Effective Date: 01 January 2026
Last Updated: 30 July 2026
Policy Version: 1.1
1. Introduction
HudumaPortal is an online services marketplace owned and operated by Tanzaite DigitalTech, a company registered in the United Republic of Tanzania under registration number [REGISTRATION NUMBER], with its registered address at Office H8, CRDB Building, Masika Street, Morogoro
HudumaPortal enables Clients and Service Providers to:
- Create and manage accounts;
- Advertise and discover services;
- Post and apply for jobs;
- Communicate;
- Create bookings and appointments;
- Make and receive qualifying payments;
- Manage projects and milestones;
- Submit ratings and reviews;
- Purchase subscriptions and promotions;
- Participate in referral programs and challenges; and
- Receive customer support.
This Privacy Policy explains how we collect, use, store, disclose, protect and otherwise process personal data when you use:
- The HudumaPortal website;
- HudumaPortal mobile applications;
- HudumaPortal account dashboards;
- HudumaPortal payment and wallet features;
- HudumaPortal messaging systems;
- HudumaPortal chatbot and AI-assisted features;
- HudumaPortal customer-support channels;
- Referral and promotional programs; and
- Any related service operated under the HudumaPortal brand.
2. Who Is Responsible for Your Personal Data?
For personal data processed to operate HudumaPortal, Tanzanite Digital Tech normally acts as the data controller because it determines why and how that personal data is processed.
Our data-controller registration details are:
Registered entity: Tanzanite Digital Tech
PDPC registration number: [PDPC REGISTRATION NUMBER]
Registered address: Office H8, CRDB Building, Masika Street, Morogoro
Data Protection Officer: Thomas William
Privacy email: [email protected]
Companies that process personal data on our instructions—such as hosting, communications, verification or payment-support providers—may act as data processors.
A Client or Service Provider may independently act as a data controller when they receive and use another User’s personal data for their own business or professional purposes. For example, a Service Provider may independently process a Client’s address to attend an on-site appointment.
3. Definitions
In this Policy:
“Client” means a person, company or organization seeking or purchasing Services.
“Data Controller” means a person or organization that determines the purpose and means of processing personal data.
“Data Processor” means a person or organization processing personal data on behalf of and under the instructions of a Data Controller.
“Data Subject” means the person to whom personal data relates.
“Personal Data” means information about an identified or identifiable person.
“Platform” means the HudumaPortal website, mobile applications and related systems.
“Processing” includes collecting, recording, organizing, storing, viewing, using, changing, transferring, disclosing, restricting, deleting or destroying personal data.
“Sensitive Personal Data” includes data presenting a heightened risk to a person, including biometric data, financial transactions, health information, data relating to children, offences and other categories recognized by applicable law.
“Service Provider” means a person or business offering Services through HudumaPortal.
“User” means any person accessing or using HudumaPortal.
4. Our Data-Protection Principles
We aim to process personal data according to the following principles:
1. Lawfulness, fairness and transparency: We process personal data for lawful purposes and explain how it is used.
2. Purpose limitation: We collect personal data for specified and legitimate purposes.
3. Data minimization: We collect only information reasonably necessary for the intended purpose.
4. Accuracy: We take reasonable steps to keep personal data accurate and current.
5. Storage limitation: We do not retain identifiable personal data longer than reasonably necessary.
6. Security: We use appropriate technical and organizational safeguards.
7. User rights: We provide reasonable methods for Users to exercise applicable data rights.
8. Privacy by design: We consider privacy when developing or changing products, systems and processes.
9. Accountability: We maintain records, policies and controls to demonstrate compliance.
5. Personal Data You Provide to Us
5.1 Registration and Account Information
When you register, we may collect:
- Full name;
- Email address;
- Telephone number;
- Password in encrypted or hashed form;
- Account type;
- Country;
- Region, city or service area;
- Preferred language;
- Date of birth or age confirmation;
- Profile photograph;
- Referral code; and
- Acceptance of applicable policies.
5.2 Service Provider Profile Information
Service Providers may provide:
- Professional title;
- Biography;
- Skills;
- Languages;
- Education;
- Employment history;
- Experience;
- Certificates;
- Qualifications;
- Professional licences;
- Business name;
- Business registration details;
- Service locations;
- Availability;
- Portfolio items;
- Service descriptions;
- Prices;
- Delivery periods; and
- Social or business contact information where permitted.
