Legal document
Privacy Policy
Version 1.0
Version: 1.0
Controller: [Your legal entity name], United Republic of Tanzania
Contact: privacy@indusflo.s.co.tz
1. Scope
This Policy explains how we collect, use, store, and protect personal data when you use Indusflo, in line with Tanzania’s Personal Data Protection Act and related regulations where applicable.
2. Data we collect
| Category | Examples | Purpose |
|---|---|---|
| Account | Name, email, phone, password hash | Authentication, support |
| Organization | Company name, industry, country, tax ID (optional) | Provisioning, compliance |
| Usage | Logs, IP, device, feature usage | Security, billing, improvement |
| Workforce (your input) | Employee names, attendance you enter | Features you enable |
| Payment | Billing status (not full card numbers on our servers when using Lipa) | Subscriptions |
3. Legal bases
We process data based on: contract (providing the service), legitimate interests (security, analytics), legal obligation, and consent where required (e.g. marketing emails).
4. How we use data
- Provide and secure the multitenant platform
- Provision your dedicated database space
- Send transactional emails (invites, alerts, billing)
- Comply with law and enforce Terms
We do not sell your personal data.
5. Tenant isolation
Your operational data is stored in a separate database from other customers. Platform staff access is restricted, logged, and limited to support and billing needs.
6. Retention
| Data | Retention |
|---|---|
| Active tenant | While subscription active |
| After cancellation | 6 months (archived), then deleted per offboarding policy |
| Audit logs (platform) | 2 years |
| Backups | Up to 90 days rolling |
7. Your rights
Subject to applicable law, you may request: access, correction, deletion, restriction, portability (export), and objection. Contact privacy@indusflo.s.co.tz. We respond within 30 days.
Tenant owners can export organization data from the application.
8. International transfers
If servers or subprocessors are outside Tanzania, we use appropriate safeguards (contracts, security measures) documented in the DPA.
9. Security
Encryption in transit (HTTPS), access controls, audit logging, and regular backups.
10. Subprocessors
We may use hosting, email, and payment providers. A list is available on request or in the DPA annex.
11. Children
The service is for businesses; not directed at children under 18.
12. Changes
We will post version updates and notify material changes to tenant owners.
13. Complaints
You may contact us first. You may also lodge a complaint with the relevant Tanzanian data protection authority when applicable.