Privacy Policy

Effective date: 01 January 2026

Last updated: 30 July 2026

Version: 1.0

1. Introduction

Mwanachuo Hub respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how Mwanachuo Hub collects, records, uses, stores, shares, protects and otherwise processes personal data when you access or use:

The Mwanachuo Hub website;

Any Mwanachuo Hub mobile application;

Student marketplace services;

Product and service listings;

Hostel, housing and roommate-search features;

Lost & Found features;

Study groups;

Events and volunteering features;

Messaging, comments, reviews and support services;

Seller, service-provider and student-verification services; and

Any other service provided under the Mwanachuo Hub brand.

Mwanachuo Hub is designed for higher-education students, student entrepreneurs, local businesses, service providers, landlords, hostel operators and members of surrounding campus communities. Its publicly visible services currently include marketplace listings, services, housing, study groups, events, volunteering, messaging, reviews and Lost & Found functions. �

Mwanachuo Hub +2

This Policy is intended to comply with:

The Personal Data Protection Act, 2022, now cited as Chapter 44 of the Laws of Tanzania;

The Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023;

Applicable directives, guidelines and decisions issued by the Personal Data Protection Commission;

Other applicable laws of the United Republic of Tanzania relating to electronic transactions, communications, cybersecurity, consumer protection and lawful disclosure of information.

The Personal Data Protection Act came into force on 1 May 2023 and establishes the legal framework governing the collection, use, storage, disclosure and transfer of personal data in Tanzania. �

PDPC

Please read this Policy carefully. By creating an account or using Mwanachuo Hub, you acknowledge that you have been informed of the personal-data processing described in this Policy.

Consent will be requested separately where consent is legally required. Merely publishing this Policy does not replace specific consent required for sensitive personal data, marketing, optional location access or other processing that requires a separate affirmative choice.

2. Who Is Responsible for Your Personal Data?

For purposes of this Privacy Policy, the data controller is:

Tanzanite Tech [insert complete registered legal name]

Trading as Mwanachuo Hub

Registered address: [Insert registered address]

Postal address: [Insert postal address]

Company registration number: [Insert registration number]

TIN: [Insert TIN]

PDPC registration number: [Insert data-controller registration number]

Email: [Insert privacy email]

Telephone: [Insert telephone number]

Tanzanite Tech determines why and how personal data is processed through Mwanachuo Hub and is therefore ordinarily the data controller.

Certain organizations that provide hosting, payment, communication, security, analytics or customer-support services may process personal data on our instructions as data processors.

Independent sellers, service providers, landlords, event organizers and other Users may become separate data controllers when they independently decide how to collect or use another User’s personal information. For example, a landlord who collects a tenant’s identification documents outside Mwanachuo Hub may be independently responsible for that processing.

A person or organization must not collect or process personal data in Tanzania without being appropriately registered with the Personal Data Protection Commission as a data controller or data processor. Tanzanite Tech must therefore complete and maintain its applicable PDPC registration before operating personal-data processing activities. �

PDPC +1

3. Scope of This Policy

This Policy applies to personal data processed when you:

Visit the Mwanachuo Hub website or application;

Create or manage an account;

Search for products, services, accommodation or other opportunities;

Post, edit or remove a Listing;

Buy, sell, reserve or request a product or service;

Communicate through Mwanachuo Hub;

Join or manage a study group;

Post or respond to Lost & Found information;

Search for hostel, rental or roommate opportunities;

Submit a review, rating, report or complaint;

Contact customer support;

Participate in surveys, competitions or promotional campaigns;

Apply for verification;

Interact with our emails, advertisements or social-media pages; or

Otherwise interact with Tanzanite Tech concerning Mwanachuo Hub.

This Policy does not govern the independent privacy practices of third-party websites, payment companies, delivery providers, universities, landlords, sellers or service providers that operate outside Mwanachuo Hub.

4. Important Definitions

4.1 Personal data

“Personal data” means information relating to an identified or identifiable natural person.

Examples include a person’s name, telephone number, email address, identification number, photograph, device information, account information and location information.

4.2 Sensitive personal data

Sensitive personal data includes information that may create a higher risk of harm if misused. Depending on the circumstances, it may include:

Racial or ethnic origin;

Political opinions or affiliations;

Religious or philosophical beliefs;

Health information;

Genetic data;

Biometric information;

Gender-related information;

Marital and family information;

Information about children;

Banking or financial information; and

Other information classified as sensitive under applicable law.

The PDPC identifies information concerning health, biometrics, banking, religion, political views, marriage, family and children as examples of sensitive personal data. �

PDPC

4.3 Processing

“Processing” includes any operation performed on personal data, including collecting, recording, organizing, storing, updating, retrieving, viewing, using, sharing, transmitting, restricting, anonymizing, erasing or destroying it.

4.4 Data subject

A “data subject” is the individual to whom the personal data relates.

4.5 User Content

“User Content” includes Listings, profiles, photographs, videos, messages, questions, comments, reviews, reports, group posts, Lost & Found notices and other information submitted by Users.

5. Our Data-Protection Principles

Mwanachuo Hub processes personal data according to the following principles:

5.1 Lawfulness, fairness and transparency

We will process personal data only for lawful purposes and will provide reasonably clear information about how it is used.

5.2 Purpose limitation

We will collect personal data for specific, explicit and legitimate purposes. We will not use it for an incompatible new purpose without an appropriate legal basis and, where required, further notice or consent.

5.3 Data minimization

We will collect only the personal data reasonably necessary for the intended purpose.

5.4 Accuracy

We will take reasonable steps to keep personal data accurate and up to date and to correct or remove materially inaccurate information.

5.5 Storage limitation

We will not retain identifiable personal data longer than reasonably necessary for the applicable purpose, legal obligation, safety requirement or dispute.

5.6 Integrity and confidentiality

We will use appropriate technical and organizational measures to protect personal data against unauthorized access, misuse, alteration, loss, destruction and unlawful disclosure.

5.7 Accountability

We will maintain appropriate policies, records, contracts, controls and compliance procedures to demonstrate responsible processing.

The Regulations require personal data to be processed lawfully, fairly and transparently; collected for legitimate and specified purposes; limited to what is necessary; kept accurate; retained only as necessary; processed consistently with data-subject rights; and protected by appropriate technical and organizational measures. �

PDPC

6. Personal Data We May Collect

The specific information we collect depends on how you use Mwanachuo Hub.

6.1 Account and identity information

We may collect:

Full name;

Username;

Date of birth or age confirmation;

Gender, where voluntarily provided or operationally necessary;

Profile photograph;

Email address;

Telephone number;

Password in encrypted or securely hashed form;

Preferred language;

Account type;

Registration date;

Account status;

Communication preferences; and

Authentication or password-reset records.

We should never store a password in readable plain text.

6.2 Student and educational information

Where student status is relevant, we may collect:

Name of university, college or higher-education institution;

Campus or study location;

Student identification number;

Institutional email address;

Programme or field of study;

Year of study;

Expected graduation year;

Student identification photograph;

Admission or enrolment evidence; and

Student-verification status.

We will collect only the minimum information necessary for verification. Where possible, we will retain confirmation that verification was completed rather than permanently keeping a complete copy of the document.

Mwanachuo Hub does not represent that a User is academically qualified, in good standing or currently enrolled merely because the User has provided the name of an institution.

6.3 Seller and service-provider information

We may collect:

Seller or business name;

Business-registration information;

Tax identification information;

Business address;

Service area;

Professional qualifications;

Licences or permits;

Seller description;

Product or service categories;

Operating hours;

Prices;

Payment or payout details;

Verification documents;

Transaction history;

Performance records;

Customer reviews;

Complaints and dispute history; and

Seller subscription or promotional-package information.

6.4 Listing information

When you post a Listing, we may collect:

Listing title and description;

Price;

Product condition;

Category;

Quantity;

Availability;

Photographs and videos;

General location;

Delivery or collection information;

Product specifications;

Service details;

Accommodation details;

Contact preferences;

Date and time of posting;

Listing views and engagement; and

Listing moderation history.

Listing information may be publicly visible.

6.5 Hostel, housing and roommate information

We may collect:

General property location;

Property photographs;

Rent, deposit and other charges;

Property facilities;

Room type;

Availability;

Distance from campus;

Landlord, agent or hostel-operator details;

Proof of authority to list the property;

Property-verification records;

Preferred roommate information;

Housing inquiries;

Viewing requests; and

Reports or complaints concerning a property.

Users should not place complete identity-document numbers, exact residential addresses, private tenancy records or other unnecessary sensitive information in public housing Listings.

6.6 Lost & Found information

When you post or respond to a Lost & Found notice, we may collect:

Description of the item;

Approximate location and date of loss or discovery;

Photographs;

Ownership-verification information;

Messages between the finder and claimant;

Handover arrangements;

Reported misconduct; and

Resolution status.

Users must not publicly display full identification numbers, bank-card numbers, passwords, access codes, academic record numbers or other confidential details found on an item.

We may temporarily restrict certain identifying details so that a claimant can prove ownership.

6.7 Study-group information

We may collect:

Group name and description;

Subject or course;

Institution or campus;

Group members;

Group administrator;

Meeting location or online link;

Schedule;

Messages and posts;

Shared resources;

Membership requests; and

Reports of misconduct.

