Privacy Policy

Winga

Last Updated: 6/14/2026

1. Introduction

Welcome to Winga ("Winga," "we," "us," or "our"). Winga is a multi-vendor e-commerce platform operated by Empirical Communication, a company registered in the United Republic of Tanzania under registration, with its registered office at Second floor, Biashara Complex, Along, Plot No. 5029 Mwinyijuma Rd, Dar es Salaam.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Winga mobile application, website, and related services (collectively, the "Platform"). This Policy is issued in accordance with the Personal Data Protection Act, 2022 (Act No. 11 of 2022) of Tanzania and its accompanying regulations.

By creating an account or using the Platform, you confirm that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Platform.

2. Information We Collect

We collect the following categories of personal data:

2.1 Information you provide directly

• Full name, phone number, email address, and date of birth (where required)
• Delivery addresses, including area, street/mtaa, ward, district, and region
• National ID or business registration details (for sellers only, where required for verification)
• Payment details, including mobile money numbers (M-Pesa, Tigo Pesa, Airtel Money, HaloPesa) and, where applicable, card information processed by our licensed payment partners
• Profile photo, business name, and product listings (for sellers)
• Communications you send to us, including customer support messages, reviews, and ratings

2.2 Information collected automatically

• Device information (device model, operating system, unique device identifiers)
• App usage data (pages viewed, products searched, time spent, click patterns)
• Location data (only with your permission, to improve delivery accuracy and show nearby sellers, deals, or pickup points)
• Log data, including IP address, access times, and crash reports

2.3 Information from the AI Personal Shopper feature (where enabled)

• Messages you send to the AI shopping assistant, including product preferences, budget ranges, and shopping intent
• Conversation history is retained to improve recommendations and is not shared with third parties for advertising purposes

2.4 Information from Live Shopping and Group Buying features (where enabled)

• Comments and reactions posted during live shopping sessions
• Group buying participation, including the neighbourhood/area you select for delivery grouping
• Referral activity when you share a deal with others

3. Legal Basis for Processing Your Data

Under the Personal Data Protection Act, 2022, we process your personal data on the following legal bases:

• Consent — where you have given clear consent (e.g., location access, marketing communications)
• Contractual necessity — to fulfil orders, process payments, and provide customer support
• Legal obligation — to comply with tax, consumer protection, and financial regulations applicable in Tanzania
• Legitimate interest — to improve the Platform, prevent fraud, and ensure security, provided this does not override your fundamental rights

4. How We Use Your Information

We use your personal data to:

• Create and manage your account
• Process and fulfil orders, including coordinating with sellers and delivery partners
• Process payments through licensed mobile money operators and payment gateways
• Provide AI-powered product recommendations through the AI Personal Shopper
• Facilitate group buying ("Nunua Pamoja") deals, including showing area-based participation counts to other users
• Enable live shopping sessions, including displaying viewer counts and comments to other participants
• Send order updates, delivery notifications, and promotional offers (you may opt out of marketing messages at any time)
• Investigate and prevent fraud, abuse, and violations of our Terms and Conditions
• Comply with applicable laws, including tax reporting and regulatory requests from Tanzanian authorities

5. Sharing Your Information

We do not sell your personal data. We may share your information with:

5.1 Sellers on the Platform — when you place an order, the relevant seller receives your name, delivery address, phone number, and order details necessary to fulfil your order.

5.2 Delivery partners — including our delivery agents and any third-party courier or "Mtaa Agent" pickup point operators, who receive the minimum information necessary to complete delivery.

5.3 Payment service providers — including mobile money operators (Vodacom M-Pesa, Tigo Pesa, Airtel Money, Halotel HaloPesa) and licensed payment gateways, to process transactions securely. We do not store your mobile money PIN.

5.4 Service providers — including cloud hosting providers, SMS/notification providers, and analytics providers, who process data on our behalf under confidentiality obligations.

5.5 Legal and regulatory authorities — where required by Tanzanian law, including the Tanzania Revenue Authority (TRA), the Personal Data Protection Commission (PDPC), the Bank of Tanzania, or pursuant to a valid court order.

5.6 Other users (limited cases) — in Live Shopping sessions, your display name and comments are visible to other viewers. In Group Buying, only your selected area/neighbourhood (not your name or exact address) is shown to other participants in the leaderboard.

6. Data Storage and Security

Your data is stored on secure servers. We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

• Encrypted data transmission (HTTPS/TLS)
• Access controls limiting staff access to personal data on a need-to-know basis
• Regular security reviews of our systems

Where your data is processed or stored outside the United Republic of Tanzania (for example, by cloud infrastructure providers), we ensure such transfers comply with the cross-border data transfer requirements of the Personal Data Protection Act, 2022.

7. Data Retention

We retain your personal data for as long as your account remains active, and for a reasonable period afterward to comply with legal, accounting, tax, and dispute-resolution obligations under Tanzanian law. AI Personal Shopper conversation history is retained for up to [Insert Retention Period, e.g., 12 months] unless you request earlier deletion.

8. Your Rights as a Data Subject

Under the Personal Data Protection Act, 2022, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your personal data, subject to legal retention requirements
• Withdraw consent for processing based on consent (e.g., marketing, location access)
• Object to certain processing activities, including automated decision-making by the AI Personal Shopper
• Lodge a complaint with the Personal Data Protection Commission (PDPC) if you believe your data protection rights have been violated

To exercise any of these rights, contact us using the details in Section 12 below. We will respond within the timeframe required by applicable law.

9. Cookies and Similar Technologies

The Winga website and app may use cookies, local storage, and similar technologies to keep you logged in, remember your preferences (such as language and delivery area), and understand how the Platform is used. You can manage cookie preferences through your browser or device settings, though disabling certain cookies may affect Platform functionality.

10. Children's Privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete such information.

11. Marketing Communications

We may send you promotional messages via SMS, push notification, email, or WhatsApp regarding offers, new products, live shopping sessions, and group buying deals. You can opt out at any time through the app settings or by following the unsubscribe instructions in any marketing message. Opting out of marketing does not affect transactional messages (e.g., order confirmations, delivery updates).

12. Contact Us / Data Protection Officer

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact:

Data Protection Officer [Insert Company Legal Name] Email: [Insert Email Address] Phone: [Insert Phone Number] Address: [Insert Physical Address]

You may also lodge a complaint directly with the Personal Data Protection Commission (PDPC) of the United Republic of Tanzania.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes through the app or via email, and the "Last Updated" date at the top of this Policy will reflect the most recent revision. Continued use of the Platform after such changes constitutes acceptance of the updated Policy.

This Privacy Policy is governed by the laws of the United Republic of Tanzania, including the Personal Data Protection Act, 2022, the Electronic Transactions Act, 2015, and the Electronic and Postal Communications Act, 2010, as may be amended from time to time.