Privacy Policy for Hekta ID

Effective Date: July 30, 2026

1. Introduction

This Privacy Policy explains how Hekta Company collects, uses, processes, and protects your personal data when you use Hekta ID. We are committed to safeguarding your privacy in strict accordance with the Tanzania Personal Data Protection Act, 2022 (PDPA) and international data protection standards, including the GDPR.

2. Data We Collect

To provide seamless authentication across the Hekta Ecosystem, we collect the following types of data:

Identity Data: Full name, email address, phone number, and profile picture.

Authentication Data: Encrypted passwords, security questions, and multi-factor authentication (MFA) tokens.

Technical & Usage Data: IP addresses, browser types, device identifiers, operating systems, login timestamps, and access logs (e.g., tracking when you sign in to NafDex vs. Sebuleni).

3. How We Use Your Data

We process your personal data solely for the following legitimate purposes:

  • Authentication: To verify your identity and grant access to Hekta Ecosystem applications.
  • Security: To detect and prevent fraudulent activities, unauthorized access, and cyber threats.
  • Service Improvement: To analyze authentication trends and improve the performance of our SSO infrastructure.
  • Communication: To send you critical security alerts, account recovery emails, and administrative notices.

4. Data Sharing and Ecosystem Integration

Hekta ID acts as the identity provider for our ecosystem.

Within the Hekta Ecosystem: When you log into an app like NafDex or Sebuleni using your Hekta ID, we share basic profile information (e.g., Name, Email, User ID) with that specific application to create your session.

Third-Party Processors: We may use trusted third-party cloud infrastructure and email delivery services to operate Hekta ID. These providers are bound by strict data processing agreements and cannot use your data for their own purposes.

Legal Requirements: We may disclose your information if required to do so by Tanzanian law, subpoena, or other legal processes, or to protect the rights, property, or safety of Hekta Company, our users, or the public.

5. International Data Transfers

While our primary operations are in Tanzania, our cloud servers and infrastructure may be located in other jurisdictions. By using Hekta ID, you consent to the processing of your data on global servers, provided that such transfers comply with mechanisms ensuring an adequate level of data protection equivalent to the Tanzania PDPA and GDPR.

6. Your Rights Regarding Your Data

Under the Tanzania PDPA and international laws, you have the right to:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Correct any inaccurate or incomplete data in your Hekta ID profile.
  • Erasure (Right to be Forgotten): Request the deletion of your Hekta ID. Note: Deleting your Hekta ID will permanently delete your access and data across all connected Hekta applications (NafDex, Sebuleni, etc.).
  • Data Portability: Request your data in a structured, commonly used, and machine-readable format.
  • Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

7. Data Security and Retention

We implement robust, industry-standard security measures (including end-to-end encryption and secure socket layers) to protect your data. We retain your personal data only for as long as your Hekta ID remains active, or as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

8. Changes to This Policy

We may update this Privacy Policy periodically. If we make material changes, we will notify you via email or by displaying a prominent notice upon your next login to Hekta ID.

9. Contact Us

For any questions, concerns, or to exercise your data protection rights, please contact our Data Protection Officer at:

Hekta Company
Dar es Salaam, Tanzania
Email: account@sebuleni.com