Boomkadi Privacy Policy

1. Introduction

Boomkadi is operated by ZaidiPro Innovation Firm.

We respect the privacy of:

• Customers
• Guests
• Event Organisers
• Partners
• Vendors
• Staff
• Ushers
• other authorised users
• visitors to Boomkadi services

This Privacy Policy explains how personal data may be collected, used, stored, shared and protected when using Boomkadi, BoomOS, public Event pages and related services.

2. Data Controller

The Data Controller responsible for Boomkadi is:

ZaidiPro Innovation Firm

P.O. Box 12105 Dar es Salaam, Tanzania

Official Email: zaidiprotz@gmail.com

Privacy / Data Protection Email: boomkaditz@gmail.com

Phone / WhatsApp: +255 659 553 848

ZaidiPro Innovation Firm is registered with the Personal Data Protection Commission of Tanzania as a Data Controller.

PDPC Registration Number: 0-000-010-918

Registration Date: 17 June 2026

Valid Until: 17 June 2031

Nature of Work: Information Technology

3. Data Protection Principles

Boomkadi aims to process personal data:

• lawfully;
• fairly;
• transparently;
• for specified and legitimate purposes;
• only to the extent reasonably necessary;
• accurately;
• securely;
• only for an appropriate retention period.

We seek to follow applicable Tanzanian personal data protection requirements.

4. Personal Data We May Collect

Depending on how a person interacts with Boomkadi, we may process the following categories.

Account Information

• Full name
• Email
• Telephone number
• Profile image
• Business name
• Account role
• Authentication/security information

Customer and Order Information

• Customer name
• Contact information
• Event details
• Event type
• Event date
• Venue
• Services ordered
• Card quantities
• Guest quantities
• Quotations
• Invoices
• Payment status

Guest Information

• Guest name
• Telephone number
• Invitation/Card type
• Card number
• QR identifier
• RSVP status
• Attendance status
• Check-in timestamp
• Other relevant Event attendance information

Pledge and Contribution Information

• Name
• Telephone number
• Pledge amount
• Amount recorded as paid
• Message
• Card category
• Card entitlement
• Contribution status

Partner Information

• Name
• Contact information
• Referral code
• Referral links
• Referred Orders
• Referral Leads
• Events
• Commission information
• Commission status

Vendor Information

• Business name
• Business description
• Contact information
• Location
• Service categories
• Packages
• Prices
• Portfolio
• Social media links
• Availability
• Event assignments
• Ratings and reviews

Staff and Operational Information

• Personnel details
• Event assignments
• Availability
• Attendance
• Work-related information

Technical Information

Where reasonably required, technical information may include:

• IP address
• Browser/device information
• Login records
• timestamps
• security events
• system logs

Communication Information

We may process communications involving:

• Customer support
• Email
• SMS
• WhatsApp where applicable
• notifications
• feedback
• service enquiries

5. Guest Information Provided by Event Organisers

Boomkadi may receive Guest information from:

• Customers
• Event Organisers
• authorised Event Managers
• other appropriately authorised persons

This information may be used for:

• invitation management;
• QR generation;
• RSVP;
• Event admission;
• attendance;
• Event communications; and
• Event reporting.

Event Organisers should provide only information reasonably necessary for their Event.

They should not upload unnecessary sensitive personal data.

6. How We Use Personal Data

Personal data may be used to:

• create accounts;
• authenticate users;
• administer accounts;
• process Orders;
• manage Customers;
• create Events;
• manage Events;
• create digital invitations;
• generate QR credentials;
• manage Guest lists;
• manage RSVP;
• manage Event attendance;
• provide scanning services;
• manage Pledges;
• record Contributions;
• manage Partners;
• attribute referrals;
• calculate and administer commissions;
• manage Vendors;
• manage Vendor profiles;
• manage Vendor assignments;
• manage Event personnel;
• maintain Event Finance records;
• create invoices;
• generate reports;
• provide Customer support;
• send operational communications;
• maintain security;
• prevent fraud;
• investigate abuse;
• comply with legal obligations; and
• improve Boomkadi.

7. Basis for Processing

Depending on the circumstances, personal data may be processed because it is necessary for:

• providing a requested service;
• performing a contract;
• taking requested steps before entering into an agreement;
• complying with legal obligations;
• legitimate operational or security purposes permitted by applicable law;
• protecting lawful interests; or
• consent where consent is specifically required.

