1. Introduction
We are committed to protecting personal data in accordance with the Tanzania Personal Data Protection Act.
2. Information We Collect
Depending on the product you use, we collect:
- Account data: name, username, email address and phone number
- Business and ERP data (Pafety Suite)
- Student data (Pafety Shule)
- GPS location data (Pafety GPS Tracking)
- Event and guest data entered by event organisers in Pafety Kadi: event details, guest names and titles, phone numbers, email addresses, invitation type, RSVP responses and messages, and check-in (verification) records
- Contribution and pledge records kept by organisers in Pafety Kadi (contributor name, phone, pledged and paid amounts)
- Credit purchase submissions in Pafety Kadi: number of credits, amount paid, payment transaction reference and the phone number used to pay
- Technical data: device type, operating system, app version, IP address and usage logs
3. Purpose of Data Collection
To provide services, improve systems, communicate, and comply with laws.
4. Legal Basis
Processing is based on consent, contract, legal obligation, or legitimate interest.
5. Data Sharing
We do not sell personal data. We share it only with:
- Service providers that deliver messages on your instruction: Meta (WhatsApp Business API), our SMS gateway provider and our transactional email provider
- Hosting and infrastructure providers that store and process data on our behalf
- Public authorities where the law requires it
Each guest receives a personal invitation link. Anyone who holds that link can open the invitation page for that guest, so organisers should share links only with the intended guest.
6. Data Security
We use encryption and access control to protect data.
7. Data Retention
Data is retained as necessary for operations and legal compliance.
8. User Rights
Users may access, correct, or request deletion of their data.
9. School Data Compliance (Pafety Shule)
- Schools act as data controllers of student data
- Pafety Technologies acts as a data processor
- Schools must obtain parental/guardian consent where required
- We process student data only as instructed by the institution
10. Messaging Consent (Pafety Kadi)
By using Pafety Kadi (formerly Pafety Events) or any messaging feature to send WhatsApp, SMS or email invitations:
- Users confirm they have obtained consent from recipients before sending messages
- Users are responsible for compliance with communication laws
- Pafety Technologies is not responsible for misuse of messaging services
11. Pafety Kadi Mobile App and Web Platform
Pafety Kadi lets event organisers create digital invitation cards, send them to guests, record RSVPs and contributions, and verify guests at the entrance. This section explains how the Pafety Kadi app (iOS and Android) and the web platform at kadi.pafetytech.co.tz handle data.
11.1 Data you give us
- Your account: name, email address, phone number and password (stored hashed; we never see your password)
- Events you create: names of the celebrants or hosts, dates, venues, programme, committee contacts, gifting details and photos you upload
- Guest lists you upload or type in: names, titles, phone numbers and email addresses of your guests
- Contributions and pledges you record for your event
- Credit purchases: the credits requested, the amount paid, the payment transaction reference and the phone number used to pay, which we use to confirm your payment
11.2 Data created while you use the app
- Invitation delivery status (sent, delivered, read) returned by WhatsApp or the SMS gateway
- RSVP responses and messages written by guests on their invitation page
- Check-in records: which guests were admitted, how many people, and at what time
- Credit usage: one credit is consumed per guest when a card is generated or an invitation is sent; we keep a transaction history so you can see how credits were used
11.3 Guest data and organiser responsibilities
When you upload a guest list you are the data controller for your guests' information and Pafety Technologies processes it on your behalf. You confirm that you have a lawful basis, such as the guest's consent or your existing relationship with them, to invite them and to share their name and phone number with us for that purpose. Guest data is used only to create that guest's card, deliver their invitation, record their RSVP and verify them at the event. We do not use guest data for marketing.
11.4 Guests' rights
If you received an invitation through Pafety Kadi and want your details removed, you may reply to the organiser or contact us directly; we will remove your details from the event on request.
11.5 Device permissions
- Camera: used only to scan the QR code on a guest's invitation card at the entrance. No photos or video are stored
- Photo library: used only when you choose an image for a card template or event photo
- Fingerprint / Face ID: optional sign-in. Biometric checks are performed by your phone's operating system; Pafety Kadi never receives, stores or transmits your fingerprint or face data. When enabled, a sign-in token is kept in your phone's secure storage and is removed when you turn the option off or sign in with another account
- Network: required to load events, send invitations and buy credits. The app caches template images and lists on your device so they load faster
11.6 Security and sessions
Data is transmitted over encrypted connections (HTTPS). Sign-in uses expiring tokens; a session may last up to 30 days before you need to sign in again. Access to your events is limited to your account and to Pafety Technologies staff who support the service.
11.7 Data retention and account deletion
Your events, guest lists and contribution records are kept for as long as your account is active so that you can reuse them. You may delete individual events and guests at any time from the app or the web platform. To delete your account and all associated data, contact us at the address below or use the Edit Profile screen in the app; we complete account deletion within 30 days, except for records we must keep to comply with the law, such as payment records.
11.8 Payments
Credits are paid for by bank or mobile payment (for example CRDB Lipa Namba) outside the app. We do not collect card numbers or bank credentials. We store only the transaction reference, the amount and the phone number you tell us you paid from, in order to confirm the payment and add credits to your account.
11.9 Children
Pafety Kadi accounts are intended for adults (18 years and older). We do not knowingly collect personal data from children through the app.
12. Cross-Border Data Transfer
Data may be stored or processed outside Tanzania with safeguards.
13. Cookies
We use cookies to enhance user experience.
14. Third-Party Services
We are not responsible for third-party platforms.
15. Changes to Policy
We may update this policy.
16. Contact Information
If you have any questions about this Privacy Policy, please contact us or email info@pafetytech.co.tz. For Pafety Kadi account or data deletion requests, use the same address and include the email or phone number registered on the account.