Skip to main content
Free delivery on orders over TZS 200,000 · Same-day Bolt delivery in Dar
BasicsbyCK
← Back to Moja

Privacy Policy

Last updated: April 2026 · Reli Technology Limited

1. Who We Are

Moja Commerce is operated by Reli Technology Limited, incorporated in Tanzania. We are the data controller for personal data processed through the Moja platform.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under the Tanzania Personal Data Protection Act (2022).

2. Data We Collect

From merchants (business owners)

  • Name, phone number, email address
  • Business name, registration details, trading address
  • Identity documents (NIDA card, selfie, business licence) — for KYC/AML purposes only
  • TIN number (optional)
  • Banking and mobile money account details
  • Transaction and financial data generated through the platform
  • Device identifiers and usage logs

From customers placing orders

  • Name, phone number (required for mobile money payments)
  • Delivery address (when applicable)
  • Order history

3. How We Use Your Data

  • Service delivery: to operate merchant accounts, process orders, and facilitate payments.
  • KYC/AML compliance: to verify merchant identity as required under the Tanzania Electronic Money Regulations (2015) and AML Act (2006/2012/2019). Identity documents are reviewed by authorised personnel only.
  • Financial reporting: to generate transaction records, receipts, and reports accessible to the merchant.
  • Customer communications: to send OTP codes, payment confirmations, and service notices via SMS.
  • Platform improvement: aggregated and anonymised analytics to improve features and performance.
  • Legal obligations: to respond to lawful requests from the Bank of Tanzania, Financial Intelligence Unit (FIU), or other competent authorities.

4. Legal Basis for Processing

  • Contract performance — processing necessary to provide the services you requested.
  • Legal obligation — KYC/AML data, financial records, and audit trails required by Tanzanian law.
  • Legitimate interests — fraud prevention, platform security, and product improvement.
  • Consent — where explicitly obtained (e.g., marketing communications). You may withdraw consent at any time.

5. Data Sharing

We share personal data only with:

  • Payment processors and mobile network operators — to execute transactions (e.g., Vodacom, Airtel, CRDB, NMIB).
  • Cloud infrastructure providers — for secure data storage (AWS, within or outside Tanzania with appropriate safeguards).
  • Regulatory authorities — as required by law (BoT, FIU, TRA).
  • Delivery partners (e.g., Bolt) — only the information necessary to complete a delivery.

We do not sell your personal data to third parties for marketing purposes.

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described above:

  • KYC identity documents: minimum 10 years as required by the AML Act.
  • Transaction records: minimum 7 years for tax compliance.
  • Account data: duration of account plus 2 years after closure.

Note: AML Act retention obligations take precedence over erasure requests for regulated categories of data.

7. Your Rights

Under the Tanzania Personal Data Protection Act (2022), you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Request erasure (subject to legal retention obligations).
  • Object to processing based on legitimate interests.
  • Withdraw consent where processing is consent-based.
  • Lodge a complaint with the Personal Data Protection Commission of Tanzania.

To exercise your rights, contact: privacy@usereli.tech. We will respond within 30 days.

8. Security

We implement technical and organisational security measures including encryption in transit (TLS 1.2+), encryption at rest for sensitive fields, access controls, and regular security reviews. Identity documents are stored in a restricted-access object store and are only accessible to authorised compliance personnel.

9. Cookies & Analytics

Our web storefront uses minimal first-party cookies for session management. We use PostHog for product analytics (self-hosted or EU region). No third-party advertising cookies are used.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via the app or email at least 14 days before they take effect. Continued use of Moja after that date constitutes acceptance of the revised policy.

11. Contact

Data Protection Contact: privacy@usereli.tech

Reli Technology Limited · Dar es Salaam, Tanzania

Terms of ServiceMoja Commerce