Users must not upload confidential examination material, unlawfully copied books, unauthorized academic records or another student’s personal information.

6.8 Event and volunteering information

We may collect:

Event registration details;

Ticket information;

Attendance status;

Volunteer interests;

Availability;

Emergency contact, where reasonably necessary;

Accessibility requirements;

Payment confirmation;

Feedback;

Photographs or recordings, where notice and any required consent have been provided; and

Safety or incident information.

We will request health, disability or accessibility information only when necessary to provide appropriate support and with the required protection.

6.9 Transaction and payment information

Depending on the services available, we may collect:

Order or booking details;

Product or service selected;

Amount;

Transaction reference;

Payment method;

Payment status;

Refund status;

Seller payout information;

Mobile-money telephone number;

Billing information;

Receipt or invoice information;

Fraud indicators; and

Payment-related communications.

Where payment is processed by an independent bank, mobile-money operator or payment gateway, Mwanachuo Hub may receive confirmation and transaction references without receiving the complete card, PIN or mobile-money credentials.

You must never send a PIN, password, one-time verification code or complete payment-card security code through Mwanachuo Hub messaging.

6.10 Messages and communications

We may collect communications sent through:

In-platform messaging;

Support requests;

Comments;

Product questions;

Study groups;

Dispute-resolution channels;

Reports;

Email;

SMS;

Telephone calls;

Push notifications; and

Approved social-media channels.

Where calls are recorded for training, quality or safety purposes, we will provide appropriate notice and obtain consent where required.

6.11 Reviews, ratings and reports

We may collect:

Ratings;

Written reviews;

Photographs attached to reviews;

Comments;

Reports against Users or Listings;

Evidence submitted during an investigation;

Moderation decisions;

Appeals; and

Fraud or safety records.

6.12 Location information

We may collect:

Region;

District;

Ward;

Campus;

General neighbourhood;

User-selected search location;

Approximate location derived from an internet-protocol address; and

Precise device location where you have expressly enabled it.

Precise location access should be optional unless essential for a specific requested service.

Users should avoid publishing exact residential locations in public Listings. Exact collection, delivery or meeting locations should normally be shared privately after appropriate verification.

6.13 Device and technical information

We may automatically collect:

Internet-protocol address;

Device type;

Operating system;

Browser type;

Application version;

Device identifiers;

Session information;

Referral source;

Pages viewed;

Search activity;

Clicks and interactions;

Error and diagnostic logs;

Cookie identifiers;

Security events; and

Approximate network location.

6.14 Marketing and engagement information

We may collect:

Marketing preferences;

Newsletter registration;

Campaign interactions;

Advertisement views;

Referral information;

Survey responses;

Competition participation;

Promotional-code usage; and

Consent and opt-out records.

6.15 Information from other Users

We may receive information about you from another User, for example when someone:

Sends you a message;

Reviews you;

Reports your account;

Names you as a property representative;

Invites you to a study group;

Lists you as an emergency contact; or

Submits evidence in a dispute.

A User must not provide another person’s personal data without lawful authority.

7. Sensitive Personal Data

Mwanachuo Hub will not intentionally collect sensitive personal data unless:

It is necessary for a specific and lawful purpose;

The User has received clear information about the processing;

Prior written or otherwise legally valid express consent has been obtained where required;

Another legal exception applies; and

Additional security and access controls are implemented.

Examples may include:

Student identification documents;

Identity-verification records;

Banking or payout information;

Information concerning a User under 18;

Health or accessibility information for an event;

Biometric information, should biometric verification ever be introduced;

Information contained in a safety investigation; or

Information voluntarily included in User Content.

Under the Act, sensitive personal data generally requires prior written consent, which may be withdrawn. Where the data subject is a minor or otherwise unable to consent, consent must be obtained from a parent, guardian or other legally recognized representative, subject to applicable exceptions. �

PDPC

We will not use sensitive personal data for advertising personalization.

We will not request political opinions, religious beliefs, health details, biometric data or similar information merely to create a basic Mwanachuo Hub account.

8. How We Obtain Personal Data

We may obtain personal data:

8.1 Directly from you

This includes data you submit during registration, verification, posting, messaging, purchasing, booking, reporting or contacting support.

8.2 Automatically

This includes device data, cookies, security logs, search activity and other information produced when you interact with the Platform.

8.3 From other Users

For example, through reviews, messages, reports, group invitations or transaction information.

8.4 From service providers

This may include:

Payment confirmations;

Delivery status;

Identity-verification results;

Fraud indicators;

Hosting logs;

Communication-delivery status; and

Customer-support records.