Boomkadi does not treat consent as the legal basis for every processing activity.

Where processing specifically relies on consent, the person may withdraw that consent subject to applicable law and any processing already lawfully carried out.

8. Sensitive Personal Data

Boomkadi is not designed to routinely collect unnecessary sensitive personal data.

Users should avoid uploading unnecessary information concerning matters such as:

• health;
• biometric information;
• religion;
• other sensitive personal characteristics; or
• other information requiring additional legal protection

unless the information is genuinely necessary, lawful and appropriately authorised.

Additional safeguards may apply where sensitive personal data is processed.

9. Information Concerning Children

Boomkadi is primarily intended for adults, businesses and organisations managing Events.

Where information concerning a child is legitimately required for an Event, the Event Organiser or responsible adult should ensure that it is provided lawfully and only to the extent necessary.

Boomkadi should not be used to unnecessarily collect sensitive information about children.

10. Sharing Personal Data

Boomkadi may share information with authorised recipients where reasonably necessary to provide the service.

Recipients may include:

• the Customer/Event Organiser;
• authorised Boomkadi staff;
• assigned Ushers;
• assigned Scanners;
• assigned Supervisors;
• assigned Vendors;
• authorised Partners;
• payment providers;
• email providers;
• SMS providers;
• messaging providers;
• hosting/cloud infrastructure providers;
• professional advisers;
• regulators;
• lawful authorities where legally required.

Boomkadi does not sell personal data as a commodity.

Access should be limited according to role and purpose.

11. Vendor Access to Event Information

A Vendor assigned to an Event should receive only information reasonably required to perform the assigned service.

This may include:

• Event name
• Event type
• Event date
• Event time
• Venue
• relevant service instructions
• approved contact information

A Vendor should not automatically receive unrestricted access to:

• Event Finance;
• Partner commissions;
• private CRM notes;
• unrelated Guest information;
• other Vendors' private information;
• Admin information.

12. Partner Access to Referral Information

Partners may access information reasonably required to track referrals associated with them.

This may include:

• Customer/Event identification
• Event type
• referral stage
• qualifying deal value
• commission
• commission status
• Event status

Partners should not receive unrestricted access to:

• internal CRM notes;
• Staff tasks;
• Event expenses;
• internal margins;
• unrelated Customer information;
• private Admin information.

13. Public Vendor Profiles

Vendors may choose to publish business information publicly.

Public information may include:

• Business name
• Logo
• Banner
• Business description
• Service categories
• Location
• Packages
• Prices
• Portfolio
• Business contact information
• Social media links
• Ratings

Private information must not automatically be publicly displayed.

Private information may include:

• verification documents;
• identity documents;
• private account data;
• internal Admin notes;
• internal Event assignments;
• private financial information.

14. Social Media and Embedded Content

Vendors may provide links to public Instagram or other social media content.

Boomkadi may display or embed public social content where technically permitted.

When embedded content is loaded or interacted with, the relevant third-party social platform may process information according to its own terms and privacy practices.

15. Payment Information

Boomkadi may use third-party payment providers.

Where payment credentials are entered directly into a third-party payment environment, Boomkadi may not receive or store complete card/payment credentials.

Boomkadi may retain relevant transaction information including:

• transaction reference;
• amount;
• payment status;
• transaction date;
• payment provider;
• Order reference;
• Event reference.

16. Cookies and Similar Technologies

Boomkadi may use cookies, browser storage or similar technologies for purposes including:

• authentication;
• session management;
• security;
• language preference;
• essential functionality;
• analytics where enabled.

Strictly necessary technologies may be required for the platform to function.

Where non-essential analytics, advertising or tracking technologies are used and applicable law requires user choice, Boomkadi should provide appropriate controls.

17. Data Retention

Personal data is retained only for as long as reasonably necessary for purposes including:

• service delivery;
• Event administration;
• contractual obligations;
• financial/accounting records;
• dispute resolution;
• security;
• fraud prevention;
• regulatory obligations;
• legitimate business records.

Different categories of information may require different retention periods.

Where information is no longer reasonably required, it may be:

• securely deleted;
• anonymised; or
• archived where retention remains legally justified.

