Data Protection Policy

1. Introduction and Purpose

Barah Technologies Ltd, trading as AnKara ("AnKara", "we", "us", or "our"), provides a digital invoicing platform that enables Tanzanian businesses to create, send, and manage invoices, including recurring invoices, automated payment reminders, and related billing communications delivered by email and WhatsApp.

This Data Protection Policy ("Policy") sets out how AnKara collects, uses, stores, discloses, and protects personal data in the course of operating the AnKara platform. It is prepared as the code of ethics for personal data protection required of every data controller under Section 65 of the Personal Data Protection Act, Cap. 44 (the "Act"), and is intended to be submitted to the Personal Data Protection Commission ("the Commission") for consideration and approval.

This Policy applies to personal data processed by AnKara in connection with:

• business owners and staff who register for and use the AnKara platform ("Business Users");
• the clients and customers of Business Users who are named on invoices generated through AnKara ("Invoice Recipients"); and
• any other individual whose personal data is processed through the AnKara platform in the course of providing the service.

2. Definitions

"personal data" means data about an identifiable person recorded in any form, as defined under Section 3 of the Act.

"sensitive personal data" includes, among other things, data related to the financial transactions of an individual, and any other personal data considered by law to present a major risk to the rights and interests of the data subject.

"data controller" means Barah Technologies Ltd, trading as AnKara, being the person who determines the purpose and means of processing personal data collected through the platform, save as described in Section 3.

"data processor" means any third party that processes personal data on AnKara's behalf and under AnKara's instructions, including the processors listed in Section 13.

"data subject" means an identifiable natural person whose personal data is processed, including Business Users and Invoice Recipients.

"processing" means any operation performed on personal data, whether automated or not, including collection, recording, storage, adaptation, retrieval, use, disclosure, or destruction.

"the Commission" means the Personal Data Protection Commission established under Section 6 of the Act.

3. Data Controller Details

Data controller: Barah Technologies Ltd, trading as AnKara

Contact email: privacy@invoice-ankara.com

Website: https://invoice-ankara.com

Data Protection Officer: Joshua Calvin Maimu (privacy@invoice-ankara.com), appointed pursuant to Section 27(3) of the Act and Regulation 32 of the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023, responsible for compliance oversight, handling data subject applications and complaints, and preparing quarterly compliance reports.

AnKara acts as data controller for the account, business profile, branding, subscription and payment data of Business Users. For the Invoice Recipient data that a Business User enters into the platform, the Business User is the data controller and AnKara processes that data on the Business User's behalf, solely to provide the invoicing service, as set out in AnKara's Terms of Service.

4. Principles of Personal Data Protection

In accordance with Section 5 of the Act, AnKara ensures that all personal data it processes is:

• processed lawfully, fairly, and transparently;
• collected for explicit, specified, and legitimate purposes, and not further processed in a manner incompatible with those purposes;
• adequate, relevant, and limited to what is necessary for the purposes for which it is processed;
• accurate and, where necessary, kept up to date, with inaccurate data corrected or erased without undue delay;
• retained in a form permitting identification of data subjects for no longer than necessary;
• processed in accordance with the rights of data subjects set out in this Policy; and
• processed with appropriate security safeguarding against unauthorised or unlawful processing, loss, destruction, or damage.

5. Categories of Personal Data Collected

5.1 Business User account data

Email address and password, the password being stored only in hashed form by AnKara's authentication provider. Where a Business User signs in with Google, AnKara receives the name, email address and profile photo associated with that Google account, and does not request or receive access to any other Google account data.

5.2 Business profile and branding data

Business/trading name, P.O. Box, city, phone number, email address, Tax Identification Number (TIN), bank account details (bank name, account name, account number, branch), the notification email address used for account alerts, the Business User's chosen brand colour and, where uploaded, a business logo image. These details are used to populate invoices and the business stamp rendered on them.