8.5 From educational institutions or other organizations

Where lawful and necessary, we may verify student, business, professional or property information with an institution, authority or other appropriate source.

We will obtain consent where required before seeking verification from an institution.

8.6 From publicly available sources

We may review lawfully available business registers, professional directories, institutional websites or other public records for verification, fraud prevention and safety.

9. Why We Process Personal Data

9.1 To provide Mwanachuo Hub services

We use personal data to:

Maintain profiles;

Publish and manage Listings;

Enable search and discovery;

Facilitate transactions;

Enable messaging;

Operate study groups;

Process Lost & Found notices;

Provide housing and roommate-search features;

Manage events and volunteering;

Provide wishlists and saved searches;

Deliver support; and

Maintain account preferences.

The applicable basis may include taking steps requested by you, performing our agreement with you, consent or another lawful basis.

9.2 To verify Users and Listings

We may verify:

Identity;

Age;

Student status;

Telephone or email ownership;

Business information;

Professional qualifications;

Property authority; and

Seller or service-provider information.

Verification supports fraud prevention, community safety and trust.

9.3 To facilitate payments and commercial records

We may use transaction information to:

Confirm payments;

Issue receipts;

Calculate fees;

Manage subscriptions;

Process refunds;

Make payouts;

Prevent fraud;

Respond to chargebacks; and

Meet financial, tax and accounting obligations.

9.4 To protect Users and the Platform

We may process personal data to:

Detect fraud;

Prevent account takeover;

Investigate scams;

Identify prohibited products;

Enforce Platform rules;

Protect students and vulnerable Users;

Review suspicious messages or Listings;

Prevent repeated account abuse;

Respond to safety incidents;

Preserve relevant evidence; and

Cooperate with lawful authorities.

9.5 To communicate with you

We may send:

Account verification messages;

Password-reset messages;

Transaction updates;

New-message notifications;

Security warnings;

Listing updates;

Support responses;

Policy notices;

Service announcements; and

Marketing communications where permitted.

9.6 To personalize and improve the Platform

We may use information to:

Show relevant categories;

Prioritize nearby Listings;

Recommend products, services or study groups;

Improve search;

Detect broken features;

Measure usage;

Conduct research;

Test new features; and

Improve accessibility and performance.

Where possible, product analytics will use aggregated or pseudonymized information.

9.7 To comply with law

We may process information where required to:

Respond to a court order;

Fulfil a statutory obligation;

Cooperate with the PDPC;

Respond to a lawful request from an authorized public body;

Maintain financial records;

Investigate criminal activity;

Protect legal rights; or

Establish, exercise or defend a legal claim.

9.8 To protect vital interests

Where necessary, we may process or disclose information to protect a person’s life, physical safety or other vital interests, including during an emergency.

10. Legal Bases for Processing

Depending on the circumstances, we may rely on one or more of the following:

Consent: You have voluntarily agreed to a specific form of processing.

Performance of an agreement: Processing is necessary to provide a service you requested or to administer our agreement with you.

Legal obligation: Processing is necessary to comply with Tanzanian law or a legally binding direction.

Vital interests: Processing is necessary to protect someone’s life or safety.

Legitimate interests: Processing is necessary for a legitimate operational, security or commercial interest, provided that the interest does not unfairly override your rights.

Public interest or lawful authority: Processing is required or permitted for a task recognized by law.

Legal claims: Processing is necessary to establish, exercise or defend a legal claim.

Other grounds permitted by applicable law.

Where we rely on consent:

Consent will be specific and informed;

Consent will not be obtained through misleading or preselected options;

We will maintain a consent record;

You may withdraw consent through a reasonably simple method; and

Withdrawal will not invalidate lawful processing completed before withdrawal.

The Regulations require Users to understand what they are consenting to and require a simplified method for withdrawing consent. They also require processing to be restricted where the legal basis or legitimate interest has ceased to apply. �

PDPC

11. Information Visible to Other People

Mwanachuo Hub is partly a public marketplace and community platform.

Depending on your settings and activity, the following may be visible to other Users or the public:

Display name;

Profile photograph;

Seller or business profile;

General location;

Institution or campus, where you choose to display it;

Listings;

Listing photographs;

Product or service descriptions;

Prices;

Reviews and ratings;

Comments;

Study-group information;

Event participation that you make public;

Lost & Found posts;

Verification status;

Account activity indicators; and

Other information you intentionally publish.

Public pages may be accessed by people without accounts and may be indexed, cached or displayed by internet search engines.

Removing information from Mwanachuo Hub may not immediately remove copies held in search-engine caches, screenshots or records lawfully retained by other people.

The following should not be displayed publicly unless clearly necessary and deliberately authorized:

Passwords;

National identification numbers;

Student identification numbers;

Complete dates of birth;

Bank or mobile-money credentials;

Exact home addresses;

Private messages;

Identity-verification documents;

Complete payment information; or

Internal fraud and safety records.

12. Messaging Privacy

Messages are generally visible to:

The sender;

The recipient;

Relevant group members where posted in a group; and

Authorized Mwanachuo Hub personnel or service providers where access is reasonably necessary.

We may review or use automated tools to analyze messages for:

Spam;

Fraud;

Phishing;

Threats;

Harassment;

Prohibited products;

Child-safety concerns;

Malware;

Account-security risks;

Reported misconduct; and

Enforcement of our Terms.

We will not routinely use the content of private messages for unrelated advertising.

Users should keep transaction communication within Mwanachuo Hub where possible because relevant messages may help resolve a complaint or investigate fraud.

13. Cookies and Similar Technologies

Mwanachuo Hub may use cookies, local storage, software-development kits, pixels and similar technologies.

13.1 Necessary technologies

These may be used for:

Account security;

Shopping-cart functions;

Language selection;

Location preferences;

Fraud prevention;

Cookie-consent records; and

Core website operation.

Necessary cookies may operate without marketing consent where legally permitted.

13.2 Analytics technologies

These help us understand:

Number of visitors;

Pages used;

Search activity;

Errors;

Feature performance; and

General Platform engagement.

13.3 Preference technologies

These remember settings such as:

Language;

Region;

Display choices.

13.4 Advertising technologies

Where introduced, advertising technologies may measure campaigns or show more relevant promotions.

Non-essential advertising or tracking cookies will be activated only after obtaining the required consent.

Users must be able to reject non-essential cookies as easily as they can accept them. Mwanachuo Hub should publish a separate Cookie Policy and cookie-management tool identifying each active cookie, its provider, purpose and duration.

Disabling certain cookies may affect Platform functionality.

14. Direct Marketing

We may send marketing messages about:

New Platform features;

Special offers;

Seller promotions;

Student opportunities;

Events;

Competitions;

Relevant products or services; and

Tanzanite Tech services.

We will send electronic marketing only where:

You have consented;

A lawful existing-customer relationship permits it; or

Another legal basis applies.

Every promotional email or SMS should:

Identify Mwanachuo Hub or the relevant sender;

Avoid misleading subject lines;

Provide a working opt-out method; and

Respect withdrawal or objection requests promptly.

You may unsubscribe through the message, your account settings or by contacting us.

Service, transaction, legal and security communications are not marketing and may continue even after you opt out of promotions.

We do not sell telephone numbers or email addresses to third parties for their independent marketing.

15. How We Share Personal Data

We may share personal data only where lawful, necessary and proportionate.

15.1 With other Users

Information may be shared where necessary to facilitate:

A product inquiry;

A transaction;

A service booking;

A housing inquiry;

A Lost & Found handover;

A study group;

A review;

An event; or

Another User-requested interaction.

We will not provide another User with your complete identity-verification file merely because that User requests it.

15.2 With service providers

We may use carefully selected providers for:

Website and application hosting;

Cloud storage;

Cybersecurity;

Email, SMS and push notifications;

Payment processing;

Customer support;

Analytics;

Identity verification;

Content moderation;

Mapping;

Delivery;

Backup;

Document management; and

Professional advice.

Processors must be subject to written obligations covering confidentiality, security, permitted processing, incident reporting, deletion or return of data, subcontracting and cooperation with data-subject requests.

15.3 With payment and financial-service providers

Relevant information may be shared with banks, mobile-money operators, payment gateways and fraud-prevention providers to complete and secure payments.

Their separate privacy notices may apply to information they collect as independent controllers.

15.4 With educational institutions

With an appropriate legal basis and, where required, consent, we may contact an institution to verify student status, investigate misuse of the institution’s name or respond to serious academic or safety concerns.

Mwanachuo Hub will not provide a university with a complete history of a student’s private marketplace activity without lawful authority.

15.5 With event organizers and partners

Where you register for a third-party event or volunteering opportunity, we may share the information reasonably necessary for registration, attendance, safety or communication.

We will identify the organizer before the information is submitted where reasonably possible.

15.6 With professional advisers

We may share relevant information with auditors, advocates, accountants, insurers and other advisers who are subject to confidentiality duties.

15.7 For legal and safety reasons

We may disclose personal data:

Where required by law;

In response to a valid court order;

To the PDPC;

To law-enforcement or another legally authorized body;

To investigate fraud or criminal conduct;

To protect a person from serious harm;

To enforce our Terms; or

To establish, exercise or defend legal rights.

We will review requests for legal validity and limit disclosure to what is reasonably required.

