Privacy policy

Who we are

KaziLaw is software for Tanzanian employment law, at kazilaw.com. We are registered with the Personal Data Protection Commission as both a data controller and a data processor. For anything in this policy, write to support@kazilaw.com.

When an employer uses KaziLaw to keep records about its staff, the employer decides what goes into those records and why, and KaziLaw holds them for the employer. When you buy from us, sign in, or visit the site, we decide what is kept, and this policy says what that is.

If you are a worker asking about your own job

On /rights you do not open an account, and your question is not stored — not with your answer, not in our activity log. It is sent to the services that find and explain the law (listed below) to produce your answer, and we do not keep it.

If you pay for questions, the payment provider needs your mobile number, and for a card also the name on the card and an email address. We pass those to the provider to take the payment and do not write them to our own database. You receive a code; we store only a scrambled version of it, not linked to who paid. A lost code cannot be looked up — but if a payment went through and you did not get your code, email support@kazilaw.com with the transaction number from your payment message and we will reissue it.

What we hold for employers

• Your organisation: its name, its sites, and the file references you choose.
• The people who use KaziLaw — managers, HR staff and directors: a work email address to sign in, their role and site, a record of who did what and when, and the country and outcome of each sign-in (never the city or the IP address).
• Staff records: the written particulars the Employment and Labour Relations Act, s.16(1), requires an employer to keep — name, date of birth, sex, permanent address, place of recruitment, job description, start date, form and length of contract, place and hours of work, and pay and benefits. An identity document number is optional and held only if you enter one.
• Cases: who the case is about, the process followed, the steps and dates, and the words — the allegation, the employee’s reply, the findings, the outcome and the reasons. Ill-health cases record fitness for work as certified, never a diagnosis.
• Documents and attachments: each document’s contents with a fingerprint and the time it was sealed, and any file you attach.
• Questions asked in the professional tool: the question as typed, with its answer.

When you buy, enquire or visit

• Payments: the amount, currency and order reference, and which campaign brought you (below). Your mobile number and card details stay with the payment provider.
• Enquiry forms: whatever you give us — a name, an email address, a phone or WhatsApp number, a note about your organisation — so that we can reply.
• Campaign details: if you arrive from an advertisement or a tagged link, your browser keeps the campaign name and any click identifier from Meta, LinkedIn or Google for 90 days, in a cookie and in local storage. If you then sign in or buy, we save them with your account or order so we can tell which campaigns work.
• Analytics and advertising tags: every page loads Vercel Web Analytics and Speed Insights, which count visits and measure how fast pages load, and the Meta Pixel and LinkedIn Insight Tag, which tell Meta and LinkedIn that a browser visited and whether it signed up or paid, so we can measure and target our advertising. Meta and LinkedIn set their own cookies and handle what they receive under their own privacy policies. These tags see the pages you visit; they do not receive the questions you ask. You can block them with your browser’s privacy settings or an ad blocker, and manage advertising in your Meta and LinkedIn settings.

Who can see an employer’s records

Inside an organisation, a site manager sees only the staff and cases at their own site; HR and directors see the whole organisation, and a director can read but not change. Outside it, we do not sell personal data and do not share it with anyone except the services that run KaziLaw, listed below, or where the law requires us to.

The services we use, and where your data is

Our data is not held in Tanzania. Neither our hosting provider nor our database provider offers an African region, and these transfers are declared to the Commission.

• Vercel — hosts the application, and runs Web Analytics and Speed Insights. United States.
• Supabase — the database and sign-in. Ireland.
• Anthropic, Voyage AI and Laws.Africa — find the provision that governs a question and write the answer. United States.
• Resend — sends our email. United States.
• ClickPesa and Vodacom M-Pesa — take payment. Tanzania.
• Meta and LinkedIn — advertising measurement, as described above.

How long we keep it

Employer records are kept for at least five years after a case closes or an employment ends — the period in s.16(5) of the Act — and nothing is deleted because a date arrives. About ninety days before five years are up, we contact the organisation and ask what it wants done. Keeping the record is the default. If the organisation asks us to delete a file, we remove the person’s details from it, keep the dates, the steps and the document fingerprints, and record the instruction in the file.

If a subscription ends, nothing is deleted. The records wait for renewal, and the organisation can still download all of them, because the law obliges an employer to keep them.

Enquiries are kept until we have dealt with them and while the conversation is useful. Campaign details are forgotten by your browser after 90 days.

Keeping it safe

Data travels encrypted, and our providers encrypt what they store. Access inside an organisation follows the roles above, and asking for a record at another site answers “not found” rather than “not allowed”. Each finished document is fingerprinted, so any change to it can be detected. Because these records are sensitive, if we learn of a breach that affects you we will tell you and the Commission as the law requires.

Your rights

Under the Personal Data Protection Act you can ask to see the personal data we hold about you, have it corrected, object to how it is used, or have it deleted where the law allows. Write to support@kazilaw.com.

If your employer keeps your records in KaziLaw, your employer decides what they hold, and the law may require them to keep it. You can ask your employer directly, or write to us and we will pass your request to them. If you are not satisfied with how a request was handled, you can complain to the Personal Data Protection Commission.

KaziLaw is not intended for anyone under eighteen.

Changes

When what we do with personal data changes, this page changes with it and the date at the top moves. A change that affects records we already hold for an organisation is told to that organisation directly.