5.3 Client Information
Clients may provide:
- Job posts;
- Project descriptions;
- Budgets;
- Deadlines;
- Required skills;
- Service address;
- Appointment location;
- Project files;
- Photographs;
- Specifications;
- Screening questions;
- Preferred provider information; and
- Other instructions necessary to obtain a Service.
5.4 Messages and Communications
We may process:
- Messages between Clients and Service Providers;
- Custom Offers;
- Proposals;
- Revision requests;
- Delivery-extension requests;
- Additional-Service requests;
- Files and attachments;
- Support communications;
- Complaints;
- Dispute evidence;
- Chatbot conversations; and
- Communications with our employees or representatives.
5.5 Booking and Project Information
We may collect:
- Service selected;
- Booking date;
- Appointment time;
- Package;
- Quantity;
- Deliverables;
- Project milestones;
- Price;
- Extras;
- Project status;
- Work delivered;
- Revision history;
- Completion status;
- Cancellation reason;
- Refund request; and
- Dispute outcome.
5.6 Payment and Wallet Information
We may process:
- Payment amount;
- Payment method;
- Payment-provider name;
- Transaction reference;
- Mobile-money or bank destination;
- Account-holder name;
- Wallet balance;
- Withdrawal request;
- Commission;
- Processing fee;
- Cashback;
- Referral reward;
- Subscription payment;
- Refund;
- Reversal;
- Chargeback; and
- Payment status.
We do not require Users to provide their mobile-money PIN, bank PIN, card PIN, card security code or one-time password to HudumaPortal support.
Payment providers may collect and process payment credentials directly under their own privacy notices.
5.7 Verification Information
Where verification is required, we may collect:
- National identification information;
- Passport;
- Driving licence;
- Voter identification;
- Business-registration documents;
- Tax information;
- Professional licence;
- Proof of address;
- Selfie;
- Facial or liveness-verification data;
- Payment-account ownership information; and
- Results of fraud or verification checks.
Identity documents and biometric information are treated as sensitive and receive enhanced safeguards.
5.8 Reviews, Ratings and Community Content
We may process:
- Ratings;
- Reviews;
- Comments;
- Challenge entries;
- Portfolio submissions;
- Votes;
- Reports;
- Community discussions;
- Public profile content; and
- Moderation decisions.
5.9 Customer Support Information
When you contact support, we may collect:
- Name;
- Contact details;
- Account information;
- Booking or transaction number;
- Inquiry category;
- Description of the issue;
- Supporting documents;
- Screenshots;
- Call records;
- Previous support history; and
- Requested resolution.
6. Information Collected Automatically
When you use HudumaPortal, we may automatically collect:
- Internet Protocol address;
- Device type;
- Device identifier;
- Browser type;
- Operating system;
- Application version;
- Language setting;
- Time zone;
- Login time;
- Pages or screens viewed;
- Search terms;
- Clicks and interactions;
- Session duration;
- Referring page;
- Error reports;
- Crash logs;
- Performance information;
- Security events;
- Cookie identifiers;
- Approximate location derived from an IP address; and
- Other technical information required to operate and secure the Platform.
We use this information to maintain the Platform, prevent fraud, diagnose problems, understand usage and improve performance.
7. Mobile-App Permissions
Depending on the features you use, the HudumaPortal mobile application may request permission to access:
- Camera: To take a profile photograph, upload evidence or scan verification documents;
- Photographs and files: To upload portfolio work, project files or support evidence;
- Location: To find nearby Services, set a service area or support an on-site booking;
- Microphone: Where an audio, video or voice-message feature requires it;
- Notifications: To send booking, message, payment, job and security alerts; and
- Device information: To support security, fraud prevention and technical operation.
You may manage permissions through your device settings. Disabling a permission may prevent the associated feature from working.
HudumaPortal should not request a device permission unless it is necessary for an active feature.
