Privacy Policy

The Services are intended for people aged 18 or older. We do not knowingly invite or intentionally collect personal data from children under 18. If you believe a person under 18 has submitted personal data to us, contact us at hassani@mustmarket.store so that we can investigate and take appropriate action.

The Services are designed primarily for students connected with Mbeya University of Science and Technology (“MUST”), but approved businesses, restaurants, food vendors, delivery providers, and other service providers may use relevant vendor features. This Policy applies to customers, buyers, sellers, vendors, restaurants, delivery participants, visitors, and account holders.

MUST Market determines the purposes and means of processing personal data for the Services and may act as a data controller or equivalent responsible entity under applicable Tanzanian data-protection law. We may also use service providers as processors or service providers to host, secure, authenticate, communicate, store, analyze, and operate the Services.

We will not appoint a formal Data Protection Officer or claim regulatory registration in this Policy unless that appointment or registration has actually been completed. We will update this Policy if our legal structure, registration status, or responsible privacy contact changes.

Please do not submit unnecessary sensitive information, passwords, mobile-money PINs, national identification numbers, medical information, or private information about another person through a listing, message, image, or support channel.

We collect information directly when you create or use an account, browse or post a listing, order food, communicate with a seller or vendor, submit a support request, join a rewards or referral programme, subscribe to communications, or contact us.

We may collect information automatically from your browser or device through server logs, cookies, analytics tools, and similar technologies. We may receive limited information from authentication providers such as Google or a university identity system when you choose to use those services. We may also receive order or delivery status from independent restaurants, food vendors, delivery providers, payment providers, and other service partners.

We may use personal data to:

1. Create, authenticate, maintain, and secure accounts;
2. Provide the marketplace, including publishing listings and helping buyers and sellers communicate;
3. Facilitate Msosi Fasta menus, orders, vendor communication, payment status, and delivery coordination;
4. Connect customers with independent restaurants, food vendors, sellers, and delivery participants;
5. Process mobile-money payments through applicable payment providers and reconcile payment records;
6. Provide customer support, respond to complaints, investigate reports, and resolve disputes;
7. Operate, calculate, administer, and audit experimental or future day-streak, reward-point, referral, coupon, and promotional programmes;
8. Detect fraud, abuse, manipulation, prohibited listings, account compromise, spam, and other security or policy violations;
9. Improve usability, reliability, performance, safety, and features;
10. Send service messages, order updates, security notices, and account notices;
11. Send marketing or promotional communications where permitted and where you have not opted out;
12. Comply with applicable laws, lawful requests, court orders, regulatory requirements, and tax or accounting obligations; and
13. Establish, exercise, or defend legal claims and protect the rights, safety, and property of MUST Market, users, vendors, and the public.

We will not use personal data for a materially incompatible purpose without providing an appropriate notice or obtaining consent where required.

Depending on the circumstances and applicable law, our lawful basis may include providing a service you requested, performing or taking steps toward an agreement, complying with a legal obligation, protecting safety and security, pursuing legitimate operational interests that do not override your rights, or obtaining your consent.

You may withdraw consent where processing is based on consent. Withdrawal does not necessarily affect processing already carried out lawfully before withdrawal, and it may prevent us from providing a feature that requires the relevant data.

We do not sell personal data as a business model. We do not disclose personal data to unrelated third parties for their independent direct marketing unless you have been informed and have provided the required consent.

If you publish a marketplace listing, some information may be visible publicly or to other users, including the product title, description, price, category, condition, location area, listing image, seller display name, and listing date. Do not publish your private address, financial credentials, passwords, or another person’s personal data.

A buyer or seller may contact you through WhatsApp or another communication channel. Once you communicate directly with another user, that person may process information independently of MUST Market. Review the privacy practices and security settings of those services and do not share information that you do not want the other participant to have.

Msosi Fasta listings and orders may be fulfilled by independent restaurants and food vendors rather than by MUST Market. We may share the customer’s name, phone number, food order, delivery location, payment status, and relevant instructions with the vendor or delivery participant to fulfil the order.

