Privacy Policy

Last updated: 2022-06-29

Effective Date: 24 September 2026

Last Updated: 24 September 2026

This Privacy Policy explains how Cashless (“Cashless”, “we”, “us”) collects, uses and protects personal data in Tanzania, through the website at cashless.co.tz, the Cashless Biller and User apps, the web dashboard, and the Cashless API. Cashless is operated by Mitikaz Company Limited.

It is written to meet the Personal Data Protection Act, 2022 (Cap. 44) and the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023, which are administered by the Personal Data Protection Commission.

1. Who does what with your data

Cashless is a technology provider. We build and run the billing software. The actual movement of money is performed by regulated third parties — the mobile money operators, card networks and acquirers, and our banking partners. For the transaction records those parties hold, they are the controller and their own privacy notices apply alongside this one.

For the data we collect through our website, apps and dashboard, Cashless is the data controller.

2. What we collect

  • Enquiry details — the name, email address, phone number and message you submit through the contact form on this website.
  • Merchant account details — business name, registration details, the contact person, store and cashier records, and payout destination, collected when a business signs up to bill with Cashless.
  • Transaction metadata — the bill reference, amount, currency, timestamp, status, and the channel used. We process the customer’s mobile money number in order to route the bill to the right person.
  • Technical data — IP address, browser and device information, and pages visited, used to keep the service available and to prevent abuse.

We never receive, ask for, or store a customer’s mobile money PIN. The PIN is entered on the customer’s own device, against their own mobile money account, and is never transmitted to Cashless.

3. Why we process it

  • To route a bill to the correct customer and report its status back to the merchant
  • To create and administer a merchant account, and to pay out settled funds
  • To respond to an enquiry you sent us
  • To detect and prevent fraud and abuse of the platform
  • To meet obligations imposed on us by law, by a regulator, or by a payment partner
  • To understand and improve how the service is used, in aggregate and de-identified form

We do not sell personal data. We do not use it for automated decision-making that produces legal effects for you.

4. Who we share it with

  • Mobile money operators, card networks and acquirers — to deliver the payment request and receive its result.
  • Banking and settlement partners — to pay out merchant funds.
  • Service providers that host this website (Cloudflare) and deliver our transactional email (Brevo).
  • Mitikaz Company Limited — which operates the platform and maintains the software.
  • Regulators, law enforcement and courts — where we are compelled by law or by the rules of a payment partner.

5. Transfers outside Tanzania

Some of the providers listed above operate global infrastructure, so personal data may be processed outside Tanzania. Where that happens it is governed by our contracts with those providers and by the conditions the Personal Data Protection Act places on transfers of personal data outside the country.

6. How long we keep it

  • Website enquiries: up to 24 months from your last contact with us.
  • Merchant account records and transaction records: retained for the period required by law and by our payment partners’ own rules, which is typically at least 7 years from the end of the relationship.
  • Technical and abuse-prevention logs: short-lived, and kept only as long as needed to investigate abuse.

7. Cookies and analytics

This website uses a small number of cookies and edge-side analytics to keep the site working and to understand how visitors use it — Cloudflare edge cookies needed to serve the site, and, where enabled, Google Analytics 4 with IP anonymisation. Rate limiting on the contact form uses short-lived request metadata held at the network edge, which is not retained beyond what is needed to block automated abuse.

8. Your rights

Under the Personal Data Protection Act, 2022 you have the right to:

  • Be told whether we hold personal data about you, and to access it
  • Have inaccurate or out-of-date data corrected
  • Have data erased where we no longer have a lawful basis to keep it
  • Withdraw a consent you previously gave
  • Object to a particular use of your data
  • Complain to the Personal Data Protection Commission

To exercise any of these, contact us using the form in §10. Where a request concerns a transaction record held by a mobile money operator or bank, we will help you direct it to the right party.

9. Security

Data is encrypted in transit. Access to merchant data and internal tooling is restricted and logged, and staff are bound by confidentiality obligations. No system is perfectly secure; if you believe your Cashless account or a transaction has been compromised, contact us immediately so we can act and, where required, notify the Personal Data Protection Commission.

10. Contact us

For any question about this Privacy Policy — including access, correction, erasure, or a complaint — use the contact form on this website.

11. Changes

We may update this Privacy Policy. When we do, we will revise the “Last Updated” date above and, where a change is material, say so on the website.