Mauzo Privacy Policy

Welcome to Mauzo by Tunzaa ("MAUZO", "Tunzaa", "we", "us" or "our"). Mauzo provides businesses with technology and operational infrastructure to launch and manage branded digital marketplaces and commercial networks.

This Privacy Policy explains how we collect, receive, use, disclose, store, protect and otherwise process personal data in connection with Mauzo and marketplaces powered by it. It applies to business customers, their administrators and staff, vendors, distributors, agents, marketplace visitors and customers whose information is processed through a Mauzo-powered service.

The customer-facing marketplace may use the business customer's own name, branding, terms and privacy notices. This Policy describes Tunzaa's processing in providing Mauzo; the business customer may separately explain its own processing to its users.

This Policy should be read with applicable Tunzaa terms, service agreements, data-processing terms, cookie notices and any privacy notice provided by the business operating the relevant marketplace. Tunzaa processes personal data in accordance with applicable laws of the United Republic of Tanzania, including the Personal Data Protection Act, 2022 and applicable regulations.

Tunzaa Fintech Inc., 256 Chapman Road, STE 105-4, Newark – New Castle, 19702, Delaware, United States of America, is the United States parent of the Tunzaa group and owner of Tunzaa intellectual property, technology and group assets.

Tunzaa Digital Holdings Limited, P.O. Box 13416 Posta Mpya, Delta House – Dunga Street/Morocco Road, Plot 399/Block 42, Kinondoni, Dar es Salaam, Tanzania (email: mambo@tunzaa.co.tz), is the Tanzanian operating company responsible for local operations and regulated activities, as applicable.

Mauzo provides configurable technology for branded marketplaces and commercial networks. Depending on the service configured by a business customer, this may include web and mobile experiences, customer accounts, product catalogs, vendor management, orders, promotions, point of sale, analytics, payments integrations, delivery workflows, distribution and related business tools.

The business customer configures and operates its marketplace and determines many of its commercial practices, including which vendors participate, what products are offered, marketplace rules, customer communications, fulfilment arrangements and which features are enabled.

Mauzo is infrastructure; it does not itself become the seller of products or services offered by a business customer or its vendors merely by providing the platform. The roles and responsibilities for each data-processing activity depend on who determines its purposes and means.

A business customer will generally determine why it collects and uses information about its marketplace customers, vendors, agents and other participants. For those activities, the business customer may act as Data Controller and Tunzaa may process information on its documented instructions as Data Processor under applicable service and data-processing terms.

Tunzaa may act as an independent Data Controller for its own purposes, including managing the business relationship, accounts and platform access; securing and maintaining Mauzo; preventing fraud and abuse; providing support; improving services; and meeting legal obligations.

The applicable roles may differ by processing activity, and may be described in the business customer's agreement, a Data Processing Addendum or other applicable notice. Users should also consult the privacy notice of the business operating the relevant marketplace.

We may process information about a business customer and its representatives to assess and establish the service, configure its marketplace, create and administer accounts, provide support, manage billing and service relationships, verify the business where needed, and protect platform access.

This may include business contact details, authorized-user roles, configuration choices, integration details and service communications.

Where enabled by the business customer, Mauzo may support onboarding and administration of vendors, distributors, agents or other network participants. Information may include identity and business verification, contact details, profile and permissions, catalog and inventory records, orders, commissions, settlement instructions, performance and communications.

The business customer determines the network's participation requirements and should provide its participants with appropriate notices about its use of their information.

A Mauzo-powered marketplace may process customer account details, browsing and product interactions, shopping carts, orders, delivery details, customer support messages, preferences and related records. Tunzaa processes such information as necessary to provide the configured infrastructure and according to the applicable business customer's instructions, except where Tunzaa has a separate lawful purpose as described in this Policy.

The business customer is responsible for determining the customer-facing marketplace notice and the information needed for its commercial activities.

We may use personal data to provide and configure Mauzo; create and administer accounts; enable marketplace and vendor operations; support product catalogs, inventory, orders, analytics and integrations; provide customer support; maintain service reliability and security; detect fraud and abuse; improve our services; manage the business relationship; and comply with legal obligations.

Depending on the circumstances and applicable law, processing may be based on performance of a contract or steps requested before contract, compliance with legal obligations, legitimate interests that do not override applicable rights, consent where required, or another lawful basis recognised by applicable law. Where processing is based on consent, it may be withdrawn subject to legal limitations; withdrawal does not affect processing already lawfully undertaken.

Mauzo may connect a marketplace to Malipo by Tunzaa or other banks, financial institutions, mobile-network and payment partners, gateways and service providers. Information processed may include transaction references, payment status, reconciliation, refunds and settlement information needed to support configured payment workflows.

Payment credentials may be handled directly by a payment provider. Tunzaa may receive limited information, tokens or transaction status rather than complete payment credentials, depending on the integration.

Where delivery or fulfilment tools are enabled, information such as recipient name, contact details, delivery address, order contents, instructions, assignment and delivery status may be processed or shared with the relevant business customer, vendor or logistics provider to fulfil an order.

We may disclose personal data to the relevant business customer and its authorised users; vendors or other marketplace participants where needed for configured workflows; Tunzaa group companies; cloud, hosting and technology providers; payment and financial partners; logistics providers; professional advisers; and regulators, courts or public authorities where necessary and lawful.

When Tunzaa acts as a processor, disclosures are made as needed to deliver the service, follow the customer's instructions, protect the service or meet legal requirements.

