Privacy notice
Effective 13 October 2026
1. Introduction
Mifumo is business software for accounting, payroll, HR, CRM and invoicing, at mifumo.co.tz and in the Mifumo app. It is provided by Mdala Trading Limited, Kinzudi, P.O. Box 71202, Dar es Salaam, Tanzania ("Mifumo", "we", "us"). This notice explains what personal data we collect, why, who we share it with and your rights under the Personal Data Protection Act, 2022 and its regulations.
We are the data controller for data about people who visit our website, respond to our adverts, ask for a demo, open an account, use Mifumo or pay us. We are a data processor for the data our clients put into Mifumo, such as their employees, customers and suppliers. The client business is the controller of that data. If you are one of those people, contact that business first, and we will help them answer you.
2. Data protection principles
We process personal data lawfully, fairly and openly; collect it only for clear purposes and use it only for those purposes; collect no more than we need; keep it accurate and up to date; keep it no longer than needed; protect it with appropriate security; and respect your rights as a data subject.
3. Information we collect, why, and our legal basis
| What | Examples | Why we use it | Legal basis |
|---|---|---|---|
| Account details | Name, email, phone, company, role, password (stored scrambled) | To create and secure your account | Contract |
| Sign-in and security data | IP address, device type, system and browser (for example Android phone, Chrome), sign-in times, passkeys, two-step codes | To keep accounts safe and stop misuse | Legitimate interest, legal duty |
| Billing data | Plan, invoices, payment reference, TIN | To bill you and keep tax records | Contract, legal duty |
| Demo and contact requests | Name, company, team size, phone, email, message | To answer you and arrange a demo | Consent, legitimate interest |
| Advert responses | Details you submit in a Facebook or Instagram form, and which advert you came from | To contact you about Mifumo and measure our adverts | Consent |
| Support messages | What you write to us and our replies | To help you | Contract |
| Usage data | When you sign in, how long each visit lasts, the pages you open and the names of the buttons you press (never what you type or the records you open), errors, performance | To fix problems, improve Mifumo and help clients who are stuck | Legitimate interest |
| Mobile app data | Location and QR scans when you clock in, only while you use that feature | Staff attendance for your employer | Your employer's instructions |
We collect this data directly from you through our website, forms, the app and emails, and from your use of Mifumo. We do not seek special categories of personal data about you. Clients may record such data about their own staff (for example in payroll), and they are responsible for it. We do not sell personal data.
4. How we share personal data
We use these service providers. Each may use the data only to provide its service to us, under a written agreement.
| Provider | What for | Where |
|---|---|---|
| Google Cloud | Hosting and storage | South Africa |
| Cloudflare | Website security and delivery | Global network |
| Pesapal | Card and mobile money payments | Kenya and Tanzania |
| Hostinger | Email delivery | European Union |
| Meta (Facebook, Instagram) | Showing and measuring our adverts, and advert forms you choose to fill in | United States and other countries |
| Anthropic | Skai assistant, only for clients who turn it on | United States |
| Jev AI | Ranking demo requests, using company details only, never your name, phone or email | Outside Tanzania |
| SMS provider | Sign-in codes by SMS, when you choose them | Depends on the provider |
5. Disclosure of personal data
We also disclose personal data when the law requires it, for example to the Tanzania Revenue Authority, the Personal Data Protection Commission, the police or a court, and to protect our rights or the safety of others. If Mifumo's business is sold or merged, data may pass to the new owner under this notice.
6. Cross-border transfers
Our servers are in South Africa and some providers are in other countries. We transfer personal data outside Tanzania only as the Act allows, with the permit required from the Personal Data Protection Commission and written agreements that require the same level of protection as Tanzanian law.
7. Children's privacy
Mifumo is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children, except where a client records it, for example a school's records. If you believe a child has given us personal data, write to us and we will delete it.
8. Where personal data is held
On Google Cloud servers in Johannesburg, South Africa, with encrypted backups in the same region, and with the providers listed above for their part of the service.
9. How long we keep it
- Account data: while your account is open, then up to 12 months after closing so you can return or export it.
- Billing and tax records: at least 5 years, as tax law requires.
- Demo requests and advert responses that do not become clients: 24 months.
- Security logs: 12 months.
- Usage data: page-by-page records 90 days, then only monthly totals.
- Client business data: as the client decides, and deleted within 90 days after the client leaves, unless the client asks us to keep it longer.
10. Your rights
Under the Act you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong or out of date;
- delete data we no longer need or hold unlawfully;
- stop using your data for marketing, at any time;
- object to other processing, or withdraw consent you gave;
- not be subject to a decision based only on automated processing that significantly affects you.
11. Security
We encrypt connections, scramble passwords, offer two-step sign-in and passkeys, keep each client's data separate, limit staff access, keep backups and log access. If a breach puts your data at risk, we will tell the Personal Data Protection Commission and, where needed, you, without undue delay.
12. Automated decision-making and profiling
We use Jev AI to rank demo requests by company size, industry and region so we know whom to call first. It never uses your name, phone or email, and a person always decides whether to contact you. We make no decision with legal or similar effect about you by automated means alone.
13. Access to your personal data
Account holders can see and change most of their details in Mifumo under Account. For anything else, or for a copy of your data, write to us at the address below. We may ask you to confirm who you are first, and we will reply within 30 days.
14. Links to other websites
Our website links to other sites, such as Pesapal's payment page, the app stores and social media. Their own privacy notices apply there, and we are not responsible for them.
15. Cookies and tracking
We use cookies to keep you signed in, protect the site from attacks (Cloudflare) and remember choices such as dark mode. Our public website may also use the Meta Pixel to measure how our Facebook and Instagram adverts perform. You can block or delete cookies in your browser settings; blocking essential cookies stops sign-in from working.
16. How to complain
Write to our Data Protection Officer first. We will acknowledge your complaint within 3 working days and try to resolve it promptly. If you are not satisfied, you can complain to the Personal Data Protection Commission, P.O. Box 1105, Dodoma, helpdesk@pdpc.go.tz, www.pdpc.go.tz.
17. Contact
Data Protection Officer: Erasto Kimambo, Mdala Trading Limited, Kinzudi, P.O. Box 71202, Dar es Salaam. Email updates@mifumo.co.tz, phone 0652 040 391.
The Mifumo phone app has its own notice: Mifumo app privacy.
18. Changes to this notice
We may update this notice from time to time. Changes will be posted on this page with a new effective date, and we will tell account holders by email before important changes take effect.