18. Security

Boomkadi uses reasonable technical and organisational safeguards intended to protect personal data.

These may include:

• authentication;
• role-based access;
• database access controls;
• Row Level Security;
• restricted administrative access;
• secure hosting;
• controlled storage;
• activity logging;
• security monitoring;
• access separation.

No internet-based service can guarantee absolute security.

Users are responsible for protecting their account credentials.

19. Personal Data Breaches

Where Boomkadi becomes aware of a personal data breach, ZaidiPro Innovation Firm will assess the incident and take appropriate steps to:

• contain the incident;
• investigate;
• reduce risk;
• remediate vulnerabilities; and
• meet applicable notification obligations.

Where notification to affected individuals or the Personal Data Protection Commission is legally required, applicable procedures will be followed.

20. International and Cross-Border Processing

Some technology providers used by Boomkadi may process or host information outside Tanzania.

Where personal data is transferred outside Tanzania, ZaidiPro Innovation Firm will seek to ensure that the transfer is handled according to applicable Tanzanian personal data protection requirements and appropriate safeguards.

21. Data Subject Rights

Subject to applicable law and relevant exceptions, individuals may have rights concerning their personal data, including:

• Right to be informed
• Right of access
• Right to rectification/correction
• Right to erasure/destruction where applicable
• Right to restrict processing where applicable
• Right to data portability where applicable
• Right to object where applicable
• Rights relating to certain automated decisions
• Right to withdraw consent where processing relies on consent
• Right to complain to the appropriate authority
• Other rights provided under applicable Tanzanian law

22. Exercising Privacy Rights

Privacy/data protection requests may be submitted to:

ZaidiPro Innovation Firm / Boomkadi

Privacy / Data Protection Email:

boomkaditz@gmail.com

Official Email:

zaidiprotz@gmail.com

Phone / WhatsApp:

+255 659 553 848

P.O. Box 12105 Dar es Salaam, Tanzania

Boomkadi may need to verify the identity or authority of a person making a request before:

• providing personal data;
• correcting information;
• deleting information;
• transferring information; or
• taking another privacy-related action.

This protects information against unauthorised disclosure or deletion.

23. Complaints

If a person has concerns about how Boomkadi processes personal information, they are encouraged to contact:

boomkaditz@gmail.com

so the matter can be investigated.

Individuals may also exercise complaint rights available under Tanzania's personal data protection framework, including contacting the Personal Data Protection Commission where applicable.

24. Automated Processing and AI-Assisted Features

BoomOS may use automated calculations or AI-assisted functionality for operational purposes including:

• Event statistics;
• card calculations;
• referral calculations;
• Vendor recommendations;
• availability indicators;
• Event summaries;
• Finance analysis;
• AI Insights.

AI-generated or automated operational insights should not automatically be treated as authoritative legal, financial or contractual decisions.

Where applicable law provides rights relating to significant automated decisions, those rights will be respected.

25. Marketing

Boomkadi may send marketing communications where permitted.

Marketing preference must be treated separately from required service communications.

Where marketing consent is requested, it should be optional.

Users should be provided with an appropriate method to opt out of eligible marketing communications.

Transactional messages relating to:

• Orders;
• Events;
• security;
• assignments;
• payments;
• account operation; or
• requested services

may still be sent where necessary.

26. Third-Party Links

Boomkadi may contain links to third-party websites and services.

Third-party privacy practices are governed by their own privacy policies.

Users should review relevant third-party policies when leaving Boomkadi.

27. Changes to This Privacy Policy

This Privacy Policy may be updated where:

• Boomkadi features change;
• business practices change;
• technology providers change;
• security requirements change; or
• legal/regulatory requirements change.

Material changes may be communicated through the website, BoomOS, email or another reasonable method.

The current Effective Date and Last Updated date must always be displayed.

28. Contact and Data Controller Information

Data Controller: ZaidiPro Innovation Firm

Platform: Boomkadi / BoomOS

PDPC Registration Number: 0-000-010-918

Registration Date: 17 June 2026

Registration Valid Until: 17 June 2031

Registered Address: P.O. Box 12105, Dar es Salaam, Tanzania

Official Email: zaidiprotz@gmail.com

Privacy / Data Protection Email: boomkaditz@gmail.com

Phone / WhatsApp: +255 659 553 848