Smart Fundi Privacy Policy

Personal Data Protection Policy · Version 2.0 · Effective 17 October 2026
Operated by Barah Technologies Limited

1. Who we are
2. Scope
3. Data Protection Officer
4. Our principles
5. Data we collect
6. Why we use it
7. What is shown publicly
8. Location data
9. Payments and sensitive data
10. Who we share data with
11. Transfers outside Tanzania
12. Your rights
13. Deleting your account
14. How long we keep data
15. Security
16. Data breaches
17. Age requirement
18. Compliance with the law
19. Changes to this policy
20. Contact and complaints

1. Who we are

Smart Fundi is a digital marketplace connecting customers with handymen (fundis), shops and material suppliers (super agents) in Tanzania. It is operated by Barah Technologies Limited, which is the data controller for the personal data described in this policy.

This policy is prepared under the Personal Data Protection Act, Cap. 44 (Act No. 11 of 2022) ("the Act") and the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C). It also serves as our code of ethics under section 65 of the Act.

2. Scope

This policy applies to personal data we collect through the Smart Fundi mobile app, our website smart-fundi.com, and our payment services, about:

• Customers who search for and request fundis, shops or suppliers;
• Fundis (independent tradespeople) who offer their services;
• Shop Owners who list their businesses;
• Super Agents (Wakala Mkuu), bulk material suppliers.

3. Data Protection Officer

We have appointed a Data Protection Officer (DPO) under section 27(3) of the Act and regulation 32 of GN No. 449C. The DPO oversees our compliance, handles your requests and complaints, and is our contact point with the Personal Data Protection Commission.

4. Our principles

In line with section 5 of the Act, we process personal data lawfully, fairly and transparently; only for specific purposes explained here; limited to what is necessary; kept accurate; kept no longer than needed; kept secure; and in a way that respects your rights.

5. Data we collect

We do not use advertising or third-party analytics tools in the app, and we do not collect data from your Google account beyond your name, email address and profile photo. We never access Gmail, Google Drive or your contacts.

6. Why we use your data

7. What is shown publicly

Smart Fundi is a marketplace, so some information is visible to other users and to anyone viewing a provider's profile:

• For Fundis, Shops and Super Agents: name or business name, profile and cover photos, city, trade or products, portfolio photos, the contact or WhatsApp number you add to your listing, ratings and reviews, verification status and subscription status (active or not).
• Certificates: trade certificates you upload are shown on your public profile. Do not upload documents that show your national ID number or other identity numbers.
• Reviews you write are shown with your name on the provider's profile.

Verification documents (IDs and business licences) are never shown publicly; they are stored in a private area accessible only to you and to us for verification. When an account is closed, its profile is removed from search and public view immediately.

8. Location data

We use location to match customers with nearby providers. For Fundis, the app updates your location while you use it, so that nearby job requests can be sent to you. We use it only for matching and dispatch, and we clear your stored location when your account is closed. You can turn off location access in your phone settings, but job matching will then not work for you.

9. Payments and sensitive personal data

Under section 3 of the Act, financial transactions are sensitive personal data. Payments are processed through our payment partner, Selcom Paytech Ltd, using a mobile money prompt (USSD) sent to the phone number registered on your account.

• Before every payment, we ask for your separate, explicit consent through a checkbox that is not bundled with any other agreement (section 30(1) of the Act). We keep a record of each consent.
• We never see or store your mobile money PIN.
• You may withdraw your consent at any time (section 30(2)); we will then be unable to process payments for you, and paid features will become unavailable.

10. Who we share data with

We do not sell personal data, and we do not share it for marketing. We share it only with service providers who process it on our instructions (section 27(4) of the Act):

Other users see only the information described in section 7. We may also disclose data where required by Tanzanian law or a lawful order.

11. Transfers outside Tanzania

Our database and payment server are hosted in Frankfurt, Germany, so personal data is transferred outside Tanzania, as permitted by sections 31 and 32 of the Act. Germany is governed by the EU General Data Protection Regulation, which provides a level of protection equal to or higher than the Act. These transfers are also necessary to perform our contract with you (section 32(4)(b)). Our providers apply security standards and data processing terms consistent with the GDPR.

12. Your rights

Under Part VI of the Act and Part III of GN No. 449C, you have the following rights. To use them, contact our DPO (section 3). We may ask you to confirm your identity first.

13. Deleting your account

You can delete your account in the app under Profile → Account settings → Delete Account, or by emailing [email protected] from your registered email address. Email requests are handled within 14 days. Full instructions are on our account deletion page.

When you delete your account, it is closed immediately: you are signed out and cannot sign in again, your profile is removed from search and job matching, open job requests are cancelled, and your portfolio photos are deleted. The remaining data is kept for the limited periods in section 14, then permanently deleted.

14. How long we keep data

In accordance with section 28 of the Act and regulation 30 of GN No. 449C:

15. Security

In accordance with section 27 of the Act and regulation 27 of GN No. 449C, we protect your data with:

• Encrypted connections (HTTPS) between the app, our database and our payment server;
• Database access rules that let each user see and change only what they are allowed to, and private storage for verification documents;
• Independent confirmation of every payment with Selcom before any subscription is activated;
• Server access restricted to authorised personnel using key-based authentication, behind a firewall;
• Administrative credentials kept on our servers, never in the app;
• Regular review of our security and access rules.

Everyone who works on Smart Fundi and has access to personal data is required to follow this policy.

16. Data breaches

If a security breach affects personal data, our DPO will assess it and notify the Personal Data Protection Commission without undue delay, as required by section 27(5) of the Act. Where a breach poses a risk to you, we will also notify you directly where feasible, and tell you what we are doing about it.

17. Age requirement

Smart Fundi is for people aged 18 and over. Every user confirms they are 18 or over when signing up. If we learn that an account belongs to someone under 18, we will close it and delete its data.

18. Compliance with the law

Barah Technologies Limited collects and processes personal data in accordance with the Personal Data Protection Act, Cap. 44 and its Regulations, and with the other laws of the United Republic of Tanzania that apply to our services.

19. Changes to this policy

We review this policy at least once a year, and whenever our services or the law change. We will post the updated version here with a new effective date, and tell you in the app about any significant change.

20. Contact and complaints

For any question or request about your personal data, contact our DPO at [email protected] or +255 748 777 436. If you are not satisfied with our response, you may complain to the Personal Data Protection Commission (PDPC) under the Personal Data Protection (Complaints Settlement Procedures) Regulations, 2023 (GN No. 449B).

Appendix: Summary of processing activities