15.8 Business transfers

If Tanzanite Tech undergoes a merger, acquisition, restructuring, investment, insolvency or sale of the Mwanachuo Hub business, personal data may be disclosed to appropriate advisers, investors or successor organizations.

Such disclosure will be subject to confidentiality and data-protection requirements.

15.9 Aggregated or anonymized information

We may share statistics that do not reasonably identify an individual, such as general category demand, campus marketplace trends or Platform usage.

We do not sell identifiable personal data.

16. International and Cross-Border Transfers

Some service providers may operate servers, support teams or technology infrastructure outside Tanzania.

Before transferring personal data outside Tanzania, Mwanachuo Hub will:

Identify the data, recipient, destination and purpose;

Confirm that the transfer is necessary and lawful;

Assess the protection available in the destination;

Implement appropriate contractual, organizational and technical safeguards;

Obtain data-subject consent where required;

Apply for and obtain a PDPC cross-border transfer permit where required;

Restrict onward transfers; and

Maintain a record of the transfer.

The PDPC operates a permit-based framework for transfers outside Tanzania and assesses the destination’s protection level, contractual safeguards, security measures, recipient and purpose. �

PDPC +1

We will not transfer personal data merely because an overseas service is less expensive where the transfer would not meet legal safeguards.

Users may contact us to request general information about the safeguards used for relevant international transfers.

17. Data Retention

We retain personal data only as long as reasonably necessary for:

Providing the requested service;

Maintaining account and transaction records;

Preventing fraud;

Protecting Users;

Resolving complaints;

Meeting tax, accounting and regulatory obligations;

Establishing or defending legal claims; and

Enforcing agreements.

The exact period will depend on the type of information, purpose, risk, legal requirements and whether a dispute is pending.

Recommended Mwanachuo Hub retention schedule

Record category

Recommended standard period

Active account and profile information

For the life of the account

Closed-account information

Up to 24 months after closure

Public Listings

While active and up to 24 months after removal

Messages connected to transactions or safety

Up to 3 years after the last relevant activity

Transaction, invoice, tax and payout records

At least 7 years or the legally required period

Identity and student-verification documents

Until verification is completed, then delete or minimize within 12 months unless continued retention is justified

Verification outcome and audit record

Up to 5 years after the account closes

Customer-support records

Up to 3 years after resolution

Fraud, abuse and safety-investigation records

Up to 5 years after resolution or longer where legally necessary

Unsuccessful login and security logs

Normally 12–24 months

Cookie and analytics information

According to the period disclosed in the Cookie Policy

Marketing consent records

While consent is active and for a reasonable evidentiary period after withdrawal

Backups

Until overwritten under the secure backup cycle

These periods must be reviewed and aligned with Tanzanite Tech’s actual systems and Tanzania’s tax, company, electronic-transaction and limitation requirements before publication.

Where personal data is no longer needed, we will:

Securely delete it;

Destroy physical records;

Irreversibly anonymize it; or

Restrict access until secure deletion is completed.

Deletion from active systems may not immediately remove encrypted backup copies. Backup information will remain protected and will be removed during the applicable backup cycle.

The Regulations require clear deletion procedures, defined retention periods and the ability to justify and disclose why information is retained. �

PDPC

18. How We Protect Personal Data

We use reasonable technical and organizational measures appropriate to the nature and risk of the information.

Measures may include:

Encryption during transmission;

Encryption or equivalent protection for sensitive stored data;

Secure password hashing;

Multi-factor authentication for administrative accounts;

Role-based access controls;

Least-privilege access;

Staff confidentiality obligations;

Security training;

Access logs and audit trails;

Secure backups;

Firewalls and network controls;

Malware protection;

Vulnerability testing;

Patch management;

Secure software-development practices;

Separation of sensitive data;

Vendor-security assessments;

Incident-response procedures;

Business-continuity planning;

Data-minimization controls; and

Periodic review of access permissions.

No internet platform can guarantee complete security. Users are responsible for using strong passwords, protecting their devices and reporting suspected unauthorized access promptly.

The Regulations specifically require security-risk assessments, authorized-access controls, secure transfers and storage, audit trails, appropriate protection for sensitive data, breach procedures and regular software-vulnerability testing. �

PDPC

19. Personal-Data Breaches

A personal-data breach may include unauthorized access, disclosure, loss, alteration, destruction or misuse of personal data.

Where a suspected breach occurs, Mwanachuo Hub will:

Contain and investigate the incident;

Identify affected systems, Users and information;

Assess the likely risks;

Preserve evidence;

Correct relevant weaknesses;

Document the incident;

Notify the PDPC where required;

Notify affected Users where required or reasonably necessary; and

Take steps to reduce possible harm.

