1Who we are
Nexa Digital is the technology arm of Giselle Brands EA Ltd, based in Dar es Salaam, Tanzania. For the personal data described in this policy, we are the data controller.
You can contact us about anything in this policy by email.
2What this policy covers
This policy covers personal data we handle when you visit this website, contact us, apply for a job or become a client.
It does not cover the websites, apps or systems we build for clients. Each client publishes its own privacy policy for those. Section 7 explains our role in them.
3What we collect
- When you contact us: your name, email address, phone or WhatsApp number, company name and the details of your project.
- When you apply for a job: your contact details, the role you want, your experience, links to your work, your CV and your message.
- When you work with us: the names, job titles and contact details of the people we deal with, and billing information.
- When you browse: your IP address, browser type, the pages requested and the time, recorded automatically in our web server logs.
We don't ask for sensitive personal data such as health, religion or political views. Please don't include it in messages or CVs.
4Cookies and browser storage
This site does not use advertising, analytics or tracking cookies. It saves your chosen theme and language in your browser's local storage, along with a job application draft until you send or clear it. This information stays on your device and is never sent to us.
Pages load fonts from Google Fonts, and the photos in our coffee shop demo load from Unsplash. Those services receive your IP address when the page loads, as with any website that uses them.
5How and why we use it
- To reply to your enquiry and prepare proposals, because you asked us to.
- To assess your job application, with the consent you give when you send the form.
- To deliver projects, send invoices and keep business records, as our contract with you and Tanzanian tax law require.
- To keep this site secure and working, which is in the legitimate interest of both us and our visitors.
We only send marketing messages if you have agreed to receive them, and you can stop them at any time.
7Data in systems we build for clients
When we build, host or maintain a website, app or system for a client, that client is the data controller for the personal data inside it, and we act as their data processor. We:
- process that data only on the client's documented instructions
- keep it confidential and limit access to the people working on the project
- protect it with appropriate technical and organisational measures
- tell the client without delay if we become aware of a data breach
- return or delete the data when our work ends, unless the law requires us to keep it
If you are a client's customer or employee and want to use your rights, contact that client first. We will help them respond.
8Transfers outside Tanzania
Some of our service providers, such as hosting, email or cloud storage, may store data outside Tanzania. When that happens, we transfer personal data only as the Personal Data Protection Act and its regulations allow, with appropriate safeguards in place.
9How long we keep it
- Enquiries that don't lead to a project: up to 24 months.
- Job applications: up to 12 months, so we can contact you about future roles. Ask us and we will delete yours sooner.
- Client and billing records: as long as Tanzanian tax and company law requires, usually five years.
- Web server logs: up to 90 days.
10How we protect it
We use encrypted connections (HTTPS), strong passwords, restricted access, regular software updates and backups. Job applications and CVs go straight to a restricted recruitment inbox and are not stored on our web server.
No system is completely secure, but we work to prevent unauthorised access, loss or misuse. If a breach happens, we will notify the Personal Data Protection Commission and the people affected where the law requires.
11Your rights
Under the Personal Data Protection Act, 2022, you have the right to:
- know what personal data we hold about you and how we use it
- get a copy of it
- have inaccurate or out-of-date data corrected
- ask us to delete it, in the cases the law allows
- object to, or ask us to restrict, how we use it
- withdraw your consent at any time, without affecting what we did before
- not be subject to decisions made only by automated means that significantly affect you
To use any of these rights, email us. We may ask you to confirm your identity, and we will respond within 30 days.
If you are not satisfied with our answer, you can complain to the Personal Data Protection Commission (PDPC).
12Children
This website and our services are meant for businesses and adults. We do not knowingly collect personal data from anyone under 18. Students applying for field attachment must be 18 or older.
13Changes to this policy
We may update this policy when our services or the law change. We will change the date at the top of this page and, for significant changes, tell our clients directly.
This page is available in English, Kiswahili, French and Chinese. If the versions differ, the English version applies.