Privacy Policy — Mtu Kati

This draft is published in English while it is under legal review. A Kiswahili version will follow the final text. One promise in any language: no ads, no third-party trackers, no selling your data — on this website or in the app. This website sets no cookies and runs no analytics.

Who we are

Mtu Kati is an escrow-protected marketplace for Tanzania, operated by Numarah Company Limited (“Numarah”, “we”). When you buy or sell on Mtu Kati, payment is held in escrow until the order is delivered and confirmed. We operate in Tanzania and comply with the Personal Data Protection Act, 2022.

What we collect

Account details (name, email, phone, date of birth, password), identity verification data when you complete KYC (ID document and selfie, processed by our verification partner), listing and order history, payment references from M-Pesa or card providers (we never store full card numbers), messages you exchange with other users, approximate location if you enable nearby listings, and device information needed to keep your account secure.

Why we use it

To run the marketplace and escrow service, verify identities and prevent fraud and money laundering (a legal obligation for a payments platform), resolve disputes, send transactional notifications, and — only with your separate consent — marketing messages. We do not sell your personal data and we do not show third-party advertising.

Who we share it with

Payment providers (for example our card-processing partner) to process payments, our identity-verification partner for KYC, SMS and email delivery providers, and authorities where the law requires it (for example anti-money-laundering reporting). Other users only ever see your public profile: display name, ratings, and listings.

Your rights

You can access and download all data we hold about you (from Settings in the app), correct your profile at any time, delete your account from inside the app (Profile, Delete account) — see “Data retention after account deletion” below for what we keep and why — withdraw marketing and other optional consents per category, and restrict processing. To exercise any right, use the in-app tools or write to privacy@mtukati.com. You may also complain to the Personal Data Protection Commission (Tanzania).

Retention and security

Identity-verification (KYC) documents and transaction records are kept for the minimum period required by Tanzanian anti-money-laundering law . Other data is kept for as long as it is needed for the purposes described in this policy and under “Data retention after account deletion” below, then deleted or anonymised. Data is encrypted in transit, access is role-restricted and audit-logged, and multi-factor authentication protects administrative access.

Data retention after account deletion

When you delete your account, we do not erase all of your information straight away. We scramble your contact details (email and phone) and sign you out of every session immediately. To comply with our legal obligations, resolve disputes, prevent and investigate fraud, and establish or defend legal claims, we retain (a) your identity-verification (KYC) documents and your transaction records for the minimum period required by Tanzanian anti-money-laundering law (10 years), after which the identity documents are deleted; and (b) other account information — including your profile, notifications, block list, device and push tokens, and your order, dispute and communication history — for as long as necessary for those purposes, after which it is deleted or anonymised.

This website

mtukati.com is a static informational site. It sets no cookies, uses no analytics or advertising trackers, and collects no personal data. Your language choice (English or Kiswahili) is stored only on your own device. If you email us, we receive what you send and use it only to reply.

Children

Mtu Kati is for adults. You must be at least 18 years old to create an account, and we verify age at registration.

Contact

privacy@mtukati.com — we respond to data-rights requests within the statutory timelines of Tanzania’s Personal Data Protection Act.