A User notification may include:

What happened;

The type of information involved;

Likely risks;

Actions taken;

Steps the User should take; and

How to contact us.

Users should immediately report suspected breaches, unauthorized access, phishing or accidental disclosure to:

Security email: [Insert security email]

Emergency security telephone: [Insert number]

20. Privacy by Design and Impact Assessments

Mwanachuo Hub will consider privacy during the design and development of products, not only after launch.

Before introducing high-risk processing, Tanzanite Tech should conduct a Data Protection Impact Assessment.

An assessment may be required before introducing:

Biometric identity verification;

Facial recognition;

Large-scale location tracking;

AI profiling with significant effects;

Processing involving children or vulnerable Users;

Large-scale sensitive-data processing;

Combining data obtained from unrelated sources;

Systematic monitoring of public areas;

High-risk fraud scoring;

New technologies presenting material privacy risks; or

A major change in how existing data is used.

The Regulations require impact assessments for processing likely to affect a person’s rights and freedoms, including large-scale processing, innovative technology, biometric information, sensitive information involving children and significant automated decision-making. �

PDPC

21. Automated Decisions, Recommendations and Artificial Intelligence

Mwanachuo Hub may use automated systems to:

Rank search results;

Recommend Listings;

Detect spam;

identify suspicious account activity;

Identify potentially prohibited content;

Match Users with categories or general locations; and

Prioritize reports for human review.

These systems may consider factors such as:

Search terms;

Selected location;

Listing relevance;

Listing recency;

Category;

Availability;

User preferences;

Prior interactions;

Verification status;

Complaints;

Security indicators; and

Platform-rule compliance.

We will not make a decision producing a serious legal or similarly significant effect solely through automation unless:

It is legally permitted;

Appropriate notice has been provided;

Relevant safeguards are in place;

A required impact assessment has been completed; and

A meaningful method of human review or challenge is available.

Users may contact us to request information or human review where an automated decision materially affects account access, verification or another significant service.

Automated tools may make mistakes. A User should not be permanently suspended solely because a low-confidence automated system identifies possible misconduct without appropriate review.

22. Children and Users Under 18

Mwanachuo Hub is primarily intended for higher-education students who are at least 18 years old.

A person under 18 must not independently:

Enter a binding commercial transaction;

Offer professional services;

Enter a housing agreement;

Submit identity-verification documents;

Provide sensitive personal data; or

Use another restricted feature without legally valid authorization.

Where a minor is permitted to use a feature:

Consent from a parent or lawful guardian may be required;

We may verify the relationship between the child and representative;

Information must be explained in clear, age-appropriate language;

Only the minimum required information will be collected;

Profiling and targeted advertising will be restricted;

Precise location will not be publicly displayed; and

Additional safety controls will apply.

The Regulations allow rights to be exercised on behalf of a child by an authorized parent or guardian and require the representative to be informed about processing risks and safeguards. �

PDPC

A parent or guardian who believes a child has provided personal data without proper authorization should contact us immediately.

23. Your Personal-Data Rights

Subject to applicable conditions and lawful exceptions, you may have the following rights:

23.1 Right to be informed

You have the right to receive information about why and how your personal data is collected and processed.

23.2 Right of access

You may request confirmation of whether we process your personal data and request access to relevant information.

23.3 Right to rectification

You may request correction of personal data that is inaccurate, incomplete, outdated or misleading.

23.4 Right to erasure or destruction

You may request deletion or destruction where, for example:

Information is no longer needed;

Consent has been withdrawn;

Processing is unlawful;

You object to commercial use; or

Deletion is required by law.

Deletion may be refused or limited where retention is necessary to comply with law, protect freedom of expression, serve a recognized public interest, resolve a dispute or establish a legal claim.

23.5 Right to restrict or prevent processing

You may request that certain processing be stopped or restricted, particularly where it causes or is likely to cause unwarranted harm.

23.6 Right to data portability

Where applicable, you may request personal data you provided in a structured and commonly usable format or request transfer to another organization where technically and legally feasible.

23.7 Right to object

You may object to processing based on particular circumstances, including certain commercial or direct-marketing processing.

23.8 Rights concerning automated decisions

You may object to or request review of certain decisions made solely through automated processing.

23.9 Right to withdraw consent

You may withdraw consent at any time where processing is based on consent.

Withdrawal does not invalidate processing lawfully completed before the withdrawal.

23.10 Right to complain

You may complain to Mwanachuo Hub and, where dissatisfied, to the Personal Data Protection Commission.

23.11 Right to compensation

Where legally established, a person may seek compensation for damage resulting from an infringement.

23.12 Transmission of rights

Certain rights may be exercised by an authorized representative or lawful heir in circumstances recognized by law.

