Organa Fresh is a Tanzanian grocery delivery platform registered with the Business Registrations and Licensing Agency (BRELA) and operating from #10 Kariakoo Market, Dar es Salaam. We are a retail and wholesale supplier of fresh fruit, vegetables, dairy, meat, fish, dry foods, edible oils, spices, and herbs. We deliver to households, chefs, caterers, and businesses across Dar es Salaam.

For the purposes of this policy, Organa Fresh is the data controller — meaning we determine how and why your personal information is processed. You can contact our data protection team at hello@organafresh.co.tz or by calling +255 768 149 040.

We collect only the information necessary to process your orders, deliver groceries to you, and improve your shopping experience. Below is a detailed breakdown of every category of data we collect, why we collect it, and how we use it.

2.1 Identity & Contact Information

When you place an order, we collect:

• Full name — so we know who is receiving the order.
• Phone number — this serves as your primary account identifier. Your phone number is how we contact you about your order, confirm delivery details, and resolve any issues. It is also how you sign in to view your order history.

We do not require an email address, password, national ID number, date of birth, or any government-issued identification to create an account. Your account is created automatically when you place your first order — no separate registration is needed.

2.2 Delivery Information

To deliver your order, we collect:

• Delivery address — the physical location where you want your groceries delivered (plot number, street name, landmark, area).
• Delivery area — your neighbourhood or ward within Dar es Salaam, used to calculate the delivery fee and estimated delivery time.
• Delivery notes — optional instructions you provide, such as gate codes, floor numbers, or landmarks to help our delivery team find you.

If you choose to save an address to your account, it is stored in our customer_addresses table and linked to your customer profile for your convenience on future orders. You can manage your saved addresses at any time through the address management page.

2.3 Order Information

For every order you place, we maintain a complete record including:

• Which products you ordered, their quantities, and unit prices.
• The total amount you paid, including any delivery fees and discounts applied.
• Your chosen payment method (Mobile Money, Cash on Delivery, or Bank Transfer).
• The order status at each stage (confirmed, packing, out for delivery, delivered, cancelled).
• The date and time the order was placed, and when it was delivered.

This information allows us to process your order, handle refunds or replacements, and provide you with an order history. It also helps us analyse which products are popular and ensure we maintain adequate supply levels.

2.4 Payment Information

We do not store your Mobile Money PIN, bank account number, or card details on our servers. Here is how each payment method works:

• Mobile Money (M-Pesa, Tigo Pesa, Airtel Money, HaloPesa): The payment transaction is processed directly through your mobile money provider's secure network. We only record whether the payment was successful (the payment status — paid or unpaid). We never see or store your PIN.
• Cash on Delivery: You pay in cash when the order arrives at your door. No electronic payment data is collected or stored.
• Bank Transfer: You initiate a transfer from your bank to ours. We only record whether we have confirmed receipt of the transfer. Your bank account details are never collected by our platform.

2.5 Technical Information

When you visit our platform, our server automatically logs:

• IP address — with the last octet anonymised (set to zero) for visitor session tracking and abuse prevention. We do not store your full IP address.
• Browser type and operating system — so we can optimise the platform for the devices our customers use (primarily Android phones in Tanzania).
• Visit timestamps and page views — to understand which products and categories are popular and to detect unusual activity.

We do not use third-party analytics services, advertising trackers, or social media pixels. We do not track you across other websites.

2.6 Local Storage

Our platform uses your browser's localStorage and sessionStorage to:

• Remember your shopping cart while you browse.
• Keep you signed in between visits (your customer ID, name, and phone number are stored locally on your device — not on a remote tracking server).
• Remember your preferences, such as whether you have dismissed the PWA installation prompt or terms acceptance notice.

This data stays on your device. It is never transmitted to third parties. You can clear it at any time through your browser settings, though doing so will sign you out and clear your cart.

Every piece of information we collect serves a specific and necessary purpose. We do not collect data "just in case." Here is exactly how we use each category:

Purpose	Data Used	Legal Basis
Process and deliver your order	Name, phone, address, order items, payment method	Performance of a contract
Communicate about your order status	Phone number, name	Performance of a contract
Verify your identity and provide order history	Phone number (account identifier)	Legitimate interest
Calculate delivery fees	Delivery area	Performance of a contract
Process refunds or replacements	Order history, phone number	Legal obligation / Legitimate interest
Prevent fraud and abuse	Anonymised IP, order patterns	Legitimate interest
Improve our product range and platform	Aggregated order data (not personally identifiable)	Legitimate interest
Send promotional offers	Phone number	Consent (you must opt in)

Promotional communications: We will only send you marketing messages (SMS or WhatsApp) if you explicitly agree to receive them. You can withdraw your consent at any time by contacting us. We will never send unsolicited marketing messages. Transactional messages — such as order confirmations, delivery updates, and refund notifications — are not marketing and are sent because they are necessary to fulfil your order.

We do not sell your personal data. We do not rent, trade, or share your information with third parties for their marketing purposes. Ever.

4.1 Our Delivery Team

Your name, phone number, and delivery address are shared with our delivery drivers solely so they can deliver your order and contact you if needed (for example, if they cannot find your location). Our delivery team is trained on data confidentiality and is instructed not to use your information for any purpose other than completing your delivery.

