Sub-processors
Preamble
This page lists the sub-processors Ustawi ("Ustawi") currently engages to help deliver the Service, as referenced in the Data Processing Agreement (/legal/data-processing-agreement). We will provide notice of material changes per the notice period set out there.
1. How to Read This List
Each entry shows the sub-processor's name, the function it performs, the categories of data it may process, and its processing location.
2. Current Sub-processors (registry table)
As of September 2026, Ustawi runs on a single hosting environment with no additional named third-party sub-processors wired into the product. This will be updated as real vendors (SMS gateway, transactional email, payment/mobile-money) are procured and integrated.
| Sub-processor | Function | Data categories | Location |
|---|---|---|---|
| Ustawi-managed hosting environment | Application hosting and database infrastructure (single VPS as of this writing) | All Customer Data (per-tenant isolated databases) | East Africa region |
| Not yet engaged | SMS notifications to borrowers and staff — no SMS gateway is currently wired into the platform | — | — |
| Not yet engaged | Transactional/account email — mail is currently logged, not sent via a real provider | — | — |
| Not yet engaged (if applicable) | Disbursement/repayment payment processing or mobile-money integration | — | — |
| Not yet engaged | Customer support/helpdesk tooling | — | — |
3. Sub-processor Due Diligence
Before engaging a sub-processor, Ustawi assesses its security and data-protection practices and requires it to accept data-protection obligations no less protective than Ustawi's own commitments under the Data Processing Agreement.
4. Notice of Changes
We will notify tenant customers of any new sub-processor or change in sub-processor at least 30 days before it begins processing Customer Data, giving the tenant the opportunity to object on reasonable data-protection grounds per the Data Processing Agreement, Section 5. To be notified of sub-processor changes, email us via /contact.
5. Objecting to a New Sub-processor
A tenant customer that reasonably objects to a new sub-processor should contact /contact within the notice period; Ustawi will work in good faith to address the objection, which may include offering an alternative configuration or, if unresolved, allowing the tenant to terminate the affected app without penalty.
6. Contact
Questions about this list: /contact or privacy@ustawi.co.tz.
Frequently asked questions
Who are Ustawi's sub-processors?
See the registry table in Section 2 — currently a single hosting environment, with no additional named third-party vendors wired into the product yet.
How will I know if a new sub-processor is added?
See Section 4 — at least 30 days' notice before it begins processing Customer Data.
Can I object to a new sub-processor?
Yes — see Section 5.