5.3 Invoice Recipient data

When a Business User creates an invoice or saves a client, AnKara processes the following data about the Invoice Recipient, as entered by the Business User: name, email address, WhatsApp/phone number, invoice line-item details (description, quantities, amounts, tax, due dates), and any recurring billing schedule attached to the invoice.

5.4 Financial transaction data (sensitive personal data)

AnKara processes payment-related data when a Business User pays for a subscription plan through its payment partner, Selcom: the plan, amount, mobile money number and network used, order and transaction references, and payment status. Where invoice payment by Invoice Recipients is made available, equivalent data is processed for those payments. AnKara never receives mobile money PINs or card credentials. Financial transaction data constitutes sensitive personal data under Section 3 of the Act and is processed only with the standalone consent described in Section 8 of this Policy.

5.5 Technical data

IP addresses, request times and error logs recorded by AnKara's servers and processors, as necessary for the operation and security of the platform. AnKara does not use advertising or cross-site tracking technologies.

6. Purpose of Processing

AnKara processes personal data for the following purposes only:

1. to create and administer Business User accounts and authenticate sign-in;
2. to create, render as PDF documents (including with the Business User's chosen branding and business stamp), and deliver invoices on behalf of Business Users to their Invoice Recipients by email and WhatsApp;
3. to generate and send automated payment reminders at scheduled intervals before and after an invoice due date;
4. to process recurring invoices in accordance with a Business User's configured billing schedule;
5. to process subscription payments, activate plans, and apply each plan's invoice allowance;
6. to facilitate invoice payment through an integrated payment gateway, where that feature is made available, and to reconcile payment status against the relevant invoice;
7. to maintain business profile and client records within a Business User's AnKara account;
8. to notify Business Users of account events, such as an exhausted invoice allowance;
9. to handle data subject requests, including account closure and deletion;
10. to comply with legal and regulatory obligations, including those arising under the Act and Tanzanian tax law; and
11. to maintain the security, integrity, and proper functioning of the platform.

Personal data collected for one purpose will not be used for an incompatible purpose without the consent of the data subject or other lawful basis recognised under Section 25 of the Act.

7. Legal Basis for Processing

AnKara's lawful bases for processing personal data include: the performance of a contract with the Business User (provision of invoicing services); the legitimate interests of the Business User in billing their own clients; compliance with legal obligations, including tax record-keeping; and, in respect of sensitive personal data, the explicit written consent of the data subject.

8. Sensitive Personal Data and Consent

In accordance with Section 30 of the Act, AnKara does not process sensitive personal data, including financial transaction data connected with subscription or invoice payments, without first obtaining the prior written consent of the data subject.

This consent is obtained through a standalone consent checkbox, separate and distinct from acceptance of AnKara's Terms of Service, presented before any payment request is initiated. The checkbox is never pre-ticked, and AnKara records the date and time of consent and the version of the consent wording shown.

Consent may be withdrawn at any time without charge or the need to provide any explanation, by contacting AnKara using the details in Section 16 of this Policy. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal; after withdrawal, no further payments can be initiated through the platform until consent is given again.

9. Data Subject Rights

In accordance with Part VI of the Act, every data subject has the right to:

• be informed whether AnKara is processing their personal data, and to receive a description of that data, the purposes of processing, and the recipients to whom it may be disclosed;
• request rectification of personal data that is incomplete, inaccurate, or misleading;
• request erasure or destruction of personal data in the circumstances set out in Regulation 17 of the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023;
• object to or request the suspension of processing likely to cause substantial damage;
• object to processing of their personal data for direct marketing purposes; and
• lodge a complaint with the Commission where they consider AnKara has infringed their rights under the Act.

Requests may be submitted using the prescribed forms under the Regulations, or by writing to AnKara using the contact details in Section 16. AnKara will respond within the timeframes prescribed by the Regulations (generally within fourteen days of receipt).

