Privacy policy

The Gahitwen LLC, 131 Continental Dr Ste 305, Newark, DE 19713, USA. Email: info@gahitwen.com.

We follow Tanzania's Personal Data Protection Act, 2022 and its regulations. Where another country's law applies, we meet its material requirements.

For our clients’ customers’ data (names, phone numbers, messages and consent records), the client is the controller and Gahitwen is the processor. We process that data on the client’s instructions and only for the service.

For website visitor data, setup requests, staff accounts and billing records, Gahitwen is the controller.

We do not use client data for our own marketing or sell it to anyone.

Account information: name, email, phone number, business name, role, and sign-in records such as IP address and device.

Message data: customer phone numbers, message content, templates, delivery status, timestamps, and consent or opt-out records.

Technical data: server logs, IP address, browser type, and essential cookies (session and language).

Billing records: amounts, dates, method and payment reference. We do not store card numbers; Meta fees are paid on the client’s own Meta account.

Health Mode: we store only name, phone, service and time. We do not collect health information, diagnoses or treatment details.

AI data: content we submit to an AI provider for staff drafts, with phone numbers removed.

Providing the service: connecting numbers, sending and receiving messages, managing templates, campaigns, appointments and reports.

Protecting the service: detecting abuse, intrusions, delivery errors and quality problems.

Support and training, service quality review, and aggregated statistics that do not identify a person.

Collecting Gahitwen fees, keeping statutory records, and responding to lawful requests from authorities.

Sending essential notices about the service, legal changes and security.

We rely on consent for marketing messages and, where permitted, health-related processing; performance of a contract for the service you request; legal obligation for tax and audit records; and legitimate interests for security, abuse prevention and service improvement.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We share data with Meta (WhatsApp Business Platform) to send and receive messages and manage the client’s WhatsApp account; and with our hosting, email and AI providers used for staff tools.

We share data with professional advisers, auditors or authorities where the law requires it, and with the client if there is a complaint or investigation.

We do not sell personal data. Providers are bound by confidentiality and security contracts.

Meta and other providers may process data outside Tanzania, including in the United States and the European Union. We require appropriate safeguards through contracts, security standards and the conditions of Tanzania’s Personal Data Protection Act, 2022.

For client customer data, the client gives the instructions and any transfer approvals required by law.

We keep account data and messages while the service is active. After the service ends, we return or delete client data within 30 days, except billing, tax and audit records that the law requires us to keep.

Opt-out records may be kept longer to prevent unwanted messages. Backups are purged within 90 days.

Clients can set a shorter retention period in the service settings.

We use HTTPS, access control, strong passwords, two-step verification for staff, AES-256-GCM encryption for Meta tokens and registration PINs, and an append-only audit log.

Staff access data only for their work and access is recorded. We keep backups and test restores.

No system is completely secure. If data is breached, we notify the client within 72 hours and the authorities where the law requires it.

Under Tanzania’s Personal Data Protection Act, 2022 you may request a copy of your data, correct inaccurate data, delete data, restrict or object to processing, port data, and withdraw consent.

Send a request to info@gahitwen.com. We respond within 30 days. For client customer data, we may refer you to the client, who is the controller.

You may complain to Tanzania’s Personal Data Protection Commission (PDPC) if you believe we have not followed the law.

We use essential cookies only: the sign-in session and your chosen language. We do not use advertising or third-party tracking cookies.

You can block cookies in your browser, but portal and ops console features will not work without a session.

This is a business service and is not directed to children under 18. We do not knowingly collect children’s data. If a child’s data is submitted by mistake, we delete it after notice.

We may update this policy to reflect changes in law, Meta rules or the service. We will post the updated date and notify clients by email or in the portal about material changes.