Privacy Policy

Overview

SANDC Technology ("we", "us", "our") operates the Naina platform. This Privacy Policy describes how we collect, use, store, and protect personal information when you use our Service, and the choices you have regarding that information.

This policy applies to all users of the platform — including organization administrators, managers, accountants, and tenants registered within your organization. By using the Service, you consent to the practices described in this policy.

Information We Collect

We collect information in three ways: information you provide directly, information generated by your use of the Service, and information received from third-party integrations.

How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery: To provide, operate, and maintain all platform features including lease management, invoicing, SMS alerts, and payment processing.
• Account management: To authenticate users, manage sessions, and enforce role-based access permissions.
• Billing & subscriptions: To process payments, generate invoices, track subscription status, and send payment confirmations.
• Communications: To send SMS reminders, system notifications, and important service updates to you and your tenants.
• Security & fraud prevention: To detect suspicious activity, enforce login limits, and protect against unauthorized access.
• Analytics & improvement: To understand usage patterns and improve platform features (aggregate, anonymized data only).
• Legal compliance: To comply with applicable Tanzanian laws, respond to lawful requests from authorities, and resolve disputes.

We will never use your data for purposes incompatible with those listed above without first obtaining your explicit consent.

Data Sharing & Disclosure

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• Payment processors: Transaction data is shared with Selcom/SafariBank and mobile money providers (M-Pesa, Tigo Pesa, Airtel Money, Halopesa, EzyPesa) strictly to process payments.
• SMS providers: Phone numbers and message content are shared with Beem Africa solely to deliver SMS notifications you or your organization initiate.
• Cloud infrastructure: Files are stored on Amazon Web Services (AWS S3). AWS processes data on our behalf under a Data Processing Agreement.
• Accounting integration: Financial data is shared with the Fedha accounting engine to generate ledgers, journals, and reports within your organization.
• Legal requirements: We may disclose information if required by law, court order, or governmental authority in Tanzania.
• Business transfer: If SANDC Technology is acquired or merged, your data may be transferred as part of that transaction, with advance notice given to users.

All third-party service providers we use are contractually bound to process your data only as instructed and to maintain appropriate security standards.

Data Storage & Security

We take the security of your data seriously. The measures we have in place include:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Encryption at rest: Uploaded files stored on AWS S3 are encrypted at rest using AES-256.
• Password hashing: Passwords are never stored in plain text. We use a multi-round hashing process before storage.
• Access controls: Role-based permissions ensure users can only access data relevant to their role within their organization.
• Session security: Sessions expire after a configurable inactivity period. Login attempts are rate-limited to prevent brute-force attacks.
• Audit logging: All significant actions — logins, data changes, payment events — are logged with timestamps and user identifiers.
• Regular backups: Database backups are performed on a regular schedule to prevent data loss.

Despite these measures, no system is completely immune to security risks. We encourage you to use a strong, unique password and report any security concerns to info@sandc.co.tz immediately.

Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Active accounts: Data is retained for the lifetime of your account plus 90 days after closure.
• Financial records: Transaction records, invoices, and payment history are retained for 7 years to comply with Tanzanian financial regulations.
• Uploaded files: Documents stored on AWS S3 are retained until you or your organization deletes them, or for 90 days after account termination.
• Audit logs: System audit logs are retained for 12 months for security and compliance purposes.
• Anonymized analytics: Aggregated, anonymized usage statistics may be retained indefinitely for platform improvement purposes.

After the applicable retention period, data is permanently deleted from our systems and backups.

Your Rights

You have the following rights with respect to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate or incomplete data about you.
• Deletion: Request deletion of your account and associated personal data, subject to legal retention requirements.
• Data portability: Request an export of your data in a machine-readable format (CSV/JSON).
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to our processing of your data for analytics or marketing purposes.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at info@sandc.co.tz or info@naina.africa. We will respond within 30 days.

Cookies & Tracking

We use session cookies to maintain your login state and remember your preferences. These cookies are:

• Session cookies: Temporary cookies deleted when you close your browser. Used to keep you logged in during a session.
• Preference cookies: Store UI settings such as language and notification preferences.
• Security cookies: Used to detect suspicious activity and enforce session timeouts.

We do not use third-party advertising cookies or cross-site tracking technologies. You can configure your browser to block or delete cookies, though this may affect some platform functionality.

Third-Party Services

The platform integrates with the following third-party services. Each has its own privacy policy governing their data practices:

• Amazon Web Services (AWS S3): File storage. AWS Privacy Policy
• Beem Africa: SMS delivery. Contact Beem Africa for their data policy.
• Selcom / SafariBank: Payment processing. Contact Selcom for their data policy.
• Google Fonts: Typography (loaded from Google's CDN). Google Privacy Policy

We are not responsible for the privacy practices of third-party services. We recommend reviewing their policies before using the platform.

Children's Privacy

The Naina platform is intended for use by adults (18+) and businesses. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date and notify registered users via the platform or email at least 14 days before the changes take effect.

Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes.

Contact & Data Protection

For privacy-related inquiries, data access requests, or concerns about how we handle your information, please contact us: