Privacy notice
Boss Limited ("Boss Limited", "we", "us") respects your privacy. This notice explains how we collect, use, store and protect personal data through this website and our business dealings with you, in accordance with the Personal Data Protection Act, 2022 (Act No. 11 of 2022) of the United Republic of Tanzania and its regulations, as administered by the Personal Data Protection Commission (PDPC).
1. What personal data we collect
We collect personal data you provide directly, and a small amount collected automatically:
- Contact form submissions — your name, email address, subject and message, when you write to us through this site.
- Newsletter sign-up — your name and email address, if you subscribe to updates.
- Client and correspondence records — name, job title, organisation, phone number, email and address, when you engage us as a client, supplier or partner.
- Technical data — standard web server logs (IP address, browser type, pages visited, date and time), collected automatically when you browse the site.
We do not knowingly collect sensitive personal data (health, biometric, financial account, or similar special categories) through this website.
2. Why we use your data
- To respond to enquiries and correspondence sent through our contact form.
- To provide, administer and support the security printing, cheque processing, anti-fraud and document archiving services we offer to banks and institutions.
- To send product updates or newsletters you have asked to receive.
- To maintain accurate business, accounting and compliance records.
- To keep our website secure and functioning correctly.
3. Our legal basis for processing
We process personal data only where we have a lawful basis to do so under the Act, which includes:
- Consent — for example, when you submit the contact form or subscribe to updates.
- Performance of a contract — where processing is necessary to deliver a product or service you or your organisation has requested.
- Legitimate interest — for routine business administration, security and record-keeping, balanced against your rights.
- Legal obligation — where we must retain or disclose records to comply with applicable law.
5. How long we keep it
We retain personal data only for as long as necessary for the purpose it was collected — typically for the duration of an enquiry, business relationship, or as required by Tanzanian tax, corporate or record-keeping law — after which it is securely deleted or anonymised.
6. How we protect it
We apply reasonable technical and organisational measures — including restricted access, secure storage and staff confidentiality obligations — to protect personal data against loss, misuse, unauthorised access, disclosure or alteration.
7. Your rights
Under the Personal Data Protection Act, 2022, you have the right to:
- Be informed about how your personal data is processed.
- Request access to the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request deletion of your data, where there is no lawful reason for us to continue holding it.
- Object to, or request restriction of, certain processing.
- Withdraw consent at any time, where processing is based on consent — this will not affect processing already carried out.
- Lodge a complaint with the Personal Data Protection Commission (see Section 11).
To exercise any of these rights, contact us using the details in Section 11. We will respond within the timeframe required by the Act.
9. Children's data
This website and our services are directed at businesses and adults. We do not knowingly collect personal data from children.
10. Changes to this notice
We may update this notice from time to time to reflect changes in our practices or the law. The "Effective" date at the top of this page shows when it was last revised. We encourage you to review it periodically.
11. Contact us & complaints
For any question about this notice, or to exercise your rights over your personal data, contact us directly:
If you are not satisfied with our response, you have the right to lodge a complaint with Tanzania's data protection regulator: