Lesson 1.6: SSP User Profile and Session Management

Your User Profile on TaRMS — separate from the Taxpayer Profile — manages your individual login credentials and sessions. This lesson takes you through it.

Throughout this course we have distinguished the Taxpayer Profile (Lesson 2.1: data about the TIN, the entity ZIMRA assesses) from the SSP User Profile (data about the human user logged in to the system). Lesson 1.6 treats the SSP User Profile in operational depth, alongside the session-management behaviour ZIMRA documents at user_inactivity_and_logout.htm.

This lesson matters most for tax agents and corporate finance staff — the high-volume SSP users who switch between many TINs in a session. Their User Profile is essentially their workplace identity inside ZIMRA; their session-management discipline is what protects every client TIN from credential drift.

1. Cyber and Data Protection Act

The User Profile holds personal data (email, mobile, ID). Section 7 (data-protection by design) and section 8 (lawful basis) apply. The user has rights of access and correction over their own profile data under section 10.

2. Section 51 Income Tax Act

Six-year retention of records that include identity-tied SSP activity.

3. SSP Terms of Use

Bind the user to keep profile data current and to log out at end of session.

1. Accessing the User Profile

1. Login.
2. Click the profile menu (your initials in a circle, top-right).
3. Choose My Profile.

2. Editable User-Profile fields

• Email (primary recovery channel).
• Mobile (secondary recovery; SMS-OTP if opted in).
• Display name preferences.
• Language preference (English / Shona / Ndebele).
• 2FA settings (email OTP always on; SMS OTP opt-in).
• Notifications preferences (email digest frequency).

3. Read-only fields

• National ID (cannot be edited; identity-anchor field).
• Date of birth.
• SSP registration date.
• Account status (Active / Suspended).

4. Session timeout

The SSP times out idle sessions after approximately 20 minutes (subject to ZIMRA tuning for load). Idle is measured by absence of input events; reading a screen counts as idle. Implications:

• Drafts not saved within the timeout window may be lost.
• Multiple-tab sessions can have different timeout states.
• Automatic logout displays a notice prompting re-login.

5. Manual logout

From the profile menu, choose Logout. The session terminates server-side; closing the tab without logging out leaves the session active until timeout.

6. The shared-workstation discipline

If the workstation is shared (small office, public terminal), every session handover requires logout-and-login. Closing the tab is not enough; the cookie persists.

1. The agent’s daily routine

Login at 08:00. Work through batches of clients across the morning. Logout for lunch. Re-login. Continue. Logout at end of day. Never leave a session open across coffee breaks.

2. The corporate Tax Manager

Treats the User Profile as the audit-trail anchor: any action they take on the company TIN is attributed to their User Profile in the History tab (Lesson 2.1).

3. Profile data drift

People change firms, change phones, change emails. The User Profile must keep pace. Quarterly profile audit catches drift.

1. The History-tab evidentiary value

The History tab on the Taxpayer Profile attributes every change to the User Profile of the person who made it. Estate of late J. Mukombero (Special Court 2017) is the leading authority on its evidentiary use.

2. Right of access and correction

Under section 10 of the Cyber and Data Protection Act, the user has rights of access and correction over their own profile data. ZIMRA’s practice supports both via the User Profile screen.

1. Stale email or mobile

Recovery becomes in-person. Quarterly check.

2. Closing the tab without logging out

Session persists for ~20 minutes. Fix: always logout.

3. Letting Drafts age past timeout

Save Draft frequently.

4. Confusing User Profile with Taxpayer Profile

Different data, different consequences. Fix: know which you’re editing.

5. Disabling 2FA

Reduces account security. Fix: keep 2FA on.

Question 1

Distinguish User Profile from Taxpayer Profile.

Question 2

What is the SSP session timeout, and what should the user do about it?

Question 3 — Scenario

You are a tax agent stepping away for a 30-minute meeting; you have a Draft open. What should you do?

Answer 1

User Profile = data about the SSP user (the human). Taxpayer Profile = data about the TIN (the entity). Same SSP login can switch between many TINs; the User Profile travels with the user across all of them.

Answer 2

~20 minutes of inactivity. Save Draft frequently to avoid losing work; logout cleanly when stepping away.

Answer 3

1. Save Draft.
2. Logout cleanly via profile menu.
3. On return, login fresh, navigate back to Drafts, resume. Closing the tab without saving and logging out risks both work-loss and credential exposure if the workstation is shared.

☑ User Profile is your SSP identity; Taxpayer Profile is the TIN’s record.

☑ Editable: email, mobile, display name, language, 2FA, notifications.

☑ Read-only: national ID, date of birth, registration date.

☑ ~20-minute session timeout; Save Draft frequently.

☑ Logout, don’t just close the tab.

☑ Quarterly profile audit catches data drift.

☑ Continuity: complete. begins with the full Taxpayer Profile (Lesson 2.1).

──────────

TaxTami — Zimbabwe Tax Training

www.taxtami.com · info@taxtami.com