Compliance Framework
Security Mandate
By interacting with this digital architecture, transmitting correspondence, or entering marketplace nodes, you formally acknowledge and consent to the data archival tracking pipelines explicitly defined within this statutory text.
1. Statement of Principle & Statutory Scope
The Shimulimuli Heritage Foundation (hereinafter "the Foundation" or "SHF") acts as a dedicated data collector and controller. It operates in strict alignment with the Personal Data Protection Act, No. 11 of 2022 of the United Republic of Tanzania.
This data protection policy governs the methods by which the Foundation logs, structures, isolates, processes, and protects personal identifiers, system telemetry, and metadata gathered from its digital portals, inquiry modules, and transactional frameworks. This policy serves to minimize exposure risks and prevent unlawful data manipulation under the Cybercrimes Act, 2015.
2. Categories of Information Subject to Collection
The Foundation restricts data collection strictly to information necessary for execution, regulatory metrics, and archival security. The parameters collected fall under the following structural classes:
- Identity Metrics & Contact Parameters: Complete legal names, authenticated email structures, telephone channels, and formal organizational designations provided via administrative inquiry modules.
- Transactional Log Records: Payment logs, ledger references, and billing profiles generated via interaction with the SHF Heritage Shop electronic gateways. For security, raw banking or credit card vectors are handled entirely by secure third-party electronic payment systems and are never stored on our local server arrays.
- System Metadata & Telemetry Logs: Internet Protocol (IP) pathways, network nodes, browser configurations, active session records, and localized tracking analytics compiled automatically to optimize interface presentation and monitor for unauthorized network intrusions.
3. Methods & Legal Bases for Data Processing
Under Section 22 of the Personal Data Protection Act, 2022, the Foundation establishes that processing is executed under the following clear legal baselines:
Data gathered is used exclusively to evaluate and respond to partnership inquiries, fulfill transactional processing inside the marketplace modules, log regional research clearance authorizations, and maintain system stability. The Foundation does not trade, rent, lease, or commercially exploit individual identity parameters to external advertising brokers or data mining syndicates.
4. Absolute Security Control Systems
The Foundation implements technical and administrative defense mechanisms designed to insulate databases against unauthorized deletion, data corruption, illegal access, or alteration.
Data protection controls include end-to-end cryptographic processing layers, firewall systems, and strictly managed, role-based internal access permissions. Access to identity logs is limited entirely to authorized technical personnel and executive officers of the Board who are bound by non-disclosure conditions.
However, transmission of data across open network channels contains inherent architectural risks. Users submit information to our portal structures at their own risk. The Foundation, its Board, its CTO, and its administration shall not be held liable for third-party network interceptions or zero-day security compromises that occur outside the reasonable scope of our infrastructure.
5. Mandatory Disclosures to Regulatory Authorities
The Foundation maintains complete transparency with national state agencies in the United Republic of Tanzania. SHF reserves the right to disclose individual tracking parameters, log footprints, and personal data profiles to relevant state authorities without prior user notification if required to do so under the following statutory contexts:
- To comply with a valid warrant, court order, or official decree issued by a competent Tanzanian court of law.
- To support investigations regarding systemic cyber intrusions or malicious exploitation of our platforms under the Cybercrimes Act, 2015.
- To protect, establish, or enforce the statutory safety, property, and constitutional rights of the Shimulimuli Heritage Foundation, its founders, and its field teams during legal or civil disputes.
6. Retention Schedules & Archival Isolation
The Foundation stores individual contact metrics and system transaction logs only for the timeline required to satisfy administrative processing, resolve legal inquiries, or fulfill reporting rules mandated by the Registrar of Non-Governmental Organizations.
When data parameters pass beyond active utility, they undergo secure destruction, deletion, or absolute anonymization so they can no longer link to an identifiable individual. Cultural research artifacts and historical metadata portfolios remain stored within the Foundation's institutional archive indefinitely.
7. Data Subject Rights & Statutory Contact Channels
Pursuant to Part V of the Personal Data Protection Act, 2022, users hold distinct legal rights regarding their information profile, including the right to request access to their stored parameters, request structural corrections to inaccurate records, or object to specific processing channels.
To execute any statutory data rights or file technical inquiries regarding data handling, formal requests must be directed to the office of the Chief Technology Officer via the official communication lines:
Primary Email Support: info@shf.co.tz
Corporate Mailing: P.O. Box 42431, Dar es Salaam, Tanzania
Last Audited by Data Controller Board: June 2026