Soko Privacy Policy

Welcome to Soko by Tunzaa ("SOKO", "Tunzaa", "we", "us" or "our"). SOKO is a digital marketplace operated in Tanzania by Tunzaa Digital Holdings Limited, through which buyers and sellers may discover, advertise, purchase, sell and otherwise transact in relation to goods and services.

Tunzaa is committed to protecting the privacy and security of personal data entrusted to us. This Privacy Policy explains how we collect, receive, use, disclose, store, protect and otherwise process personal data in connection with SOKO.

It applies to personal data processed through SOKO, including information provided through user accounts, product listings, orders, transactions, communications, customer support, delivery and fulfilment activities, and related digital functionality.

This Privacy Policy should be read together with the applicable Tunzaa Terms of Use, SOKO Marketplace Terms, Seller Terms and Conditions, Acceptable Use Policy, Cookies and Tracking Technologies Policy, and other product-specific notices or policies applicable to your use of SOKO.

Tunzaa processes personal data in accordance with applicable laws of the United Republic of Tanzania, including the Personal Data Protection Act, 2022, the applicable regulations made under it, and applicable requirements of the Personal Data Protection Commission (“PDPC”).

Tunzaa Fintech Inc., 256 Chapman Road, STE 105-4, Newark – New Castle, 19702, Delaware, United States of America, is the United States parent of the Tunzaa group and the owner of Tunzaa intellectual property, technology and group assets.

Tunzaa Digital Holdings Limited, P.O. Box 13416 Posta Mpya, Delta House – Dunga Street/Morocco Road, Plot 399/Block 42, Kinondoni, Dar es Salaam, Tanzania (email: mambo@tunzaa.co.tz), is the Tanzanian operating company responsible for local operations and regulated activities, as applicable.

SOKO operates as a marketplace connecting buyers and sellers. Tunzaa may, on the applicable transaction or service, act as marketplace operator, technology provider, payment provider, fulfilment provider, or another service provider identified in the applicable transaction flow.

Unless expressly stated otherwise, the Seller remains responsible for the goods or services offered through SOKO, including their legality, authenticity, quality, description, availability, pricing, fulfilment, delivery, warranties, returns, refunds, taxes and customer relationship.

Because SOKO involves multiple participants and service providers, responsibility for personal-data processing may differ depending on the particular processing activity.

The entity or person responsible for processing personal data, and whether Tunzaa acts as a Data Controller or Data Processor, depends on the particular processing activity.

Tunzaa may act as an independent Data Controller where it determines the purposes and means of processing, including for account administration, platform security, fraud prevention, risk management, compliance, service analytics, product improvement and platform administration.

Where Tunzaa processes personal data on behalf of a Seller or other business user solely to provide services requested by that Seller or business user, the Seller or business user may act as the Data Controller and Tunzaa may act as a Data Processor. Where applicable, such processing may be governed by a Data Processing Addendum (“DPA”) or other contractual arrangements.

We may process information necessary to create and administer your account; enable you to browse products; place orders; communicate with Sellers; process or facilitate payments; arrange delivery; process returns and refunds; provide customer support; resolve complaints and disputes; protect your account; detect fraud and abuse; and provide and improve SOKO.

Information associated with your orders may include your name, contact details, delivery information, order details, transaction information and communications relating to the transaction.

If you use SOKO as a Seller, we may process information necessary to establish your Seller account, verify your identity or business, conduct KYC/KYB checks, identify beneficial owners where required, conduct risk and compliance checks, manage product listings, process orders, process settlements, facilitate delivery, administer Seller performance, prevent fraud and prohibited activity, provide Seller support, and comply with legal and regulatory requirements.

Seller onboarding may require information concerning the Seller's identity, business, beneficial owners, tax position, settlement arrangements and other matters reasonably required for marketplace integrity or legal compliance.

SOKO requires certain information to be exchanged between Buyers and Sellers to enable transactions. Where a Buyer places an order, Tunzaa may make available to the relevant Seller information reasonably necessary to fulfil the transaction. This may include Buyer name, contact information, delivery information, order information and relevant transaction information.

A Seller must use customer information only for authorised and legitimate purposes. Sellers must not use Buyer information obtained through SOKO for unrelated purposes unless they have an appropriate lawful basis and comply with applicable data-protection requirements.

We may use personal data to administer accounts; conduct KYC/KYB and verification; initiate, process, reconcile and settle transactions; provide customer support; detect and prevent fraud and abuse; conduct risk management; improve SOKO; provide analytics and personalisation; comply with legal and regulatory requirements; and protect Tunzaa, users, service providers, business partners, the public, our systems and property.

