Privacy Policy

NEDA Labs Ltd. ("Company", "we", "us") operates SimpleFX. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Platform. It applies to all Liquidity Providers and visitors.

This Policy is issued in compliance with the Personal Data Protection Act, 2022 (Tanzania), the Electronic and Postal Communications Act (Cap. 306, 2010), and, where applicable, the principles of the European Union General Data Protection Regulation (GDPR) for data subjects located in the European Economic Area.

The data controller responsible for your personal data is:

NEDA Labs Ltd.
Dar es Salaam, United Republic of Tanzania
Email: devops@ntzs.co.tz

We may collect and process the following categories of personal data:

• Identity Data: Full legal name, date of birth, nationality, government-issued identification number (e.g. NIDA, passport, driving licence).
• Contact Data: Email address, telephone number, physical address.
• Financial Data: Blockchain wallet addresses, transaction history on the Platform, deposited inventory amounts, earned fees.
• KYC/AML Data: Copies of identification documents, proof of address, source of funds declarations, and any enhanced due diligence data required under the Anti-Money Laundering Act (Cap. 423).
• Technical Data: IP address, browser type and version, device identifiers, operating system, time zone, referring URLs, and Platform usage data collected via cookies and analytics.
• Communications Data: Records of correspondence with us, including support requests.

We do not collect special categories of sensitive personal data (such as biometric data for identification purposes) except where required by applicable KYC/AML obligations.

We process your personal data on the following legal bases under the Personal Data Protection Act, 2022 and, where applicable, GDPR:

• Contract Performance: Processing necessary to provide you with the Platform and LP Wallet services.
• Legal Obligation: Processing required to comply with Tanzanian law, including KYC/AML obligations under the Anti-Money Laundering Act (Cap. 423), the Financial Intelligence Unit Act (Cap. 427), and reporting obligations to the Bank of Tanzania and FIU-Tanzania.
• Legitimate Interests: Processing for fraud prevention, Platform security, and product improvement, where such interests are not overridden by your rights.
• Consent: Where you have given specific, informed consent, including for optional marketing communications. You may withdraw consent at any time.

We use your personal data to:

• Verify your identity and complete KYC/AML screening;
• Create and manage your LP Wallet;
• Process and record transactions on the Platform;
• Detect, investigate, and prevent fraud, money laundering, and other illegal activities;
• Comply with legal obligations and respond to requests from FIU-Tanzania, the Bank of Tanzania, or other competent authorities;
• Communicate with you about your account, Platform updates, and changes to these policies;
• Improve the Platform through aggregated, anonymised analytics;
• Send marketing communications where you have consented.

We do not sell your personal data. We may share your data with:

• Regulatory Authorities: FIU-Tanzania, the Bank of Tanzania, the Tanzania Revenue Authority (TRA), and law enforcement agencies where required by law or court order;
• KYC/AML Service Providers: Third-party identity verification and sanctions screening providers operating under appropriate data processing agreements;
• Cloud Infrastructure Providers: Hosting and database providers (including those outside Tanzania) subject to adequate data transfer safeguards;
• Professional Advisers: Lawyers, auditors, and insurers bound by professional confidentiality obligations;
• Business Successors: In the event of a merger, acquisition, or asset sale, subject to the same privacy commitments.

Any international transfer of personal data is conducted in compliance with the cross-border transfer provisions of the Personal Data Protection Act, 2022, including the use of standard contractual clauses or adequacy determinations where applicable.

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including:

• A minimum of seven (7) years after the termination of your LP account, as required by the Anti-Money Laundering Act (Cap. 423) and the Electronic Transactions Act (2015);
• For the duration of any ongoing legal proceedings or regulatory investigations;
• As otherwise required by applicable Tanzanian law.

After the applicable retention period, data is securely deleted or anonymised.

Under the Personal Data Protection Act, 2022, you have the following rights in respect of your personal data:

• Right of Access: To request a copy of the personal data we hold about you;
• Right to Rectification: To request correction of inaccurate or incomplete data;
• Right to Erasure: To request deletion of your data, subject to our legal retention obligations;
• Right to Restriction: To request that we restrict processing of your data in certain circumstances;
• Right to Object: To object to processing based on legitimate interests;
• Right to Data Portability: To receive your data in a structured, machine-readable format where technically feasible;
• Right to Withdraw Consent: Where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at devops@ntzs.co.tz. We will respond within thirty (30) days. You also have the right to lodge a complaint with the Personal Data Protection Commission of Tanzania.

The Platform uses essential cookies necessary for its operation (e.g. session management) and, with your consent, analytics cookies to understand usage patterns. We do not use third-party advertising cookies. You may manage cookie preferences through your browser settings. Disabling essential cookies may impair Platform functionality.

We implement industry-standard technical and organisational security measures including AES-256 encryption for sensitive stored data, TLS 1.3 for data in transit, access controls, and regular security audits. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in high risk to your rights and freedoms, we will notify you and the Personal Data Protection Commission without undue delay, as required by the Personal Data Protection Act, 2022.

The Platform is not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected such data, we will delete it promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform or by email. The "Last updated" date at the top of this Policy indicates when it was last revised.

For any privacy-related queries or to exercise your data rights:

Data Protection Officer
NEDA Labs Ltd.
Dar es Salaam, United Republic of Tanzania
Email: devops@ntzs.co.tz