Business Users may exercise the right to erasure directly in the AnKara app (Settings, then Delete Account), or without installing the app by following the instructions at https://invoice-ankara.com/delete-account. Requests concerning Invoice Recipient data are forwarded to the Business User responsible for that data within seven days, and AnKara assists the Business User in responding.

10. Security of Personal Data

In accordance with Section 27 of the Act and Regulation 27 of the Regulations, AnKara implements technical and organisational measures appropriate to the risk, including:

• encrypted (TLS) transmission of data between the AnKara application, its backend infrastructure, and its processors;
• authenticated Business User accounts with passwords stored only in hashed form;
• database access rules that restrict each Business User's records to that Business User's own authenticated account;
• administrative credentials and third-party service keys held only on server-side infrastructure, never inside the mobile application;
• independent verification of every payment notification with the payment provider before any subscription is activated;
• access to production systems restricted to authorised personnel, with periodic review of access and system activity; and
• contractual security obligations imposed on all data processors engaged by AnKara.

AnKara will notify the Commission without undue delay of any security breach affecting personal data processed by or on behalf of AnKara, as required by Section 27(5) of the Act, and will notify affected data subjects where the breach is likely to affect their rights.

11. Data Retention and Disposal

Personal data is retained only for as long as necessary to fulfil the purposes described in Section 6, or as required by applicable tax, accounting, or other legal obligations, in accordance with the following schedule:

Account deletion requested in the app is carried out immediately. Deletion requested by email or through the public request page is completed within fourteen days of the request being verified. Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with Regulation 30 of the Regulations.

12. Transborder Data Flow

AnKara's primary database (Supabase) is hosted in Frankfurt, Germany, and certain processors operate from France, the United States, and other jurisdictions, as listed in Section 13. WhatsApp messages sent through Notify Africa are delivered via Meta's WhatsApp Business Platform, whose infrastructure is located outside Tanzania.

Transfers are made only where necessary for the performance of AnKara's services, to recipients that are bound to process the data solely for the purposes for which it was transferred and to maintain appropriate security and data protection safeguards, in accordance with Sections 31 and 32 of the Act. Where required, AnKara will submit the appropriate transborder data flow application (Form No. 7) to the Commission in respect of each destination country.

13. Third-Party Data Processors

AnKara engages the following third-party data processors in connection with the platform:

Each processor is engaged under terms requiring that personal data be processed only on AnKara's instructions, and that appropriate security measures are maintained, consistent with Section 27(4) of the Act.

14. Children's Data

The AnKara platform is intended for use by business owners and staff aged 18 or over. AnKara does not knowingly collect personal data relating to children through the ordinary operation of the platform. Where the consent of a child's parent or guardian is required in any circumstance covered by this Policy, AnKara will seek that consent in accordance with Section 30(4) of the Act.

15. Automated Decision-Making

AnKara's recurring invoice, payment reminder, and invoice-allowance features operate on scheduled, rules-based logic (for example, generating and sending an invoice on a pre-set date, sending a reminder a fixed number of days before a due date, or pausing invoice creation once a plan's allowance is reached). These processes do not involve profiling or automated decisions that produce legal or similarly significant effects on a data subject. Should this change, AnKara will notify affected data subjects in accordance with Section 36 of the Act.

16. How to Contact Us

Data subjects wishing to exercise any right described in this Policy, or to raise any question or concern regarding the processing of their personal data, may contact AnKara at:

Email: privacy@invoice-ankara.com

Data Protection Officer: Joshua Calvin Maimu

Website: https://invoice-ankara.com

Data subjects who remain dissatisfied following AnKara's response may lodge a complaint with the Personal Data Protection Commission in accordance with Part VII of the Act.

17. Amendments to this Policy

AnKara may update this Policy from time to time to reflect changes in its practices or in applicable law. Material changes will be notified to Business Users through the platform or by email. Any amended version submitted for the Commission's consideration will follow the approval procedure set out in Section 65(2) and (3) of the Act.