Privacy notice
How we protect your personal data.
Effective: 11 October 2026
Who we are and the law we follow
Duma Brands, Dar es Salaam, Tanzania, is the data controller for personal data collected through dumabrands.com. We process personal data in line with the Personal Data Protection Act, 2022 (Cap. 44) and the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023, and we register as a data controller with the Personal Data Protection Commission (PDPC). Our data protection officer can be reached at info@dumabrands.com or +255 752 911 144. Email our data protection officer.
What we collect
When you send a brief: your name, email, optional phone and business name, the service you are interested in, your answers about budget and timing, and your message. Automatically, for security and to understand how people find us: approximate location (country or city level), device and browser type, the page and campaign link you arrived from (including ad click identifiers), and a one-way scrambled version of your IP address. We do not ask for, and you should not send, sensitive personal data such as health, financial or identity documents.
Why we use it
To reply to your enquiry and prepare a proposal or quotation, to deliver work you ask us for, to keep our systems secure and stop spam or abuse, and, only if you allow measurement cookies, to understand which marketing brings enquiries. Each purpose is lawful and directly related to why you contacted us (sections 22 and 25 of the Act). We never sell your personal data.
Your consent
The form asks for your consent before you send it. You may withdraw consent at any time by emailing us; this does not affect processing that already took place. Advertising and analytics tools from Google and Meta load only after you choose Allow measurement, and you can change that choice by clearing your browser data.
Who receives it
Only the Duma Brands team members who handle your enquiry. Our service providers process data on our instructions under written terms: Hostinger (website hosting and the database), Resend (email delivery) and, only with your permission, Google and Meta measurement tools. We disclose personal data to authorities only where the law requires it (section 26).
Transfers outside Tanzania
Some providers store or process data on servers outside Tanzania, including in the European Union and the United States. We transfer data only where it is necessary to answer you or perform a contract you asked for, or with your consent, and we require the provider to protect it to a standard comparable with Tanzanian law (sections 31 and 32). We will obtain any cross-border transfer authorisation the Commission requires.
How long we keep it
Enquiries that do not become projects are kept for up to 24 months, then deleted or anonymised. Client project and invoice records are kept for as long as tax and accounting laws require. Security logs are kept for up to 12 months. Unsent form drafts stay only in your own browser tab and disappear when it closes.
How we protect it
Data is sent over encrypted HTTPS, stored in a private database that only authorised staff can open after signing in, protected by access roles, rate limits and an audit log, and checked by automated security tests. If a breach affects personal data, we will notify the Commission without undue delay (section 27) and contact affected people where appropriate.
Your rights
Under the Act you may: ask whether we hold your data, what it is, why we use it and who receives it (section 33); ask us to stop processing that is likely to cause you damage or distress (section 34); stop direct marketing at any time (section 35); ask about and object to decisions made only by automated means (section 36); ask us to correct, block, erase or destroy inaccurate or unlawful data (section 38); and seek compensation for loss caused by a breach of the Act (section 37). Email info@dumabrands.com; we reply within 21 days and may ask you to confirm your identity. Make a request.
Complaints to the Commission
If you are unhappy with how we handled your data, please tell us first so we can fix it. You also have the right to complain to the Personal Data Protection Commission, P.O. Box 1105, Dodoma, email helpdesk@pdpc.go.tz. PDPC complaint form.
Children
Our services are for businesses and adults. We do not knowingly collect data from children; if a parent or guardian believes a child sent us personal data, contact us and we will delete it (section 30(4)).
Changes to this notice
We will update this notice when the law or our practices change and show the new effective date at the top.