Duka Langu Privacy and Policy

📄 DUKA LANGU PRIVACY POLICY

Last updated: January 03, 2026

This Privacy Policy for ULTRATEC INVESTMENT LIMITED (‘we’, ‘us’, or ‘our’) describes how and why we might access, collect, store, use, and/or share (‘process’) your personal information when you use our services (‘Services’), including when you:

– Download and use our mobile application (Duka Langu), web platform, or any other application of ours that links to this Privacy Policy.
– Engage with us in other related ways, including sales, marketing, or events.

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. We are the data controller responsible for decisions about how your personal information is processed under Tanzania’s Personal Data Protection Act (PDPA) 2022 and other applicable laws. If you do not agree with our policies and practices, please do not use our Services. If you still have questions or concerns, please contact us at info@ultratec.co.tz.

SUMMARY OF KEY POINTS
– We collect names, phone numbers, email addresses, business data (inventory, sales, expenses), device information, and location data (if permitted).
– We do not process sensitive personal information.
– We process your information to provide and improve the Services, communicate with you, ensure security, and comply with legal obligations.
– We share data only with trusted third parties (payment processors, analytics providers) and in specific situations (e.g., business transfers).
– Inactive accounts are automatically deleted after 2 years.
– You have rights to access, correct, delete, and object to the processing of your data.

TABLE OF CONTENTS
1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. HOW LONG DO WE KEEP YOUR INFORMATION?
7. HOW DO WE KEEP YOUR INFORMATION SAFE?
8. DO WE COLLECT INFORMATION FROM MINORS?
9. WHAT ARE YOUR PRIVACY RIGHTS?
10. INTERNATIONAL TRANSFERS OF YOUR INFORMATION
11. DATA BREACH NOTIFICATION
12. CONTROLS FOR DO-NOT-TRACK FEATURES
13. DO WE MAKE UPDATES TO THIS POLICY?
14. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

1. WHAT INFORMATION DO WE COLLECT?
Personal information you disclose to us
We collect personal information that you voluntarily provide when registering or using the Services, such as:
– Names
– Phone numbers
– Email addresses
– Mailing/business addresses
– Usernames and passwords
– Business data (inventory details, sales records, purchases, expenses, reports)

Payment Data
All payment and subscription data is handled and stored securely by Vodacom M-Pesa. For their privacy practices, please refer to their policy: https://vodacom.co.tz/m-pesa (or the current M-Pesa privacy statement).

Application Data
With your permission, we may collect geolocation information, access to camera/storage (for features like receipt scanning), device information, and push notification preferences.

Information automatically collected
We automatically collect device information (IP address, device ID, operating system), usage data, log data, and approximate location data for service improvement, security, and analytics.

Google API
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2. HOW DO WE PROCESS YOUR INFORMATION?
We process your information to:
– Provide, operate, and maintain the Services (account management, POS features, reports).
– Improve and develop the Services.
– Communicate with you (administrative, updates, marketing with consent).
– Prevent fraud and ensure security.
– Comply with legal obligations.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
We process your personal information based on:
– Performance of a contract – To deliver the Services you subscribed to.
– Consent – For marketing communications or optional features (withdrawable at any time).
– Legal obligation – To meet tax, accounting, or regulatory requirements.
– Legitimate interests – For security, fraud prevention, analytics, and service improvement (where these interests are not overridden by your rights).

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
We share information only in limited cases:
– With payment processors (e.g., Vodacom M-Pesa).
– With analytics providers (e.g., Google Analytics).
– With affiliates or related companies (bound by this Policy).
– During business transfers (mergers, acquisitions).
– When required by law or to protect our rights.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
Yes, we use cookies and similar technologies for functionality, security, and analytics (including Google Analytics). You can opt out of Google Analytics at: https://tools.google.com/dlpage/gaoptout.

6. HOW LONG DO WE KEEP YOUR INFORMATION?
We retain your personal and business data only as long as necessary to provide the Services and fulfil the purposes in this Policy, or as required by law (e.g., up to 7 years for tax and financial records under Tanzanian law).

If your account remains inactive for a continuous period of two (2) years (no logins, transactions, or app usage), we will automatically delete or anonymise all associated personal and business data. We may send a reminder email before deletion to give you an opportunity to reactivate your account.

Upon account termination or your deletion request, we will delete or anonymise your data where possible, retaining only information required for legal compliance, fraud prevention, or dispute resolution.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?
We implement reasonable technical and organisational measures (e.g., encryption, access controls, secure hosting) to protect your data. However, no transmission over the internet or storage system can be guaranteed 100% secure. You access the Services at your own risk.

8. DO WE COLLECT INFORMATION FROM MINORS?
No. We do not knowingly collect or market to children under 18 years of age.

9. WHAT ARE YOUR PRIVACY RIGHTS?
Under the Personal Data Protection Act (PDPA) and applicable laws, you have the right to:
– Access your personal information
– Correct inaccuracies
– Request deletion
– Restrict or object to processing
– Data portability (where applicable)
– Withdraw consent

To exercise these rights, contact us at info@ultratec.co.tz. We will respond in accordance with the law.

10. INTERNATIONAL TRANSFERS OF YOUR INFORMATION
Your personal and business data is hosted on servers located in France and the United States (via our hosting provider InMotion Hosting). Whenever we transfer your data outside Tanzania, we ensure appropriate safeguards are in place (such as standard contractual clauses or adequacy decisions) to protect it in accordance with the Personal Data Protection Act (PDPA) 2022.

11. DATA BREACH NOTIFICATION
In the event of a personal data breach that poses a risk to your rights, we will notify you and the Personal Data Protection Commission as required by law.

12. CONTROLS FOR DO-NOT-TRACK FEATURES
We do not currently respond to Do-Not-Track browser signals, as no uniform standard exists.

13. DO WE MAKE UPDATES TO THIS POLICY?
Yes. We will notify you of material changes by email, in-app notice, or prominently on our website. Please review this Policy periodically.

14. HOW CAN YOU CONTACT US ABOUT THIS POLICY?
Email: info@ultratec.co.tz
Postal address:
ULTRATEC INVESTMENT LIMITED
34534
Dar es Salaam, Mikocheni B 34534
Tanzania