Privacy Policy
Effective Date: August 2026 | Last Updated: August 26, 2026
Section 1
Introduction
Welcome to SokoPlus ("Platform"), operated by POX Technologies Ltd ("Company", "we", "us", "our"), a company registered in the United Republic of Tanzania. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website (sokopluss.co.tz), mobile application, and related services (collectively, the "Service").
By accessing or using SokoPlus, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please discontinue use of the Service.
This policy complies with the Tanzania Personal Data Protection Act No. 11 of 2022, the Electronic and Postal Communications Act (EPOCA), and the Cybercrimes Act of 2015. As a data controller under the Personal Data Protection Act, SokoPlus is registered with the Personal Data Protection Commission (PDPC).
By accessing or using SokoPlus, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please discontinue use of the Service.
This policy complies with the Tanzania Personal Data Protection Act No. 11 of 2022, the Electronic and Postal Communications Act (EPOCA), and the Cybercrimes Act of 2015. As a data controller under the Personal Data Protection Act, SokoPlus is registered with the Personal Data Protection Commission (PDPC).
In Plain LanguageThis page explains what information we collect about you, why we collect it, how we use it, and how we keep it safe. We follow Tanzanian data protection law and are registered with the government's data protection commission.
Section 2
Information We Collect
2.1 Personal Information You Provide
- Full name, email address, phone number
- Delivery addresses and location data
- Payment information (mobile money numbers, card details via third-party processors)
- National ID (NIDA) details for vendor verification
- Selfie photographs and identity documents for vendor/service provider verification
- Business registration documents (for vendors and service providers)
- Student ID information (for campus commerce features)
- Device type, operating system, browser type, and version
- IP address and approximate geolocation
- Usage data: pages viewed, features used, search queries, time spent
- Referral source and navigation patterns
- Push notification tokens (for order updates and alerts)
- Payment verification data from Selcom, M-Pesa, Tigo Pesa, Airtel Money, or Stripe
- NIDA verification results for vendor identity confirmation
- Analytics data from third-party services (Google Analytics)
In Plain LanguageWe collect three types of information: (1) what you give us directly (name, phone, address, ID for vendors), (2) what we automatically see when you use the site (device info, pages you visit), and (3) what we get from other companies (payment confirmations, ID verification results).
Section 3
How We Use Your Information
We use your information for the following purposes:
- Order fulfillment: Process and fulfill orders, payments, and deliveries
- Identity verification: Verify vendor and service provider identities (NIDA verification, selfie authentication)
- Communication: Facilitate communication between buyers, vendors, service providers, and delivery partners
- Transaction updates: Send transactional messages: order confirmations, delivery updates, payment receipts
- Marketing: Send marketing communications (with your consent; opt-out available)
- Support: Provide customer support and dispute resolution
- Security: Detect and prevent fraud, abuse, and security incidents
- Improvement: Improve and personalize the Platform experience
- Analytics: Generate aggregated, anonymized analytics and market insights
- Legal compliance: Comply with legal obligations under Tanzanian law
- Referral system: Administer the referral and credit system
In Plain LanguageWe use your data to: make orders work (process payments, deliver products), verify who you are (especially vendors), keep you updated about your orders, improve the platform, prevent fraud, and follow the law. We only send marketing messages if you say yes, and you can opt out anytime.
Section 4
Legal Basis for Processing
Under the Personal Data Protection Act No. 11 of 2022, we process your data based on:
- Contractual necessity: Processing required to fulfill our contractual obligations to you (order processing, delivery)
- Legal obligation: Processing required to comply with Tanzanian law (tax records, identity verification)
- Legitimate interest: Processing for our legitimate business interests (fraud prevention, platform improvement) that don't override your rights
- Consent: Processing based on your explicit consent (marketing emails, push notifications, analytics cookies)
In Plain LanguageWe only use your data when we have a good reason: it's needed for your order, required by law, needed for our legitimate business (like stopping fraud), or you specifically said yes (like for marketing).
Section 5
How We Share Your Information
5.1 With Platform Participants
- Vendors receive buyer name, phone number, delivery address, and order details necessary to fulfill orders
- Service Providers receive client name, phone number, and service location for booking fulfillment
- Delivery Partners receive recipient name, phone number, delivery address, and recipient verification code
- Payment processors (Selcom, M-Pesa, Stripe) for transaction processing
- Cloud hosting providers (Render, Vercel) for infrastructure
- Cloudinary for image storage and optimization
- Mapbox for mapping and location services
- Brevo for email communication services
In Plain LanguageWe share your info only when needed: the vendor needs your address to deliver your order, payment companies need your details to process payment, and our hosting providers keep the site running. We never sell your data to anyone. If the government legally requires us to share information, we have to comply.
Section 6
Data Security
We implement industry-standard security measures to protect your personal data, including:
However, no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security but we are committed to doing our best to protect your information with industry-standard security measures.
- SSL/TLS encryption for all data in transit
- Encrypted storage for sensitive personal data
- Role-based access controls for admin and vendor dashboards
- Regular security audits and vulnerability assessments
- Secure session management with automatic timeout
However, no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security but we are committed to doing our best to protect your information with industry-standard security measures.
