Privacy Policy

This Privacy Policy explains how Ustawi ("Ustawi", "we") collects, uses, discloses, and protects personal data when you use the Ustawi platform, our marketing website, or our mobile field-agent application. It applies to visitors to our website, individuals whose data our tenant customers (microfinance institutions, SACCOs, employers) process using Ustawi, and our own staff and agents.

For website visitors and prospective customers, Ustawi acts as a data controller. For borrower, guarantor, and loan data that our tenant customers (MFIs/SACCOs/employers) input into the platform, Ustawi acts as a data processor on that tenant's instructions — see the Data Processing Agreement (/legal/data-processing-agreement) for those terms. If you are a borrower with a question about your loan data, your first point of contact is the lender (our tenant customer) that holds your loan, not Ustawi directly.

Grounded in what the platform actually processes: Identity & KYC data (name, national ID/NIDA number, date of birth, photograph, phone number, address, and other identity documents submitted during borrower onboarding); Financial & loan data (applications, disbursement/repayment records, balances, collateral/guarantor details, credit history and CRB check results); Compliance/AML data (sanctions/PEP screening results and, where applicable, STR records); Insurance data (credit-life/asset insurance policy and claims information, where enabled); Payroll/check-off data (salary deduction schedules shared with employers, where enabled); Location data (approximate GPS coordinates captured by the mobile field-collection app at the moment of a collection visit, to verify visit authenticity); Device & authentication data (device identifiers for device-trust/device-binding); Account & usage data (login activity, audit-log entries, diagnostic data); Communications data (SMS and in-app notification delivery records).

We process personal data only where we have a lawful basis to do so under the Personal Data Protection Act, 2022. Depending on the activity, that basis is the performance of the loan or savings contract, compliance with a legal obligation, our (or our tenant's) legitimate business interests, or your consent. The table below summarises the main purposes and their lawful basis:

We share data with: (a) the tenant institution that originated your loan or account (they are the controller); (b) sub-processors that help deliver the Service, listed at /legal/sub-processors; (c) regulators and law enforcement where legally required (e.g. STR filings via goAML, BOT reporting); (d) credit reference bureaus, where the tenant uses CRB checking, per that tenant's own consent process. We do not sell personal data.

Data is retained for as long as the underlying loan/account relationship is active, plus a statutory retention period thereafter for regulatory and audit purposes. Indicatively: KYC and loan records are retained for at least 7 years after the loan relationship ends; AML screening and Suspicious Transaction Report records for at least 7 years; marketing and website analytics data for up to 24 months; and server/access logs for up to 12 months. These periods are indicative demo figures; confirm against current Bank of Tanzania guidance and your own statutory obligations.

Each tenant's data is isolated in its own dedicated database (per-tenant data isolation). Customer Data is hosted in a secure, access-controlled hosting environment with data residency in the East Africa region.

Subject to Tanzanian law, you may have the right to: access a copy of your personal data; request correction of inaccurate data; request erasure where processing is no longer necessary; object to or restrict certain processing; and lodge a complaint with the relevant data protection authority. To exercise these rights regarding a specific loan, contact your lender first; for platform-level requests, contact us via /contact or privacy@ustawi.co.tz.

Where data is transferred outside Tanzania (e.g. to a cloud infrastructure provider or sub-processor with servers abroad), we take steps intended to ensure an adequate level of protection. Where such transfers occur, we rely on a transfer mechanism permitted under the Personal Data Protection Act, 2022 — such as your consent, contractual necessity, or safeguards like standard contractual clauses with the recipient — to keep your data protected.

We apply technical and organizational measures described in full at /legal/security-and-data-protection-statement, including per-tenant data isolation, role- and branch-scoped access controls, encrypted document storage, and audit logging of sensitive actions.

In the event of a personal data breach likely to result in a risk to individuals, we will notify affected tenant customers without undue delay and support them in meeting their own regulatory notification obligations. Where we are required to notify the Personal Data Protection Commission (PDPC) or affected individuals directly, we aim to do so without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

The Service is not directed at individuals under 18 and we do not knowingly collect data from children.

See the Cookie Policy (/legal/cookie-policy) for details on cookies and similar technologies used on our website and portal.

We may update this Policy periodically; material changes will be posted here with an updated "Last updated" date and, where appropriate, notified in-app.

Questions about this Policy or how we handle your personal data can be directed to our Data Protection Officer, who can be reached at privacy@ustawi.co.tz. General enquiries: /contact.