Independent vendors may have their own legal and privacy responsibilities. We expect them to use customer data only for legitimate fulfilment, support, safety, and legal purposes and not for unrelated marketing without an appropriate lawful basis.

MUST Market currently supports mobile-money payments only and does not accept cash for applicable paid orders. Payment processing may involve third-party mobile-money or payment providers. We may receive payment status, transaction reference, amount, currency, and related metadata, but we do not intend to collect or store your mobile-money PIN.

Payment providers may process information under their own terms and privacy notices. Payment disputes, reversals, failed payments, and refunds may require us to share relevant order and payment references with the provider and the vendor.

Day streaks, reward points, referrals, coupons, free-soda promotions, and similar features may currently be experimental and may become active or change in the future. We may collect activity and eligibility data needed to prevent abuse and determine whether a qualifying action occurred.

Unless a specific promotion states otherwise, rewards are not cash, are not transferable, are not guaranteed, have no independent monetary value, and may expire or be cancelled if obtained through fraud, duplicate accounts, self-referrals, chargebacks, cancelled orders, prohibited conduct, or technical error. We may change or discontinue a programme prospectively, subject to applicable law and any specific terms published for a promotion.

We may use essential cookies and similar technologies for authentication, security, session management, preferences, and core functionality. We may use analytics or performance tools to understand how the Services are used and improve them. Where required, we will request consent for non-essential cookies and provide appropriate controls.

You can control cookies through your browser settings. Disabling essential cookies may prevent login, ordering, referral attribution, or other features from functioning.

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including account operation, order and payment records, rewards and referral audit records, customer support, fraud prevention, legal claims, tax/accounting obligations, and dispute resolution.

Retention periods depend on the type of data, the sensitivity and volume of the information, whether an account remains active, legal requirements, and legitimate operational needs. When data is no longer needed, we will delete, anonymize, or securely dispose of it, subject to lawful exceptions.

We use reasonable technical and organizational safeguards appropriate to the nature of the data and the risks involved. These may include access controls, authentication, encryption in transit where supported, logging, backups, vendor controls, least-privilege access, and procedures for incident response.

No internet service is completely secure. You are responsible for protecting your account credentials, device, mobile phone, and mobile-money authentication information. We will not ask you to disclose your mobile-money PIN or account password through an unsolicited message.

If we become aware of a personal-data incident, we will investigate, take reasonable remedial steps, and make notifications where required by applicable law.

Some service providers, hosting systems, authentication providers, analytics providers, messaging platforms, or payment providers may process data outside Tanzania or in jurisdictions different from your own. Where applicable, we will use appropriate contractual, organizational, or legal safeguards and provide information required by applicable law.

Third-party websites and services linked from MUST Market, including WhatsApp, Google, social media, mobile-money providers, restaurants, and delivery services, are governed by their own terms and privacy notices. We are not responsible for the independent practices of third parties.

Subject to applicable Tanzanian law and lawful limitations, you may have rights to request information about processing, access a copy of personal data, correct inaccurate data, request deletion or restriction, object to certain processing, withdraw consent, request portability where applicable, and complain to the relevant supervisory authority.

To make a request, email hassani@mustmarket.store with the subject “Privacy Request”. Explain the request, identify the account or information concerned, and provide reasonable information to help us verify your identity. We may request additional verification to protect against unauthorized disclosure.

We aim to respond within the period required by applicable law. We may retain limited information where necessary for legal compliance, security, fraud prevention, payment reconciliation, dispute resolution, or establishment or defence of legal claims.

You may also contact the Personal Data Protection Commission where you believe your rights have been infringed or a complaint has not been resolved. The relevant contact details should be confirmed from the Commission’s current official channels.

You may unsubscribe from non-essential marketing messages by using the unsubscribe option where provided or by contacting hassani@mustmarket.store. Service, security, account, payment, and order communications may still be sent where necessary to provide the Services.

We may update this Policy to reflect changes in the Services, law, vendors, rewards programmes, or data practices. We will publish the updated version on the website and revise the effective date. Where the law requires additional notice or consent for a material change, we will take the required steps.