The PDPC identifies rights to information, access, correction, erasure, restriction, portability, objection, automated-decision safeguards, complaint, withdrawal of consent, compensation and transmission to an heir. �

PDPC

24. How to Exercise Your Rights

You may submit a request through:

Privacy request form: [Insert form location]

Privacy email: [Insert privacy email]

Postal address: [Insert address]

Your request should provide:

Your full name;

Account email or telephone number;

The right being exercised;

A clear description of the information or processing involved;

Relevant dates or Listings; and

Any supporting documents reasonably required.

We may ask for sufficient information to confirm identity. We will not request excessive identification information.

We may also require proof of authority where a request is made by:

A parent;

A guardian;

An advocate;

An authorized representative; or

A lawful heir.

We will acknowledge requests and respond within the period required by law.

The Regulations provide, among other procedures, up to 14 days for considering certain rectification and erasure or destruction requests. A rejected rectification request must be communicated in writing with reasons. �

PDPC +2

Where we refuse or limit a request, we will explain the lawful reason unless prohibited from doing so.

Ordinarily, no fee will be charged for a legitimate request. A reasonable fee may be imposed or a request may be refused where the law permits and the request is clearly unfounded, excessive or repetitive.

25. Complaints

Privacy concerns should first be submitted to Mwanachuo Hub’s Data Protection Officer.

Data Protection Officer

Tanzanite Tech – Mwanachuo Hub

Email: [Insert DPO email]

Telephone: [Insert telephone number]

Address: [Insert address]

We will:

Record the complaint;

Acknowledge receipt;

Investigate fairly;

Request further information where necessary;

Communicate the outcome; and

Take corrective action where appropriate.

A person who believes personal-data principles have been violated, or who is dissatisfied with the controller’s decision, may submit a complaint to the Personal Data Protection Commission. �

PDPC

Personal Data Protection Commission

Email: helpdesk@pdpc.go.tz

Office hours: Monday–Friday, 08:00–16:00

Complaint submission: Through the Commission’s approved complaint system or procedures.

The Commission’s current contact and data-subject information are published through its official website. �

PDPC

26. Data Protection Officer

Tanzanite Tech will appoint a Data Protection Officer as required.

The officer’s duties include:

Advising Mwanachuo Hub on compliance;

Monitoring data-processing activities;

Receiving privacy requests and complaints;

Identifying violations;

Recommending corrective action;

Supporting staff training;

Reviewing impact assessments;

Coordinating incident response;

Maintaining compliance records; and

Preparing and submitting required compliance reports.

The Regulations require a Data Protection Officer to oversee compliance, advise on violations, handle data-subject requests and complaints, and prepare quarterly compliance reports for the Commission. �

PDPC

The Data Protection Officer must be given sufficient independence, resources and access to senior management.

27. Third-Party Websites and Services

Mwanachuo Hub may contain links to:

Payment services;

Delivery providers;

Social-media platforms;

Maps;

Universities;

Event organizers;

Sellers’ websites; and

Other external services.

We are not responsible for an independent third party’s privacy practices merely because Mwanachuo Hub links to or integrates with that service.

Users should review the third party’s privacy notice before submitting information.

Mwanachuo Hub will not authorize a third-party integration to collect more information than reasonably necessary for its stated function.

28. Research, Analytics and Product Development

We may use aggregated, pseudonymized or anonymized information to:

Understand student marketplace needs;

Improve housing discovery;

Identify popular product categories;

Improve Platform safety;

Measure feature performance;

Develop new services;

Support business planning; and

Produce non-identifying reports.

Research involving identifiable or sensitive personal data will require an appropriate legal basis, safeguards and, where required, consent or regulatory authorization.

We will not publicly publish research that reasonably identifies an individual User without consent or another lawful basis.

29. Changes to This Privacy Policy

We may update this Policy where necessary due to:

New Platform features;

Changes in law;

Regulatory guidance;

New service providers;

Security improvements;

New data uses;

Changes in business structure; or

Feedback from Users.

The revised Policy will state its new effective date.

Where a change materially affects Users, we may provide notice through:

Email;

In-platform notification;

Push notification;

Website banner; or

Another reasonable method.

Where a new activity requires consent, continued use alone will not replace the required consent.

Previous versions should be archived for accountability.

30. Contact Us

Questions, requests and complaints concerning this Policy may be directed to:

Tanzanite Tech – Mwanachuo Hub

Attention: Data Protection Officer

Email: [Insert official privacy email]

Support email: [Insert support email]

Telephone: [Insert telephone number]

Physical address: [Insert registered address]

Postal address: [Insert postal address]

PDPC registration number: [Insert registration number]

Quick Links

Information