employer or another organisation, authorised administrators of that organisation may receive information associated with your Zentry workforce account and authentication activity.

Service Providers

Domiveon may use carefully selected infrastructure, hosting, notification, communications, security, monitoring and technical-support providers to operate Zentry.

Such providers may process only the information reasonably necessary to perform services on our behalf and must implement appropriate confidentiality and security measures.

Apple and Google

Apple or Google may process limited technical information when their operating-system or notification services are used, including when push notifications are delivered through APNs or Firebase Cloud Messaging.

Legal and Regulatory Authorities

We may disclose information where required by applicable law, regulation, court order, or lawful request from a competent authority, or where necessary to protect the rights, security, or integrity of Domiveon, Zentry, our customers, or users.

Corporate Transactions

If Domiveon undergoes a merger, acquisition, restructuring or transfer of business assets, relevant information may be transferred as part of that transaction, subject to applicable data-protection requirements.

We do not disclose Zentry Authenticator information to unrelated third parties for independent marketing or advertising purposes.

12. Data Storage and Security

Zentry is a security-sensitive identity platform. Domiveon implements technical and organisational measures designed to protect information against:

unauthorised access;
unauthorised disclosure;
alteration;
accidental loss;
misuse;
destruction; and
compromise.

Depending on the component and authentication method, these measures may include:

encryption of information in transit;
encryption of sensitive information at rest;
secure cryptographic key management;
mobile operating-system secure storage mechanisms;
hardware-backed key storage where supported;
access controls based on least privilege;
authentication and administrative access controls;
security monitoring;
vulnerability management;
logging and audit controls; and
secure software-development practices.

No information system can guarantee absolute security. We continuously review security measures according to the nature and sensitivity of the information processed and evolving security threats.

13. Information Stored on Your Device

Zentry Authenticator may store authentication-related information locally on your device.

Depending on the authentication functionality enabled, this may include:

enrolled accounts;
authentication configuration;
one-time-password information;
cryptographic credentials or keys;
device registration information;
application preferences; and
limited security state information.

iOS or Android security capabilities and, where appropriate, additional Zentry security controls protect sensitive security information.

Removing an account from Zentry Authenticator or uninstalling the application may remove locally stored information but does not necessarily delete information retained by your organisation or the Zentry service.

14. Data Retention

Personal information is retained only for as long as reasonably necessary for the purposes for which it was collected, including authentication, security, audit, contractual, regulatory and legal requirements.

Retention periods may differ depending on:

the type of information;
customer configuration;
organisational security requirements;
contractual obligations;
regulatory obligations;
security investigation requirements; and
applicable law.

Authentication and security audit records may be retained for a defined security or compliance period even after an individual authentication event has completed.

When information is no longer required, Zentry will securely delete, anonymise, or otherwise dispose of it in accordance with applicable retention requirements.

Customer organisations may establish their own retention periods for workforce information processed through Zentry.

15. Account Removal and Deletion

You may remove a Zentry account or device enrolment from Zentry Authenticator where available.

Removing an account from the mobile application does not necessarily delete the corresponding workforce identity your organisation maintains.

Where your Zentry account has been created or administered by an employer or other organisation, requests to delete the organisational account should normally be directed to that organisation.

You may also contact Domiveon about deleting personal information for which Domiveon is the Data Controller.

Domiveon may retain certain information where required for security, fraud prevention, dispute resolution, regulatory compliance or another lawful purpose.

16. Your Privacy Rights

Subject to applicable law, you may have rights regarding personal information concerning you, including the right to:

obtain confirmation as to whether personal information about you is being processed;
request access to personal information held about you;
request correction of inaccurate or incomplete information;
request deletion of information where legally applicable;
object to or request restriction of certain processing;
withdraw consent where processing is based on consent;
request information regarding persons or categories of persons with whom your information has been shared; and
lodge a complaint with an appropriate data-protection authority.

