Privacy Policy
Effective date: August 23, 2026
The short version
Privacy policies are long. Here is ours in plain language, with the full version below.
-
Your data belongs to you. We collect what we need to provide our services and comply with Tanzanian law. We do not sell your personal data to anyone, ever.
-
Application data stays with us. Employee information, organisation details, names, addresses, and licences you submit directly to Payleo are used only by Payleo Financial Service Limited and are never shared with or sold to third parties.
-
Cookies and in-app data are functional, not commercial. We share data with third-party services only to deliver what you asked for — sending you an SMS, authenticating your login, or emailing a notification. That is the extent of it.
-
Financial data is treated with the highest care. Credit-related information is shared only as required by the Bank of Tanzania and the Personal Data Protection Commission (PDPC). We may periodically share data with a registered credit bureau as required by regulation. All other financial data is stored on infrastructure owned by Payleo Financial Service Limited.
-
We name every subprocessor. The full table, what they do, and where they operate is in this policy.
-
We operate from known domains only. Our services are delivered exclusively from
*.payleo.tz,*.payleo.co, and*.payleo.link. If you receive communication claiming to be from Payleo on any other domain, it is not from us. -
We comply with Tanzanian law. This policy is built around the Personal Data Protection Act (Cap. 44) and its 2023 Regulations, and our internal controls are aligned with SOC 1 Type compliance standards.
-
Questions: privacy@payleo.tz. Real people, not a form.
Who we are
Payleo Financial Service Limited (“Payleo”, “we”, “us”, “our”) is a financial services company registered and operating in the United Republic of Tanzania. We are registered as a data controller and data processor with the Personal Data Protection Commission in accordance with Section 14 of the Personal Data Protection Act (Cap. 44) and the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023.
Who’s who: data controller vs. data processor
| Situation | Who decides what happens to the data | Our role |
|---|---|---|
| You submit an application, provide employee or organisation details, or use our financial services | Us | Data Controller. We determine the purpose and means of processing. |
| We process data on your instructions through our platform (e.g. payroll, payments to your employees or vendors) | You (or your organisation) | Data Processor. We process data on your behalf and under your instructions. |
| A third-party subprocessor handles data to deliver a service component (e.g. SMS delivery, authentication) | Us | Data Controller engaging a subprocessor under a data processing agreement. |
What we collect
Data you provide to us
-
Account and organisation data: business name, registration or incorporation details, business licences, TIN, physical and postal addresses, phone numbers, email addresses, and details of authorised representatives.
-
Employee and personnel data: names, identification numbers, contact details, job titles, and payroll information submitted by your organisation for the purpose of using our services.
-
Financial and credit data: bank account details, transaction records, credit application information, repayment history, and any supporting documents submitted in connection with credit products.
-
Support data: whatever you write to us, and the account context attached to that conversation.
Data we collect automatically
-
Technical data: IP address, browser type and version, device information, operating system, referring URL, pages viewed, and timestamps.
-
Usage data: which features you use and how often, tied to an internal identifier rather than your personal details.
-
Error and performance data: diagnostic information when something goes wrong, used solely for debugging and improving service reliability.
What we do not collect
-
We do not knowingly collect personal data from anyone under the age of 18 without the involvement of a parent or guardian, consistent with the protections for children’s data under the Act.
-
We do not build advertising profiles from your data.
-
We do not sell, rent, or trade personal data.
How we handle your application data
Directly submitted information
All information submitted directly to Payleo — including employee details, organisation names, addresses, business licences, and other registration information — is used exclusively by Payleo Financial Service Limited for the purpose of delivering our services. This data is not shared with, sold to, or made available to any third party.
Cookies and in-app data
We use cookies and similar technologies strictly for functional purposes:
- Authentication cookies keep you signed in and verify your identity across sessions.
- Session cookies maintain your state as you navigate our platform.
- Security cookies help detect and prevent fraud and unauthorised access.
We do not use third-party advertising or tracking cookies within our application. Where we use analytics tools (such as Google Analytics or PostHog), these are configured to gather aggregate usage insights to improve your experience and do not track you across other websites.
