Privacy Policy

1. Who is responsible for your data

Nguzo Innovations, of Jossam House, No. 80 CocaCola Rd, Dar es Salaam, Tanzania, is the data controller for personal data collected through this website, through our mobile apps (NguzoCRM, SiteWorks, DarSMS, DESA and Onfika) where you use them in your own name, and for our own client, sales and marketing records.

We process personal data in accordance with the Personal Data Protection Act, 2022 (PDPA), the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 and other applicable Tanzanian law, under the oversight of the Personal Data Protection Commission (PDPC).

For any privacy question or request, contact us at hello@nguzo.co.tz.

2. Personal data we collect

Information you give us:

• Contact form and enquiries: your name, email address, phone number, company name and the message you send.
• Clients: contact details of your staff, billing information, tax details (such as TIN and VRN), contracts, quotations, invoices and payment records.
• Communications: emails, WhatsApp messages, calls and meeting notes when you contact us.
• Account users: login details and activity for our client portals and SaaS products.

Information collected automatically:

• Technical data: IP address, browser type, device information, pages visited and the time of your visit, recorded in our server logs for security and troubleshooting.
• Cookies: see "Cookies" below.

We do not intentionally collect sensitive personal data (such as health, religion, biometric or financial account credentials) through this website. Please do not include it in contact form messages.

3. Data collected by our mobile apps

When you use NguzoCRM, SiteWorks, DarSMS, DESA and Onfika or another Nguzo Innovations app, we may collect the following, depending on the app, the features you use and the permissions you allow:

• Account data: your name, email address, phone number, job title, organisation and password (stored only in encrypted, hashed form).
• Content you create: contacts, tasks, notes, quotations, invoices, work orders, inspection reports, signatures and other records you enter.
• DarSMS: the names and phone numbers in the contact lists you upload, the messages you send, your sender IDs, and delivery reports. Messages are delivered through licensed mobile network operators and SMS aggregators.
• DESA (schools): records entered by the school about students, parents or guardians and staff, such as names, class, admission and attendance records, results, fee payments, contact details and photos.
• Onfika (appointments): the details you give when booking, such as your name, phone number, email, the service, date and time, and any notes, which are shared with the business you book with so it can confirm the appointment and send reminders by SMS or email. Please do not include sensitive information (for example health details) in booking notes unless the business asks for it.
• Precise location (SiteWorks and other field apps): when you check in, start or finish a job, or while you are on duty, so your organisation can schedule work, show technician locations and record where work was done. Location is collected in the background only if this feature is switched on by your organisation and you choose "Allow all the time"; the app tells you before asking for this permission. We do not sell location data or use it for advertising.
• Camera and photos: only when you choose to take or attach a photo (for example site photos, receipts, documents or a profile picture). Only the images you select are uploaded.
• Files: documents you choose to attach.
• Contacts on your device: only if the app offers contact import and you choose to use it. Imported contacts are used only within your account.
• Notifications: a push notification token from Firebase Cloud Messaging (Android) or Apple Push Notification service (iOS), so we can send you job, task and account alerts.
• Device and diagnostic data: device model, operating system and app version, language, an app installation identifier, crash logs and performance data, used to keep the app working and fix problems.

Apps ask for each permission when the related feature is first used. You can refuse or withdraw a permission at any time in your device settings; the related feature will stop working but the rest of the app will continue to work.

Our apps do not show third-party advertising, do not use advertising identifiers and do not track you across apps or websites owned by other companies. All data is sent between the app and our servers over encrypted connections (HTTPS/TLS).

4. How we use your data and our legal basis

We only process personal data for specific, lawful purposes, and only as much as we need:

• To respond to your enquiry and send you a confirmation by SMS or email, so we can take steps you request before entering into a contract.
• To prepare quotations, deliver projects, provide support and manage our contract with you (performance of a contract).
• To invoice, keep accounting records and meet tax and other legal obligations (legal obligation).
• To keep our website and systems secure, prevent fraud and improve our services (our legitimate interests, balanced against your rights).
• To send you news, offers or newsletters, only where you have agreed or where you are an existing client and have not opted out (consent, which you can withdraw at any time).

We do not sell your personal data, and we do not make decisions about you based solely on automated processing.

5. Who we share your data with

We share personal data only where necessary, with:

• Service providers that help us run our business, such as web hosting and cloud providers, email providers, SMS gateways, and font and content-delivery networks used by our website. They process data only on our instructions and under confidentiality obligations.
• Your organisation, if your app account was created by your employer: it can see the records, job activity and location data you create in its account.
• The school, for DESA, and the business you book with, for Onfika: they receive and control the records and booking details in their account.
• Mobile network operators and SMS aggregators, to deliver SMS sent through DarSMS and SMS notifications and reminders from our other products.
• App platform providers: Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) to deliver notifications, and Google Play and the Apple App Store to distribute the apps and process in-app purchases.
• Payment providers, banks and mobile money operators, to process payments and refunds.
• Professional advisers such as accountants, auditors and lawyers.
• Government and regulatory authorities, such as the Tanzania Revenue Authority, the PDPC, law enforcement agencies or courts, where the law requires it.
• A buyer or successor business, if Nguzo Innovations is reorganised or sold, subject to this policy.

