Privacy Policy

Last updated: January 1, 2025

1. Information We Collect

We collect the following categories of information:

• Account details: name, email address, phone number, and — for vendors — business registration and NIDA verification details.
• Transaction data: orders, payment method (e.g. mobile money or card), delivery addresses, and order history.
• Usage data: search queries, page views, device and browser information, and approximate location (region/city) used to show relevant sellers and delivery options.

2. How We Use Your Information

We use your information to provide and improve our services, process transactions and deliveries, verify identities (including OTP via SMS), communicate with you, personalize your experience, prevent fraud, and ensure platform security. We may also use anonymized data for analytics and research purposes.

3. Legal Basis (Personal Data Protection Act, 2022)

We process personal data in accordance with the Tanzania Personal Data Protection Act, No. 11 of 2022. Processing is based on your consent, the performance of a contract (fulfilling your orders), our legal obligations, or our legitimate interest in operating a secure marketplace.

4. Data Sharing

We do not sell your personal information. We share data only with trusted service providers necessary to operate the platform — payment processors, SMS/OTP providers, cloud hosting, file storage, and analytics — or when required by Tanzanian law. Vendors receive only the buyer details needed to fulfil an order.

5. Data Retention

We retain personal data only for as long as your account is active or as needed to provide services, comply with legal obligations (such as tax and accounting records), resolve disputes, and enforce our agreements. Data that is no longer needed is securely deleted or anonymized.

6. Data Security

We implement industry-standard security measures including encryption in transit, access controls, and regular security audits. However, no method of transmission over the internet is 100% secure, and we encourage you to keep your account credentials confidential.

7. Your Rights

Under the Personal Data Protection Act you have the right to access, correct, or delete your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. To exercise these rights, contact us at [email protected].

8. Children's Privacy

M-Duka is not directed at children under 18, and we do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us so we can remove it.

9. Cookies

We use cookies and similar technologies to enhance your experience, remember preferences, and analyze platform usage. See our Cookie Policy for details. You can manage cookie preferences through your browser settings.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes and update the "Last updated" date at the top of this page.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at [email protected].