Privacy Policy

Our Commitment

Primezone Solutions Ltd ("we", "us", "our") operates SmartBiashara ERP ("the Service"). We take your privacy seriously and are committed to handling your personal data in accordance with the Personal Data Protection Act 2022 of the United Republic of Tanzania and applicable East African Community regulations.

This Privacy Policy explains what data we collect, how we use it, who we share it with, how long we keep it, and what rights you have. We have written this in plain language so you can understand exactly what happens with your information.

1. Data Controller

For the purposes of data-protection law, the data controller for personal data collected through SmartBiashara is:

2. What Personal Data We Collect

We collect the following categories of personal data:

2.1 Data You Provide Directly

• Account registration: business name, owner full name, email address, phone number, password (hashed), business address
• Billing information: payment confirmation details (we do not store full card numbers — they are held by our payment processors PesaPal and Flutterwave under their own privacy terms)
• Customer records you add to your account: names, phone numbers, addresses of YOUR customers (you are the data controller for those)
• Employee records you add: names, NIDA numbers, phone numbers, payroll information of YOUR staff
• Support correspondence: messages you send us via WhatsApp, email, or in-app chat

2.2 Data We Collect Automatically

• Device and connection data: IP address, browser type, operating system, device identifiers
• Usage data: pages visited, features used, time spent, error logs
• Cookies and similar technologies (see section 8 below)
• Mobile-money transaction references when you pay via M-Pesa, Tigo Pesa, Airtel Money, or Halopesa

2.3 Data From Third Parties

• Payment confirmations from PesaPal, Flutterwave, and mobile-money operators
• Identity verification (where required for fraud prevention)

3. How We Use Your Personal Data

We use your personal data for the following purposes (the legal basis under Tanzania's PDPA is shown in brackets):

• To provide the Service — create and maintain your account, process transactions, store your business records [performance of a contract]
• To bill and collect payment — process subscription fees through mobile money, PesaPal, Flutterwave, or bank transfer [performance of a contract]
• To provide customer support — respond to your questions and resolve issues [performance of a contract; legitimate interest]
• To improve the Service — analyse usage patterns, fix bugs, develop new features [legitimate interest]
• To send service communications — account alerts, billing receipts, security notices, plan-renewal reminders [performance of a contract; legitimate interest]
• To send marketing communications — tips, product updates, special offers (you can opt out at any time) [consent]
• To prevent fraud and abuse — detect suspicious payments, unauthorised access, and violations of our Terms [legitimate interest; legal obligation]
• To comply with Tanzanian law — respond to lawful requests from TRA, TCRA, police, and courts [legal obligation]

4. Who We Share Your Data With

We do not sell your personal data. We share it only with the following categories of recipients:

4.1 Payment Processors

• Mobile-money operators: Vodacom M-Pesa, Tigo Pesa (Tigo), Airtel Money, Halopesa — to verify and process subscription payments
• PesaPal — to process card and mobile-money payments via their gateway
• Flutterwave — to process international card payments
• Banks — to verify bank-transfer payments (CRDB, NMB, NBC, Equity, etc.)

4.2 Infrastructure Providers

• Hostinger — our hosting provider, with servers in Lithuania / Netherlands (EU)
• Google Workspace — for email delivery (welcome emails, receipts)
• WhatsApp (Meta) — for customer support chat
• OpenAI — for our AI-assistance feature (your data is processed under their API terms and not used to train their models)

4.3 Legal Authorities

We may disclose personal data when required by Tanzanian law, court order, or lawful government request — including to the Tanzania Revenue Authority (TRA), TCRA, the Personal Data Protection Commission, or law-enforcement agencies.

4.4 Business Transfers

If Primezone Solutions Ltd is acquired, merged, or sells its assets, your personal data may be transferred to the new owner. We will notify you by email before the transfer takes effect.

5. International Data Transfers

SmartBiashara is hosted with Hostinger in European data centres (Lithuania / Netherlands). Some of our service providers (Google, WhatsApp/Meta, OpenAI, Flutterwave) may process your data outside Tanzania. Where we transfer personal data outside Tanzania, we ensure that the recipient is bound by adequate data-protection safeguards or we obtain your explicit consent.

The European Union's GDPR and Tanzania's PDPA 2022 are broadly compatible, and our hosting provider maintains GDPR-compliant processing agreements with us.

6. Data Security

We protect your data with industry-standard safeguards:

• All data is transmitted over HTTPS (TLS 1.2 or higher)
• Passwords are hashed using bcrypt with strong cost factors — we cannot read your password
• Database backups are encrypted and stored in geographically separate locations
• Access to production systems is restricted to authorised personnel and logged
• Payment data is tokenised by our payment processors (we never store full card numbers or PINs)
• Regular security audits and dependency updates

No system is perfectly secure. If a data breach occurs that affects your personal data, we will notify you and the Personal Data Protection Commission within 72 hours, in line with the PDPA 2022.

7. Data Retention

We retain your personal data for as long as your account is active, plus a reasonable period afterwards to handle renewals, refunds, tax obligations, and legal claims:

• Active account data: for the duration of your subscription
• Closed account data: 60 days after closure, then permanently deleted (you may request immediate deletion)
• Tax-relevant financial records: 5 years after the transaction date (TRA requirement)
• Marketing opt-out records: 2 years (to honour your opt-out)
• Support correspondence: 2 years for quality and training
• Server logs: 90 days

8. Cookies & Tracking

SmartBiashara uses cookies and similar technologies for:

• Essential cookies — to keep you logged in and remember your settings (cannot be disabled)
• Analytics cookies — to understand how the Service is used (you can opt out)
• Marketing cookies — only on our public website (you can opt out)

You can control cookies through your browser settings. Blocking essential cookies will prevent the Service from functioning correctly.

9. Your Rights Under the PDPA 2022

Under Tanzania's Personal Data Protection Act 2022, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — request deletion of your personal data, subject to legal-retention obligations
• Right to restrict processing — ask us to pause processing while a dispute is resolved
• Right to data portability — receive your data in a machine-readable format (CSV, JSON)
• Right to object — object to processing based on legitimate interest or for direct marketing
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing
• Right to lodge a complaint — with the Personal Data Protection Commission of Tanzania

To exercise any of these rights, email privacy@smartbiashara.com. We will respond within 30 days, as required by the PDPA.

10. Children's Privacy

SmartBiashara is intended for business use by adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@smartbiashara.com so we can delete it.

11. Customer-Collected Data (Your Responsibility)

When you use SmartBiashara to store personal data of YOUR customers, suppliers, and employees, you become the data controller for that data and we act as your data processor. You are responsible for:

• Obtaining lawful consent from your data subjects (or another legal basis under the PDPA)
• Providing your own privacy notice to your customers and employees
• Honouring your data subjects' rights (access, deletion, etc.) — you may use SmartBiashara's export tools to do this
• Notifying the PDPA Commission of any data breach affecting your data subjects, unless we have already done so on your behalf

We process your customer data only on your documented instructions and in accordance with our Data Processing Addendum.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email and an in-app notice at least 14 days before they take effect. The version date at the top of this page shows when the policy was last revised.

13. Contact & Complaints

For privacy questions, access requests, or complaints, contact our Data Protection Officer:

If we cannot resolve your complaint, you have the right to lodge a complaint with the Personal Data Protection Commission of Tanzania: https://www.uhuru.go.tz / info@pdpc.go.tz.