Privacy Policy

1. Who is responsible

Tech-X is the data controller for the personal data described in this policy. We are registered in the United Republic of Tanzania and based in Mbeya.

For anything about this policy, or to exercise a right under it, write to info@tech-x.co.tz with “Privacy” in the subject line.

This policy is written to comply with the Tanzania Personal Data Protection Act, 2022 and, where our processing falls within its scope, the EU General Data Protection Regulation.

2. What we collect

2.1 When you send an enquiry

• Your name, email address, and optionally your company and phone number;
• Which services you selected, your budget range and timeline;
• What you wrote in the message field, and any file you attached;
• The date and time, and the IP address the submission came from.

2.2 When you create a portal account

• Your name and email address;
• A cryptographic hash of your password — never the password itself;
• Your organisation, phone number and address, if you provide them;
• Your project record: agreement, signature image, invoices, payments, milestones, uploaded files and messages;
• Sign-in timestamps, IP address and browser string, for security.

2.3 When you subscribe to our updates

• Your email address and the date you subscribed.

2.4 When you visit this website

• Standard server logs: IP address, page requested, referrer, browser string, timestamp;
• Your appearance preference (light or dark) and whether you dismissed the promotional notification — both stored in your own browser, not on our servers.

3. Why we use it, and on what legal basis

Where our basis is legitimate interest, we have weighed it against your rights and are happy to share that assessment on request.

4. Who we share it with

We do not sell personal data. We never have and we will not.

We share it only with:

• Our hosting provider, which stores the website and database on our behalf;
• Our email provider, which delivers transactional and notification email from our own domain;
• Subcontractors on your project, where the work requires it — bound by the same confidentiality obligations we are;
• Professional advisers such as accountants and lawyers, where required;
• Authorities, where the law compels us. We will tell you first unless we are legally forbidden from doing so.

Every processor is bound by a written agreement limiting them to our instructions.

5. How we protect it

• All traffic is encrypted in transit with TLS;
• Passwords are hashed with a modern one-way algorithm and are never recoverable, by us or anyone else;
• Portal access is scoped to a single account — a client can only ever see their own project;
• Sign-in attempts are rate-limited to frustrate credential stuffing;
• Uploaded files are stored outside the web root and served only to the authenticated owner;
• Every significant action in the portal is written to an audit log;
• Access on our side is limited to the people who need it for your project.

6. How long we keep it

The seven-year periods are driven by Tanzanian tax and company law, not by our preference.

7. Your rights

You can ask us to:

• Show you the personal data we hold about you;
• Correct anything inaccurate or incomplete;
• Delete it, where we have no legal obligation or overriding ground to keep it;
• Restrict how we use it while a dispute about it is resolved;
• Export it in a common machine-readable format;
• Object to processing based on legitimate interest;
• Withdraw consent at any time, where consent was the basis.

Write to info@tech-x.co.tz. We respond within 30 days and there is no charge. We may ask you to confirm your identity first, so that we are not handing your data to somebody else.

If you are not satisfied with how we handled a request, you can complain to the Personal Data Protection Commission of Tanzania, or to your local supervisory authority if you are in the EU or UK.

8. Where your data goes

Our hosting and email are provided from data centres that may sit outside Tanzania. Where personal data leaves the country, we rely on the safeguards required by the Personal Data Protection Act, 2022, and on standard contractual clauses where the GDPR applies.

9. Children

Our services are for businesses. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, write to us and we will delete it.

10. Changes to this policy

We will update this policy when our processing changes. The “last updated” date at the top always reflects the current version, and we will email account holders directly about any change that materially affects them.

How to reach us about this document

Questions about this document, or a request under it, should go to info@tech-x.co.tz with the document name in the subject line. We acknowledge every message within two business days.