8. Information Received From Other Sources
We may receive personal data from:
- Clients or Service Providers involved in a transaction;
- Payment providers;
- Banks and mobile-money operators;
- Identity-verification providers;
- Social-login providers;
- Referral participants;
- Fraud-prevention providers;
- Publicly available professional or business registers;
- Regulatory authorities;
- Law-enforcement agencies;
- Professional bodies;
- Customer-support vendors;
- Analytics providers; and
- Other partners where collection is lawful.
Where reasonably required, we will inform you of the source and purpose of the data.
9. Why We Process Personal Data
9.1 To Create and Operate Accounts
We use personal data to:
- Register Users;
- Verify email addresses and telephone numbers;
- Authenticate logins;
- Maintain profiles;
- Recover accounts;
- Manage preferences;
- Provide account dashboards; and
- Prevent unauthorized access.
9.2 To Operate the Marketplace
We process personal data to:
- Publish Service Listings;
- Publish genuine Job Posts;
- Display provider profiles;
- Enable search and matching;
- Recommend relevant Services or Jobs;
- Allow proposals and Custom Offers;
- Create bookings;
- Manage projects;
- Support appointments;
- Manage milestones;
- Deliver files;
- Provide reviews; and
- Operate community features.
9.3 To Facilitate Payments
We process transaction data to:
- Confirm payments;
- Maintain Protected Payment Holds;
- Calculate platform fees;
- Record provider earnings;
- Process withdrawals;
- Process refunds;
- Calculate cashback;
- Investigate duplicate or unauthorized payments;
- Respond to chargebacks; and
- maintain accounting records.
9.4 To Verify Users and Prevent Fraud
We may process personal data to:
- Verify identity;
- Verify business registration;
- Verify professional licences;
- Verify payment-account ownership;
- Detect duplicate accounts;
- Detect fake reviews;
- Detect referral abuse;
- Detect payment manipulation;
- Investigate suspicious transactions;
- Enforce Restricted Services rules; and
- Protect Users and the Platform.
9.5 To Provide Customer Support
We use personal data to:
- Respond to questions;
- Investigate complaints;
- Resolve technical problems;
- Review cancellations;
- Process refund requests;
- Mediate disputes;
- Review appeals;
- Investigate safety concerns; and
- Maintain support records.
9.6 To Communicate With You
We may send:
- Account confirmations;
- Security alerts;
- Booking notices;
- New-message alerts;
- Payment confirmations;
- Withdrawal updates;
- Project notifications;
- Dispute notices;
- Subscription reminders;
- Job alerts;
- Service recommendations;
- Referral updates;
- Challenge information;
- Policy notices; and
- Customer-support messages.
9.7 To Improve HudumaPortal
We may use information to:
- Analyze Platform use;
- Test new features;
- Measure conversion;
- Improve search;
- Improve recommendations;
- Identify unavailable categories;
- Improve accessibility;
- Diagnose errors;
- Prevent abuse;
- Improve customer support; and
- Develop new services.
Where possible, we use aggregated, anonymized or pseudonymized information.
9.8 To Meet Legal and Regulatory Obligations
We may process personal data to:
- Comply with lawful orders;
- Respond to regulators;
- Maintain transaction and tax records;
- Investigate fraud;
- Enforce contracts;
- Establish or defend legal claims;
- Protect health or safety;
- Report suspected criminal activity; and
- Comply with data-protection requirements.
10. Lawful Grounds for Processing
Depending on the activity, we process personal data where:
- You have provided valid consent;
- Processing is necessary to create or perform a contract with you;
- Processing is required to provide a feature you requested;
- Processing is necessary for a lawful and specified business purpose related to operating HudumaPortal;
- Processing is required to comply with a legal obligation;
- Processing is necessary to protect a person’s life, health or safety;
- Processing is necessary to establish, exercise or defend a legal claim;
- Processing concerns information you deliberately made public; or
- Another lawful ground under applicable Tanzanian law applies.
Where we rely on consent, you may withdraw it, subject to legal and contractual limitations.
Withdrawing consent does not make earlier lawful processing invalid.
11. Sensitive Personal Data
We may process sensitive personal data only where necessary and permitted.
This may include:
- Identity documents;
- Biometric or facial-verification data;
- Financial-transaction information;
- Information concerning offences or fraud;
- Professional disciplinary information;
- Health or accessibility information voluntarily provided for a Service;
- Data concerning children received during a safety complaint; and
- Other sensitive categories recognized by law.
