Privacy Policy

Buildra Systems Ltd ("Buildra", "we", "us") is a company registered in the United Republic of Tanzania, with its registered office at Rose Garden Rd, Mikocheni, Dar es Salaam. For the personal data described in this policy, Buildra acts as the data controller in respect of its own accounts and marketing, and as a data processor in respect of the project data and evidence that customers upload on behalf of their own clients.

Company registration number: [Company Registration No.] · TIN: [TIN]. Our Data Protection Officer can be reached at dpo@buildra.co.tz.

This policy covers personal data we process about account holders, their colleagues, prospective customers, and individuals who appear in or are referenced by the photos, videos and records captured on a project (for example a site worker visible in an image). It does not cover third-party websites we link to, which have their own policies.

• Account data — name, work email, phone number, employer, role, and login credentials.
• Project & evidence data — photos, videos, notes, milestones, reports, and the metadata sealed with each exhibit: GPS coordinates, device and server timestamps, the capturing user, and the work package.
• Billing data — organisation name, billing contact, and payment references. Card and mobile-money details are handled by our payment partners, not stored by Buildra.
• Device & usage data — IP address, device and browser type, app version, and logs of actions taken in the platform (including views and exports, which form part of the chain of custody).
• Communications — messages you send us by email, the walkthrough request form, or support channels.

• To provide, secure and maintain the Buildra platform.
• To seal, store and reproduce evidence with a verifiable chain of custody.
• To generate and deliver reports to the recipients a customer nominates (clients, banks, lawyers, site teams).
• To process subscriptions, invoicing and payments.
• To provide support, respond to enquiries, and send service notices.
• To detect, investigate and prevent fraud, abuse and security incidents.
• To comply with our legal and regulatory obligations.

We rely on one or more of the lawful bases recognised under the Personal Data Protection Act, 2022: performance of a contract with you or your organisation; your consent (which you may withdraw at any time); our legitimate interests in running and securing the service; and compliance with a legal obligation. Where we rely on consent — for example certain marketing — we ask for it separately and clearly.

We do not sell personal data. We share it only:

• With report recipients a customer designates, as part of the platform's core function.
• With sub-processors who host and operate the service (cloud infrastructure, communications and payment providers) under written contracts that require equivalent protection.
• Where required by law, a court of competent jurisdiction, or a lawful request from a Tanzanian authority such as the Personal Data Protection Commission.
• In connection with a business transfer (merger, acquisition or financing), subject to this policy.

Photos and videos captured on a project may show identifiable individuals. Customers who capture this content are responsible for having a lawful basis to do so and for informing the people concerned. Because evidence is sealed to a write-once record, edits and deletions are constrained by design — see our Evidence Policy for how requests affecting sealed records are handled.

We protect personal data with encryption in transit and at rest, access controls, audit logging, and write-once storage for sealed evidence. Data is hosted with reputable cloud providers; where feasible we use regions that support data residency appropriate to our Tanzanian customers. No system is perfectly secure, but we work to industry standards and review our controls regularly — see our Security & Compliance page.

We keep personal data for as long as needed to provide the service and to meet legal, accounting and evidentiary requirements. Sealed evidence and its chain of custody are retained for the period agreed in a customer's plan (for example a multi-year chain-of-custody term). When data is no longer required, we delete or anonymise it.

Subject to the Personal Data Protection Act, 2022, you may ask us to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• erase data, or restrict or object to processing, where the law allows;
• receive certain data in a portable form;
• withdraw consent where processing is based on consent.

To exercise these rights, contact dpo@buildra.co.tz. We may need to verify your identity, and some rights are limited where data forms part of a sealed evidentiary record held on behalf of a customer — in that case we will direct the request to the relevant customer (the controller).

Some of our providers process data outside Tanzania. Where we transfer personal data abroad, we do so in line with the Personal Data Protection Act, 2022 and applicable regulations, using appropriate safeguards and, where required, the conditions for transfer set by the Personal Data Protection Commission.

Our websites use a small number of cookies and similar technologies to keep you signed in, remember preferences, and understand aggregate usage. You can control cookies through your browser settings; blocking some may affect how the site works.

Buildra is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child's data has reached us, contact us and we will remove it.

We may update this policy from time to time. When we make material changes we will update the date above and, where appropriate, notify you. Continued use of the service after an update means you accept the revised policy.

Questions or requests: dpo@buildra.co.tz or Buildra Systems Ltd, Rose Garden Rd, Mikocheni, Dar es Salaam, Tanzania. If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commission of Tanzania.