Where your employer or another Zentry customer controls the information, Domiveon may refer your request to that organisation or assist it in responding to your request.

We may need to verify your identity before responding to a privacy request.

17. International Data Transfers

Depending on the Zentry deployment selected by a customer, information may be processed or stored in a country other than the country in which the user is located.

Where personal data is transferred across national borders, Domiveon takes appropriate measures to ensure that such transfers comply with applicable data-protection requirements.

For personal data subject to Ugandan law, transfers outside Uganda will be managed in accordance with applicable requirements governing international transfers and protection of personal data.

Customer-specific deployment or data-residency arrangements may also apply.

18. Application Permissions

Zentry Authenticator requests only the permissions necessary for enabled features.

Depending on your operating system and configuration, these may include:

Camera: used to scan authentication-enrolment QR codes.

Notifications: used to deliver authentication requests, security notifications and other identity-related alerts.

Biometric Authentication: used through the device operating system to protect access to Zentry Authenticator or approve authentication actions.

Network Access: used to communicate securely with Zentry services.

Zentry Authenticator does not require access to your contacts, personal photographs, microphone, SMS messages or precise location for its standard authentication functions.

Any future feature requiring additional sensitive permissions will be subject to appropriate user disclosure and operating-system permission controls.

19. Third-Party Authentication Accounts

Zentry Authenticator may support standards-based authentication credentials that can be used with third-party services.

Where a user voluntarily adds a third-party account by scanning or entering an authentication secret, the relevant credential may be stored securely on the user’s device.

Domiveon does not acquire ownership of the user’s third-party account.

The privacy practices of the organisation operating the third-party service are governed by that organisation’s privacy policy.

20. Analytics and Advertising

Zentry Authenticator does not contain third-party advertising and does not use authentication activity for behavioural advertising.

If Domiveon uses application analytics or crash-reporting technologies, it will limit their use to maintaining security, reliability, and performance, and will reflect relevant data collection in this Privacy Policy and applicable App Store or Google Play privacy disclosures.

Domiveon does not permit analytics providers to use Zentry authentication data for advertising profiling.

21. Children

Zentry Authenticator is a workforce and enterprise identity-security product and is not designed or marketed for children.

We do not knowingly use Zentry Authenticator to collect personal information from children for consumer purposes.

Where an organisation lawfully provides Zentry access to a person who has not reached the age of majority, that organisation is responsible for ensuring that the use and processing of personal information is lawful and appropriately authorised.

22. Security Incidents

If Domiveon becomes aware of a personal-data breach affecting information for which it has notification responsibilities, Domiveon will assess the incident and notify affected customers, individuals, and competent authorities where required by applicable law.

Customers using Zentry may have separate notification obligations concerning information for which they act as Data Controller.

23. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

changes to Zentry functionality;
changes to our data-processing practices;
changes to applicable law or regulation;
changes to service providers; or
improvements to our privacy and security practices.

When we make material changes, we will update the effective date of this Privacy Policy and provide additional notice where required.

We will make the current version of this Privacy Policy available through the Zentry website, within Zentry Authenticator, or through another readily accessible location.

24. Contact Us

If you have questions about this Privacy Policy, Zentry’s privacy practices or the handling of your personal information, you may contact:

Domiveon Limited
Plot 7 Lourdel Road
Nakasero
Kampala, Uganda

Email: info@domiveon.com

Subject: Zentry Privacy Request

Where appropriate, you may also submit privacy requests to the Data Protection Officer or privacy representative identified by Domiveon.

If your Zentry account is managed by your employer or another organisation, you may also contact that organisation’s Human Resources, Information Security, Privacy or Data Protection function regarding its processing of your workforce information.

25. Supervisory Authority

Individuals in Uganda may also have the right to contact or lodge a complaint with the relevant data-protection supervisory authority:

Personal Data Protection Office (PDPO)
Kampala, Uganda

Nothing in this Privacy Policy limits any rights available to you under applicable data-protection law.