Privacy policy

1. Introduction

Starshine Technology Company Limited (“Starshine”, “the Company”, “we”, “us” or “our”) is a private company limited by shares, incorporated and existing under the Companies Act, Cap. 212 of the laws of the United Republic of Tanzania, with its registered office in Mainland Tanzania and its principal place of business in Dar es Salaam.

This Privacy Policy is issued as the Company’s public notice on the collection, use, storage, disclosure and protection of personal data. It is prepared with reference to the Company’s Memorandum and Articles of Association, the Personal Data Protection Act, 2022, the Electronic and Postal Communications Act, and other applicable Tanzanian law. It explains how we handle personal information when you visit starshinetech.co.tz, contact us, or use our products and services.

By using our website, submitting an enquiry, or entering a commercial relationship with us, you acknowledge this Policy. Where the law requires a specific consent, we will ask for that consent separately and clearly.

2. Who we are and what we do

In accordance with our Memorandum of Association, the Company is established, among other objects, to:

• design, develop, manufacture and distribute technological devices, software and related accessories;
• provide information-technology consultancy, support and solutions to individuals, businesses and public bodies;
• establish and operate technology-based training and educational programmes;
• research, develop and commercialise technology and intellectual property; and
• import, export and sell technology-related goods and services.

Our public product suite currently includes RafikiSMS, RafikiCard, RafikiEvent, RafikiPay, STARHOST TZ, Starshine POS, Dawasmart, Mgahawa Suite, and related software, hosting, integration and support services. This Policy applies to personal data processed in connection with those activities, our website, and our business operations.

For the purposes of the Personal Data Protection Act, 2022, Starshine is the data controller in respect of personal data that we determine the purpose and means of processing. Where we process data solely on a client’s documented instructions (for example, hosting a client system or sending messages from a client account), we act as a data processor for that client, who remains the controller of their end-user data.

3. Scope

This Policy applies to:

• visitors to https://starshinetech.co.tz and related Starshine websites;
• persons who submit contact, sales or support enquiries;
• customers, prospects, suppliers, consultants and partners;
• trainees and participants in our technology training programmes;
• authorised users of Starshine products and hosted systems; and
• individuals whose data is contained in project, billing or support records.

It does not replace a separately signed data-processing agreement, service agreement, or product terms, which prevail to the extent of any conflict for that specific engagement.

4. Personal data we collect

The categories of personal data we may collect depend on how you interact with us. They may include:

• Identity and contact data: name, job title, organisation, email address, telephone number and postal or physical address.
• Enquiry and correspondence data: messages submitted through our website (including the service of interest, budget range and project description), emails, call notes and meeting records.
• Account and service data: usernames, role or permission level, configuration choices, support tickets and usage logs necessary to operate a product or hosted environment.
• Transactional data: invoices, payment references, billing contacts and records required for accounting and tax.
• Training data: enrolment details, attendance and assessment or certification records where you join a Starshine programme.
• Technical data: Internet Protocol address, browser and device type, referring page, date and time of access, and similar server logs used for security and availability of the website.
• Communications content processed on a client’s behalf: for example message content, recipient numbers or guest lists inside RafikiSMS, RafikiEvent or similar products, where the client is the controller.

We do not seek to collect special-category data (such as health, biometric or children’s data) through the public website. Pharmacy, hospitality or identity products may process operational records belonging to a client. In those cases the client is responsible for having a lawful basis to supply that data to the system.

5. How we collect personal data

We collect personal data:

• directly from you, when you complete a form, email us, call +255 621 728 109 or +255 621 728 110, meet our team, or sign a proposal or contract;
• from your organisation, if a colleague names you as a project, billing or technical contact;
• automatically, through ordinary website and server logs when you visit our site;
• from service providers who support hosting, domain, email, payment or messaging infrastructure, limited to what is needed to operate those services; and
• from publicly available professional sources, where this is reasonable for business development and not prohibited by law.

Our public website contact form currently collects name, email address, telephone number, company name, service of interest, budget indication and a free-text message. That information is stored so the Starshine team can respond to your enquiry.

6. Purposes and lawful bases

We process personal data only where a lawful basis exists. In practice this includes:

• Performance of a contract, or steps at your request before entering a contract: preparing proposals, delivering software, hosting, training, support and related services.
• Compliance with a legal obligation: company, tax, accounting, electronic-communications, anti-money-laundering where applicable, and data-protection record-keeping under Tanzanian law, including the duty under the Companies Act to keep proper books of account.
• Legitimate interests: operating, securing and improving our website and products; responding to enquiries; defending legal claims; and managing suppliers, consultants and associate engagements contemplated by our Articles of Association, provided those interests are not overridden by your rights.
• Consent: where we are required to obtain it, including certain electronic marketing, optional cookies if introduced, or processing that cannot rest on another basis. You may withdraw consent at any time, without affecting processing that already occurred lawfully.

Typical purposes include delivering IT consultancy and product services; coordinating research or implementation work; administering training; managing imports, exports and procurement of technology goods; invoicing; information-security monitoring; and communicating about projects, incidents or account matters.

7. Product-specific processing

Where you or your organisation use a Starshine product, additional processing may occur as follows. Product-specific terms or a data-processing addendum may apply.

