This policy explains what personal data PangaEvent collects, why, and the rights you have over it under Tanzanian data protection law.
PangaEvent ("we," "us," "our") operates a marketplace connecting customers planning events with verified event vendors across Tanzania. This Privacy Policy explains what personal data we collect through our website and Android application (together, the "Platform"), why we collect it, who we share it with, and the rights you have over it. We process personal data in accordance with the Tanzania Personal Data Protection Act, 2022 (Act No. 11 of 2022) and its implementing regulations.
1.1 This Policy applies to personal data we collect from Customers, Vendors, and visitors to the Platform. It should be read together with our Terms of Service.
1.2 "Personal data" means any information relating to an identified or identifiable natural person, as defined under the Personal Data Protection Act, 2022.
1.3 By using the Platform, you acknowledge that you have read and understood this Policy. Where we rely on your consent for a particular use of your data, we will ask for it separately.
PangaEvent is the data controller responsible for your personal data for the purposes of Tanzanian data protection law. You can reach us using the details in Section 15.
Terms such as "Booking," "Customer," "Vendor," "Event Request," and "Platform" have the same meaning given to them in our Terms of Service. In this Policy, "Processing" means any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.
4.1 Information you give us directly.
4.2 Information we collect automatically. When you use the Platform, we automatically collect technical data such as your IP address, browser type and version, device identifiers, operating system, pages viewed, and timestamps of activity, using cookies and similar technologies described in Section 10.
4.3 Information from third parties. Our payment aggregator, Selcom, provides us with transaction status and a provider-tagged reference for payments made through it; we do not receive or store your mobile money PIN.
We process your personal data on one or more of the following legal bases, consistent with the Personal Data Protection Act, 2022:
We use personal data to:
We do not sell your personal data to third parties, and we do not use your data for automated decision-making that produces a legal or similarly significant effect on you without human review.
7.1 With your counterpart in a Booking. When you message, request a Quotation from, or book a Vendor, that Vendor sees your name and the details of your Event Request; a Customer sees the Vendor's public profile. Private contact details (phone number, email) are not exposed through vendor listings, but you may choose to share them within a private message thread with your counterpart to plan your event.
7.2 With our payment aggregator. Where you pay online, we share the minimum information necessary (amount, phone number, Booking reference) with Selcom to process the transaction.
7.3 With service providers. We share data with vendors who help us operate the Platform under contract, including hosting and infrastructure providers, email delivery services, and — for the Android app — Firebase Cloud Messaging for push notifications. These providers are contractually restricted from using your data for any purpose other than providing services to us.
7.4 For legal reasons. We may disclose personal data where required by law, court order, or a lawful request from the Tanzania Personal Data Protection Commission or another competent authority, or where necessary to protect the rights, property, or safety of PangaEvent, our Users, or the public.
7.5 Business transfers. If PangaEvent is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to the protections of this Policy.
7.6 We do not sell personal data to third parties for their own marketing purposes.
8.1 We retain personal data for as long as your account is active and as needed to provide the Platform to you.
8.2 After account closure, we retain Booking, payment, and message records for a period necessary to meet our legal, tax, and dispute-resolution obligations, after which they are deleted or anonymized.
8.3 Vendor verification documents are retained only for as long as necessary to support the verification decision and any subsequent review, and are stored separately from general file storage with restricted, admin-only access.
9.1 We use industry-standard safeguards to protect your personal data, including encryption of data in transit (HTTPS/TLS) and hashed storage of passwords.
9.2 Vendor verification documents are stored with dedicated access controls separate from general Platform file storage, restricted to authorized administrators.
9.3 Uploaded files are validated against their actual file content, not just their file name or claimed type, before being accepted.
9.4 No system can be guaranteed 100% secure. We continually review our security practices, but you also play a role — keep your password confidential and notify us immediately at pangaevent@gmail.com if you suspect unauthorized access to your account.
10.1 We use strictly necessary cookies to keep you logged in, protect against cross-site request forgery, and remember your language preference (English or Swahili).
10.2 We may use limited analytics technologies to understand aggregate usage patterns, such as which pages are most visited, so we can improve the Platform.
10.3 You can control or disable cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging in or using core features of the Platform.
Under the Personal Data Protection Act, 2022, you have the right to:
To exercise any of these rights, contact us at pangaevent@gmail.com. We may need to verify your identity before actioning a request, and may decline a request to the extent permitted by law.
The Platform is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If you believe a child has provided us with personal data, please contact us at pangaevent@gmail.com and we will take steps to delete it.
Where a service provider we use (such as cloud hosting, email delivery, or push notification infrastructure) processes data outside Tanzania, we take steps to ensure that provider offers an adequate level of protection for your personal data, consistent with the requirements of the Personal Data Protection Act, 2022, before any such transfer takes place.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated Policy on this page with a new effective date. If a change is material, we will provide additional notice, such as an in-app announcement or email.
If you have a question, request, or concern about this Policy or how we handle your personal data, contact us first:
If you are not satisfied with our response, you have the right to lodge a complaint with the Tanzania Personal Data Protection Commission (PDPC), the independent authority responsible for enforcing data protection law in the United Republic of Tanzania.