Privacy Policy
What personal data we collect when you use SmartBiashara, why we need it, who sees it, how long we keep it, and how you can use your rights under Tanzania’s Personal Data Protection Act 2022.
Last updated 14 November 2026
This policy applies to smartbiashara.com and the SmartBiashara applications operated by Primezone Solutions Ltd.
Primezone Solutions Ltd (“we”, “us”, “our”) operates SmartBiashara, including the SmartBiashara ERP at erp.smartbiashara.com (“the Service”). We handle your personal data in line with the Personal Data Protection Act 2022 of the United Republic of Tanzania (PDPA) and applicable East African Community regulations.
The MiniPOS app also has its own shorter notice, the MiniPOS App Privacy Policy.
Who we are
For data-protection purposes, the data controller for personal data collected through SmartBiashara is:
Primezone Solutions Ltd
Dar es Salaam, United Republic of Tanzania
Data Protection Officer: privacy@smartbiashara.com
Phone and WhatsApp: +255 749 900 050
What we collect
Data you give us
- Account registration: business name, owner’s full name, email address, phone number, password (stored only in hashed form) and business address.
- Billing: payment confirmation details. We do not store full card numbers. Card details are held by our payment processors, PesaPal and Flutterwave, under their own privacy terms.
- Records about your customers: names, phone numbers and addresses of the people you sell to. You are the data controller for these records (see Data about your customers and staff).
- Records about your staff: names, NIDA numbers, phone numbers and payroll information of your employees.
- Support messages: what you send us by WhatsApp, email or in-app chat.
Data we collect automatically
- Device and connection data: IP address, browser type, operating system and device identifiers.
- Usage data: pages visited, features used, time spent and error logs.
- Cookies and similar technologies (see Cookies).
- Mobile-money transaction references when you pay by M-Pesa, Tigo Pesa, Airtel Money or Halopesa.
Data from other organisations
- Payment confirmations from PesaPal, Flutterwave and mobile-money operators.
- Identity checks, where needed to prevent fraud.
How we use it
Each purpose below is shown with its legal basis under the PDPA.
| What we use your data for | Legal basis |
|---|---|
| Provide the service: create and maintain your account, process transactions and store your business records | Performance of a contract |
| Bill and collect payment for your subscription through mobile money, PesaPal, Flutterwave or bank transfer | Performance of a contract |
| Answer your support questions and resolve issues | Performance of a contract; legitimate interest |
| Improve the service: study how features are used, fix bugs and build new features | Legitimate interest |
| Send service messages: account alerts, billing receipts, security notices and renewal reminders | Performance of a contract; legitimate interest |
| Send marketing messages such as tips, product updates and offers (you can opt out at any time) | Consent |
| Prevent fraud and abuse: detect suspicious payments, unauthorised access and breaches of our Terms | Legitimate interest; legal obligation |
| Comply with Tanzanian law, including lawful requests from TRA, TCRA, the police and the courts | Legal obligation |
Who we share it with
We do not sell your personal data. We share it only with the groups below, and only as much as each one needs.
Payment processors
- Mobile-money operators (M-Pesa, Tigo Pesa, Airtel Money and Halopesa), to verify and process subscription payments.
- PesaPal, to process card and mobile-money payments through its gateway.
- Flutterwave, to process international card payments.
- Banks, to verify payments made by bank transfer.
Infrastructure providers
- Hostinger, our hosting provider, with servers in Lithuania and the Netherlands (EU).
- Google Workspace, to deliver email such as welcome messages and receipts.
- WhatsApp (Meta), for customer support chat.
- OpenAI, for the AI assistance feature. Your data is processed under OpenAI’s API terms and is not used to train its models.
Legal authorities
We may disclose personal data when Tanzanian law, a court order or a lawful government request requires it. This includes the Tanzania Revenue Authority (TRA), the Tanzania Communications Regulatory Authority (TCRA), the Personal Data Protection Commission and law-enforcement agencies.
If the business changes hands
If Primezone Solutions Ltd is acquired, merges with another company or sells its assets, your personal data may pass to the new owner. We will tell you by email before the transfer takes effect.
International transfers
SmartBiashara is hosted with Hostinger in European data centres in Lithuania and the Netherlands. Some of our service providers (Google, WhatsApp/Meta, OpenAI and Flutterwave) may also process your data outside Tanzania.