Where prior written consent is required, we will request it separately and explain:
- The data being collected;
- The purpose;
- Intended recipients;
- Retention;
- Risks;
- Withdrawal process; and
- Consequences of not providing the data.
We do not use sensitive personal data for unrelated advertising.
12. Public Information
Certain information is public because the marketplace depends on Users discovering one another.
Public Service Provider information may include:
- Display name;
- Profile photograph;
- Biography;
- Skills;
- Service location;
- Languages;
- Verification badges;
- Qualifications;
- Portfolio;
- Service Listings;
- Prices;
- Reviews;
- Ratings;
- Response statistics;
- Membership level; and
- Approved business contact information.
Public Client information may include:
- Display name;
- Job Post;
- General location;
- Reviews;
- Account-verification status; and
- Other information intentionally published through a public feature.
Do not publish information you do not want displayed publicly.
We may remove personal telephone numbers, residential addresses, identification numbers or other sensitive information from public content.
13. Messages and Project Files
Messages and files are generally visible to:
- The sender;
- The intended recipient;
- Authorized HudumaPortal personnel;
- Authorized processors supporting the Platform; and
- Authorities where disclosure is lawfully required.
We may review messages or files where reasonably necessary to:
- Provide support;
- Investigate a dispute;
- Detect fraud;
- Protect safety;
- Enforce Platform rules;
- Respond to a lawful request; or
- Diagnose a technical problem.
Users must not use messages or project files to distribute malware, steal credentials, harass others or unlawfully collect personal data.
14. Clients and Service Providers as Independent Data Users
When a Client and Service Provider communicate or enter a Project, each may receive personal data concerning the other.
Users must:
- Use that information only for the relevant Service or lawful purpose;
- Keep it secure;
- Avoid unauthorized marketing;
- Avoid selling or sharing it;
- Delete it when no longer reasonably required;
- Respect confidentiality;
- Report loss or misuse; and
- Comply with applicable data-protection law.
A Service Provider must not use a Client’s telephone number or address for unrelated advertising.
A Client must not use a Service Provider’s identity information to impersonate, harass or discriminate against them.
15. Payment Providers
Payments may be processed by independent banks, mobile-money operators, card networks or payment gateways.
Those providers may process:
- Name;
- Telephone number;
- Account number;
- Transaction reference;
- Payment amount;
- Device information;
- Fraud information; and
- Other information required to authorize or settle a payment.
HudumaPortal may receive payment status and transaction identifiers but should not receive or store your secret PIN, OTP or card security code.
Payment providers process information according to their own legal obligations and privacy notices.
16. Identity and Professional Verification
HudumaPortal may use internal teams or approved verification providers to validate:
- Identity;
- Age;
- Business registration;
- Address;
- Professional licence;
- Bank or mobile-money account ownership;
- Selfie match;
- Duplicate accounts; and
- Fraud risk.
Verification badges confirm only the specific check identified. They do not guarantee service quality, safety or future conduct.
We may retain a record that verification was completed even where the underlying document is later deleted.
17. Reviews and Ratings
We process review data to:
- Help Users make decisions;
- Measure marketplace quality;
- Identify misconduct;
- Resolve disputes;
- Detect manipulation; and
- Improve Services.
A review may be associated with:
- Reviewer account;
- Transaction;
- Booking date;
- Service Provider;
- Rating;
- Review text;
- Moderation status; and
- Fraud indicators.
Reviews marked Verified Booking are connected to an eligible HudumaPortal transaction.
We may remove or restrict a review where it violates the Review Policy or contains unlawful personal information.
18. Referrals, Rewards and Challenges
When you participate in a referral program or challenge, we may process:
- Referral link;
- Referrer;
- Referred account;
- Device identifiers;
- Qualifying action;
- Payment status;
- Reward status;
- Challenge entry;
- Votes;
- Comments;
- Eligibility;
- Identity verification; and
- Fraud indicators.
We use this information to administer the program, verify eligibility, issue rewards, prevent abuse and resolve complaints.
Challenge entries, names, photographs, videos, comments, votes and winner information may be made public according to the applicable Official Rules.