We may share limited data with third-party services solely to perform functions you have requested or that are necessary for service delivery — for example, sending an SMS via our messaging provider, delivering an email notification, or authenticating your login. These third parties are bound by data processing agreements and may only use the data for the specific purpose for which it was shared.
How we handle your financial data
Credit data
As a regulated financial services provider, we are required to handle credit-related data in accordance with the rules and directives of the Bank of Tanzania. This means:
-
We collect and process credit data (application details, repayment history, creditworthiness assessments) only as necessary to evaluate and manage credit products.
-
We may periodically share credit data with a registered credit bureau as required or permitted by Bank of Tanzania regulations. This sharing is limited to what is mandated by law and is conducted through secure channels.
-
We comply with the data retention periods prescribed by the Bank of Tanzania and the Personal Data Protection Commission (PDPC). Credit data is retained for the period required by applicable regulations and is securely deleted or anonymised once that period expires.
-
Where credit data constitutes sensitive personal data under the Act, it receives the additional protections required by the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023.
All other financial data
All financial data that is not subject to mandatory sharing with regulatory bodies — including bank account details, transaction records, and internal financial assessments — is stored exclusively on infrastructure owned and managed by Payleo Financial Service Limited. This data is not shared with any third party except where required by law or where you have given explicit consent.
Subprocessors: who else touches personal data
We engage third-party service providers (“subprocessors”) to assist in delivering our services. Every subprocessor operates under a data processing agreement with us, receives only the data necessary for its specific function, and processes that data solely on our instructions.
| Entity Name | Purpose | Location |
|---|---|---|
| Fly.io | Infrastructure Provider | United States |
| GSuite (Google LLC) | Internal and External Communications; Internal Document Management | United States |
| Firebase (Google LLC) | Centralised Authentication Provider | United States |
| Axiom, Inc. | Logging and Infrastructure Monitoring | United States |
| Google Analytics (Google LLC) | User Experience Insights | United States |
| Beem.Africa | SMS Provider | Tanzania |
| WhatsApp, Inc. (Meta LLC) | WhatsApp Messaging Provider | United States |
| PostHog, Inc. | Customer Analytics, User Experience Insights | United States |
| Vercel, Inc. | Web Hosting | United States |
| Slack Technologies, LLC | Internal Communication | United States |
| Upstash, Inc. | Event Messaging Platform; Redis Service Provider | United States |
| GitHub, Inc. | Code Hosting | United States |
| PlanetScale, Inc. | Data Hosting | United States |
| Functional Software, Inc. (Sentry) | Crash Monitoring | United States |
| Neon, Inc. | Data Hosting | United States |
| Plus Five Five, Inc. (Resend) | Email Service Provider | United States |
International transfers. Some of our subprocessors are located outside Tanzania. Where personal data is transferred outside the United Republic, we do so in compliance with Section 31 and 32 of the Personal Data Protection Act and the transfer procedures set out in Part IV of the 2023 Regulations. We ensure that adequate safeguards exist in the receiving country, including contractual agreements that require the recipient to protect personal data to a standard consistent with Tanzanian law.
Changes to subprocessors. This list will be updated when subprocessors are added or removed. We encourage you to check this page periodically. If you have concerns about a subprocessor, contact us at privacy@payleo.tz.
Our known domains
Payleo services are delivered exclusively from the following domains:
- *.payleo.tz — our primary Tanzanian domain
- *.payleo.co — our secondary service domain
- *.payleo.link — used for short links and transactional communications
Any communication, website, or application claiming to be from Payleo but operating outside these domains is not authorised by us. If you encounter a suspicious domain, please report it to security@payleo.tz.
Legal bases for processing
Under the Personal Data Protection Act (Cap. 44) and the 2023 Regulations, we process personal data on the following bases:
| What we do | Legal basis |
|---|---|
| Provide the financial services you signed up for | Performance of a contract |
| Process credit applications and manage credit products | Legal obligation (Bank of Tanzania regulations) and performance of a contract |
| Share credit data with a registered credit bureau | Legal obligation (Bank of Tanzania directives) |
| Maintain platform security and prevent fraud | Legitimate interest |
| Product analytics and service improvement | Legitimate interest (opt-out available) |
| Send transactional notifications (SMS, email, WhatsApp) | Performance of a contract |
| Comply with audit, tax, and regulatory requirements | Legal obligation |
| Respond to your support requests | Performance of a contract and legitimate interest |
Your rights as a data subject
Under the Personal Data Protection Act and the 2023 Regulations, you have the right to:
-
Prevent processing — request that we suspend or cease collecting or processing your personal data where it is likely to cause substantial damage to you or another person (Regulation 15).
