Privacy Policy

1. Data Controller

DobiKisasa (“we”, “us”, “our”) is the data controller for personal data collected through this platform, including the website (dobikisasa.co.tz), the customer app, and the rider app. We operate across Tanzania connecting customers with local laundry partners and delivery riders.

Data Protection Officer: dobi@dobikisasa.co.tz · +255 715 166 699

2. Legal Framework

We process personal data in compliance with:

• The Personal Data Protection Act (PDPA), No. 11 of 2022 — United Republic of Tanzania
• The Electronic and Postal Communications Act (EPOCA), Cap. 306
• The Electronic Transactions Act, No. 15 of 2015
• The Cybercrimes Act, No. 4 of 2015
• The Income Tax Act (Cap. 332) — for earnings and WHT reporting
• The Electronic Money Regulations, 2015 (Bank of Tanzania)
• EU General Data Protection Regulation (GDPR) — for international data transfers where applicable

3. Legal Basis for Processing

• Performance of contract — to register your account and fulfil orders placed
• Legal obligation — to comply with TRA, TCRA, Bank of Tanzania, and NIDA requirements
• Legitimate interest — to improve service quality, detect fraud, and ensure platform safety
• Consent — for optional data uses such as marketing communications (withdrawable at any time)

4. Personal Data We Collect

We do not collect precise GPS coordinates from customers. Pickup addresses are entered manually. Rider location is collected only during active delivery jobs.

5. How We Use Your Data

• Create and manage accounts on the platform
• Process and track laundry orders from pickup to delivery
• Coordinate pickup and return with assigned delivery riders
• Process payments via licensed mobile money operators regulated by the Bank of Tanzania
• Send SMS and in-app notifications regarding order status
• Calculate and manage Fresh Rewards loyalty points (customers)
• Calculate, track, and disburse rider and partner earnings
• Deduct and remit Withholding Tax (WHT) to TRA where applicable
• Detect, investigate, and prevent fraud and platform misuse
• Comply with legal obligations under TRA, TCRA, and Bank of Tanzania
• Improve platform quality through anonymised, aggregated analytics

6. Data Sharing

We do not sell, rent, or trade your personal data. We share it only where strictly necessary:

• Assigned riders — customer first name, phone, and pickup address for delivery coordination only
• Laundry partners — basket count and service type only (no personal identity details)
• Customers — assigned rider's name and phone for delivery coordination only
• Licensed mobile money operators (M-Pesa, Tigo Pesa, Airtel Money) — for payment or earnings processing only
• SMS gateway provider — phone number for order notification messages only
• Tanzania Revenue Authority (TRA) — transaction and WHT records as required by the Income Tax Act
• National Identification Authority (NIDA) — for rider identity verification at registration
• Tanzania Communications Regulatory Authority (TCRA) — as required under EPOCA
• Law enforcement or judiciary — only where required by a valid court order or applicable Tanzanian law

7. Your Rights Under PDPA 2022

As a data subject under the Personal Data Protection Act (No. 11 of 2022), you have:

• Right of Access — request a copy of all personal data we hold about you
• Right to Rectification — correct inaccurate or incomplete data via your profile settings
• Right to Erasure — request deletion of your account and personal data (subject to legal retention obligations)
• Right to Data Portability — receive your data in a structured, machine-readable format
• Right to Object — object to processing carried out on the basis of legitimate interest
• Right to Withdraw Consent — where processing is based on consent, you may withdraw at any time

To exercise these rights, email dobi@dobikisasa.co.tz or call +255 715 166 699. We will respond within 30 days as required by the PDPA 2022.

8. International Data Transfers

Our platform infrastructure is hosted on cloud servers which may be located outside Tanzania (Vercel Inc., United States). Where personal data is transferred internationally, we apply appropriate contractual and technical safeguards consistent with PDPA 2022 requirements to ensure your data is protected to an equivalent standard.

9. Data Retention

• Order and transaction records: 7 years (Tanzania Revenue Authority requirement)
• Rider earnings, WHT records: 5 years (Bank of Tanzania / TRA requirement)
• Account and profile data: retained while account is active; deleted within 30 days of a verified closure request
• Active delivery location data: 90 days (for dispute resolution purposes)
• SMS delivery logs: 90 days
• Anonymised analytics data: 24 months

10. Security Measures

• All data in transit is encrypted using TLS 1.2 / HTTPS
• Authentication is phone number and OTP-based — no passwords are stored
• Session tokens (web) are stored in HTTP-only cookies; mobile tokens are stored in device secure storage
• National ID and licence numbers are stored in encrypted form
• Access to personal data is restricted to authorised personnel on a need-to-know basis
• In the event of a personal data breach likely to affect your rights, we will notify you within 72 hours as required by the PDPA 2022

11. Children's Privacy

DobiKisasa is not directed at or intended for persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has registered, please contact us immediately at dobi@dobikisasa.co.tz for immediate account deletion.

12. Cookies (Website)

When using the DobiKisasa website (dobikisasa.co.tz), we use a session authentication cookie (dk_session) strictly for keeping you logged in. We do not use advertising cookies, cross-site tracking, or third-party analytics that identify you personally.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification or email at least 14 days before taking effect. Continued use of the service after the effective date constitutes acceptance.

14. Supervisory Authority

If you are not satisfied with how we have handled your personal data, you may lodge a complaint with:

Tanzania Communications Regulatory Authority (TCRA)
Website: www.tcra.go.tz · Mawasiliano Towers, 20 Sam Nujoma Road, Dar es Salaam

15. Contact Us

Data Protection Officer — DobiKisasa
Email: dobi@dobikisasa.co.tz
Phone: +255 715 166 699