Privacy Policy
Sera hii ya faragha iko kwa Kiingereza. Kwa maswali kuhusu taarifa zako, tuandikie kwa posta@bsa.ai.
1. Who we are
Posta Salary Advance is a salary-advance service for employees of Tanzania Posts Corporation ("Posta", "we", "us"). Posta is the data controller for the personal data described in this policy.
Black Swan operates the technology behind the service (the WhatsApp assistant, the website and web app, and the loan systems) on Posta's behalf. Black Swan processes personal data only on Posta's instructions and for the purposes below.
Contact for anything about your personal data: posta@bsa.ai.
2. What this policy covers
- Our WhatsApp number, +255 669 097 459.
- This website, posta.creditsim.bsa.ai, and the Posta Salary Advance web app.
- The SMS and email messages we send you.
3. The data we collect
- Contact and account: your mobile number, WhatsApp profile name, language preference and PIN. We store your PIN only in a scrambled (hashed) form that nobody can read. If you turn on fingerprint or face sign-in, we keep the public key your device creates. We never receive your fingerprint or face from your device.
- Identity: your NIDA number, a photo of your NIDA card, and a selfie or short face video. We use these to confirm you are a real person and that you match your ID.
- Employment, from Posta's HR records: your name, employee number, department, take-home pay, payday and employment status. We use these to confirm you are Posta staff and to work out how much you can borrow.
- Loans and payments: your applications, amounts, fees, due dates and repayments, your mobile money number and payment references.
- Messages: what you send us on WhatsApp, by SMS or by email, including any photos or documents.
- Technical: IP address, device and browser details, and records of sign-ins and actions. We keep these for security and to fix problems.
4. How we use your data
- To confirm your identity and that you are eligible Posta staff. This is needed to provide the service and to meet our legal duties to know our customers and prevent fraud.
- To assess your application, set your limit, send your advance and collect repayments. This is needed to provide the service you ask for.
- To send you reminders, notices and one-time codes about your account and loans.
- To answer your questions. Some replies on WhatsApp are written by an automated assistant that uses artificial intelligence to read your message and look up your own account.
- To keep the service secure, detect fraud and resolve disputes.
- To keep records and report to regulators and licensed credit reference bureaus where the law requires or allows it.
Automated decisions. Some decisions about your application, such as your limit or whether a request can be approved straight away, are made automatically using your HR and repayment information. You can ask for a person to review any such decision by writing to posta@bsa.ai.
We do not sell your personal data, and we do not use it for advertising.
5. Who we share it with
- Black Swan, which runs the platform for Posta.
- Service providers that help us run the service, only for that purpose:
- Meta Platforms (WhatsApp), to exchange messages with you.
- Amazon Web Services, for the identity and face checks.
- Anthropic, for the automated assistant that helps answer your messages.
- Beem Africa, to send SMS.
- Resend, to send email.
- Payment providers, including Malipo and your mobile money operator, to send advances and collect repayments.
- Hosting and infrastructure providers that store and run our systems.
- Licensed credit reference bureaus, where the law allows, for example about late or missed repayments.
- Authorities and regulators, when the law requires it.
6. Transfers outside Tanzania
Some of our service providers, such as Meta, Amazon Web Services, Anthropic and Resend, process data outside Tanzania. We send them only what they need for their part of the service. We use the safeguards required by the Personal Data Protection Act, 2022 for these transfers.
7. How long we keep it
- Account, loan and payment records: while you use the service, then for as long as the law requires for financial records.
- Identity photos and face checks: for as long as needed to verify you and to prevent fraud, then deleted.
- Messages: for as long as needed to serve you and to resolve any dispute.
8. How we protect it
Data is encrypted in transit (HTTPS). PINs are stored only in hashed form. Access to personal data is limited to people and systems that need it, and access is logged.
9. Your rights
Under the Personal Data Protection Act, 2022 you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete your data, unless we must keep it by law or while a loan is outstanding;
- stop or limit some uses of your data, or withdraw a consent you gave;
- have a person review a decision made automatically.
Write to posta@bsa.ai and include the phone number you use with us. We may need to confirm it is you before acting. We aim to respond within 30 days. To delete your data, see data deletion.
If you are not happy with how we handled your data, you can complain to the Personal Data Protection Commission of Tanzania.
10. Age
The service is only for adults aged 18 or over who are employed by Posta.
11. Changes to this policy
We will update the date at the top when this policy changes, and tell you on WhatsApp about any important change.
12. Contact
Tanzania Posts Corporation, Posta Salary Advance: posta@bsa.ai