Privacy Policy

1.Who we are and what this covers

Tambua is an inclusive learning platform for Tanzania. It helps teachers notice learners who may need support, gives them practical guidance, and gives schools and partners accurate totals. In this policy, "Tambua", "we" and "us" mean the team that runs the platform.

This policy covers the Tambua website, the web app at every level (teacher, school, partner, family and Tambua admin), the Tambua blog, and the mobile app when it is released. It follows the Personal Data Protection Act, 2022 of the United Republic of Tanzania, which has been in force since 1 May 2023 and is overseen by the Personal Data Protection Commission.

2.Our role and your school's role

When a school uses Tambua, the school decides why and how its learners' information is used. For learner records, the school is the data controller and Tambua processes the information on the school's behalf and on its written instructions. When a district or NGO programme brings schools onto Tambua, the agreement for that programme sets out who decides what.

For accounts, sign in, the website, the blog, reviews and messages you send us, Tambua is the data controller.

3.What we collect

We collect the information below. Where something is optional, the screen says so.

4.Children's information

Information about children needs special care, and some of it, such as how a child functions, is sensitive. We treat it that way.

A teacher records consent before screening a learner, following the school's rules and the law. A parent or guardian can ask the school at any time to stop screening or to remove their child's information.

• A screening result in Tambua shows where a learner may need support. It is never a diagnosis, and it is never used to label a child.
• We never sell children's information, never use it for advertising, and never use it to make automated decisions about a child.
• Learner names are not kept in long term storage on the device; they stay on our servers, where access is checked.
• Partners and government see totals only, and groups smaller than a set size are hidden.
• Children do not have Tambua accounts. A parent or guardian creates a family account.

5.How we use information

We use information only for these purposes:

• To run Tambua: sign you in, show each person what their role allows, and save their work.
• To help teachers support learners: screening, guidance, referrals and follow up.
• To give schools, districts and partners accurate totals so support reaches the right places.
• To send messages you need, such as sign in codes, invitations and replies to your questions, by SMS or email.
• To keep Tambua safe: stop misuse, investigate problems and protect accounts.
• To improve Tambua, using totals and error reports rather than named records.
• To meet our duties under the law.

6.Our lawful grounds

We process personal information only where the law allows it. For learner screening we rely on consent recorded through the school. For accounts and the service we rely on the agreement with you or your school. For security and fixing faults we rely on our legitimate interest in keeping Tambua safe, and we balance that against your rights. Where the law requires us to keep or share something, we rely on that legal duty.

Where we rely on consent, you can withdraw it at any time. Withdrawing does not affect what was done before.

7.Who can see what

Access is checked on our servers for every request, not only on the screen.

• A teacher sees the learners in their own classes.
• A head teacher or academic master sees their own school.
• A parent or guardian sees only their own children, once the school has accepted the link.
• District officers, NGOs and government partners see totals for the schools in their programme, never names.
• A small number of Tambua staff can reach records to give support or fix a fault. Their access is recorded in an audit log.
• We share information with authorities only when the law requires it, and we tell the school unless the law forbids it.
• We never sell or rent personal information.

8.Service providers

We use a small number of trusted providers to run Tambua. Each one handles information only on our instructions and must protect it.

9.Information outside Tanzania

Some of our providers may store or handle information outside Tanzania. When that happens, we transfer it only as the Personal Data Protection Act allows, including to countries with adequate protection and with any permit the Commission requires, and under written terms that protect it.

10.How long we keep information

We keep information only as long as it is needed:

• Accounts: while the account is open. When you close it, we delete or anonymise your details within 90 days.
• Learner records: while the school uses Tambua, or until the school removes the learner. When a school leaves, we return or delete its records as agreed.
• Security logs: up to 12 months, to protect accounts and investigate misuse.
• Messages to us: up to 24 months after the conversation ends.
• Totals that cannot identify anyone may be kept longer, to show change over time.

11.How we protect it

We use safeguards suited to information about children:

• Encrypted connections (HTTPS) for every page and request.
• Passwords stored with Argon2, a strong one way method, so no one can read them, including us.
• Two step sign in with an authenticator app, sign in codes by SMS, and short lived sessions.
• Permissions checked on the server for every request, limits on repeated attempts, and an audit log.
• Regular backups and staff access only where it is needed.

12.Cookies and storage on your device

Tambua does not use advertising or tracking cookies. We store a few small items in your browser so the service works: your sign in, your language, text size and theme, which page tips you have seen, and a random number that lets the blog count your helpful or not helpful choice once. You can clear them in your browser settings at any time; you will then need to sign in again.

If you speak a question to Ask Tambua, your browser turns it into text with its own speech service (in some browsers, such as Chrome, that service belongs to the browser maker). Tambua receives only the text, and answers are read aloud by your device. Nothing you say is recorded by Tambua.

13.Your rights

Under the Personal Data Protection Act you have the right to:

To use any of these rights, write to hello@tambua.example. We will reply within 30 days. For a learner's record, we work with the child's school, which holds the record.

• Know what information we hold about you and get a copy. Signed in users can download it from Settings, Privacy and data.
• Have wrong or incomplete information corrected.
• Ask us to delete information, or to stop or limit using it.
• Object to a use of your information, and withdraw consent.
• Complain to the Personal Data Protection Commission if you are not happy with how we handled your information.

14.If something goes wrong

If a security breach affects personal information, we act at once to contain it. We notify the Personal Data Protection Commission promptly as the law requires, tell the schools concerned, and tell affected people when there is a risk to them, with clear advice on what to do.

15.Changes to this policy

We will update this policy when the service or the law changes. The version and date at the top will change, and for important changes we will tell signed in users in the app before the change takes effect.