Privacy Policy

1. Who We Are

Kasri is operated by Mnemba Technologies Ltd, a company registered in the United Republic of Tanzania. We provide a multi-tenant SaaS platform for Tanzanian housing associations under the Unit Titles Act No. 16 of 2008. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Kasri platform or visit kasri.app. It should be read together with our Terms of Service. Our primary privacy framework is the Personal Data Protection Act, 2022 ("PDPA") and related Tanzanian regulations.

2. Data Controller & Data Processor

Under the PDPA, Kasri generally acts as a data processor for personal data submitted by or on behalf of your housing association. Your association (the body corporate) is the data controller and determines the purposes and means of processing. Where we collect data directly from visitors to our marketing website, we act as a data controller. Our Data Processing Agreement is available on request from privacy@kasri.app.

3. What Data We Collect

We collect: (a) Account data — name, email address, phone number, role, and association details provided during registration. (b) Usage data — pages visited, features used, timestamps, IP address, browser type, and device information. (c) Financial data — payment records, levy contributions, and transaction history necessary for treasury operations. (d) Communication data — emails, support tickets, SMS or messaging delivery metadata, and demo booking information. (e) Content data — documents, minutes, resolutions, and other files you upload to the platform.

4. How We Collect Data

We collect data: (a) directly when you register, fill forms, upload documents, or contact us; (b) automatically through cookies and similar technologies when you browse our website or use the platform; (c) from third-party payment processors and identity verification services when required for treasury operations.

5. Legal Basis for Processing (PDPA)

We process personal data only on lawful bases recognised under the Personal Data Protection Act, 2022, including: (a) Consent — where you have given clear consent (for example, optional marketing communications). (b) Contract — processing necessary to perform our service agreement with your association. (c) Legal obligation — where we must comply with Tanzanian law, including the Unit Titles Act, the PDPA, applicable financial rules, and electronic communications requirements. (d) Legitimate interests — for security monitoring, fraud prevention, and service improvement, balanced against your rights and freedoms.

6. How We Use Your Data

We use your data to: (a) provide, maintain, and improve the Kasri platform; (b) process transactions and manage levy collections; (c) send service notifications, updates, and security alerts by email, SMS, or other electronic channels where authorised; (d) comply with legal and regulatory obligations in Tanzania; (e) detect and prevent fraud or abuse; (f) communicate with you about support requests or service changes. We do not sell your personal data to third parties.

7. Protection of People & Personal Data

We follow high standards for the security of people and their information. Each association is a fully isolated tenant — your data is never co-mingled with another building's. Personally identifiable information is held separately from operational records wherever practicable, so identity details are not freely stored alongside unrelated association data. Access is permission-gated; high-risk actions require multi-factor authentication; and successful mutations are written to an immutable audit log.

8. Data Sharing & Sub-processors

We may share your data with: (a) service providers who process data on our behalf (cloud infrastructure, payment processing, email or SMS delivery) under contractual data processing agreements; (b) your housing association administrators as needed for platform operations; (c) Tanzanian regulatory authorities where required by law, including the Personal Data Protection Commission and, where lawfully compelled, communications regulators such as TCRA. We maintain an up-to-date list of sub-processors available on request.

9. International Data Transfers

Your data may be processed in secure data centres located outside Tanzania. Where personal data is transferred internationally, we apply appropriate safeguards under the PDPA — including contractual protections and technical controls — to maintain an equivalent level of protection. Details are available on request from privacy@kasri.app.

10. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. After account termination, data is retained for a grace period of 90 days then anonymised or deleted, unless Tanzanian legal retention obligations require longer storage. Financial transaction records may be retained for up to 10 years as required by Tanzanian financial regulations.

11. Your Rights under the PDPA

Subject to the Personal Data Protection Act, 2022, you have the right to: (a) be informed about processing of your personal data; (b) access your personal data; (c) request rectification of inaccurate data; (d) request erasure or destruction of your data, subject to legal retention obligations; (e) object to or restrict certain processing; (f) withdraw consent where processing is consent-based. To exercise these rights, contact your association administrator or email privacy@kasri.app. You may also use our Data Deletion Request process. We fulfil valid requests within the timelines required under Tanzanian law (typically within 30 days).

12. Electronic Communications & TCRA

Service-related messages (security alerts, payment receipts, association notices you are entitled to receive) may be sent without separate marketing consent because they are necessary to operate the Service. Optional promotional messages require your clear consent and can be withdrawn at any time. We design messaging practices to align with applicable Tanzanian electronic and postal communications rules administered by the Tanzania Communications Regulatory Authority (TCRA), including lawful use of SMS and other channels and respect for recipient preferences. Associations remain responsible for the content of notices they authorise and for any member consents required for their own campaigns.

13. Cookies & Tracking

We use essential cookies to operate the platform and optional analytics cookies to understand usage patterns. You can control cookie preferences through your browser settings. Third-party services we use may set their own cookies. Detailed cookie information is available in our Cookie Notice, which can be requested from privacy@kasri.app.

14. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit and at rest, role-based access controls, multi-factor authentication for high-risk actions, tenant isolation, and immutable audit logging. Digital records and notices are intended to operate consistently with the Electronic Transactions Act (Cap. 442). Detailed security information is available on our Security & Compliance page.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or Tanzanian legal obligations. Material changes will be notified via email or through the Service at least 30 days in advance. We encourage you to review this policy periodically.

16. Contact & Complaints

For privacy-related inquiries, data subject requests, or complaints, contact our Data Protection Officer at privacy@kasri.app or write to Mnemba Technologies Ltd, Dar es Salaam, United Republic of Tanzania. If you are unsatisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commission of Tanzania. This Privacy Policy is governed by the laws of the United Republic of Tanzania.