When we transfer personal data outside Tanzania, we make sure the recipient is bound by adequate data-protection safeguards, or we ask for your explicit consent. Our hosting provider maintains GDPR-compliant processing agreements with us.
How we protect it
- All data travels over HTTPS (TLS 1.2 or higher).
- Passwords are hashed with bcrypt at a strong cost factor, so we cannot read your password.
- Database backups are encrypted and stored in geographically separate locations.
- Access to production systems is limited to authorised staff and every access is logged.
- Payment data is tokenised by our payment processors. We never store full card numbers or PINs.
- We run regular security audits and keep software dependencies up to date.
No system is perfectly secure. If a data breach affects your personal data, we will notify you and the Personal Data Protection Commission within 72 hours, in line with the PDPA.
How long we keep it
We keep personal data while your account is active, and for a limited period afterwards to handle renewals, refunds, tax obligations and legal claims.
| Type of data | How long we keep it |
|---|---|
| Active account data | For as long as your subscription is active |
| Data from a closed account | 60 days after closure, then permanently deleted. You can ask us to delete it sooner. |
| Tax-relevant financial records | 5 years from the transaction date (TRA requirement) |
| Record that you opted out of marketing | 2 years, so we can keep honouring your opt-out |
| Support correspondence | 2 years, for quality and training |
| Server logs | 90 days |
To have your data deleted before these periods end, follow the steps in our Data Deletion Policy.
Cookies
- Essential cookies keep you signed in and remember your settings. They cannot be switched off.
- Analytics cookies help us understand how SmartBiashara is used. Our website uses Google Analytics for this. You can opt out with your browser settings or Google’s opt-out add-on.
- Marketing cookies are used only on our public website. You can opt out.
You can control cookies in your browser settings. If you block essential cookies, the Service will not work properly.
Your rights
Under the PDPA you have the right to:
- Access a copy of the personal data we hold about you.
- Correct data that is wrong or incomplete.
- Erasure: ask us to delete your personal data, subject to the records we must keep by law.
- Restrict processing while a dispute is being resolved.
- Data portability: receive your data in a machine-readable format (CSV or JSON).
- Object to processing based on legitimate interest, or to direct marketing.
- Withdraw consent at any time where we rely on consent. This does not affect processing that already took place.
- Complain to the Personal Data Protection Commission of Tanzania.
To use any of these rights, email privacy@smartbiashara.com. We will reply within 30 days, as the PDPA requires.
Data about your customers and staff
When you store personal data about your own customers, suppliers or employees in SmartBiashara, you are the data controller for that data and we act as your data processor. That means you are responsible for:
- having a lawful basis, such as consent, for collecting and using their data under the PDPA;
- giving your customers and staff your own privacy notice;
- handling their requests to see or delete their data, which you can do with SmartBiashara’s export and editing tools;
- telling the Personal Data Protection Commission about a breach that affects them, unless we have already done so for you.
We process your customers’ data only on your documented instructions.
Children
SmartBiashara is for business use by adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email privacy@smartbiashara.com and we will delete it.
Links to other websites
Our website and apps may link to websites run by other organisations. We are not responsible for how they handle personal data, so please read their privacy policies before you share information with them.
Changes to this policy
We may update this policy from time to time. If a change is material, you will hear from us by email and in the app at least 14 days before it applies. Check the “Last updated” date above to see which version you are reading.
Contact and complaints
For privacy questions, access requests or complaints, contact our Data Protection Officer:
Data Protection Officer
Primezone Solutions Ltd
Dar es Salaam, United Republic of Tanzania
Email: privacy@smartbiashara.com
Phone and WhatsApp: +255 749 900 050
If we cannot resolve your complaint, you can complain to the Personal Data Protection Commission of Tanzania at info@pdpc.go.tz.
The rest of the rules, in one place
These pages cover what you agree to when you sign up, what happens to money you pay, and how to have your account deleted.
- Read the Terms and Conditions
Terms and Conditions
The agreement for using SmartBiashara: plans, billing, acceptable use and liability.
- Read the Data Deletion Policy
Data Deletion Policy
Step-by-step: how to ask us to delete your account and what we must keep.
- Read the Refund and Cancellation Policy
Refund and Cancellation Policy
The 14-day money-back guarantee and how cancellations work.
- Read the MiniPOS App Privacy Policy
MiniPOS App Privacy Policy
The privacy notice for the MiniPOS app and minipos.smartbiashara.com.