Privacy Policy — Nyumba Direct

1. Who we are

Nyumba Direct is a rental marketplace operated by SafariDigital Africa Company Limited, a company registered in the United Republic of Tanzania. We connect property owners directly with tenants — no middlemen, no extra fees.

Data controller: SafariDigital Africa Company Limited
Registered address: Shoppers Mall, Dodoma · PO Box 300
Contact: privacy@nyumbadirect.tz

2. Information we collect

We collect information that you provide directly to us, information generated when you use the Service, and information from third parties when relevant.

Information you provide

Account information — your full name, phone number, and (optionally) email address when you sign up.
Profile information — for owners and agents: agency name, license number, bio, and profile photo (all optional).
Property listings — for owners: property descriptions, photos, location details, rent, and amenities.
Inquiries and messages — when you contact an owner through the Service, your phone number is shared with that owner so they can reply.
Identity verification — we verify your phone number via a one-time SMS code at signup and login.

Information collected automatically

Usage data — pages you view, listings you click, search queries, and time of activity.
Device and log data — IP address, browser type, operating system, and approximate location based on IP.
Cookies and similar technologies — used to keep you logged in and remember basic preferences (see Section 7).

Information from third parties

If you sign up via WhatsApp, we receive your WhatsApp number and profile name from Meta (the operator of WhatsApp).
If you report a listing or another user, we record the details you provide as part of the flag investigation.

3. How we use your information

We use your personal information for the following purposes:

To provide the Service — creating your account, displaying listings, enabling inquiries, sending notifications about your account and listings.
To match tenants with owners — when a tenant inquires, we share their phone with the listing owner so the two can contact each other directly.
To moderate the platform — reviewing listings, investigating flags, suspending accounts that violate our Terms of Use.
To prevent fraud and abuse — detecting fake listings, scam attempts, brokers attempting to bypass our no-middleman covenant.
To improve the Service — understanding which features are used, where users encounter problems, and what to build next.
To comply with law — responding to lawful requests from authorities, meeting our legal obligations.
To communicate with you — sending SMS notifications about your listings, account actions, and (rarely) service updates.

4. Legal basis for processing

Under Tanzania's Personal Data Protection Act, 2022, we process your personal data on the following legal bases:

Performance of a contract — to deliver the Service you signed up for.
Your consent — for optional features like marketing communications.
Legitimate interest — for fraud prevention, security, and improving the Service.
Legal obligation — when we must process data to comply with Tanzanian law.

5. Who we share your information with

We share personal information only as described below. We do not sell your data.

With other users

When you inquire about a listing as a tenant, your phone number and name are shared with the listing owner.
Owner names, listing details, and listing photos are publicly visible on the Service.
Profile photos and agency details (if provided) are visible on listings.

With service providers

We use trusted third-party services to operate the platform. Each only receives the data necessary for their function:

Africa's Talking — sends SMS notifications and verification codes (receives your phone number and the message body).
Meta Platforms — operates WhatsApp; we use the WhatsApp Business API to provide a search and inquiry channel (receives your WhatsApp number and message content while you're using the bot).
Cloudflare — hosts our images (R2) and provides our content delivery network.
Hostinger — hosts our application servers.

With authorities

We may disclose your personal information if required to do so by law, in response to a valid legal request from a Tanzanian authority, or to protect the rights, property, or safety of Nyumba Direct, our users, or the public.

In a business transfer

If SafariDigital Africa Company Limited is involved in a merger, acquisition, or sale of assets, your personal information may be transferred to the new owner, subject to the protections of this Policy.

6. How long we keep your data

We retain personal information only for as long as necessary to provide the Service and meet our legal obligations.

Account information — for as long as your account is active, plus up to two years after closure for legal and fraud-prevention purposes.
Listings — retained while active. Deleted listings are removed from public view immediately and from backups within 90 days.
SMS and notification records — retained for 12 months for service quality and dispute resolution.
Server logs — typically retained for 30-90 days for security and debugging.
Flag and moderation records — retained for the lifetime of the related account for fraud prevention.

7. Cookies

We use a minimal set of cookies and similar storage technologies. We do not use third-party advertising cookies or cross-site tracking.

Authentication cookies — to keep you logged in.
Session storage — to remember basic UI preferences during your visit.

8. Your rights

Under the Personal Data Protection Act, 2022, you have the following rights regarding your personal data:

Right to access — request a copy of the personal information we hold about you.
Right to correct — ask us to update inaccurate or incomplete information. You can do this yourself for most fields by editing your profile.
Right to erase — ask us to delete your account and associated data, subject to our retention obligations.
Right to object — object to certain types of processing, including any direct marketing.
Right to withdraw consent — where we rely on your consent, you can withdraw it at any time.
Right to lodge a complaint — file a complaint with Tanzania's Personal Data Protection Commission if you believe your rights have been violated.

To exercise any of these rights, contact us at privacy@nyumbadirect.tz. We will respond within 30 days.

9. How we protect your data

We use industry-standard security measures, including encrypted transport (HTTPS), encrypted storage of sensitive data, access controls, and regular security reviews. However, no method of transmission or storage is 100% secure. If we discover a data breach that affects you, we will notify you and the relevant authority as required by law.

10. International data transfers

Some of our service providers (Cloudflare, Meta, Africa's Talking, Hostinger) may process your data outside of Tanzania. Where this happens, we ensure appropriate safeguards are in place, including contractual commitments by the provider to protect your data to the standard required by Tanzanian law.

11. Children

The Service is not directed at people under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by SMS or via a notice on the website at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact us

For privacy-related questions or to exercise your rights, contact us at:

SafariDigital Africa Company Limited
Shoppers Mall, Dodoma · PO Box 300
Email: privacy@nyumbadirect.tz
Phone: +255 752 124 913