4.2 Payment Providers

When you pay via Mobile Money, the transaction is processed through the mobile network operator's payment infrastructure (Vodacom M-Pesa, Tigo Pesa, Airtel Money, or HaloPesa). These providers may collect and process your data according to their own privacy policies. We recommend reviewing your mobile money provider's privacy policy.

4.3 Legal Obligations

We may disclose your information if required to do so by Tanzanian law, a court order, or a lawful request from a government or law enforcement authority within the United Republic of Tanzania.

4.4 Business Transfers

If Organa Fresh is acquired by or merged with another company, your information may be transferred as part of the business assets. We will notify you before your data is transferred and becomes subject to a different privacy policy.

4.5 Service Providers

We may engage trusted service providers to assist with platform hosting, database management, and technical maintenance. These providers only access data as necessary to perform their functions and are bound by confidentiality agreements.

We retain your personal information for as long as is necessary to fulfil the purposes described in this policy, unless a longer retention period is required by law.

• Order records: Retained indefinitely for business accounting, tax compliance, and to provide you with your order history. Under Tanzanian tax law, business records must be retained for a minimum of five years.
• Customer account information (name, phone, saved addresses): Retained as long as your account remains active. If you have not placed an order in 24 months, your account may be considered inactive.
• Visitor session data (anonymised IP, visit timestamps): Retained for 90 days for security and analytics purposes, then automatically purged.
• Promotional consent records: Retained even after you withdraw consent, so we can demonstrate we are not sending marketing to people who opted out.

You can request deletion of your account and associated data at any time (see Section 7 — Your Rights).

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Access controls: Only authorised staff members can access the order management system, and access is limited to what each role requires (for example, delivery drivers see only the delivery information for their assigned orders).
• Database security: Our database is protected by authentication and runs on a secured server. Customer phone numbers — used as account identifiers — are stored in a database that is not publicly accessible.
• Input validation and sanitisation: All data submitted through our forms is validated and sanitised to prevent injection attacks.
• No storage of sensitive payment credentials: We never store Mobile Money PINs, bank account numbers, or card details.

However, no method of electronic storage or transmission over the internet is 100% secure. While we strive to protect your data using commercially acceptable means, we cannot guarantee absolute security. We encourage you to use a device PIN or biometric lock on your phone to add an additional layer of protection to any data stored locally by our platform.

Under this privacy framework, you have the following rights regarding your personal data:

7.1 Right to Access

You have the right to request a copy of the personal data we hold about you. To exercise this right, contact us at hello@organafresh.co.tz or call +255 768 149 040. We will verify your identity using your phone number before releasing any data. We aim to respond to access requests within 14 days.

7.2 Right to Correction

If you believe the information we hold about you is incorrect or incomplete, you can request that we update it. You can update your name and saved addresses through the platform. To update the phone number linked to your account, contact our support team — this requires verification to prevent unauthorised changes.

7.3 Right to Deletion

You can request that we delete your account and personal data. We will comply unless we are legally required to retain certain information (for example, order records needed for tax compliance under Tanzanian law). When you request deletion:

• Your customer profile will be anonymised (name, phone, and addresses removed).
• Your order records will be retained in an anonymised form for our legal accounting obligations, but they will no longer be linked to your personal identity.
• Your saved addresses will be permanently deleted.

7.4 Right to Object

You have the right to object to the processing of your personal data for direct marketing purposes. You can withdraw marketing consent at any time without affecting your ability to use the platform for ordering.

7.5 Right to Data Portability

You can request a copy of your order history and account data in a structured, commonly used format (JSON or CSV). We will provide this within 30 days of verifying your identity.

Our platform is not directed at children under the age of 16. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. We will delete the information from our records as quickly as possible.

If you are under 18, you may use our platform only with the involvement and consent of a parent or guardian who agrees to these terms on your behalf.

Our platform uses only essential cookies and browser storage necessary for its operation:

• Session data: Stored in sessionStorage — used to temporarily hold checkout information (address, delivery area, payment method) as you move between the address form, payment page, and order confirmation. This data is cleared when you close your browser tab.
• Persistent preferences: Stored in localStorage — used to remember your sign-in state, prompt dismissal preferences, and wishlist. This data persists between visits but stays entirely on your device.

We do not use tracking cookies, advertising cookies, analytics cookies, social media pixels, or any third-party cookie-based tracking technology. There are no "Accept Cookies" banners on our platform because we do not deploy any cookies that require consent under standard privacy frameworks.

We may update this Privacy Policy from time to time. When we make changes, we will:

• Update the "Last updated" date at the top of this page.
• Post a notice on our platform for significant changes.
• For material changes that affect your rights, we may also notify you via SMS to the phone number linked to your account.

We encourage you to review this Privacy Policy periodically. Your continued use of the platform after changes are posted constitutes your acceptance of the updated policy.

This Privacy Policy is governed by the laws of the United Republic of Tanzania. Any disputes relating to this policy shall be subject to the jurisdiction of the courts of Dar es Salaam, Tanzania. We also aim to comply with relevant data protection principles including those set forth by the Tanzania Communications Regulatory Authority (TCRA) and the Personal Data Protection Act where applicable.

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices — or if you wish to exercise any of your data rights — please contact us:

We aim to respond to all privacy-related enquiries within 48 hours. If you are not satisfied with our response, you may lodge a complaint with the Tanzania Communications Regulatory Authority (TCRA) or the relevant data protection authority.