Business customers are responsible for providing appropriate notices, identifying a lawful basis, configuring features responsibly, limiting access to authorised users, responding to requests from their marketplace users where they are the Controller, and complying with applicable data-protection laws and contractual instructions. They must use personal data only for authorised purposes and protect it against unauthorised access, disclosure or loss.

Tunzaa and business customers may use automated or analytical tools for platform security, fraud detection, account or vendor risk assessment, operational monitoring, recommendations and marketplace functionality. These tools may trigger review, additional verification, restrictions or delays. Where required by applicable law, information about relevant automated decisions and mechanisms to raise an objection or request human review will be provided.

We may analyse technical, service and usage information, including aggregated or de-identified data, to monitor performance, troubleshoot problems, understand feature use, improve Mauzo, develop products and maintain security. Business customers may also access analytics about their own marketplace according to the features and permissions they configure.

Mauzo services and marketplace experiences may use cookies, SDKs, local storage, device identifiers, analytics tools and similar technologies for authentication, security, functionality, performance measurement and analytics. The business customer may determine additional technologies used on its branded marketplace. Where required, appropriate consent mechanisms will be provided; further information may appear in applicable cookie notices.

Personal data may be accessed or processed outside Tanzania within the Tunzaa group or by authorised cloud, technology, payment and other service providers. Any transfer from Tanzania will be made subject to applicable Tanzanian data-protection requirements and appropriate safeguards, including regulatory permission where required.

We retain personal data for as long as reasonably necessary for the purposes described in this Policy, including service delivery, account and transaction records, security, support, dispute resolution, legal claims and regulatory requirements. Where Tunzaa acts as a processor, retention and deletion are also governed by the business customer's instructions and applicable agreement. When information is no longer required, we take appropriate steps to delete, anonymise or securely dispose of it, subject to lawful retention requirements.

Tunzaa maintains technical and organisational measures appropriate to the risks of processing, which may include access controls, authentication, monitoring, system protections, security procedures and incident response. Access is limited according to legitimate operational, security and compliance needs. No electronic system can be guaranteed completely secure; users should also protect their credentials and devices.

If Tunzaa becomes aware of a personal-data breach, we will assess and respond in accordance with applicable law and contractual duties. This may include containment, investigation, risk assessment, remediation and notifications to authorities, affected individuals or business customers where required.

You are responsible for protecting passwords, access credentials, authentication codes and devices, and for limiting account access to authorised persons. Notify the relevant business customer or Tunzaa promptly if you suspect unauthorised access, using the support channel available to you.

Subject to applicable law and lawful exceptions, individuals may have rights to access, correct, erase or restrict certain personal data, object to certain processing, withdraw consent where applicable, and exercise other rights provided by law. Where a business customer controls the processing, requests should generally be made to that business customer; Tunzaa will assist it as required by applicable law and agreement.

Contact the business operating the relevant marketplace for requests about its customer, vendor or network records. For information Tunzaa processes as an independent Controller, or if you are unsure where to direct a request, contact us using the details below. We may request reasonable information to verify identity and will respond within applicable legal timeframes.

Tunzaa Digital Holdings Limited — Data Protection, P.O. Box 13416 Posta Mpya, Delta House – Dunga Street/Morocco Road, Plot 399/Block 42, Kinondoni, Dar es Salaam, Tanzania. General email: mambo@tunzaa.co.tz. Website: www.tunzaa.co.tz.

Tunzaa has not yet designated a dedicated Data Protection Officer contact. Until a dedicated address is formally designated, the general email above may be used for privacy enquiries.

If you believe personal data has been processed unlawfully, contact the relevant business customer or Tunzaa, as appropriate, so the matter can be reviewed. You may also exercise any statutory right to lodge a complaint with the Personal Data Protection Commission or another competent authority.

Mauzo is business infrastructure and is not intended to be directed to children. The business customer is responsible for configuring its marketplace appropriately. Tunzaa does not knowingly collect children's personal data except where lawful and necessary for a specific service, with appropriate safeguards where required.

Users may submit product, profile, support or other content through a Mauzo-powered service. Do not include another person's personal data unless you have authority and a lawful basis. Business customers may moderate or remove content under their marketplace rules and applicable law.

Mauzo may integrate with services selected by a business customer, including payment, banking, logistics, identity verification, analytics and communication providers. A third party that processes information as an independent Controller may apply its own privacy notice and obligations.

We seek to maintain information that is reasonably accurate and relevant to its purpose. Business customers and users should keep information current and avoid submitting unnecessary personal or sensitive information.

A business customer may request closure of its Mauzo service subject to its agreement and applicable procedures. Closure does not necessarily immediately delete all records: Tunzaa or the business customer may retain information for outstanding services, transactions, security, disputes, legal claims or regulatory duties. Data will be deleted, anonymised or securely disposed of when no longer required, subject to applicable retention requirements.

We may amend this Policy to reflect changes in Mauzo, our processing, technology, applicable law or privacy practices. For material changes, we will take reasonable steps to communicate them through appropriate channels. The Last Updated date below indicates the latest revision.

This Policy describes Tunzaa's processing in connection with Mauzo. A business customer may provide a separate privacy notice for its branded marketplace and remains responsible for its own processing and notices. If documents conflict, the applicable service agreement or data-processing terms govern the parties' contractual relationship to the extent stated there.

Nothing in this Policy limits any right or protection that cannot lawfully be limited under applicable data-protection law.

This Policy is intended to be interpreted consistently with applicable laws of the United Republic of Tanzania. Mandatory legal requirements continue to apply to the relevant processing activity.

This Privacy Policy is available in English and Kiswahili. The Kiswahili version is machine-translated and pending legal review. The English version is the reference if there is any difference.