1. Who we are
This website is run by [REGISTERED BUSINESS NAME], trading as Instafix Tanzania ("Instafix", "we", "us"), a business registered in the United Republic of Tanzania under registration number [BRELA REGISTRATION NUMBER]. We are the data controller for the personal data described in this policy.
- Address: [PHYSICAL ADDRESS], Dar es Salaam, Tanzania
- Email: instafixtanzania@gmail.com
- WhatsApp: +255 749 660 003
- Personal Data Protection Commission registration number: [PDPC REGISTRATION NUMBER]
2. The short version
- You can browse this website without giving us any personal data.
- The site sets one cookie of its own, to remember your cookie choice. It uses no analytics, advertising or social media tracking.
- The contact form does not send anything to us or store anything on this website. It opens WhatsApp or your email app with your message filled in, and you decide whether to send it.
- We use what you send us to reply to you and to deliver the services you ask for. We never sell your data.
3. What we collect and how
When you browse this website
Our hosting provider, Vercel, automatically processes technical data needed to deliver the pages and keep the site secure, such as your IP address, browser type, the page requested and the time of the request. We do not use this data to identify you.
The site also stores your cookie choice in a cookie, and on computers with a mouse it remembers the position of the decorative cursor in your browser while the tab is open. Our Cookie Policy lists these.
When you contact us
If you message us on WhatsApp, Instagram, by email or by phone, or use the contact form to prepare such a message, we receive what you choose to send. This is usually:
- your name;
- your phone number, email address or social media handle;
- the topic and content of your message;
- anything you attach, such as screenshots.
When you become a client
To deliver a service we may need more information, depending on the service:
- Account recovery and verification: account usernames, profile or page links, the email addresses and phone numbers linked to the account, screenshots and, where a platform requires it, a copy of an identity document. We do not need your passwords and will not ask you to send them to us.
- Financial advisory and training: information about your income, spending, savings, debts and goals that you choose to share and, for businesses, financial records.
- Payments: your name, the amount, the payment reference and the method used. We do not collect or store card details.
Some of this, such as identity documents and financial details, may be sensitive personal data. We collect it only when the service you asked for needs it, and only with your explicit consent.
Information from others
If a platform such as Meta replies to an appeal we make for you, we receive the outcome. If someone refers you to us, they may give us your name and contact details.
4. Why we use it and our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Replying to your enquiries | Contact details and message | Your consent, and taking steps you ask for before a contract |
| Delivering the services you book | Client information described above | Performing our contract with you; your explicit consent for sensitive data |
| Taking payments and keeping accounts | Payment records | Complying with legal obligations, such as tax law |
| Running and securing the website | Technical data | Our legitimate interest in a working, secure website |
| Remembering your cookie choice | Consent cookie | Complying with legal obligations on consent |
| Sending tips or offers | Contact details | Only with your separate consent, which you can withdraw at any time |
| Handling disputes and legal claims | Relevant records | Our legitimate interests and legal obligations |
We do not make automated decisions about you that have legal or similarly significant effects, and we do not build advertising profiles.
5. Who we share it with
We share personal data only where it is needed for the purposes above:
- Vercel Inc. (United States), which hosts this website.
- Meta Platforms (WhatsApp, Instagram and Facebook), when you contact us on WhatsApp or Instagram, and when we submit recovery or verification requests to Meta for you.
- Google (Gmail), which provides our email.
- Banks and mobile money providers, when you pay us.
- Professional advisers, such as lawyers and accountants, who must keep it confidential.
- Authorities, courts or regulators, where the law requires it.
Meta and Google also decide for themselves how they use data you share on their services, under their own privacy policies. We do not sell your personal data and do not share it for advertising.
6. International transfers
Some of these providers store data outside Tanzania, including in the United States and the European Union. When personal data leaves Tanzania we rely on the safeguards allowed under the Personal Data Protection Act, 2022, such as the provider's contractual commitments to protect it. For visitors from the EU or UK we rely on the Standard Contractual Clauses or other approved safeguards offered by the provider. Contact us if you would like more detail.
7. How long we keep it
| Data | How long |
|---|---|
| Enquiries that do not lead to work | 12 months after our last contact |
| Client case files and messages | For the engagement, then [CLIENT RECORDS RETENTION PERIOD] |
| Identity documents used for verification | Deleted within 30 days after the case closes |
| Payment and accounting records | As long as tax law requires: [TAX RECORDS RETENTION PERIOD] |
| Cookie choice | 6 months |
| Hosting logs | A short period, under Vercel's retention settings |
When a period ends we delete the data or make it anonymous.
8. How we protect it
We use reasonable technical and organisational measures, including:
- encrypted HTTPS connections and modern security headers on this website;
- two factor authentication and strong passwords on the accounts we use for client work;
- access to client data only for team members who need it;
- deleting identity documents promptly once a case closes.
No method of storing or sending data is completely secure. If a breach is likely to put your rights at risk, we will tell you and the Personal Data Protection Commission as the law requires.
9. Your rights
Under Tanzania's Personal Data Protection Act, 2022 and other laws that apply to you, you can:
- Access: ask for a copy of the personal data we hold about you.
- Correction: ask us to correct data that is wrong or incomplete.
- Deletion: ask us to delete your data where we have no lawful reason to keep it.
- Objection: object to processing based on our legitimate interests, and to direct marketing at any time.
- Withdraw consent: where we rely on your consent, withdraw it at any time. This does not affect what we did before you withdrew it.
- Complain: complain to the Personal Data Protection Commission (see section 14).
To use any of these rights, email instafixtanzania@gmail.com. We may need to confirm your identity first. We aim to reply within 30 days, and in most cases there is no charge.
10. Children
Our services are for adults aged 18 and over. Young people under 18 may join our training only with the involvement of a parent, guardian or school. We do not knowingly collect personal data from children. If you think a child has sent us personal data, contact us and we will delete it.
11. Visitors in the EU and UK
If you are in the European Economic Area or the United Kingdom, the GDPR or UK GDPR gives you the rights in section 9, plus the right to restrict how we use your data and the right to data portability. Our legal bases are listed in section 4. You can also complain to your local data protection authority, for example the Information Commissioner's Office in the UK.
12. California residents
If you live in California, the California Consumer Privacy Act gives you the right to know what personal information we collect, use and disclose, to have it deleted or corrected, and not to be treated differently for using these rights.
In the last 12 months we have collected the categories described in section 3: identifiers (such as your name and contact details), commercial information (the services you bought), internet activity (technical data) and, for some clients, sensitive personal information such as identity documents, used only to provide the service. We collect them for the purposes in section 4 and disclose them only to the recipients in section 5.
We do not sell or share personal information for cross context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. To make a request, email us.
13. Changes to this policy
We may update this policy when our services or the law change. We will post the new version here with a new effective date. For important changes we will also show a notice on the website or tell clients directly. If a change affects the cookies we use, we will ask for your cookie choice again.
14. Contact and complaints
For questions or requests, email instafixtanzania@gmail.com, message us on WhatsApp at +255 749 660 003, or write to [PHYSICAL ADDRESS], Dar es Salaam, Tanzania.
If you are not satisfied with our answer, you can complain to the Personal Data Protection Commission (Tume ya Ulinzi wa Taarifa Binafsi) at www.pdpc.go.tz. Visitors in the EU or UK can also complain to their local data protection authority.