Legal

Data Protection Policy

Effective as of October 28, 2026

At-a-glance

We process personal information lawfully, fairly, and securely in line with Tanzania's Personal Data Protection Act, 2022, and applicable international requirements.

You have rights to access, correct, delete, restrict, object to processing, and request data portability. Contact [email protected] to exercise these rights.

1. Purpose

This Data Protection Policy ("Policy") sets out NEDA LABS LIMITED's ("Company", "NEDApay", "we", "us", or "our") commitment to protecting the privacy, confidentiality, integrity, and security of personal data collected, processed, stored, transmitted, or otherwise handled during its business operations.

The Company recognizes the importance of personal data protection and is committed to ensuring that personal data is processed lawfully, fairly, transparently, and securely.

This Policy is implemented in accordance with the Personal Data Protection Act, 2022 of the United Republic of Tanzania, its associated Regulations, and other applicable legal, regulatory, and contractual requirements relating to privacy and data protection. Where the Company processes personal data originating from other jurisdictions, it shall take reasonable measures to comply with applicable international data protection requirements to the extent required by law.

2. Scope

This Policy applies to all personal information that we collect, use, disclose, and otherwise process in connection with our business operations. This includes personal information that we collect from you directly, as well as personal information that we collect from third parties.

Controller: NEDA LABS LIMITED, 9th Floor, Tan House, Victoria, Dar es Salaam.
Contact: [email protected].

3. Definitions

Personal information: Any information that can be used to identify an individual, either directly or indirectly.
Processing: Any operation or set of operations performed on personal information, whether or not by automated means, such as collection, use, disclosure, and storage.
Data controller: The entity that determines the purposes and means of processing personal information.
Data processor: A natural or legal person, public authority, agency or other body which processes personal information on behalf of the controller.
Data subject: The individual to whom the personal information relates.

4. Data Protection Principles

We will process your personal information in accordance with the following data protection principles:

Lawfulness, fairness, and transparency: We will only process your personal information in a lawful, fair, and transparent manner.
Purpose limitation: We will only process your personal information for specified, explicit, and legitimate purposes.
Data minimization: We will only collect and process the personal information that is necessary for the purposes for which it is processed.
Accuracy: We will take reasonable steps to ensure that your personal information is accurate and up to date.
Storage limitation: We will only store your personal information for as long as is necessary for the purposes for which it is processed.
Integrity and confidentiality: We will take appropriate technical and organizational measures to protect your personal information from unauthorized access, use, disclosure, or destruction.

5. Data Collection

We collect personal information from you in a variety of ways, including:

When you provide it to us directly, such as when you create an account, contact us with a question, or submit a form.
When you use our website or mobile app.
When you interact with us on social media.
When we receive it from third parties, such as our business partners or service providers.

The types of personal information that we collect may include:

Identity details: your name, date of birth, country or nationality, phone number, email address, and the national ID number and ID documents you provide when we verify you (for example your NIDA number in Tanzania).
A selfie and a liveness check taken during verification, which we compare with your ID document. This is biometric data.
For businesses: business name, tax identification number (TIN), registration documents, and details of authorised representatives.
Account and wallet details: your username, wallet address and sign-in information.
Payout details you give us, such as a mobile money number or bank account number, and recipient names. For some deposits in some countries, an extra ID number is requested at the time and passed to our payment partner to complete the deposit; we do not store it.
Transaction records: amounts, currencies, dates and status, and the other party's wallet address or payout details.
Your IP address and other technical information about your device.
Usage information from analytics, such as the screens you view, the features you use, your device and browser type, and your approximate location (see the Analytics section).
Messages you send to our support team.

6. Data Use

We use your personal information for a variety of purposes, including:

To provide you with our products and services.
To communicate with you about your account and our products and services.
To process your payments.
To verify your identity and carry out the checks required by anti-money-laundering, counter-terrorist-financing and sanctions rules.
To prevent and investigate fraud and misuse of the Services.
To provide customer support.
To personalize your experience on our website and mobile app.
To improve our products and services.
To understand how our website and mobile app are used, and to find and fix problems.
To report to regulators and comply with other legal obligations.

ID documents, selfie and liveness checks. We collect these only to confirm who you are and to prevent fraud and money laundering. They are processed on our behalf by our identity-verification partner, Didit, which acts as our processor and may process them in countries outside Tanzania. We decide how long Didit keeps them, and we keep them for the period set out in Data Retention. They are shared with regulators or authorities only where the law requires it.

8. Analytics

We use Google Analytics on our website and web app, and Firebase Analytics (also provided by Google) in our mobile app, to understand which features are used and to find and fix problems. Google acts as our service provider for this.

Website and web app

Google Analytics runs only if you accept analytics cookies in our cookie banner. Nothing is loaded from Google before you choose, and if you decline it does not run.
It sets cookies named _ga and _ga_ followed by an identifier, to tell visits apart.
You can withdraw your consent at any time under Settings, then Cookie preferences. Withdrawing stops the collection and removes the Google cookies.

Mobile app

Firebase Analytics is built into the app and is on for everyone who uses it. There is no switch for it in the app. If you object to this, contact us at [email protected].

What we collect

The screens you view and the features you use, such as starting a deposit, a transfer, a swap or an identity check, and whether a step failed (as an error code only).
Technical information: your device and browser type, operating system, app version, language, and approximate location (country or city) that Google works out from your connection.
A random internal account identifier, not your name, email address, phone number or wallet address, so that activity from the same account can be counted together.
For payments, only a broad size band (for example under 10 US dollars, 10 to 100 US dollars, or over 100 US dollars), never the exact amount.

What we do not send to analytics

We do not send your name, email address, phone number, identity document or ID numbers, wallet address, transaction details or exact amounts to analytics. We do not use analytics data for advertising, and advertising features and personalisation are switched off.

How long it is kept

Google keeps analytics data for up to 14 months and then deletes it automatically. Google may process it in the United States and other countries (see Data transfers below).

9. Data Security

We take reasonable steps to protect your personal information from unauthorized access, use, disclosure, or destruction. We use a variety of security measures, including:

Encryption of data in transit
Access controls that limit who on our team can see personal data
Secure data centres operated by our infrastructure providers
Regular internal security audits

If a personal data breach is likely to put your rights or freedoms at risk, we will notify the relevant data protection authority and, where the law requires, the people affected.

10. Data Retention

We keep identity-verification records, transaction records and related documents for at least ten (10) years after your account is closed or the transaction takes place, whichever is later, as required by the Bank of Tanzania Fintech Regulatory Sandbox and anti-money-laundering rules. Analytics data is kept by Google for up to 14 months. Other personal information is kept only for as long as is needed for the purposes in this Policy, and is then deleted or made anonymous.

11. Your Rights

You have the following rights with respect to your personal information:

The right to access your personal information.
The right to correct your personal information.
The right to delete your personal information.
The right to restrict the processing of your personal information.
The right to object to the processing of your personal information.
The right to data portability.

You can exercise your rights by contacting us at [email protected].

12. Children's Privacy

We do not knowingly collect personal information from children under the age of 18. If you are a parent or guardian and you believe that your child has provided us with personal information, please contact us at [email protected].

13. Changes to This Policy

We may update this Policy from time to time. We will notify you of any changes by posting the new Policy on our website.

14. Contact Us

If you have any questions about this Policy, please contact us at [email protected].

NEDA LABS LIMITED
9th Floor, Tan House, Victoria, Dar es Salaam