Msitu Smart
PDPA 2022 Compliant

Privacy Policy

Last updated: September 17, 2026 · United Republic of Tanzania

Tanzania Personal Data Protection Act Compliance

Msitu Smart adheres strictly to the provisions of the Personal Data Protection Act (Act No. 11 of 2022) of the United Republic of Tanzania. We ensure that your identity, telephone records, GPS farm coordinates, and forestry logs are processed lawfully, transparently, and with robust encryption.

1. Introduction & Data Controller

This Privacy Policy explains how Msitu Smart Tanzania(“we”, “us”, or “our”) collects, uses, discloses, and protects your personal information when you utilize our digital forestry monitoring web platform, accessible at msitusmart.co.tz.

For the purposes of applicable data protection legislation in Tanzania, the Data Controller is Msitu Smart Tanzania, with principal operations located in Iringa Municipality, Tanzania.

2. Information We Collect

We collect information categorized under:

A. Personal Identification Data

Full name, email address (including Gmail synchronization), telephone number, associated forestry cooperative or enterprise, and town/district location.

B. Forestry Spatial & GIS Data

Precision GPS boundary polygons (latitude and longitude beacons), calculated farm acreage/hectares, tree species composition (e.g., Pine, Eucalyptus, Cypress), planting year stands, and tree census counts.

C. Silvicultural & Field Observation Logs

Photographs of tree canopies, firebreak buffer inspections, pest reports, thinning and pruning notes, and seedling survival statistics.

D. Transactional Billing Data

Mobile money M-Pesa/Airtel Money transaction codes, bank transfer deposit slips, amount remitted in TZS, payment timestamps, and subscription plan selection. We do not store raw bank debit card PINs or mobile wallet secrets.

E. Telemetry & Heartbeat Data

Client heartbeat pings for active presence verification, IP address, browser user-agent, and access timestamps.

3. Purpose & Legal Basis for Data Processing

Under the Tanzanian Personal Data Protection Act, we process your data based on lawful grounds:

  • Contractual Necessity: To provision your forestry dashboard, render interactive Google Maps boundary overlays, and store monitoring observations.
  • Verification & Fraud Prevention: To manually verify mobile money and bank transfer subscriptions and guard against unauthorized access.
  • Platform Improvements: To monitor platform performance and server uptime, diagnose bugs, and improve spatial mapping capabilities.
  • Legal Compliance: To satisfy Tanzanian taxation, forestry, and regulatory record-keeping mandates.

4. Sharing & Disclosure of Information

We do not sell, rent, or trade your personal or forestry data to third parties. Data is only shared under the following strictly defined conditions:

  • Cloud Infrastructure: Secure database storage and authentication powered by Firebase / Google Cloud Platform with end-to-end encryption in transit and at rest.
  • Mapping Services: Google Maps JavaScript API for rendering satellite layers and boundary polygons.
  • Regulatory Authorities: Where compelled by valid legal summons or statutory directives from Tanzanian law enforcement or the Tanzania Forest Services Agency in accordance with due process.

5. Data Security & Storage Safeguards

We employ industry-standard technical and organizational measures to safeguard your data:

  • Encrypted SSL/TLS communication across all web endpoints.
  • HTTP-only, SameSite secure session cookies to prevent cross-site request forgery and token exposure.
  • Strict role-based access control (RBAC): Administrators cannot modify your private farm coordinates without verified operational cause, and non-admins are barred from viewing directory records.

6. Your Rights Under Tanzanian Law

Under the Personal Data Protection Act of Tanzania (2022), you hold enforceable rights regarding your personal data:

Right to Access

Request a copy of all personal records and mapped plot coordinates held on your account.

Right to Rectification

Update inaccurate contact information, tree species classifications, or boundary points.

Right to Erasure

Request account deletion and de-indexing of associated forestry logs and boundary geometries.

Right to Data Portability

Obtain your boundary coordinates and logs in structured digital format (GeoJSON / CSV).

To exercise any of these rights, email us at privacy@msitusmart.co.tz. Requests are addressed within 30 days.

7. Data Retention Period

We retain your account data and forestry records for as long as your account remains active. In the event of account cancellation, forestry plot geometries and observation notes are retained for 90 days in a soft-deleted quarantine before permanent purging, allowing data recovery should an accidental cancellation occur.

8. Cookies & Session Management

Msitu Smart utilizes essential session cookies (`__session`) required to maintain authenticated access and perform role verification. We do not deploy intrusive cross-site ad tracking cookies or third-party behavioral advertising trackers.

9. Contact Our Data Protection Desk

If you have any questions, concerns, or grievances concerning this Privacy Policy or our handling of your forestry spatial data, please contact:

Data Protection Officer (DPO)

Msitu Smart Tanzania

Gangilonga / Uhuru Avenue, Iringa Municipal, Tanzania

Email: privacy@msitusmart.co.tz