Depending on the circumstances and applicable law, Tunzaa may process personal data on the basis of performance of a contract; taking steps at your request before entering into a contract; compliance with a legal or regulatory obligation; legitimate interests that do not override applicable rights; consent where consent is required; or another lawful basis recognised under applicable law.

Where processing is based on consent, you may withdraw consent subject to applicable legal limitations. Withdrawal of consent will not affect processing that was lawfully undertaken before withdrawal.

SOKO may facilitate transactions involving banks, financial institutions, mobile-network and payment partners, acquiring providers, payment gateways and other relevant payment-service providers.

Depending on the transaction, Tunzaa may process payment and settlement information necessary to initiate, process, reconcile, settle, refund or investigate transactions. Where a third-party payment provider processes payment credentials, Tunzaa may receive limited payment information, tokens or transaction status rather than complete payment credentials.

Users should never disclose passwords, PINs, authentication credentials or other confidential security information to another SOKO user or unauthorised person.

SOKO may facilitate delivery or fulfilment directly or through third-party logistics and fulfilment providers. Where necessary, we may process and share recipient name, contact details, delivery address, order details, fulfilment information, delivery instructions, delivery status and related transaction information.

We may disclose personal data to Tunzaa group companies; Buyers and Sellers; banks and financial institutions; payment and mobile-network partners; technology providers; logistics and fulfilment providers; professional advisers; regulators, courts and government authorities; and other parties where necessary and lawful.

Sellers are responsible for complying with applicable data-protection requirements when they process customer or other personal data. Sellers must process customer information only for lawful and authorised purposes, maintain confidentiality, protect customer information, avoid unnecessary collection and retention, not sell customer information, not disclose customer information without lawful authority, not use customer information for unrelated marketing without a lawful basis, and comply with applicable Tunzaa instructions and contractual requirements.

Tunzaa may use automated systems and analytical tools for fraud scoring, Seller or merchant risk scoring, transaction monitoring, account-risk controls, recommendations, personalisation, security, abuse prevention and other legitimate marketplace functions.

Automated processing may result in additional verification, transaction review, account restrictions, transaction delays, rejection or suspension of certain activities, or other security or risk-management measures.

Where required by applicable law, Tunzaa will provide relevant information concerning automated decision-making and available mechanisms to raise an objection or request appropriate human review.

Tunzaa may analyse service, technical, usage and aggregated or de-identified information to monitor SOKO performance, understand user interaction, identify technical problems, improve functionality, develop products, improve search and recommendations, personalise experiences and maintain marketplace security.

SOKO may use cookies, software development kits, pixels, device identifiers, analytics tools, local storage, similar technologies and other tracking technologies for security, authentication, functionality, analytics, attribution, personalisation, performance measurement and advertising where applicable.

Where required, appropriate consent mechanisms will be presented to users. Our use of cookies and similar technologies may be further described in the Tunzaa Cookie and Tracking Technologies Policy.

Personal data collected through SOKO may be accessed or processed outside Tanzania within the Tunzaa group, through cloud infrastructure, through technology providers, through payment or service providers, or through other authorised service providers.

Any transfer of personal data from Tanzania to another jurisdiction will be conducted subject to applicable Tanzanian data-protection requirements. Where required, Tunzaa will obtain applicable regulatory permission and implement appropriate contractual, technical and organisational safeguards.

Tunzaa retains personal data for as long as reasonably necessary for the purposes for which it was collected. Retention may be necessary for account administration, transaction records, payment and settlement, fraud prevention, security, dispute resolution, legal claims, regulatory requirements, tax and accounting obligations, enforcement of agreements and other lawful purposes. Different categories of information may therefore be retained for different periods.

When personal data is no longer required, Tunzaa will take appropriate steps to delete, anonymise or otherwise securely dispose of it in accordance with applicable requirements and our internal retention arrangements.

Tunzaa maintains reasonable technical and organisational measures appropriate to the risks associated with processing personal data. These measures may include access controls, authentication, confidentiality controls, monitoring, security testing, system protections, controlled access to information, security procedures, incident-response procedures and other appropriate technical and organisational safeguards. Access to personal data is limited according to legitimate business, operational, security and compliance requirements.

No electronic system can be guaranteed to be completely secure. Users should therefore also take reasonable measures to protect their accounts, devices and credentials.

Where Tunzaa becomes aware of a personal-data breach, we will assess and respond to the incident in accordance with applicable law. Our response may include identifying and containing the incident; investigating the cause; assessing the information affected; assessing potential risks; implementing remedial measures; notifying relevant authorities where required; notifying affected Data Subjects where required; and implementing measures designed to prevent recurrence.

