Scope & Legal Roles
UzaDebt is operated by Fortune Technology Co. Ltd. (Posta House, Ghana Street, Dar es Salaam, Tanzania). We process personal data in compliance with the Personal Data Protection Act, No. 11 of 2022 (PDPA) and regulations issued by the Personal Data Protection Commission (PDPC).
- When you apply directly on UzaDebt.io: Fortune Technology Co. Ltd. acts as the Data Controller for your intake profile until your file is matched with a partnering lender.
- When a bank, MFI, or digital lender refers your written-off account: The originating lender remains the Data Controller, and UzaDebt acts as an authorized Data Processor / Third-Party Collection Agent under a written mandate.
Categories of Personal Data We Collect
| Category | Data Elements | Purpose |
|---|---|---|
| Identity & Contact | Full name, active mobile number (MSISDN), optional email, region, and optional previous SIM number. | Account matching, portal authentication, and private repayment updates. |
| Obligation & Plan Data | Originating lender name, debt category, approximate balance, overdue band, selected restructuring plan, and hardship/dispute notes. | Evaluating pre-agreed lender discounts and administering repayment schedules. |
| Payment & Ledger Records | UzaDebt Control Number, transaction amounts, provider references, timestamps, and settlement status. | Reconciliation, issuing Official Settlement Confirmations, and statutory audit trails. |
| Technical & Security Logs | IP address, browser user agent, rate-limit counters, and consent timestamps. | Fraud prevention, rate limiting, and audit compliance. |
Lawful Basis & Prohibited Practices
We process your data strictly on the basis of your explicit consent, performance of a restructuring arrangement, and legitimate institutional debt-recovery mandates. UzaDebt never sells borrower data, never runs third-party advertising trackers, and strictly prohibits contacting employers, relatives, or phone contacts.
Third-Party Processors & Disclosures
Personal data is shared only with essential service providers bound by confidentiality and security obligations:
- Originating Lenders: To verify debt balances, confirm restructuring rules, remit recovered funds, and trigger Credit Reference Bureau (CRB) updates.
- ClickPesa (Payment Gateway): To generate UzaDebt Control Numbers and reconcile mobile-money (M-Pesa, Mixx by Yas, Airtel Money, HaloPesa) and bank payments.
- NextSMS & SMTP Providers: To deliver private payment instructions, receipts, and security alerts.
Data Retention & Security Controls
- Retention: Payment ledgers, settlement confirmations, and audit logs are retained for 7 years to satisfy Tanzanian financial, tax, and regulatory audit requirements. Unmatched pilot inquiries may be deleted upon request.
- Security: All traffic is encrypted in transit (HTTPS/TLS), admin access is restricted by role-based access control (RBAC) and logged in an immutable audit trail, and payment webhooks require cryptographic/secret verification.
Your Rights Under PDPA 2022
You have the right to request access to your personal data, correction of inaccurate balances or contact details, restriction of processing during a dispute, or erasure where no overriding legal retention duty applies. Submit requests to hello@uzadebt.io. We acknowledge requests within 2 business days and respond within 14 days.