Privacy
Privacy notice
Last updated 31 October 2026
1. Introduction
This notice explains what personal data Fazza Holdings collects, why, who can see it, how long we keep it and what you can ask us to do with it. We have tried to write it plainly and to describe only what our systems actually do.
2. Who we are
Fazza Holdings Limited, Dar es Salaam, Tanzania, is responsible for the personal data described here (the “data controller”). Contact: office@fazzaholdings.com, +255 767 236 526.
3. What this notice covers
- the public website fazzaholdings.com and its inquiry form;
- the Fazza Holdings staff portal (fazzaholdings.com/admin), used by our staff;
- FAZZA BASIC, our internal operations app for Android and iOS, used by our staff to record biomass deliveries. FAZZA BASIC accounts are created by Fazza Holdings administrators; nobody can register in the app.
4. Personal data we collect
Website inquiries
- your name, email address, the topic you choose and your message;
- your organisation and phone number, if you give them;
- the IP address and browser type the inquiry was sent from.
Staff accounts (staff portal and FAZZA BASIC)
- name, work email or username, role and permissions, and job title and phone number if recorded;
- a one-way hash of your password (never the password itself);
- for each signed-in session: when it started and was last used, the IP address, the browser or app details and, in the app, the phone’s model name;
- sign-in attempts: a one-way hash of the email entered, the IP address, the time and whether it succeeded;
- an audit history of the changes you make in the system, with the time and IP address.
Business records entered by staff
- deliveries: date, purchase order, truck registration, driver name and phone number, delivery note and receipt numbers, quantity, material supplier and remarks;
- photos and PDF documents attached to deliveries;
- suppliers and customers: business names, contact person, phone numbers, email, address, tax number and payment details, as needed to buy from and sell to them.
We do not collect location, contacts, microphone audio, health data or payment card data.
5. How we collect it
Directly from you when you send an inquiry or use the portal or app; from our staff, who record deliveries, drivers and suppliers as part of their work; and automatically by our servers (IP address, browser or app details) when you connect.
6. Why we use it
- to answer inquiries and manage the business relationship that follows;
- to run our operations: record deliveries, reconcile them with purchase orders, pay suppliers and invoice customers;
- to sign staff in, show each person only what their role allows, and keep a record of who changed what;
- to protect our systems and accounts against spam, password guessing and misuse;
- to keep the accounting and tax records the law requires.
We do not sell personal data, use it for advertising or make automated decisions about people with it.
7. Our reasons for using it
We use personal data where it is needed to respond to your request or to perform a contract or working relationship with you, where we must keep it by law (for example accounting records), and where it is in our legitimate interest to run and secure our business in a way you would reasonably expect. Where we ask for consent, you can withdraw it.
8. App permissions
- Camera: used only when you tap “Take photo” to photograph a delivery document.
- Photos and files: the system picker opens only when you choose a file; the app cannot browse your photo library. Photos are resized and their location data (EXIF) is removed before upload; PDF files are uploaded as chosen.
Deliveries not yet sent are kept on the phone in an encrypted database so that work is not lost without a connection. After a delivery is sent its photos and files are deleted from the phone at once and a short summary stays for 3 days as a confirmation. A test version of the app used internally inside the Expo Go preview app keeps drafts unencrypted; the versions in Google Play and the App Store always encrypt them.
9. Who can see it
- Our staff, according to their role. For example, field staff cannot see prices, amounts or supplier payment details.
- DigitalOcean, our hosting provider, which runs the servers that store the data on our behalf.
- Expo (650 Industries, Inc.): when FAZZA BASIC starts it asks Expo’s update service whether a newer version of the app exists. That request includes technical details such as the app version, the platform, a random installation identifier created by the app and the phone’s IP address, but no account or delivery data.
- An email delivery provider, if we turn on email notifications, would carry notification emails (for example, about a new inquiry).
- Authorities, auditors or professional advisers, where the law requires it or to protect our legal rights.
The website, the portal and the app contain no advertising, analytics or crash-reporting services and do not track you across other apps or websites.
10. Where it is stored
Our servers are in the United States (DigitalOcean, New York), so personal data is transferred outside Tanzania. We protect it in transit with encrypted connections (HTTPS) and limit access as described in section 12.
11. How long we keep it
- Inquiries: as long as needed to respond and manage the business relationship that follows. They are not deleted automatically. You can ask us to delete yours (section 13); we will tell you if we need to keep it.
- Sign-in attempts: deleted automatically after 90 days. Ended sessions (signed out, revoked or expired) are deleted 90 days after they end.
- Delivery, supplier, invoice and payment records, their attachments and change history: kept as business and accounting records for as long as tax, accounting and audit obligations require. An attachment removed from a record is hidden but kept as part of that record’s history.
- Audit log: kept for security and accounting audit.
- Staff accounts: a closed account is deactivated; on request its personal details are then removed and replaced with an anonymous label (see section 14).
- Backups: nightly database backups; only the newest 14 are kept, so removed data leaves the backups within about two weeks.
12. Security
Encrypted connections (HTTPS); passwords stored only as one-way hashes; sign-in temporarily blocked after repeated failed attempts; sign-in sessions that expire and can be revoked, and on the phone a sign-in token kept in secure storage (Android Keystore / iOS Keychain); permissions checked on the server for every request; separate database accounts with only the access each part of the system needs; an audit history of changes; and regular backups. No system is perfectly secure. Tell us at once at office@fazzaholdings.com if you suspect misuse of an account.
13. Your rights
Under Tanzania’s Personal Data Protection Act, 2022 you can ask to see the personal data we hold about you, to have it corrected, to have it deleted, or to object to how we use it. Staff can download a copy of their account data from the staff portal (Settings → Your data) and send a correction or deletion request from there, or a deletion request from the app (Profile). Anyone can also email office@fazzaholdings.com. We may need to confirm your identity first, and we will tell you if the law requires us to keep some records. You can also complain to the Personal Data Protection Commission of Tanzania.
14. Deleting your account
FAZZA BASIC and staff portal users can ask for their account and personal data to be deleted in the app (Profile → Request account deletion), on the account deletion page, or by email to office@fazzaholdings.com. We confirm the request with the account’s email address, close the account (signing it out everywhere), and remove your name, email, username, phone number and job title from it, replacing them with an anonymous label. Delivery, invoice and payment records you created are kept as business records as described in section 11 and then show “Former staff member” instead of your name. The audit log is kept unaltered for security and accounting audit, so its entries may still contain your email address or name as recorded at the time. The message you used to make the request is kept as the record that we handled it. Uninstalling the app removes everything it stored on the phone, including unsent drafts.
15. Children
The website and the app are for businesses and our staff. They are not directed at children, and we do not knowingly collect children’s personal data.
16. Cookies and tracking
The public website sets no cookies and uses no analytics. The staff portal sets one cookie, needed to keep you signed in, which cannot be read by scripts on the page and ends when you sign out or the session expires.
17. Privacy contact
For any question or request about your personal data: office@fazzaholdings.com, or Fazza Holdings Limited, Dar es Salaam, Tanzania, phone +255 767 236 526.
18. Changes to this notice
When we change this notice we update the date at the top of this page.