Privacy Policy — Finvoice

1. Who We Are

Finvoice ("Finvoice", "we", "us" or "our") operates an invoice network for Tanzanian businesses. Our platform provides free invoicing between businesses, a verified payment reputation (the "Trust Score") built from acknowledged and settled invoices, and optional invoice financing facilitated through Tanzania's leading banks and financial institutions.

Our registered office is at 9th Floor TanHouse Victoria, P.O. Box 77499, 14112, Dar es Salaam, Tanzania. For the purposes of the Personal Data Protection Act, 2022 of the United Republic of Tanzania (the "PDPA") and its regulations, Finvoice is the data controller of the personal data described in this Policy. You can reach our privacy team at privacy@finvoice.co.tz or by phone on +255 798 334 334.

2. Scope of This Policy

This Policy applies to personal data we process when you visit our website, create or use a Finvoice account, send or receive invoices through the platform, build a Trust Score, request invoice financing, contact our support team, or otherwise interact with us. It applies to business owners, directors, employees and other individuals whose personal data appears in accounts, KYC records or invoice data submitted to the platform.

This Policy does not cover the practices of third parties, including the banks and financial institutions that provide financing through the platform. When you request financing, the receiving institution processes your data under its own privacy notice, which we encourage you to read.

3. The Data We Collect

We collect the following categories of personal data:

Account and KYC data — your name, business name, business registration and taxpayer identification numbers (TIN), national ID or passport details, role in the business, email address, phone number, physical address, and verification documents you submit during onboarding.
Invoice and transaction data — the invoices you send and receive, including counterparties, amounts, dates, payment terms, acknowledgment and settlement events, dispute records, and any attachments or notes added to invoices.
Device and usage data — IP address, browser type, operating system, device identifiers, pages visited, actions taken on the platform, and approximate location derived from your IP address.
Cookies and similar technologies — we use strictly necessary cookies to operate the platform (such as session and security cookies) and, with your consent where required, analytics cookies to understand how the platform is used. You can control cookies through your browser settings.
Communications data — records of your correspondence with us, including support requests, feedback and survey responses.

4. How We Use Your Data

We use personal data for the following purposes:

To provide the platform — creating and managing accounts, verifying identity (KYC), issuing and delivering invoices, recording acknowledgments and settlements, and providing customer support.
To compute the Trust Score — we analyse acknowledged and settled invoice history, payment timeliness and dispute outcomes to compute a verified payment reputation for your business. The Trust Score reflects transaction behaviour on the platform; you may request correction of inaccurate underlying data as described in Section 10.
To facilitate financing when you request it — when, and only when, you request invoice financing, we share relevant data (including your KYC records, invoice history and Trust Score) with the bank or financial institution you select so that it can assess your application. We do not share your data with financing institutions for marketing or any other purpose without your request or consent.
To keep the platform safe — detecting and preventing fraud, abuse, money laundering and other unlawful activity, and enforcing our terms.
To improve our services — analytics, research and product development, using aggregated or de-identified data wherever possible.
To communicate with you — service notifications, security alerts and, with your consent, marketing communications which you may opt out of at any time.
To comply with law — meeting our obligations under Tanzanian law, including tax, anti-money laundering and financial services regulations.

5. Legal Bases for Processing

We process personal data only where we have a lawful basis under the PDPA, namely:

Performance of a contract — most processing is necessary to provide the platform services you have signed up for, including invoicing and Trust Score computation.
Consent — for example, sharing your data with a financing institution when you request financing, optional analytics cookies, and marketing communications. You may withdraw consent at any time without affecting prior processing.
Legal obligation — where processing is required by Tanzanian law, such as KYC, tax and anti-money laundering requirements.
Legitimate interests — such as securing the platform, preventing fraud and improving our services, balanced against your rights and interests.

6. Sharing and Disclosure

We do not sell your personal data. We share it only in the following circumstances:

With your invoice counterparties — the businesses you invoice, or that invoice you, see the invoice details and business identity necessary to transact.
With financing institutions — only when you request financing, as described in Section 4.
With service providers — hosting, communications, identity verification, analytics and support providers who process data on our behalf under contracts that require confidentiality and appropriate safeguards.
With authorities — where required by law, court order or lawful request of a competent authority, including the Personal Data Protection Commission, the Bank of Tanzania or law enforcement.
In a business transfer — if Finvoice is involved in a merger, acquisition or asset sale, personal data may be transferred subject to this Policy and applicable law.

7. Data Residency and International Transfers

We store personal data primarily in the United Republic of Tanzania. Where we use service providers that process data outside Tanzania, we do so in accordance with the PDPA and its regulations, including ensuring that the destination provides an adequate level of protection or that appropriate safeguards (such as contractual protections) are in place, and obtaining any approvals or meeting any conditions required by the Personal Data Protection Commission.

8. Data Retention

We keep personal data only for as long as necessary for the purposes described in this Policy, and thereafter as required by law. In general: account and KYC records are kept for the life of the account and for the period required by anti-money laundering and financial regulations after closure; invoice and transaction records are kept for the period required by Tanzanian tax and commercial law; and device and analytics data are kept for shorter operational periods. When data is no longer needed, we delete it or irreversibly anonymise it.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, access controls and role-based permissions, audit logging, staff confidentiality obligations and regular security reviews. No system is completely secure; if we become aware of a personal data breach that poses a risk to you, we will notify the Personal Data Protection Commission and affected users as required by the PDPA.

10. Your Rights under the PDPA 2022

Subject to the conditions and exemptions in the PDPA, you have the right to:

Access — request a copy of the personal data we hold about you and information about how we process it.
Correction — request that inaccurate or incomplete data be corrected, including data underlying your Trust Score.
Deletion — request deletion of data that is no longer necessary or that we process unlawfully, subject to legal retention obligations.
Objection and restriction — object to, or ask us to restrict, certain processing, including processing for direct marketing.
Withdraw consent — where processing is based on consent, withdraw it at any time.
Complain — lodge a complaint with us at privacy@finvoice.co.tz, and with the Personal Data Protection Commission of Tanzania if you are not satisfied with our response.

To exercise any of these rights, contact privacy@finvoice.co.tz. We may need to verify your identity before acting on a request, and we will respond within the timelines required by the PDPA.

11. Children

Finvoice is a business-to-business service and is not directed at children. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a child has provided us with personal data, please contact privacy@finvoice.co.tz and we will delete it.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in our services or the law. If we make material changes, we will notify you through the platform or by email before the changes take effect, and we will update the "Last updated" date above. Your continued use of the platform after the effective date constitutes acceptance of the updated Policy.

13. Contact Us

If you have questions about this Policy or how we handle your personal data, contact us at:

Privacy: privacy@finvoice.co.tz
General: hello@finvoice.co.tz
Phone: +255 798 334 334
Address: Finvoice, 9th Floor TanHouse Victoria, P.O. Box 77499, 14112, Dar es Salaam, Tanzania