About this notice
Settlo Pay is a product of Settlo Technologies Ltd ("Settlo Pay"), a company registered in Tanzania. Settlo Pay is a payment service provider registered by the Bank of Tanzania. This notice explains what personal information we handle, why, and what you can do about it. It is written under Tanzania's Personal Data Protection Act, 2022.
It covers the public site at settlopay.co.tz, the merchant dashboard at app.settlopay.co.tz, the payment pages your customers reach when they pay you, and our API. It also covers admin.settlopay.co.tz, which is our own back office and is not open to merchants.
Personal information means information about a person who can be identified from it. Information about a business is not personal information, but the details of the people behind that business are.
Every version of this notice carries a version string and a date. When you sign up we record which version you accepted, so there is always an answer to the question of which wording applied to you.
The roles we play
For our own relationship with your business we decide why and how personal information is handled. In the language of the Act, we are the controller. That covers your sign-up, your account, your verification, the messages we send you and the records we keep.
When your customers pay you through Settlo Pay, your business decides why that payment is being taken. Your business is the controller for your customers' information, and we handle it on your instructions as a processor. You are responsible for telling your customers what you do with it and for having a lawful reason to collect it.
There is an overlap, and it is deliberate. For fraud checks, sanctions screening, anti-money-laundering obligations and our own records of what moved, we act as a controller in our own right, because those duties fall on us and not on you. We cannot take your instruction to ignore them.
What we collect
We collect only what a payments business needs to open your account, verify it, move money and keep the records the law requires. Grouped by kind:
- Account and identity: your first and last name, email address, mobile number and the password you set. If you belong to a merchant team, the role you hold and what you did with it.
- Business and verification: your business name, business type (sole proprietor, company or NGO), taxpayer identification number, region and district; the company registration document issued by BRELA; your taxpayer identification document; a director's national identity document; and the result of a NIDA check of a 20-digit National Identification Number, which asks the person a set of identity questions and records whether the answers matched.
- Transaction: the amount, currency, time, method and rail of each payment, its reference and status, the payer identifier the rail gives us such as a mobile money number, refunds against it, and the reason a payment failed.
- Payout and settlement: the bank account or mobile money wallet you are paid into, the name held on it, the beneficiaries you save, and the record of every payout, transfer and bill payment.
- Card, where card payments are available to your business: a token that stands in for the card, the card brand, the expiry month and year, and the last four digits. We never receive or store the full card number or the security code printed on the card.
- Technical and device: your IP address, browser and device type, the pages you opened and when, and the record our systems keep of each sign-in and each API call made with your keys.
- Communications: anything you write to us, including through the contact form on settlopay.co.tz, and the messages we send you about your account.
- Website analytics: how the site is used, and only if you accept analytics cookies. Our cookie policy lists each one.
We do not ask for special categories of personal information, such as health or political opinions, and you should not send them to us.
Where it comes from
- From you: what you type at sign-up, during verification, and in the dashboard.
- From your device: technical details your browser sends with every request.
- From your customers: what they enter to pay you, and what the rail returns about that payment.
- From banks, mobile money operators and card partners: confirmations, settlement reports, refunds, and notices of a dispute.
- From the checks we run: identity checks, sanctions and fraud screening, and the risk scores our own systems produce.
- From other people in your business: if a colleague invites you, they give us your name and email before you have given us anything.
Why we use it and on what basis
The Act requires a lawful basis for each use. Ours are set out beside each purpose:
- To open and run your account and provide the features you turn on. Basis: performing our contract with you.
- To move money: to take payments from your customers over mobile money, bank transfer and QR, to pay you out to a bank account or wallet, to refund, and to reconcile what was paid against what settled. Basis: performing our contract with you.
- To check who you are and who stands behind your business before money moves, and to screen for fraud, money laundering and sanctions. Basis: our legal obligations, and our legitimate interest in keeping the platform safe for everyone on it.
- To keep the records the law requires us to keep, and to answer lawful requests from courts, the police and tax and financial authorities. Basis: our legal obligations.
- To keep the service secure, to investigate misuse, and to establish or defend legal claims. Basis: our legitimate interests.
- To support you when you get in touch, and to tell you about changes to the service, its terms or its prices. Basis: performing our contract with you.
- To follow up on an unfinished sign-up and tell you about Settlo Pay services. You can opt out of these messages at any time.
- To measure how the public site is used, so we can improve it. Basis: your consent, given through the cookie banner and withdrawable at any time.
We do not build advertising profiles, and we do not use your transaction data to target advertising at you or at your customers.
Payment data in particular
A payment is not only a row in our system. To take or send money we have to pass what the other side needs in order to act on it.
For mobile money and bank transfers that means the amount, the currency, a reference, the account number or wallet number involved, and the name held against it. Banks and mobile money operators keep their own records of the same payment under their own terms, and we cannot delete those for you.
Where card payments are available to your business, the card details are captured and held by our card partners, not by us. We will only work with card partners assessed against the payment card industry's data security standard. What reaches our systems is a token, the brand, the expiry and the last four digits, which is enough to show you the payment, refund it, and answer a dispute. If a cardholder disputes a payment, the card scheme and the issuing bank receive the evidence needed to decide it, which can include the transaction details and what you sold.
