1. Introduction

DXHUBX ICT LIMITED ("we," "us," "our") is a Tanzania-based technology company registered with BRELA (Business Registration Number: 200656849), based in Dar es Salaam, Tanzania. We are committed to protecting your privacy and handling your personal information responsibly and transparently, in accordance with the Tanzania Personal Data Protection Act, 2022, and other applicable laws.

This Privacy Policy explains what personal information we collect, why we process it, how we share it, and the rights you have in relation to it. It applies to this website (dxhubx.co.tz) and to our general business activities. Where we build and operate systems on behalf of clients, additional terms are set out in the relevant client agreement and, where applicable, a separate Data Processing Agreement (DPA), which you can read at our DPA page.

2. Data Controller

For the purposes of this website, DXHUBX ICT LIMITED acts as the data controller. This means we decide why and how personal information collected through this website is processed. Our contact details are set out in Section 24 below.

3. Information We Collect

We collect information you provide directly and information collected automatically when you use our website:

• Contact and inquiry forms: name, email address, phone number, organization name, service of interest, and the contents of your message
• Newsletter and insights: email address when you subscribe to receive our articles and updates
• Automatic technical data: IP address, browser type and version, device information, pages visited, and approximate time of visit
• Communication data: information exchanged when you contact us by email, phone, or WhatsApp
• Client project data: information provided during the course of a project or engagement, such as business details, technical specifications, and any content you provide

4. Categories of Personal Data

Depending on how you interact with us, we may process the following categories of personal data:

• Identity data: name, job title, organization name, and similar identifiers
• Contact data: email address, phone number, and business address
• Business/professional data: company details, industry, and role
• Technical/device data: browser type, device type, operating system
• IP and log data: IP address and server/security logs (retained in hashed or limited form where practicable)
• Communications data: messages, call notes, and correspondence with us
• Billing/transaction information: invoice details, payment references, and transaction history
• Marketing preferences: your consent choices and communication preferences

5. Legal Basis for Processing

We process personal data only where we have a lawful basis to do so, including:

• Contract performance: where processing is necessary to respond to an inquiry, prepare a quotation, or deliver services you have requested or agreed to
• Consent: where you have given us permission (for example, for marketing communications), which you may withdraw at any time
• Legal obligation: where processing is required to comply with laws and regulations applicable in Tanzania, including tax, accounting, and communications regulations
• Legitimate interests: for business and security purposes such as fraud and spam prevention, service improvement, network and information security, and the efficient operation of our business

6. How We Use Personal Data

We use the information we collect to:

• Respond to your inquiries and provide services you've requested
• Prepare proposals, quotes, and project estimates
• Deliver, maintain, and support the services you have engaged us to provide
• Send updates about our services (only with your consent)
• Improve our website, content, and services
• Detect and prevent spam, abuse, and fraudulent submissions
• Comply with legal and regulatory obligations

7. Cookies and Analytics

Our website uses essential cookies and local storage to ensure the site functions correctly, including remembering your cookie preferences and security protections. These are necessary for the website to work.

When you consent, we may also use Google Analytics (via Google Tag Manager) to understand how visitors use our website so we can improve it. Analytics cookies collect data such as pages visited and referral sources. Analytics data may include information from your device and browser, and we do not represent that this data is automatically non-identifying. We have configured our consent mechanism so that analytics scripts only load after you accept non-essential cookies.

You can accept or decline non-essential cookies using the cookie banner shown on your first visit. You may also control cookie settings through your browser at any time.

8. Third-Party Services

To operate and improve our website and services, we use trusted third-party services, including:

• Google Analytics / Google Tag Manager: for website analytics
• OpenStreetMap: to display our office location on the contact page
• WhatsApp: for customer communication through our chat widget
• Email delivery providers: to send and receive your messages

We do not sell, trade, or rent your personal information to third parties. We may share information only when required by law, to enforce our Terms of Service, or with your explicit consent.

9. Subprocessors

We may engage third-party subprocessors to assist us in operating our business and delivering services. These include cloud and hosting providers, email and SMS providers, payment providers, CDN/security providers, analytics providers, and other API or software-as-a-service providers. Where a subprocessor processes personal data on our behalf, we require it to protect that data to standards consistent with this Policy and applicable law. A current list of subprocessors is available on request.

10. International / Cross-Border Data Transfers

Your information may be processed and stored outside Tanzania through the use of cloud services, email, analytics, payment, and other service providers located in other countries. Where data is transferred internationally, we take steps to ensure that processing continues to comply with applicable Tanzanian requirements and, where relevant, the terms of the Personal Data Protection Act, 2022.

