We collect information you provide directly, information generated automatically through your use of our services, and information from third-party sources where lawfully permitted.
| Category | Data Collected | Purpose |
|---|
| Identity | Full name, email address, phone number | Account creation, communication, authentication |
| Organisation | Company name, registration number, tax ID, address | Billing, compliance, KYC verification |
| Operational | Shipment data, manifests, clearance documents, cargo details | Service delivery, customs workflows |
| Financial | Invoice data, payment method, transaction history | Billing, fraud prevention, financial reporting |
| Technical | IP address, browser type, device ID, session tokens | Security, authentication, platform performance |
| Usage | Feature interactions, page views, error logs | Product improvement, support, analytics |
| Communications | Support tickets, chat messages, emails | Customer support, record-keeping |
How We Use Your Data
We use personal information only for purposes consistent with why it was collected:
- Deliver and operate the platform — shipment management, customs workflows, compliance tracking, invoicing, and all other product features.
- Authenticate and secure your account — identity verification, session management, fraud detection, and two-factor authentication.
- Billing and financial compliance — processing payments, generating VAT-compliant invoices, and maintaining audit-ready financial records.
- Customer support — responding to tickets, troubleshooting issues, and following up on reported problems.
- Product improvement — aggregated and anonymised usage analytics to improve platform performance and prioritise new features.
- Legal obligations — complying with tax authority requirements (TRA), BRELA filings, regulatory mandates, and lawful orders from competent authorities.
- Communication — transactional notifications (deadline alerts, filing confirmations, renewal reminders) and, with your consent, product updates.
We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects without human review.
Legal Basis for Processing
Our processing of your personal data is grounded in the following lawful bases under applicable data protection law:
- Contract performance — processing necessary to provide the services you have contracted with us.
- Legal obligation — processing required to comply with Tanzanian tax, customs, and corporate law.
- Legitimate interests — platform security, fraud prevention, and service improvement, balanced against your privacy rights.
- Consent — marketing communications and optional analytics features, which you may withdraw at any time.
Data Sharing & Disclosure
We share personal data only in limited, defined circumstances:
- Service providers — cloud hosting (AWS/GCP), payment processors, email delivery providers, and analytics tools operating under strict data processing agreements.
- Government and regulatory agencies — BRELA, TRA, NSSF, WCF, OSHA, and other Tanzanian regulatory bodies where your filings require data submission.
- Your tenant organisation — other authorised users within your company account may have access to operational data depending on their assigned role.
- Legal process — where required by valid court order, subpoena, or binding government request.
- Business transfers — in the event of a merger or acquisition, subject to equivalent privacy protections.
Data Retention
We retain your personal data for as long as your account is active or as needed to provide services. Upon account termination, we retain data for a minimum of 7 years to satisfy Tanzanian tax and corporate record-keeping obligations.
Specific retention periods by category:
- Financial records (invoices, payments, tax filings) — 7 years minimum.
- Shipment and customs documents — 5 years from completion.
- Support ticket history — 3 years.
- Access logs and technical data — 12 months rolling.
- Marketing consent records — until consent is withdrawn plus 2 years.
After the applicable retention period, data is securely deleted or anonymised.
Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Right of Access — Request a complete copy of all personal data we hold about you at any time.
- Right to Rectify — Correct inaccurate or incomplete data in your profile or associated records.
- Right to Erasure — Request deletion of your personal data, subject to legal retention obligations.
- Data Portability — Export your data in a machine-readable format (JSON or CSV) at any time.
- Right to Object — Object to processing based on legitimate interests or direct marketing.
- Restrict Processing — Request that we limit processing while a dispute or review is underway.
To exercise any of these rights, email privacy@hudumika.tz. We will respond within 30 days. Some requests may be subject to legal limitations or identity verification.
Security Measures
We implement industry-standard technical and organisational measures to protect your data:
- AES-256 encryption at rest; TLS 1.3 in transit.
- Role-based access controls with principle of least privilege.
- Multi-factor authentication for administrator and privileged access.
- Automated intrusion detection and anomaly monitoring.
- Regular security audits and penetration testing.
- Secure data backup with geo-redundancy across multiple availability zones.
Despite our measures, no system is 100% secure. If you believe your account has been compromised, contact security@hudumika.tz immediately.
Cookies & Tracking
We use session cookies for authentication and a small set of analytics cookies to understand aggregate usage patterns. We do not use third-party advertising trackers. You can control cookies via your browser settings, though disabling session cookies will prevent login.
International Transfers
Data is primarily stored and processed within the African Union region. Where data is transferred outside Tanzania, we ensure appropriate safeguards are in place including Standard Contractual Clauses or equivalent protective mechanisms.
Changes to This Policy
We may update this Privacy Policy to reflect changes in law, technology, or our practices. We will notify account holders of material changes by in-app notification or email at least 14 days before the change takes effect. Continued use of the platform after that date constitutes acceptance.
Data Protection Office
Hudumika Ltd · Plot 123, Maktaba Street · Dar es Salaam, Tanzania
Email: privacy@hudumika.tz
For urgent data breach notifications: security@hudumika.tz