A completed transaction is a financial record, and that changes what we can do with it. We cannot delete it because someone asks: it is the evidence of what moved, it is what settlement, refunds and disputes are worked out from, and the law requires us to keep it. What we can do is stop using it for anything beyond those purposes.
Sending data outside Tanzania
We keep personal information in Tanzania where it is practical to do so. Some of the suppliers we depend on, such as hosting and email delivery, store or handle data outside the country.
Where that happens we move personal information only where the Act permits it, and we require the recipient by contract to protect it to the standard this notice sets, to use it only on our instructions, and to return or delete it when we end the arrangement.
If you want to know where a particular kind of information is held, ask us through the contact page and we will tell you.
How long we keep it
Details entered into an unfinished sign-up are kept for 90 days and then deleted.
While your account is open we keep what the account needs in order to work. After it closes, how long we keep something depends on what it is:
- Verification records, transaction records and payout records: for the period anti-money-laundering and tax law set. That period is fixed by law rather than by us, and it outlasts your account.
- Support messages: for as long as they are useful in answering you, and then in a shortened form as a record of what was agreed.
- Our back-office audit log: for the life of the log. It is append-only, so entries are not removed from it.
- Website analytics: for the period set out in the cookie policy.
When a retention period ends we delete the information or strip it of anything that identifies a person, keeping only figures that no longer point to anyone.
How we protect it
Personal information is encrypted in transit and at rest. Access inside Settlo Pay is limited to the people whose job needs it, each acting under their own named account, and every one of those accounts is protected by a password we never store in readable form.
Every privileged action in our back office is written to an append-only, hash-chained audit log, so a record cannot be quietly altered or removed without breaking the chain. Sensitive changes need a second administrator to approve them before they take effect, so no single person inside Settlo Pay can move money or change a merchant's settings alone.
Full card numbers and card security codes never reach our systems at all, which means they cannot be taken from us.
No system is perfectly safe, and honesty is better than reassurance here. Keep your password to yourself, do not share API keys, and tell us straight away through the contact page if you think someone has your credentials or has got into your account.
Your rights
Under the Act you can:
- Ask what personal information we hold about you, and get a copy of it.
- Have inaccurate details corrected. You can change most of them yourself in the dashboard.
- Ask us to delete information where we are not required to keep it. Completed payment records are the main thing we cannot delete, for the reasons given above.
- Object to a use we base on our legitimate interests, and ask us to restrict a use while a dispute about it is being worked out.
- Withdraw a consent you gave, including analytics cookies, at any time. Withdrawing it does not undo what was done while it was in force.
- Tell us to stop sending you follow-up messages about Settlo Pay services.
- Complain to Tanzania's data protection authority under the Personal Data Protection Act, 2022, and to go to court.
Ask through the contact page at settlopay.co.tz/contact. We may need to check who you are before we act, so that nobody else can make a request in your name. We answer within the time the Act allows, and if we refuse a request we tell you why.
Automated checks and decisions
Before money moves we run automated checks: fraud and risk scoring on a payment, sanctions screening on the people and businesses involved, and payout limits that hold a payout above a set size until someone reviews it.
A check can slow a payment down, hold a payout, or stop either. It can also freeze an account while we look into something. We run these checks because the law requires some of them and because the rest protect everyone using the platform, including you.
These decisions are not the last word. If one goes against you, ask us and a person will look at it again, and you can tell us anything you think the check missed. We will not always be able to explain exactly what triggered a check, because saying so would tell the next person how to get past it.
We do not use these scores to build a profile of you for advertising, and we do not sell them.
If something goes wrong
If personal information is lost, exposed or reached by someone who should not have it, we investigate, stop the cause, and record what happened.
Where the Act requires it we tell Tanzania's data protection authority, within the time the Act sets, and we tell the people affected where the risk to them makes that right.
When we tell you, we say what happened, what information was involved, what we have done about it, and what we suggest you do.
Children
Settlo Pay is a service for businesses. Accounts are for people aged 18 or over, and we do not knowingly collect personal information about children.
If you believe we hold information about a child, tell us through the contact page and we will delete it.
Changes to this notice
We update this notice as the service changes, and the bank and card work now under way will bring changes to it. The version and date at the top tell you which wording you are reading.
Where a change materially affects you we tell you before it takes effect, in the dashboard or by email. Smaller corrections take effect when we publish them.
Using Settlo Pay after a change means the updated notice applies to you. If you do not accept it, you can close your account, though we will still keep what the law requires us to keep.
Contact
For anything in this notice, including a request about your own information or a complaint, use the contact page at settlopay.co.tz/contact.
We have not yet published a postal address, a telephone number or the name of a data protection contact. We would rather publish nothing than publish a channel nobody is answering. When those are in place they will appear on the contact page and in this section.
If you are unhappy with our answer, you can complain to Tanzania's data protection authority under the Personal Data Protection Act, 2022.