You are responsible for maintaining the security of your password, account credentials, authentication information, devices and other access mechanisms. You must not share your password, permit unauthorised access to your account, share authentication codes, allow unauthorised persons to operate your account, or knowingly allow your account to be used for unlawful purposes. You should immediately notify Tunzaa if you suspect that your account has been compromised.

Subject to applicable law and lawful exceptions, you may have rights concerning your personal data, including the right to access, correct, delete or erase, restrict certain processing, object to certain processing, withdraw consent where applicable, object to direct marketing, exercise rights applicable to qualifying automated decisions, and make a complaint concerning the handling of your personal data.

To exercise a Data Subject right, contact Tunzaa using the privacy contact details set out below. Your request should provide enough information for us to identify you, understand the nature of your request, identify the relevant information and respond appropriately. For security purposes, we may require reasonable verification of your identity before processing certain requests. We will handle valid requests within the period required by applicable law.

Tunzaa Digital Holdings Limited — Data Protection, P.O. Box 13416 Posta Mpya, Delta House – Dunga Street/Morocco Road, Plot 399/Block 42, Kinondoni, Dar es Salaam, Tanzania. General email: mambo@tunzaa.co.tz. Website: www.tunzaa.co.tz.

Tunzaa has not yet designated a dedicated Data Protection Officer contact. Until a dedicated address is formally designated, the general email above should not be treated as a direct DPO line — use it for privacy-related enquiries in the meantime.

If you believe that Tunzaa has processed your personal data unlawfully or otherwise failed to comply with applicable data-protection requirements, you should first contact us so that we may investigate and attempt to resolve the matter. You may also exercise any applicable statutory right to lodge a complaint with the Personal Data Protection Commission or another competent authority.

Unless a particular product expressly provides otherwise and appropriate safeguards are implemented, SOKO is not intended for children under the age of 18. Tunzaa does not knowingly collect children's personal data except where such collection is lawful and necessary for a specific service. Where applicable law requires parental or guardian involvement, Tunzaa may implement appropriate safeguards.

SOKO may allow users to submit reviews, ratings, comments, photographs, product information, questions, complaints and other content. Users must not intentionally publish another person's personal data without an appropriate lawful basis or authorisation. Tunzaa may remove or restrict content that violates applicable law, privacy requirements, SOKO policies or the rights of another person.

SOKO may integrate or interact with services operated by third parties, including payment providers, banks, mobile-network operators, logistics providers, technology providers, identity-verification providers, analytics providers and other service providers. Where a third party processes personal data independently as a Data Controller, its own privacy policy and legal obligations may apply.

Personal data may be transferred or disclosed as part of a lawful merger, acquisition, restructuring, financing, sale of assets, corporate reorganisation or similar transaction. Any such processing or transfer will remain subject to applicable data-protection requirements.

Tunzaa seeks to maintain personal data that is reasonably accurate and appropriate for the purpose for which it is processed. Users should ensure that information provided to SOKO is accurate and up to date, particularly contact information, delivery information, account information, Seller business information and verification information.

Tunzaa seeks to process personal data that is relevant and reasonably necessary for identified and legitimate purposes. We do not intend to collect personal data indiscriminately. Users should similarly avoid submitting unnecessary personal or sensitive information through SOKO.

You may request closure or deactivation of your SOKO account, subject to applicable procedures. Closing an account does not necessarily result in immediate deletion of all personal data. Tunzaa may retain information where necessary for completed or outstanding transactions, payment and settlement, refunds, accounting, tax, legal claims, disputes, fraud prevention, security, regulatory compliance or other lawful purposes. Information will be deleted, anonymised or securely disposed of when it is no longer required, subject to applicable retention requirements.

Tunzaa may amend this Privacy Policy from time to time because of changes to SOKO, new services, changes in technology, changes in data-processing practices, changes in applicable law, regulatory requirements, security developments or improvements to our privacy practices. Where changes are material, we will take reasonable steps to communicate them through appropriate channels. The Last Updated date at the beginning of this Policy will indicate when it was most recently revised.

This Privacy Policy is governed by the laws of the United Republic of Tanzania, subject to any mandatory rights or protections applicable to Data Subjects under Tanzanian data-protection law. Nothing in this Privacy Policy is intended to exclude or restrict a right that cannot lawfully be excluded or restricted.

Tunzaa Digital Holdings Limited, P.O. Box 13416 Posta Mpya, Delta House – Dunga Street/Morocco Road, Plot 399/Block 42, Kinondoni, Dar es Salaam, Tanzania. General email: mambo@tunzaa.co.tz. Website: www.tunzaa.co.tz.

Tunzaa Fintech Inc., 256 Chapman Road, STE 105-4, Newark – New Castle, 19702, Delaware, United States of America.