Share the details

Privacy

Last updated 28 October 2026. Nembo Creative Limited, trading as NEMBO.

Who is responsible

Nembo Creative Limited, trading as NEMBO, Mwenge Tower, Sinza A, Dar es Salaam, Tanzania, is the data controller for personal data collected on this site and through its order, reading and enquiry services. NEMBO processes personal data under the Personal Data Protection Act, 2022 (Cap. 44) of Tanzania and its regulations. Questions about personal data go to [email protected] or WhatsApp +255 667 218 891.

What is collected

  • Orders: name, company, email, phone or WhatsApp number, country, TIN where an invoice needs it, the order, the amount and its payment status.
  • Enquiries and sample requests: the details typed into the brief, diagnostic, order desk and sample forms, such as name, company, contact details, sector and the answers given.
  • Reader accounts: name, organisation, WhatsApp number, email, trial and subscription dates, and the number of devices in use. The access key is stored only as a one-way code that cannot be turned back into the key.
  • Messages: what a person sends to NEMBO by WhatsApp or email.
  • Visit measurement: anonymous page visits through Google Analytics, only after the visitor accepts it in the cookie notice. Declining leaves measurement off.
  • Settings kept on the device: the chosen theme, language and last document opened are saved in the visitor's own browser and are not sent to NEMBO.

Card and mobile wallet credentials go directly to Pesapal and never reach this site. NEMBO does not collect sensitive personal data such as health, religion or biometric data, and does not sell personal data.

Why, and on what legal basis

  • To perform a contract: taking payment, delivering documents and files, opening and running reader accounts, and answering the enquiry a person started.
  • To meet legal obligations: keeping invoices, receipts and accounting records that tax law requires.
  • Consent: visit measurement, the free sample and the follow-up messages that come with it, and any marketing message. Consent can be withdrawn at any time by writing to [email protected] or replying to the message to say so, and withdrawal does not affect what was done before it.
  • Legitimate interests: keeping the site and accounts secure, limiting abuse, refusing automated copying of documents, and preventing payment fraud.

NEMBO makes no decisions with legal or similar effect by automated means alone. The order desk suggests a package; a person at NEMBO confirms every order.

Who else receives it

  • Pesapal: to take payments.
  • Cloudflare: to host the site, store orders and reader accounts, and protect the site from attack.
  • Resend: to send receipts, files and access emails.
  • Google: visit measurement, only where consent was given.
  • Zatra Consultants Limited: where an ordered document is authored by Zatra, only the order details that document needs.
  • Authorities: where a law, court order or regulator requires it.

Each provider receives only what its task needs and may use it only for that task.

Storage outside Tanzania

Cloudflare, Resend and Google run servers outside Tanzania, including in the European Union and the United States, so personal data handled by them is processed abroad. NEMBO transfers personal data out of Tanzania only under the conditions in Part V of the Act, using providers bound by written data protection terms, with data encrypted in transit and at rest. A person who uses the services is told of this transfer here, and can ask NEMBO for details of the safeguards for a given provider.

How long it is kept

  • Enquiry and sample request records are deleted automatically about 13 months after they are made.
  • Orders, invoices and payment records are kept for at least five years, as Tanzanian tax law requires, then deleted.
  • Reader accounts are kept while access is active and deleted within 12 months after the trial or subscription ends, unless the account holder asks for earlier deletion.
  • Messages are kept for as long as the matter they concern is open, and then for up to 12 months.

Rights

Under the Act, a person whose data NEMBO holds can ask to:

  • be told what data is held, why, and who receives it, and get a copy;
  • correct data that is wrong, out of date or misleading;
  • have data erased where it is no longer needed or was processed unlawfully;
  • object to processing, including any use for marketing, and to restrict processing that may cause harm;
  • withdraw consent at any time.

Requests go to [email protected] from the email or WhatsApp number on the record, so that NEMBO can confirm the request comes from the right person. NEMBO replies within 30 days. There is no charge for a reasonable request.

Security

The site runs only over encrypted connections (HTTPS with HSTS). Stored data is encrypted at rest by the hosting provider. Access keys are stored as one-way codes, the accounts desk is protected by a private key, access to records is limited to the people who need it, and no payment card data is handled by NEMBO. If a breach affects personal data, NEMBO notifies the Personal Data Protection Commission promptly as the Act requires, and tells the people affected where the breach puts them at risk.

Children

The services are for businesses and adults. NEMBO does not knowingly collect personal data from anyone under 18; a parent or guardian who finds that a child has sent data can ask for it to be deleted.

Complaints

A person who is not satisfied with NEMBO's answer can complain to the Personal Data Protection Commission of Tanzania at pdpc.go.tz.

Changes

This notice is reviewed when the services or the law change. The date at the top shows the latest version.