In Plain LanguageWe use encryption (the same technology banks use) to protect your data. Only authorized people can access it. But no system is 100% hack-proof — we do our best, but can't promise perfection.
Section 7
Data Retention
We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:
- Account data: Retained until you request account deletion
- Order records: Retained for 7 years as required by Tanzanian tax and commercial law
- Payment records: Retained for 7 years for financial compliance
- Vendor verification data: Retained for the duration of the vendor relationship plus 3 years
- Analytics data: Anonymized and retained indefinitely
- Support tickets: Retained for 2 years after resolution
In Plain LanguageWe keep your data for as long as you have an account. Some records (like orders and payments) we keep for 7 years because the law requires it. If you delete your account, we remove your personal info, but some records may be kept for legal reasons.
Section 8
Your Rights
Under the Personal Data Protection Act No. 11 of 2022, you have the right to:
To exercise these rights, contact us at support@sokopluss.co.tz. We will respond within 30 days.
- Access: Request a copy of all personal data we hold about you
- Correction: Request correction of inaccurate or incomplete personal data
- Deletion: Request deletion of your account and associated personal data (subject to legal retention requirements)
- Opt-out: Unsubscribe from marketing communications at any time
- Withdraw consent: Withdraw consent for data processing where consent is the legal basis
- Data portability: Request your data in a portable, machine-readable format
- Object to processing: Object to processing based on legitimate interests
- Lodge a complaint: File a complaint with the Personal Data Protection Commission (PDPC) if you believe your rights have been violated
To exercise these rights, contact us at support@sokopluss.co.tz. We will respond within 30 days.
In Plain LanguageYou have the right to: see what data we have about you, fix mistakes, delete your account, stop getting marketing emails, take your data somewhere else, and complain to the government if we mess up. Email us and we'll handle it within 30 days.
Section 9
Cookies and Tracking Technologies
We use cookies and similar technologies to maintain your session, remember your preferences, and analyze usage. For full details, see our Cookie Policy.
Types of cookies we use:
You can manage cookies through your browser settings. Blocking essential cookies may affect Platform functionality.
Types of cookies we use:
- Essential cookies: Required for login, cart, and security
- Functional cookies: Remember your language and preferences
- Analytics cookies: Help us understand how the Platform is used
- PWA cookies: Enable offline access and push notifications
You can manage cookies through your browser settings. Blocking essential cookies may affect Platform functionality.
In Plain LanguageWe use cookies to keep you logged in, remember your language, and understand how people use the site. You can control cookies in your browser, but blocking the essential ones will break the site. See our full Cookie Policy for details.
Section 10
Children's Privacy
SokoPlus is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will take steps to delete such information promptly. Users under 18 must use the Platform under the supervision of a parent or legal guardian.
In Plain LanguageSokoPlus is for adults (18+). If we find out a child under 18 signed up, we'll delete their data. Kids under 18 need a parent's permission and supervision.
Section 11
Third-Party Links and Services
The Platform may contain links to third-party websites, payment gateways, or services (e.g., WhatsApp for vendor communication, Mapbox for location services). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before sharing personal data.
In Plain LanguageIf you click a link to another site (like WhatsApp or a payment page), their privacy rules apply, not ours. Check their policies before sharing personal info.
Section 12
Cross-Border Data Transfers
Your data may be processed in countries outside Tanzania where our hosting providers operate (e.g., Vercel in the United States, Render in the United States). We ensure that such transfers comply with applicable Tanzanian data protection laws and that adequate safeguards are in place.
In Plain LanguageSome of our servers are in the US (where Vercel and Render operate). When your data goes there, we make sure it's still protected according to Tanzanian law.
Section 13
Data Breach Notification
In the event of a data breach that affects your personal information, we will:
- Notify the Personal Data Protection Commission (PDPC) within 72 hours of becoming aware of the breach
- Notify affected individuals without undue delay if the breach poses a high risk to their rights and freedoms
- Document the breach, its effects, and the remedial actions taken
- Take immediate steps to contain and remediate the breach
In Plain LanguageIf someone hacks our systems and gets your data, we'll tell the government within 3 days and notify you as soon as possible. We'll also document everything and fix the problem.
Section 14
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through:
Your continued use of the Platform after changes are posted constitutes acceptance of the updated Privacy Policy.
- In-app notification upon your next login
- Email notification to registered users
- Prominent notice on our website
Your continued use of the Platform after changes are posted constitutes acceptance of the updated Privacy Policy.
In Plain LanguageIf we change how we handle your data, we'll tell you through the app, email, and website. Keep using SokoPlus after the changes and you agree to the new policy.
Section 15
Contact Us
For questions, concerns, or requests regarding this Privacy Policy or your personal data:
POX Technologies Ltd
Data Protection Officer
Email: support@sokopluss.co.tz
Phone: +255 760 706 872
Website: sokopluss.co.tz
Location: Tanzania
You may also file a complaint with the Personal Data Protection Commission (PDPC) of Tanzania.