Privacy Policy

Last updated: 2026-08-11

This Privacy Policy explains how Tumaoni ("Tumaoni", "we", "us") collects, uses, shares, and protects personal data. Tumaoni is a customer-feedback service for businesses in Tanzania, operated by Omojadata. We are committed to handling personal data in accordance with the Personal Data Protection Act, 2022 of the United Republic of Tanzania and its regulations.

1. Who controls your data

There are three kinds of people whose data flows through Tumaoni, and the roles differ:

• Business owners who register and use the app — for their account data, Tumaoni is the data controller.
• Employees whose details an owner enters — the business owner is the data controller and Tumaoni is the data processoracting on the owner's instructions.
• Customers who leave feedback — for the feedback infrastructure, Tumaoni is the controller.

2. What we collect

From business owners

• WhatsApp / mobile phone number (used to sign in and to send you notifications).
• Business name, branch names, and branch location (region, district, ward).
• Business logo, if you upload one.
• For paid plans: the mobile-money number you pay from and a record of your subscription transactions (processed through ClickPesa — see section 6).
• Device push-notification tokens, so we can alert you to new feedback.

About employees (entered by the business owner)

When a business owner adds an employee, the following is collected and stored:

• Full name.
• Gender.
• Photograph.
• Job position / role.
• A contact phone number, kept private to the business.

Only the employee's name, photograph, and job positionare shown publicly to customers. The employee's gender and contact phone number are kept for internal / administrative use and are notshown to customers. Tumaoni does not collect employees' National Identification Numbers (NIDA), dates of birth, or other national-identity data.

From customers leaving feedback

• A positive or negative rating (good / bad) and a comment.
• An optional phone number, if you choose to provide one (kept private — see below).
• The device's IP address and a randomly-generated browser token, used only to prevent duplicate ratings and abuse.

Customers do not create an account. Any phone number a customer provides is visible only to the business owner who received the rating, so they can follow up. It is never shown publicly or shared with other businesses.

3. How we use the data

• To operate the service — let owners manage branches and employees and read customer feedback.
• To display public profiles (business, branch, employee) so customers can leave feedback.
• To send owners notifications about new feedback and account activity.
• To process subscription payments and manage plan limits.
• To prevent fraud, duplicate ratings, and abuse.

4. Our lawful basis

We process personal data on one or more of these bases under the Personal Data Protection Act, 2022: your consent; the performance of a contract (for example, delivering the service you signed up for); compliance with a legal obligation; and our legitimate interests in operating, securing, and improving the service, provided those interests are not overridden by your rights.

Employee photographs. A photograph is personal data that we treat with care. Where an owner uploads one, they do so on the basis of their authority as the employer and their confirmation that the employee has been informed (see our Terms and Conditions).

5. Customer feedback is an opinion

Ratings and comments reflect the personal opinions and experiences of the customers who leave them. They are not statements of fact by Tumaoni, and Tumaoni does not verify them. Business owners can request removal of a specific customer rating from within the app.

6. Who we share data with

We do not sell personal data or share it with advertisers. We share data only with service providers that help us run Tumaoni:

• NEXT SMS (MJUMBE) — delivers one-time verification codes by SMS.
• ClickPesa — processes mobile-money subscription payments.
• Google (Firebase Cloud Messaging) — delivers push notifications.
• Cloudflare — content delivery, security, and the Turnstile anti-bot check on the rating form.
• DigitalOcean — hosts our servers and database.

We may also disclose data if required by law, court order, or a lawful request from a competent authority.

7. Retention

• Business owner account data is kept while the account is active.
• One-time verification codes are deleted as soon as they are used or expire.
• Customer feedback is kept while the related employee, branch, and business remain in Tumaoni. When an owner deletes their account, we delete their businesses, branches, and employees; we may retain anonymised, aggregate rating data (without any identifier) for integrity and statistical purposes, as permitted by the Act.
• Payment transaction records are kept as required for accounting and legal compliance.

We do not keep personal data for longer than is necessary for the purposes for which it was collected.

8. Security

We use HTTPS for all connections, restrict database access, hash verification codes, and use an anti-bot check on the rating form. No system is perfectly secure, but we take reasonable technical and organisational measures to protect personal data.

9. Data breaches

If a security breach occurs that affects your personal data, we will notify the Personal Data Protection Commission and, where the Act requires it, the affected data subjects, without undue delay after we become aware of it. Our notice will describe, as far as we can, what happened, the data involved, the likely consequences, and the steps we are taking in response.

10. Your rights

Subject to the Personal Data Protection Act, 2022, you have the right to access your personal data, correct it, request its erasure or destruction, object to or restrict certain processing, and withdraw consent at any time.

• Business owners can delete their entire account from inside the app (Settings > Account > Delete my account), which removes the account and the businesses, branches, and employees they own.
• Employees may ask to access or correct the data an owner holds about them, or to be removed. Employees can make these requests to their employer, or directly to us using the contact details below.
• Customers can request deletion of a rating they left by contacting us with enough detail to identify it.

To exercise any right, email admin@omojadata.org. We will respond within the time required by law.

11. Cross-border processing

Some of our service providers (for example, Google, Cloudflare, and ClickPesa) may process data on servers outside Tanzania. Where this happens, we take steps to ensure the data continues to be protected to a standard consistent with Tanzanian law.

12. Children

Tumaoni is intended for businesses and adults. It is not directed at children under 18, and we do not knowingly collect data from them.

13. Registration and Data Protection Officer

Omojadata's registration as a data controller and processor with the Personal Data Protection Commission of Tanzania is in progress.

We have appointed a Data Protection Officer who is responsible for overseeing our compliance with the Personal Data Protection Act, 2022. You can reach our Data Protection Officer, Hassan Abubakar Manengelo, at admin@omojadata.org.

14. Changes

We may update this Policy. The "Last updated" date at the top reflects the most recent change. Significant changes will be highlighted in the app or on this page.

15. Contact & complaints

For any privacy question or to exercise your rights, contact admin@omojadata.org or our Data Protection Officer (section 13). If you believe we have not handled your personal data lawfully, you also have the right to lodge a complaint with the Personal Data Protection Commission of Tanzania.