19. Chatbot and Artificial Intelligence
HudumaPortal may use artificial intelligence to support:
- Customer service;
- Search;
- Service recommendations;
- Job matching;
- Content assistance;
- Translation;
- Fraud detection;
- Moderation;
- Classification; and
- Platform improvement.
Information entered into an AI-assisted feature may be processed by HudumaPortal and an approved technology provider.
Users should not submit:
- Passwords;
- PINs;
- OTPs;
- Full card details;
- Highly sensitive identification documents;
- Confidential medical information;
- Unnecessary private information; or
- Information belonging to another person without authority.
HudumaPortal should not use private identity documents, payment credentials or confidential Project files to train a general-purpose AI model without a lawful basis, appropriate disclosure and any required consent.
We may use anonymized or de-identified interaction data to improve search, support and safety systems.
20. Automated Decision-Making and Profiling
HudumaPortal may use automated tools to:
- Rank search results;
- Recommend Services;
- Recommend Jobs;
- detect spam;
- Identify duplicate accounts;
- Identify suspicious payments;
- Detect review manipulation;
- Prioritize moderation;
- Apply temporary risk controls; and
- Personalize Platform content.
Where a decision significantly affecting you is based solely on automated processing, we will provide applicable information and a reasonable method to:
- Request an explanation;
- Object where permitted;
- Submit additional information;
- Request human intervention; and
- Ask for reconsideration.
We aim to include human review where automated systems could unfairly affect access to important Platform features.
21. Marketing Communications
With your consent or another lawful basis, we may send:
- New-Service announcements;
- Job alerts;
- Subscription offers;
- Promotions;
- Referral campaigns;
- Challenge announcements;
- Provider tips;
- Client tips; and
- Platform news.
You may stop direct marketing by:
- Selecting the unsubscribe option;
- Changing notification preferences;
- Disabling promotional notifications; or
- Contacting HudumaPortal.
You may continue receiving necessary transactional, safety, legal and account messages after opting out of marketing.
We do not sell or rent personal data to unrelated advertisers.
22. Personalized Advertising
Where HudumaPortal uses personalized advertising, we will:
- Explain the data used;
- Obtain consent where required;
- Provide preference controls;
- Avoid using sensitive personal data for advertising without proper authorization; and
- Allow Users to object to direct marketing.
Where personalized advertising is not active, this section does not authorize HudumaPortal to introduce it without updating the applicable notices and consent controls.
23. Cookies and Similar Technologies
HudumaPortal may use cookies, software-development kits, pixels, local storage and similar technologies.
23.1 Strictly Necessary Technologies
These support:
- Account login;
- Authentication;
- Security;
- Fraud prevention;
- Shopping or booking flow;
- Language settings;
- Session management; and
- Core Platform operation.
23.2 Preference Technologies
These remember:
- Language;
- Location;
- Display choices;
- Saved searches;
- Notification preferences; and
- Other settings.
23.3 Analytics Technologies
These help measure:
- Visitors;
- Page performance;
- Search behavior;
- Errors;
- Feature use; and
- Conversion.
23.4 Advertising Technologies
Where enabled, these may measure marketing effectiveness or personalize advertising, subject to applicable consent requirements.
Users may manage non-essential cookies through [COOKIE SETTINGS LINK].
Further details should be published in a separate Cookie Notice.
24. When We Share Personal Data
We may share personal data with the following recipients where reasonably necessary and lawful.
24.1 Other Platform Users
We share information required for:
- Service discovery;
- Job applications;
- Bookings;
- Communication;
- Delivery;
- Appointments;
- Reviews; and
- Project completion.
24.2 Payment and Financial-Service Providers
We share transaction information necessary to:
- Process payments;
- Confirm transactions;
- Complete withdrawals;
- Issue refunds;
- Prevent fraud; and
- Respond to chargebacks.
24.3 Verification and Fraud-Prevention Providers
We may share information to confirm identity, business status, licences, payment ownership and fraud risk.
24.4 Hosting and Technology Providers
We may use providers supporting:
- Cloud hosting;
- Storage;
- Backups;
- Cybersecurity;
- Application monitoring;
- Search;
- Analytics;
- AI features;
- File delivery; and
- Technical infrastructure.