11. Client Data: Controller vs Processor

It is important to distinguish between two situations:

• Our own website: For information we collect through this website (inquiries, contact forms, analytics), DXHUBX acts as the data controller.
• Client systems and databases: Where we build, host, or operate systems on behalf of a client that process personal data, the client is generally the data controller (or an independent data controller) and retains responsibility for their own compliance with the Personal Data Protection Act, 2022 — including registering with the Office of the Data Protection Commissioner (ODPC) where required and fulfilling their obligations to data subjects. We process such data only in accordance with the client's instructions and our service agreement, and we are not responsible for the client's compliance with their own regulatory obligations.

Where applicable law or the nature of the engagement requires, we may enter into a separate Data Processing Agreement (DPA) with the client setting out processing instructions, security measures, and data subject rights procedures.

12. Children's Data

Our public website is not intended for children, and we do not intentionally collect personal data from children through it. Where we build or operate school, education, or other systems that may process children's data on behalf of a client, such processing is governed by the client agreement and, where applicable, the DPA, and the client remains responsible for compliance with applicable laws concerning children's data.

13. Sensitive Personal Data

We do not intentionally collect sensitive personal data (such as health, biometric, religious, or political information) through our public website unless it is necessary and lawful to do so. Where sensitive data arises in the course of client work, it is handled strictly in accordance with the client agreement, applicable law, and, where applicable, the DPA.

14. Data Security

We take data security seriously and implement appropriate technical and organizational measures to protect your information, including CSRF protection, rate limiting, spam and bot detection, anonymized IP hashing for stored records, secure server configuration, HTTPS, and access controls. No method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security. Liability for security incidents is addressed in our Terms of Service and in the relevant service agreement, subject to applicable law.

15. Personal Data Breaches

We maintain incident-response procedures to detect, investigate, and contain security incidents affecting personal data. In the event of a personal data breach, we will handle it in accordance with applicable law and our contractual obligations, including notifying affected parties or regulators where required by law.

16. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy, such as responding to your inquiry, delivering services, or satisfying legal, accounting, and reporting requirements. Retention periods vary by category:

• Enquiries: retained for as long as needed to respond and, where relevant, for a reasonable period afterwards
• Customers and contracts: retained for the duration of the engagement and as long as required by law or for legitimate business purposes
• Invoices and financial records: retained as required by tax law
• Support records: retained for the duration of the support relationship and a reasonable period afterwards
• Security logs: retained for security monitoring and incident response purposes
• Backups: retained as described in Section 21 below
• Marketing: retained until you withdraw consent or unsubscribe

When information is no longer needed, we delete or anonymize it securely.

17. Your Data-Subject Rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your information
• Request restriction of certain processing activities
• Object to certain processing activities
• Withdraw consent at any time, where processing is based on consent
• Data portability, where applicable by law
• Receive information about automated decision-making, where relevant
• Lodge a complaint with the relevant data protection authority in Tanzania
• Seek compensation where provided by law

18. How to Exercise Your Rights

To exercise any of these rights, contact us using the details below. To protect your privacy and the security of your information, we may need to verify your identity before fulfilling a request (for example, by confirming details of your interaction with us). We will respond within a reasonable timeframe and in accordance with applicable law.

19. Marketing Communications

We send marketing communications only with your consent. You can unsubscribe or opt out at any time using the link in any marketing email, or by contacting us directly. We distinguish marketing communications from necessary service communications (such as responses to your inquiries, billing, or service notifications), which are not marketing and do not require separate consent.

20. AI and Automated Decision-Making

Our website does not currently use AI or automated decision-making that produces legal or similarly significant effects on you. Where we build or operate AI-enabled systems on behalf of clients, those systems are governed by the specific client agreement. You should not submit confidential or sensitive information to external AI services unless authorized to do so.

21. Backups and Deletion

When you request deletion of your information, or when information is otherwise scheduled for deletion, deleted information may temporarily remain in secure backups for disaster recovery, security, legal, or dispute purposes before being overwritten or destroyed in accordance with our backup lifecycle. Nothing in this Policy guarantees specific backup retention periods unless expressly agreed in a written contract.

22. Complaints

If you believe your privacy rights have been affected, please contact us so we can try to resolve your concern. If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Tanzania or another relevant authority, as applicable.

23. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Changes will be posted on this page with an updated "Last Updated" date, and material changes will be highlighted where appropriate. We encourage you to review this page periodically.

24. Contact Information

If you have questions about this Privacy Policy or our privacy practices, or wish to exercise any of your rights, please contact us:

Company: DXHUBX ICT LIMITED
Email: info@dxhubx.co.tz
Support: roseevanskyara@dxhubx.co.tz
Phone / WhatsApp: +255 753 587 561
Location: Dar es Salaam, Tanzania
Website: https://dxhubx.co.tz