If you click a link to WhatsApp, Instagram, LinkedIn or Facebook from our website, the relevant platform's own privacy policy applies to your use of it.

6. International transfers

Some of our service providers (for example cloud hosting and email services) may store or process data on servers outside Tanzania. When this happens, we transfer personal data only as permitted by the PDPA: to countries or organisations that provide an adequate level of protection, or with appropriate safeguards such as contractual commitments, and in line with any requirements of the PDPC.

7. How long we keep your data

• Enquiries that do not lead to a project: up to 2 years after our last contact, then deleted.
• Client, contract, invoice and payment records: for as long as the business relationship lasts and for at least 5 years afterwards, as required by Tanzanian tax law, or longer if needed for a legal claim.
• App accounts: for as long as your account is active, then deleted as described in "Deleting your account and data".
• App location history and diagnostic data: location history for as long as your organisation needs it for its job records (normally no longer than 24 months); crash and diagnostic data up to 90 days.
• Server logs: normally up to 12 months.
• Marketing lists: until you unsubscribe or withdraw consent.

When data is no longer needed, we delete it or anonymise it securely.

8. How we protect your data

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including encrypted connections (HTTPS/TLS), access controls and strong authentication, staff confidentiality obligations, regular updates and backups.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the Personal Data Protection Commission and, where required, you, within the time limits set by the PDPA and its Regulations.

9. Cookies

Our website uses only the cookies it needs to work properly:

• A session cookie, which keeps the website working as you move between pages and remembers you if you log in.
• A security (XSRF) cookie, which protects forms against cross-site request forgery.

These cookies are strictly necessary and are deleted when you close your browser or after a short period. We do not currently use advertising or third-party tracking cookies. If we start using analytics or marketing cookies, we will update this policy and ask for your consent where required.

You can block or delete cookies in your browser settings, but parts of the website (such as forms and login) may stop working.

10. Your rights

Under the Personal Data Protection Act, 2022 you have the right to:

• Be informed about how your personal data is used (this policy).
• Access the personal data we hold about you and receive a copy.
• Ask us to correct personal data that is inaccurate or incomplete.
• Ask us to delete or destroy personal data that is no longer needed or is processed unlawfully.
• Object to processing that is likely to cause you damage or distress.
• Stop us from using your personal data for direct marketing, at any time and free of charge.
• Not be subject to decisions based solely on automated processing.
• Withdraw consent you have given, without affecting processing carried out before withdrawal.
• Seek compensation for damage caused by a breach of the Act.

To exercise any of these rights, email hello@nguzo.co.tz. We may need to verify your identity first. We will respond within 30 days.

To stop marketing messages, use the unsubscribe link in our emails, reply STOP to our SMS, or email us.

11. Deleting your account and data

You can delete your account in any of our apps from the account or profile settings ("Delete account"), or request deletion without the app by following the steps on our Account Deletion page at nguzo.co.tz/delete-account or by emailing hello@nguzo.co.tz.

When your account is deleted we delete your profile, login details, device and notification tokens, location history and the content stored only in your personal account within 30 days, and remove it from backups within 90 days. We keep only what the law requires — such as invoices and payment records, which Tanzanian tax law requires us to keep for at least 5 years — and records your organisation owns if your account was created by your employer.

12. Complaints

If you are concerned about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Personal Data Protection Commission (Tume ya Ulinzi wa Taarifa Binafsi), Tanzania, through its official website pdpc.go.tz.

13. Data we process for our clients

When we build, host or run systems for clients (for example NguzoCRM, SiteWorks, DarSMS, DESA, Onfika, school management systems or client websites), the personal data inside those systems belongs to our client. The client is the data controller and is responsible for informing the individuals concerned; we act as a data processor and use that data only to provide the service, under the client's instructions and a data processing agreement.

If your personal data is held in a system we operate for one of our clients, please contact that organisation directly. We will assist them in responding to your request.

14. Children

Our website and most of our apps are intended for businesses and adults, and are not directed at children. We do not knowingly collect personal data directly from children under 18 without the consent of a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.

DESA, our school management system, holds records about students, many of whom are children. These records are entered and controlled by the school, which is the data controller and is responsible for having a lawful basis, including any parental or guardian consent the Personal Data Protection Act, 2022 requires. We process student data only on the school's instructions, only to provide DESA, with access limited to authorised school staff and the student's own parents or guardians, and we never use it for advertising or marketing. Parents and guardians who want to access, correct or delete a student's data should contact the school; we will help the school respond.

15. Changes to this policy

We may update this policy from time to time, for example when the law or our services change. The date at the top of this page shows when it was last updated. We will tell clients about material changes by email or through our services.