Privacy Policy

Your privacy matters. Here is how we handle your data.

Last updated: March 2026

1. Introduction

MALIPOPAY, a product of Lockwood Technology Ltd ("we", "us", or "our"), is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, store, and protect your data when you use our payment aggregation platform at malipopay.co.tz, the merchant dashboard at app.malipopay.co.tz, our API, and any related services (collectively, the "Platform").

We operate under the laws of the United Republic of Tanzania, including applicable data protection regulations and the guidelines set forth by the Bank of Tanzania. By using our Platform, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Personal Information

When you register for an account or use our Services, we may collect the following personal information:

  • Full legal name and contact details (email address, phone number, physical address).
  • National identification details (National ID, passport, or driving license number) for KYC verification.
  • Business registration information, including company name, TIN, business license number, and registration certificates.
  • Bank account details and mobile money wallet information for settlement purposes.
  • Photographs or scans of identification documents as required for identity verification.

2.2 Transaction Data

We collect information about every transaction processed through our Platform, including:

  • Transaction amounts, dates, times, and reference numbers.
  • Payment channel used (mobile money, bank, card, USSD).
  • Payer details (name, phone number, or card details as applicable).
  • Merchant account and settlement information.
  • Transaction status (successful, failed, pending, reversed).
  • Associated metadata such as invoice numbers, payment link identifiers, and callback responses.

2.3 Device and Technical Data

When you access our Platform, we automatically collect certain technical information, including:

  • IP address and approximate geolocation.
  • Browser type, version, operating system, and device identifiers.
  • Pages visited, time spent on pages, and navigation patterns within the Platform.
  • Referring website or application.
  • API request logs, including endpoints called and response codes.

2.4 Communication Data

We retain records of your communications with us, including support tickets, emails, chat messages, and phone call records, to improve our services and resolve disputes.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • Service Delivery: To process payments, execute disbursements, generate invoices, and provide all features of the Platform.
  • Identity Verification: To conduct KYC and Customer Due Diligence (CDD) checks as required by law and our AML/CTF policy.
  • Fraud Prevention: To detect, prevent, and investigate fraudulent transactions, unauthorized access, and other illegal activities.
  • Regulatory Compliance: To comply with applicable laws, regulations, and directives from the Bank of Tanzania, TRA, Financial Intelligence Unit (FIU), and other authorities.
  • Platform Improvement: To analyze usage patterns, diagnose technical issues, and improve the performance, security, and functionality of our Platform.
  • Communication: To send transaction notifications, service updates, security alerts, and administrative messages.
  • Marketing: With your consent, to send promotional communications about new features, products, or services. You may opt out of marketing communications at any time.
  • Dispute Resolution: To investigate and resolve chargebacks, refund requests, and transaction disputes.

4. Data Sharing and Disclosure

We do not sell your personal information to third parties. We may share your data with the following categories of recipients, only to the extent necessary for the stated purposes:

  • Mobile Network Operators (MNOs): Vodacom (M-Pesa), Yas (Mixx), Airtel, Halotel, and TTCL for processing mobile money transactions.
  • Banks and Financial Institutions: CRDB Bank, NMB Bank, and acquiring banks for processing bank and card payments and settlements.
  • Card Networks: Visa, Mastercard, UnionPay, and American Express for card transaction processing and authorization.
  • Regulatory Authorities: Bank of Tanzania (BoT), Tanzania Revenue Authority (TRA), Financial Intelligence Unit (FIU), and other government agencies as required by law.
  • Service Providers: Third-party service providers who assist us with hosting, analytics, customer support, fraud detection, and other operational functions, bound by confidentiality agreements.
  • Legal Requirements: When required by law, court order, subpoena, or government regulation, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Data Security

We implement robust technical and organizational measures to protect your personal and transactional data, including:

  • Encryption of data in transit using TLS 1.2 or higher and encryption of sensitive data at rest using AES-256 standards.
  • Secure API authentication using API keys, secret keys, and webhook signature verification.
  • Regular security audits, vulnerability assessments, and penetration testing of our infrastructure.
  • Role-based access controls ensuring that only authorized personnel can access sensitive data.
  • Network segmentation, firewalls, and intrusion detection systems to protect our infrastructure.
  • Compliance with PCI DSS requirements for handling card payment data.

While we take every reasonable precaution to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents.

6. Data Retention

We retain your personal and transactional data for as long as necessary to fulfill the purposes outlined in this policy and to comply with legal, regulatory, and contractual obligations. Specifically:

  • Account Data: Retained for the duration of your account and for seven (7) years after account closure, as required by Tanzanian anti-money laundering regulations.
  • Transaction Records: Retained for a minimum of seven (7) years from the date of the transaction, in accordance with Bank of Tanzania requirements and the Tanzania Anti-Money Laundering Act.
  • KYC Documents: Retained for at least five (5) years after the termination of the business relationship.
  • Technical Logs: Retained for up to twelve (12) months for operational and security purposes.

When data is no longer required, it is securely deleted or anonymized in accordance with industry best practices.

7. Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

  • Right of Access: You may request a copy of the personal data we hold about you.
  • Right to Rectification: You may request correction of inaccurate or incomplete personal data.
  • Right to Erasure: You may request deletion of your personal data, subject to our legal retention obligations.
  • Right to Restriction: You may request that we restrict processing of your data in certain circumstances.
  • Right to Data Portability: You may request your data in a structured, commonly used, and machine-readable format.
  • Right to Object: You may object to the processing of your personal data for direct marketing purposes.
  • Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our Data Protection Officer using the contact information provided below. We will respond to your request within thirty (30) days.

8. Cookies and Tracking Technologies

Our Platform uses cookies and similar tracking technologies to enhance your experience. The types of cookies we use include:

  • Strictly Necessary Cookies: Essential for the Platform to function, including authentication, security, and session management. These cannot be disabled.
  • Analytical Cookies: Help us understand how users interact with the Platform, enabling us to improve functionality and performance.
  • Functional Cookies: Remember your preferences and settings to provide a personalized experience.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Platform.

9. Children's Privacy

The MALIPOPAY Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child under 18, we will take immediate steps to delete such information from our records.

10. International Data Transfers

Your data may be transferred to and processed in countries outside the United Republic of Tanzania for the purposes of card payment processing, cloud hosting, and fraud prevention services. When such transfers occur, we ensure that appropriate safeguards are in place, including contractual data protection clauses and compliance with applicable data transfer regulations.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on our website with a revised "Last updated" date and, where appropriate, by sending you a notification through the Platform or via email.

Your continued use of the Platform after any changes to this Privacy Policy constitutes your acceptance of the updated terms.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact our Data Protection Officer:

  • Data Protection Officer
  • Email: privacy@malipopay.co.tz
  • General Inquiries: support@malipopay.co.tz
  • Phone: +255 687 128 012
  • Website: malipopay.co.tz
  • Address: Lockwood Technology Ltd, Dar es Salaam, Tanzania