Heritage Microfinance Company Limited

Privacy Policy

Last updated: August 2026

Heritage Microfinance Company Limited ("Heritage Microfinance", "we", "us" or "our") respects your privacy and is committed to protecting the personal data of our customers, website visitors and other individuals we interact with. This Privacy Policy explains what information we collect, how we use it, how we protect it, and the rights you have in relation to your personal data.

This Policy applies to personal data collected through our website (heritagefinancing.co.tz), our offices, our products and services, and any other interaction you have with us. It is prepared in line with the Personal Data Protection Act, 2022 of the United Republic of Tanzania and its regulations.

1 Information We Collect

Depending on your relationship with us, we may collect the following categories of personal data:

  • Identity information — full name, date of birth, gender, nationality, national identification number (NIDA), passport or voter ID details, photographs and signatures.
  • Contact information — postal address, physical/residential address, email address and telephone numbers.
  • Financial information — bank account and mobile money details, income and salary information, employment details, business records, credit history and repayment records.
  • Loan and transaction information — loan applications, guarantor details, collateral information, transaction history and account activity.
  • Technical information — IP address, browser type, device information and website usage data collected when you visit our website.
  • Communications — records of correspondence, enquiries, complaints and feedback you send to us.

2 How We Collect Your Information

We collect personal data:

  • Directly from you — when you apply for a loan, open an account, complete forms, visit our offices, contact us, or use our website;
  • From third parties — such as credit reference bureaus, guarantors, employers (for salary loans, with your consent), group members (for group lending), and publicly available sources;
  • Automatically — through cookies and similar technologies when you browse our website.

3 How We Use Your Personal Data

We use your personal data to:

  • Assess and process loan applications, including credit and affordability assessments;
  • Provide, administer and manage our financial products and services;
  • Verify your identity and comply with Know Your Customer (KYC) requirements;
  • Communicate with you about your accounts, repayments and our services;
  • Manage loan repayment, collections and debt recovery in a fair and lawful manner;
  • Comply with legal and regulatory obligations, including anti-money laundering (AML) laws and Bank of Tanzania requirements;
  • Prevent, detect and investigate fraud and other financial crime;
  • Improve our products, services, website and customer experience;
  • Send you information about products, services or financial education, where permitted.

4 Legal Basis for Processing

We process your personal data where:

  • Contract — processing is necessary to enter into or perform a contract with you (e.g. a loan agreement);
  • Legal obligation — we are required to process data by law or regulation;
  • Consent — you have given consent for a specific purpose, which you may withdraw at any time;
  • Legitimate interests — processing is necessary for our legitimate business interests, such as fraud prevention and improving our services, balanced against your rights.

5 Sharing and Disclosure of Your Data

We do not sell your personal data. We may share your data with:

  • Regulators and authorities — including the Bank of Tanzania, the Personal Data Protection Commission and law enforcement, where required by law;
  • Credit reference bureaus — for credit assessment and reporting in accordance with applicable law;
  • Service providers — trusted third parties who support our operations (e.g. IT systems, payment processors, SMS providers), under confidentiality obligations;
  • Guarantors and group members — only to the extent necessary for the administration of guaranteed or group loans;
  • Professional advisers — auditors, lawyers and consultants bound by professional duties of confidentiality.

Where data is transferred outside Tanzania, we ensure appropriate safeguards are in place as required by the Personal Data Protection Act, 2022.

6 Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration or disclosure. These include access controls, secure storage, staff confidentiality obligations and regular review of our security practices. While no system is completely secure, we work continuously to safeguard your information.

7 Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including satisfying legal, regulatory, accounting and reporting requirements. Loan and financial records are retained in accordance with the periods prescribed by Tanzanian law, after which data is securely deleted or anonymized.

8 Your Rights

Subject to applicable law, you have the right to:

  • Be informed about how your personal data is processed;
  • Access the personal data we hold about you;
  • Request correction of inaccurate or incomplete data;
  • Request deletion of your data where there is no lawful basis for continued processing;
  • Object to or request restriction of certain processing;
  • Withdraw consent at any time, where processing is based on consent;
  • Lodge a complaint with the Personal Data Protection Commission of Tanzania.

To exercise any of these rights, please contact us using the details in Section 13. We may need to verify your identity before acting on your request.

9 Cookies and Website Analytics

Our website uses cookies and similar technologies to ensure the site functions properly, to understand how visitors use it, and to improve your browsing experience. You can manage or disable cookies through your browser settings; however, some parts of the website may not function properly without them.

10 Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policies of any website you visit.

11 Children's Privacy

Our products and services are intended for adults. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. The updated version will be posted on this page with a revised "Last updated" date. We encourage you to review this page periodically.