• RafikiSMS: message content, sender identifiers, recipient numbers and delivery metadata are processed to transmit communications. The customer is ordinarily the controller of recipient data. Customers must have a lawful basis to message those recipients, including compliance with unsolicited-communications rules.
• RafikiCard: profile information that a user chooses to publish or share is processed to display and distribute that professional identity.
• RafikiEvent: invitee names, contact details, RSVP status and attendance records are processed to run the event on the organiser’s instructions.
• RafikiPay: payment references, channel and transaction-status data are processed to connect mobile-money, card or bank-transfer workflows. We do not store full payment-card PAN or PIN data on the public website. Licensed payment partners process card and mobile-money credentials under their own terms and licences.
• STARHOST TZ: account, domain, server and access-log data are processed to provide hosting, VPS and domain services and to keep those environments secure.
• Starshine POS, Dawasmart and Mgahawa Suite: operational records (sales, stock, orders and staff-user accounts) belong to the customer. We process them to provide the software, hosting, backups and support the customer has purchased.

8. Cookies and website technology

The public website uses strictly necessary cookies or similar technology to operate the site, including administrator session cookies for the private /admin area. We do not currently run third-party advertising or analytics pixels on the public marketing pages. If we introduce non-essential cookies, we will update this Policy and, where required, obtain consent.

9. Sharing of personal data

We do not sell personal data. We may disclose personal data only:

• to directors, employees and authorised consultants who need it to perform their duties;
• to associate member companies, contractors or specialist consultants engaged for an assignment, under confidentiality or non-disclosure obligations consistent with our Articles of Association;
• to infrastructure, hosting, domain, email, messaging or payment providers acting as processors on our instructions;
• to professional advisers (advocates, accountants, insurers) under professional confidentiality;
• to a public authority, court or regulator where required by law or to protect the Company, our users or the public; and
• in connection with a corporate reorganisation, provided the recipient is bound to protect the data in a manner consistent with this Policy.

Any sharing is limited to what is necessary for the stated purpose.

10. International transfers

Some hosting, email, domain or software-tool providers may store or access data outside the United Republic of Tanzania. Where a cross-border transfer is necessary to deliver a service, we take appropriate contractual and technical steps and remain responsible for complying with Tanzanian data-protection principles. We will not transfer personal data to a jurisdiction in a manner that would defeat the protections required by applicable law.

11. Retention

We keep personal data only for as long as needed for the purpose collected, including:

• website enquiries: ordinarily up to twenty-four (24) months after last correspondence, unless a project proceeds or a longer period is required;
• contracts, invoices and accounting records: for the period required by Tanzanian company and tax law, typically not less than six (6) years;
• product and hosting logs: for the period needed for security, billing and dispute resolution, then deletion or anonymisation;
• training records: for as long as needed to evidence certification or as agreed with the commissioning organisation; and
• data processed solely as a processor: in accordance with the customer’s instructions and the relevant service agreement.

When retention expires, we delete or irreversibly anonymise the data, unless a legal hold applies.

12. Security

We apply administrative, technical and organisational measures appropriate to the nature of the data and the risks involved. These include access control, least-privilege administration of systems, encrypted transit where practicable, backup and recovery arrangements for hosted services, and staff confidentiality. No internet transmission or hosted system can be guaranteed completely secure. You must also keep your own passwords and access credentials confidential and notify us promptly of any suspected unauthorised use of an account we provide.

13. Your rights

Subject to the Personal Data Protection Act, 2022 and any lawful exceptions, you may request to:

• be informed that we hold personal data about you;
• access a copy of that personal data;
• correct incomplete or inaccurate personal data;
• erase personal data in circumstances permitted by law;
• restrict or object to certain processing;
• withdraw consent where processing is based on consent; and
• lodge a complaint with the competent data-protection authority in Tanzania.

Requests should be sent using the contact details in section 16. We may need to verify your identity before acting. We will respond within a reasonable period, and in any event within the time required by law. We may refuse or charge for a request that is manifestly unfounded, excessive or repetitive, where the Act allows.

If we process your data only as a processor for a customer, we will direct you to that customer where appropriate, because they decide how that data is used.

14. Children

Our public website and business products are directed at organisations and adults. We do not knowingly collect personal data from children through the public contact form. If you believe we have received a child’s data in error, contact us and we will delete it unless we are legally required to retain it.

15. Third-party websites and payment partners

Our website may link to third-party sites or payment gateways. Those services have their own privacy notices. We are not responsible for their content or practices. You should read their policies before providing personal data to them.

16. Contact

The data controller is Starshine Technology Company Limited, Dar es Salaam, United Republic of Tanzania.

Privacy and data-subject requests:

• Email: info@starshinetech.co.tz (please mark the subject “Privacy request”)
• Telephone: +255 621 728 109 / +255 621 728 110
• Website: https://starshinetech.co.tz/privacy_policy

If you are not satisfied with our response, you may complain to the Personal Data Protection Commission of Tanzania or any successor authority designated under the Personal Data Protection Act, 2022.

17. Changes to this Policy

We may update this Privacy Policy to reflect changes in law, our Memorandum objects, products or operating practices. The current version is always published at https://starshinetech.co.tz/privacy-policy and https://starshinetech.co.tz/privacy_policy, with the effective date shown on the document. Material changes will be indicated by an updated date. Continued use of the website after publication constitutes notice of the revised Policy; where the law requires fresh consent, we will request it.

This document is the official Privacy Policy of Starshine Technology Company Limited as at the effective date stated on the cover. It is a company notice for website and operational use. Specific contracts, data-processing agreements and licensed-product terms continue to apply to those relationships.