-
Rectification — request correction of personal data that is inaccurate, outdated, incomplete, or misleading (Regulation 16).
-
Erasure or destruction — request deletion of your personal data where it is no longer needed for its original purpose, you have withdrawn consent, or processing has violated the law (Regulation 17), subject to exceptions where processing is necessary for legal obligations, freedom of expression, or the public interest.
-
Object to automated decisions — where a decision significantly affecting you is based solely on automated processing, you have the right to be notified and to object (Regulation 19).
-
Access — request a copy of the personal data we hold about you.
-
Data portability — receive your data in a structured, commonly used format.
To exercise any of these rights, contact us at privacy@payleo.tz. We will respond within fourteen (14) days. We may ask you to verify your identity before acting on a request. If you are not satisfied with our response, you may submit a complaint to the Personal Data Protection Commission in accordance with Regulation 36 of the 2023 Regulations.
How long we keep your data
| Data type | Retention period |
|---|---|
| Account and organisation data | For the duration of your relationship with us, plus the period required by applicable law |
| Financial and credit data | As required by Bank of Tanzania regulations and PDPC guidelines (typically 7 years after the end of the credit relationship) |
| Transaction records | As required by tax and financial regulations |
| Technical logs and diagnostics | Short-lived (typically 90 days), and designed not to contain personal data |
| Support correspondence | For the duration of your account, plus 12 months |
| Data after account closure | Deleted on our standard schedule, except where retention is required by law |
When retention periods expire, data is securely deleted or anonymised in accordance with our internal data destruction procedures, consistent with Regulation 30 of the 2023 Regulations.
Data security
We take the security of your personal data seriously and have implemented organisational and technical measures consistent with the requirements of the Personal Data Protection Act and aligned with SOC 1 Type compliance standards. These measures include:
- Encryption of data in transit and at rest.
- Role-based access controls ensuring only authorised personnel can access personal data necessary for their duties.
- Regular security assessments and vulnerability testing.
- Incident detection and response procedures, including breach notification processes as required by law.
- Audit trails and event monitoring as routine security controls.
- Secure backup and recovery procedures.
- Periodic review of all security controls and subprocessor agreements.
No system is perfectly secure. If a security incident occurs that affects your personal data, we will notify you and the Personal Data Protection Commission without undue delay and in accordance with the Act.
Data protection impact assessments
Where processing is likely to affect the rights and freedoms of data subjects, we conduct data protection impact assessments (DPIAs) before carrying out such processing, in accordance with Regulation 33 of the 2023 Regulations. This includes assessments for automated decision-making, large-scale processing, processing of sensitive personal data, and any innovative use of technology.
Children’s data
We do not knowingly collect or process personal data from children (persons under 18 years of age) except where such data is submitted by a parent, guardian, or authorised representative in connection with our services. Where children’s data is processed, we ensure that the parent or guardian is informed of the risks and the protections in place, consistent with Regulation 18 of the 2023 Regulations.
Changes to this policy
We will update this page and the effective date at the top when this policy changes. For material changes — such as a new category of data collection, a new subprocessor, or a change in how we handle financial data — we will notify you via email or an in-app notification before the change takes effect.
Contact
Data Protection Officer: privacy@payleo.tz
Security concerns: security@payleo.tz
Payleo Financial Service Limited Dar es Salaam, United Republic of Tanzania
Regulatory authority: Personal Data Protection Commission, established under Section 6 of the Personal Data Protection Act (Cap. 44)
If you are not satisfied with how we have handled your personal data, you have the right to submit a complaint to the Personal Data Protection Commission in accordance with the procedures prescribed under the Act and the 2023 Regulations.