1. Who we are
Kinukazi Limited ("Kinukazi", "we", "us") is a company registered in the United Republic of Tanzania (registration no. [to be confirmed], TIN [to be confirmed]), with its office at [to be confirmed], Dar es Salaam, Tanzania. We own and operate the brands Albertdeo and Kijani Kitamu.
We are the data controller for the personal data described in this policy, and we are registered with the Personal Data Protection Commission (PDPC) under registration no. [to be confirmed]. Our data protection officer can be reached at privacy@kinukazi.co.tz or [to be confirmed].
2. Scope
This policy covers personal data we collect through our websites (kinukazi.co.tz, albertdeo.co.tz and kijanikitamu.co.tz), by e-mail, phone, WhatsApp and social media, through tenders and contracts, and when you visit our office or receive a delivery. It applies to customers, gift recipients, business contacts, suppliers, job applicants and website visitors.
3. What information we collect
Information you give us:
- Identity and contact details: name, phone number, e-mail, postal or delivery address, organisation and job title.
- Order and transaction details: items ordered, delivery instructions, quotations, invoices and payment references. We do not store full card numbers or mobile-money PINs.
- Gift recipient details: when you send a Kijani Kitamu basket, the recipient's name, phone number and delivery address.
- Business and tender information: documents and details you share about your organisation's needs, and supplier registration documents.
- Job applications: CV, education, work history, references and anything else you choose to include.
- Communications: messages you send us and notes of calls.
Information we collect automatically: device and browser type, IP address, pages visited and how you arrived at our site, through cookies and similar technologies (see our Cookie Policy).
Information from others: payment confirmations from banks and mobile-money providers, delivery status from courier partners, and references from referees you name.
We do not ask for sensitive personal data such as health, religious beliefs or ethnic origin. Please do not send it to us unless we specifically request it for a lawful reason.
4. Why we use your information, and on what legal basis
| Purpose | Legal basis under the PDPA |
|---|---|
| Answering enquiries and preparing quotations | Steps you asked us to take before a contract |
| Processing orders, deliveries, gift deliveries and payments | Performance of a contract with you |
| Bidding for and performing tenders and supply contracts | Performance of a contract; our legitimate interest in running our business |
| Keeping accounting and tax records, issuing EFD receipts | Compliance with legal obligations |
| Recruiting staff | Steps before an employment contract; your consent to keep your application for future roles |
| Sending news and offers | Your consent, which you can withdraw at any time |
| Improving our websites and preventing fraud | Our legitimate interests, balanced against your rights; consent for non-essential cookies |
| Responding to lawful requests from authorities | Compliance with legal obligations |
We only use your information for the purposes for which it was collected, or for closely related purposes you would reasonably expect.
5. Who we share information with
We share only what each party needs, and only with parties bound to protect it:
- Vendors and suppliers who fulfil your order, and courier partners who deliver it (name, phone and delivery address only).
- Payment providers such as banks and mobile-money operators, to process payments.
- Technology providers who host our websites, e-mail and systems.
- Professional advisers such as auditors, accountants and lawyers.
- Public authorities such as TRA, PDPC, procurement regulators or the police, when the law requires it.
- A buyer or investor in all or part of our business, under strict confidentiality, if that ever happens.
We do not sell or rent personal data, and we do not share it with third parties for their own marketing.
6. Transfers outside Tanzania
Some of our service providers, such as website hosting or e-mail services, may store data outside Tanzania. When this happens we transfer data only as the Personal Data Protection Act allows: to countries or organisations with adequate protection, under written safeguards, and with PDPC approval where required. You can ask us for details of these safeguards.
7. How long we keep your information
| Information | How long |
|---|---|
| Enquiries that did not lead to an order | 24 months after the last contact |
| Orders, invoices, receipts and contracts | At least 5 years after the transaction, as tax law requires |
| Tender files | For the period required by the tender or procurement law, then 5 years |
| Gift recipient details | 12 months after delivery, unless the recipient becomes a customer |
| Job applications (unsuccessful) | 12 months, or less if you ask |
| Marketing preferences | Until you unsubscribe, then a suppression record so we do not contact you again |
| Website analytics | Up to 14 months |
After these periods we securely delete or anonymise the information.
8. How we protect your information
We use encrypted connections (HTTPS) on all our websites, access controls so staff see only what their role needs, strong passwords and two-step login for our systems, regular backups, and confidentiality agreements with staff and providers. If a data breach puts your rights at risk, we will notify the PDPC and, where required, you, as the law requires.
9. Your rights
Under the Personal Data Protection Act, 2022 you have the right to:
- be informed about how we use your personal data (this policy);
- access the personal data we hold about you and get a copy;
- have inaccurate or incomplete data corrected;
- have your data deleted or destroyed where we no longer have a lawful reason to keep it;
- object to processing that causes, or is likely to cause, you damage or distress;
- stop us using your data for direct marketing at any time;
- not be subject to decisions made solely by automated means that significantly affect you (we do not make such decisions);
- withdraw consent at any time, where we rely on consent;
- complain to the Personal Data Protection Commission.
See How We Use Your Data and Your Rights for step-by-step instructions. We respond within 30 days of verifying your identity.
10. Children
Our services are for adults. We do not knowingly collect personal data from anyone under 18 without the consent of a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.
11. Marketing
We send marketing messages only if you have agreed or, for existing customers, about similar products where the law allows, always with an easy way to stop. Every message tells you how to unsubscribe.
12. Links to other websites
Our websites may link to sites we do not control, such as payment pages or social networks. Their privacy practices are their own; please read their policies.
13. Changes to this policy
We will update this policy when our practices or the law change. We will show the new date at the top and, for significant changes, tell customers by e-mail or on our websites.
14. Contact and complaints
Data Protection Officer, Kinukazi Limited, [to be confirmed], Dar es Salaam, Tanzania. E-mail privacy@kinukazi.co.tz. Phone [to be confirmed].
If you are not satisfied with our response, you may complain to the Personal Data Protection Commission (PDPC), Tanzania.