24.5 Communication Providers
We may share contact information with providers delivering:
- Email;
- SMS;
- Push notifications;
- Customer-support communications; and
- Authentication messages.
24.6 Professional Advisers
We may disclose information to:
- Lawyers;
- Accountants;
- Auditors;
- Insurers;
- Compliance consultants; and
- Other professional advisers.
24.7 Authorities and Legal Recipients
We may disclose information where reasonably required to:
- Comply with law;
- Respond to a lawful order;
- Protect a person’s safety;
- Investigate fraud;
- Enforce our Terms;
- Defend legal claims; or
- Cooperate with a regulator.
24.8 Business Transactions
Information may be disclosed during a merger, investment, restructuring, acquisition or sale, subject to confidentiality and applicable data-protection requirements.
25. Data-Processor Contracts
Where a provider processes personal data on our behalf, we will seek to use a written contract requiring the provider to:
- Follow our documented instructions;
- Use personal data only for approved purposes;
- Maintain appropriate security;
- Limit staff access;
- Notify us of security incidents;
- Assist with User-rights requests;
- delete or return data when appropriate;
- Control subcontractors; and
- Comply with applicable data-protection requirements.
26. International Transfers
Some hosting, communications, analytics, payment or technology providers may process information outside Tanzania.
HudumaPortal will not transfer personal data outside Tanzania contrary to applicable law.
Before an international transfer, we may:
- Assess the destination and recipient;
- Determine whether the transfer is necessary;
- Obtain consent where required;
- Use appropriate contractual safeguards;
- Apply technical security measures;
- Limit the information transferred;
- Verify that the recipient will use it only for the approved purpose; and
- Obtain a permit or approval from the Personal Data Protection Commission where required.
We will not authorize a recipient to transfer the data to another recipient unless the onward transfer is lawful and appropriately approved.
27. How Long We Retain Personal Data
We retain personal data only for as long as reasonably necessary for:
- The original purpose;
- Account operation;
- Transactions;
- Customer support;
- Tax and accounting obligations;
- Fraud prevention;
- Safety;
- Disputes;
- Legal claims;
- Regulatory obligations; and
- Enforcing Platform rules.
Unless a different period is required by law or necessary for an active matter, our recommended retention schedule is:
Data category| Normal retention period
Active account and profile data| For the life of the Account
Closed account information| Up to 5 years after closure
Verification and identity records| Up to 5 years after the last relevant transaction or Account closure
Payment, withdrawal and refund records| Up to 7 years after the transaction
Booking and Project records| Up to 5 years after completion or cancellation
Messages and Project files| Up to 5 years after Project completion
Dispute and complaint records| Up to 7 years after final resolution
Customer-support records| Up to 3 years after closure of the inquiry
Reviews and public content| While published and for up to 2 years after removal
Referral and Challenge records| Up to 5 years after completion
Marketing preferences and consent records| Until withdrawal, plus up to 3 years for consent evidence
Security and access logs| Normally 12–24 months
Fraud and serious safety records| Up to 7 years or longer where lawfully necessary
Deleted-data backups| Normally deleted or overwritten within 90 days
We may retain information longer where:
- A Dispute is open;
- A legal claim is anticipated or active;
- Fraud is under investigation;
- A regulator or court requires retention;
- Financial or tax law requires it; or
- deletion would compromise Platform security.
Where possible, information retained for analytics or research will be anonymized.
28. Account Closure and Deletion
Before closure, you should:
- Complete or cancel active Projects;
- Resolve Disputes;
- Withdraw eligible balances;
- Settle outstanding amounts;
- Download important records; and
- Remove public content where the feature permits.
Account closure does not automatically require immediate deletion of every record.
We may retain limited information required for:
- Transactions;
- Accounting;
- Tax;
- Fraud prevention;
- Reviews;
- Disputes;
- Enforcement;
- Legal obligations; and
- Security.
Public content may remain where another User has a lawful interest in the record, subject to applicable rights and moderation rules.
29. Security Measures
We use appropriate technical and organizational measures designed to protect personal data.
