This policy explains how Aivexstore LTD handles personal data when you browse our website, contact us, maintain an account, place or receive an order, or otherwise interact with our services.
1. Scope and controller identity
Aivexstore LTD is responsible for deciding why and how personal data described in this policy is processed for its website and retail operations. This policy should be read with any transaction-specific notice presented when data is collected.
We aim to process personal data in accordance with the Personal Data Protection Act, 2022 (Cap. 44), applicable regulations, and other applicable Tanzanian law. This statement does not represent that Aivexstore holds a particular registration, certification, or regulatory approval.
2. Categories of data we collect
Depending on how you use the service, we may collect:
- Identity and contact data: name, email address, telephone number, and account identifier.
- Order and delivery data: products or services requested, quantity, delivery or collection details, notes, transaction reference, and order history.
- Payment-related data: payment method, amount, reference, and payment status. We do not intend to collect full card credentials, mobile-money PINs, or one-time passwords unless a clearly disclosed, lawful process actually requires and protects such information.
- Account and staff security data: username, password hash, role or permission information, sign-in events, security logs, and records needed to prevent misuse.
- Device and usage data: IP address, browser and device information, pages or features used, timestamps, approximate technical location, and diagnostic records.
- Communications: enquiries, feedback, support requests, complaint details, and our responses.
Please avoid placing unnecessary sensitive personal data in free-text order notes or messages.
3. How we collect data
We collect data directly from you when you complete a form, place an order, contact us, or use an account; automatically when your device uses the website; from staff who administer transactions; and from operational providers where necessary to confirm payments, delivery, communications, security events, or service status.
We may also receive information from a person ordering for you, an authorised representative, or public or lawful sources where appropriate. A person providing another individual's data should have authority or another lawful basis to do so.
4. Purposes and lawful processing
We process personal data only where we have an appropriate legal basis under applicable law. Depending on the context, purposes and bases may include:
- taking steps at your request, confirming, fulfilling, delivering, and supporting a contract;
- processing or reconciling payments and preventing duplicate or fraudulent transactions;
- providing accounts, customer service, notices, and responses to enquiries;
- protecting customers, staff, the website, and systems through authentication, access controls, logs, and fraud prevention;
- meeting legal, tax, accounting, consumer protection, data protection, law-enforcement, or dispute-resolution obligations;
- improving services and understanding aggregate usage where our legitimate interests are not overridden by your rights; and
- sending optional communications or using non-essential technologies where valid consent is required, with a way to withdraw it.
Where we rely on consent, withdrawal does not affect processing already lawfully completed. Where information is required to fulfil an order or legal obligation, refusing it may prevent us from completing the relevant service.
5. Cookies and local storage
The website may use cookies or similar browser storage for essential functions such as sessions, language, security, cart or order state, and remembered preferences. Where used, optional analytics or similar technologies should be activated only in accordance with applicable consent requirements.
You can manage browser storage through your browser settings. Blocking essential storage may prevent account, ordering, security, or preference features from working correctly.
6. When we disclose data
We do not disclose personal data simply because it is commercially useful to another party. We may disclose only what is reasonably necessary to:
- service providers supporting hosting, information technology, communications, payments, fraud prevention, delivery, customer support, or professional advice;
- staff and authorised personnel who need the information for their duties;
- auditors, insurers, advisers, courts, law-enforcement bodies, regulators, or public authorities where disclosure is lawful or required; and
- a successor or transaction party during a genuine business reorganisation, subject to appropriate confidentiality and legal safeguards.
Providers acting for us should process data only for authorised purposes and apply appropriate safeguards. Independent providers may also process data under their own privacy notices and legal responsibilities.
7. Cross-border transfers
Some operational technology or service providers may process data outside Tanzania. Where a cross-border transfer occurs, we will use it only where permitted and apply safeguards, approvals, contractual protections, or other measures required under the Personal Data Protection Act and applicable regulations. A transfer will be limited to what is necessary for the relevant purpose.
8. Security
We use reasonable technical and organisational safeguards appropriate to the nature and risk of the data. These may include access controls, authentication, password hashing, secure transmission where supported, system updates, logging, backups, staff confidentiality, and incident response measures.
No internet or storage system is completely secure. You should use a unique password, protect your device and credentials, and contact us promptly if you suspect an account or data security incident.
9. How long we retain data
We keep personal data only for as long as reasonably needed for the purpose collected and applicable legal, tax, accounting, warranty, fraud-prevention, security, audit, or dispute requirements. Retention depends on the type of record and transaction; we do not state a single fixed period for all data.
When data is no longer required, we will take reasonable steps to delete, destroy, anonymise, or securely archive it as applicable. Backup copies may remain for a limited cycle and stay protected until overwritten or removed.
10. Your data protection rights
Subject to the Personal Data Protection Act, 2022 (Cap. 44), applicable regulations, lawful exceptions, and the circumstances, you may have rights to:
- be informed about processing and request access to your personal data;
- request correction of inaccurate or incomplete data;
- request erasure or destruction where the legal conditions are met;
- object to or request restriction of certain processing;
- request data portability where applicable;
- withdraw consent where processing relies on consent;
- raise concerns about direct marketing or qualifying automated decision-making; and
- complain and seek a remedy available under law.
To protect you and others, we may ask for information reasonably necessary to verify identity and authority before acting on a request. We may retain a record of the request and may decline or limit it where the law permits or requires, explaining the basis where appropriate.
11. Children
Our general retail website is not designed to solicit personal data directly from children who cannot lawfully consent or contract on their own. A parent, guardian, or other authorised adult should place an order for a child. If you believe a child's data was submitted improperly, contact us so we can assess and take appropriate steps.
12. Third-party links
The website may link to independent websites or services. Their privacy practices are controlled by their operators, not by this policy. Review their notices before providing personal data. This does not remove Aivexstore's responsibilities for providers processing data on its behalf.
13. Changes to this policy
We may update this policy when our practices, services, or legal obligations change. We will publish the revised version with its updated date and provide additional notice where the nature of a change or applicable law requires it.
14. Contact and complaints
To ask a privacy question or exercise a right, contact:
Aivexstore LTD
info@aivexstore.com
If you believe your concern has not been resolved, you may complain to Tanzania's Personal Data Protection Commission (PDPC) using the current contact or complaint process published on its official website.
Implementation note: This privacy policy is a practical operational draft and should be reviewed by qualified Tanzanian counsel before production adoption.