Depending on the data and risk, measures may include:
- Encryption during transmission;
- Encryption at rest where appropriate;
- Password hashing;
- Multi-factor authentication for sensitive administration;
- Role-based access controls;
- Staff confidentiality obligations;
- Network and application monitoring;
- Secure backups;
- Audit logs;
- Vulnerability testing;
- Software updates;
- Fraud detection;
- Separation of sensitive information;
- Incident-response procedures;
- Processor-security reviews;
- Data minimization; and
- Staff privacy and security training.
No online service can guarantee absolute security.
Users should use a strong unique password and immediately report suspected Account compromise.
30. Personal-Data Breaches
A personal-data breach may involve unauthorized access, disclosure, alteration, loss, destruction or misuse of personal data.
Where a breach occurs, HudumaPortal will take reasonable steps to:
1. Contain the incident;
2. Protect affected systems and Users;
3. Investigate the cause;
4. Assess the type and amount of information affected;
5. Preserve relevant evidence;
6. Notify the Personal Data Protection Commission without undue delay where required;
7. Notify affected persons where legally required or appropriate;
8. Cooperate with payment providers, authorities and processors;
9. Correct identified weaknesses; and
10. Review controls to reduce recurrence.
A User who suspects a data breach should immediately contact [email protected]
31. Your Personal-Data Rights
Subject to applicable law and valid limitations, you may have the following rights.
31.1 Right to Be Informed
You may request information about:
- The personal data collected;
- Processing purposes;
- Intended recipients;
- Retention;
- Transfers;
- Automated processing; and
- Available rights.
31.2 Right of Access
You may request confirmation of whether we process your personal data and access to relevant information.
31.3 Right to Rectification
You may request correction of information that is inaccurate, outdated, incomplete or misleading.
31.4 Right to Erasure or Destruction
You may request deletion where:
- The data is no longer required;
- Consent has been withdrawn;
- Processing is unlawful;
- You object to commercial use;
- The law requires deletion; or
- Another valid ground applies.
Deletion may be refused where retention is necessary for legal obligations, public-interest duties, freedom of expression, disputes, fraud prevention or legal claims.
31.5 Right to Restrict or Prevent Processing
You may request that we suspend, limit or not begin processing where the processing is likely to cause substantial damage or another lawful ground applies.
31.6 Right to Object
You may object to certain uses of your personal data, including direct marketing.
31.7 Right to Data Portability
Where applicable, you may request personal data in a structured, commonly usable form or request transfer to another provider where technically and legally feasible.
31.8 Right to Withdraw Consent
You may withdraw consent at any time where consent is the basis for processing.
31.9 Rights Concerning Automated Decisions
You may request information, human intervention or reconsideration where a significant decision is made solely through automated processing.
31.10 Right to Complain
You may complain to HudumaPortal and, where appropriate, to the Personal Data Protection Commission.
31.11 Right to Compensation
Where legally established, a person who suffers damage because of unlawful processing may seek applicable compensation.
31.12 Rights Through a Representative
An authorized representative, guardian or lawful heir may exercise applicable rights where permitted by law and upon satisfactory proof of authority.
32. How to Exercise Your Rights
Submit a request to:
Data Protection Officer: [DATA PROTECTION OFFICER]
Privacy email: [PRIVACY EMAIL]
Postal address: [REGISTERED ADDRESS]
Your request should include:
- Full name;
- Registered email or telephone number;
- Account identifier;
- Right being exercised;
- Description of the relevant data;
- Preferred response method; and
- Supporting evidence where correction is requested.
We may request reasonable identity verification before disclosing, changing or deleting personal data.
We will not ask for your password, PIN, CVV or OTP.
For a request to restrict or prevent processing, we will acknowledge and temporarily restrict the relevant processing within the period required by applicable law where the request meets the required conditions.
Requests for rectification or erasure will normally be considered within 14 days after receiving the required information.
Where we reject a request, we will explain the reason and available complaint procedure, unless the law prevents us from doing so.
33. Direct Marketing Objections
You may require HudumaPortal to stop using your personal data for direct marketing.
After receiving a valid request:
- We will stop the relevant promotional communications;
- We may retain a suppression record so that you are not contacted again;
- Transactional and security communications may continue; and
- Existing lawful processing for other purposes may continue.
Opting out of marketing does not close your Account.
34. Complaints to the Personal Data Protection Commission
Where you believe that HudumaPortal has violated your privacy or personal-data rights, you may submit a complaint to the Personal Data Protection Commission of Tanzania.
We encourage Users to first contact our Data Protection Officer so that we have an opportunity to investigate and resolve the issue.
Using HudumaPortal’s internal complaint procedure does not remove your right to approach the Commission or another lawful authority.
35. Children
HudumaPortal Accounts are intended for persons aged 18 or older.
We do not knowingly permit children to independently register as Clients or Service Providers.
Where we discover that a child created an Account or provided personal data without lawful authorization, we may:
- Restrict the Account;
- Verify age;
- Contact a parent or guardian;
- Remove the information;
- Preserve information required for safety; and
- Report serious concerns to an appropriate authority.
A parent or guardian who believes that a child’s information has been processed through HudumaPortal should contact [PRIVACY EMAIL].
We do not knowingly use children’s personal data for targeted commercial advertising.
36. Confidential and Third-Party Information
Users must not upload personal data concerning another person unless they have a lawful basis and authority to do so.
Examples include:
- Client lists;
- Employee records;
- Medical information;
- Identity documents;
- Private photographs;
- Confidential business records; and
- Personal contact information.
A User submitting third-party personal data is responsible for providing required notices and obtaining necessary consent.
HudumaPortal may remove information that appears unlawfully disclosed.
37. External Links
HudumaPortal may contain links to external websites, applications or services.
We do not control the independent privacy practices of external providers.
Before providing information to an external service, review its:
- Privacy notice;
- Security;
- Terms;
- Payment process; and
- Contact information.
This Policy applies only to personal data processed by or on behalf of HudumaPortal.
38. Social Media
When you interact with HudumaPortal on Facebook, Instagram, X, LinkedIn, WhatsApp or another social platform, that platform may independently process your data.
Information you post publicly on social media may be visible to other people.
Do not send sensitive payment or identity information through a public comment or an unverified social-media account.
39. Changes to This Privacy Policy
We may update this Privacy Policy to reflect:
- Changes in law;
- New Platform features;
- New payment methods;
- New vendors;
- New AI systems;
- Security improvements;
- Regulatory directions; or
- Changes in our business.
The updated Policy will display:
- Effective date;
- Last-updated date;
- Version number; and
- A summary of material changes.
Where reasonably practicable, we will notify Users before a material change takes effect.
A change will not normally apply retrospectively in a manner that unlawfully reduces an existing right.
Where a new processing purpose is materially different from the original purpose, we will provide an appropriate notice and obtain consent where required.
40. Language
This Privacy Policy may be published in English and Kiswahili.
Both versions should communicate the same privacy rights and obligations.
Where a translation conflict occurs, the legally controlling version identified at publication will apply, subject to applicable Tanzanian law.
41. Contact Information
For privacy questions, complaints or personal-data requests, contact:
HudumaPortal Data Protection Officer
Name or designation: Thomas William
Privacy email: [email protected]
Registered entity: Tanzanite Digital Tech
PDPC registration number: [PDPC REGISTRATION NUMBER]
Registered address: Office H8, CRDB Building, Masika Street, Morogoro
For general support:
Email: [email protected]
Primary telephone: +255 752 118 496
Secondary telephone: +255 653 305 220
Location: Morogoro, Tanzania
Support hours: 8:00 a.m.–8:00 p.m., Monday–Sunday
Never provide your password, mobile-money PIN, bank PIN, card PIN, CVV or OTP through email, chat or a general support form.
42. Privacy Summary
HudumaPortal:
- Collects information necessary to operate a services marketplace;
- Uses personal data for accounts, bookings, payments, communication, verification, safety and support;
- May display selected profile, Service, Job, portfolio, review and Challenge information publicly;
- May share information with transaction participants and approved service providers;
- Does not sell or rent personal data to unrelated advertisers;
- Uses enhanced safeguards for identity, biometric and financial information;
- Provides rights to access, correct, restrict, delete and object to certain processing;
- Does not permit persons under 18 to independently operate Accounts;
- Uses personal data internationally only where appropriate legal requirements and safeguards are met;
- Maintains security and breach-response procedures; and
- Provides a Data Protection Officer and complaint process.
By using HudumaPortal, you acknowledge that personal data will be processed as described in this Policy and the notices presented when you use particular Platform features.