Privacy Policy

1 Who We Are

ZAN SECURITIES LIMITED is a licensed stockbroker and dealer and a member of the Dar es Salaam Stock Exchange (DSE), operating in both mainland Tanzania and Zanzibar. We provide investment services, including dealing in securities, collective investment schemes (such as the Timiza Fund, Timiza Plus Fund and Zan Timiza ETF), asset management, corporate finance, investment advisory and research.

Registered office: 1st Floor, VIVA Towers, Ali Hassan Mwinyi Road, P.O. Box 5366, Dar es Salaam, Tanzania. We also operate a branch at 3rd Floor, Michenzani Mall, Karume Road, P.O. Box 2138, Zanzibar, Tanzania.

Website: https://zansec.co.tz
Email: investorsupport@zansec.co.tz, info.dsm@zansec.co.tz, info.znz@zansec.co.tz
Phone: +255 222 103 433, +255 750 011 250, WhatsApp: +255 756 111 888.

2 Introduction

We are committed to protecting your privacy and to processing your personal data lawfully, fairly and transparently. This Privacy Policy describes:

• the personal data we collect and why we collect it;
• the legal bases we rely on to process personal data;
• how we use, store, share and protect your personal data;
• your rights in respect of your personal data and how to exercise them;
• how to contact us about privacy or data protection matters; and
• how to make a complaint, including to a supervisory authority.

Please read this Privacy Policy carefully. If you do not agree with the practices described, please do not submit your personal data through our website or forms.

3 Personal Data We Collect

We collect personal data that you provide to us directly and information that is collected automatically when you use our website and digital services. The categories of personal data we collect include:

Identification data: full name, date of birth, gender, nationality, and country of residence.

Contact data: postal and physical address, email address, telephone and mobile numbers.

Identity verification data: national identification (NIDA) number, passport number and expiry date, TIN number, voter ID, driving licence number, and related identification documents and images.

Financial data: bank name, bank account number and account name, CDS account details, occupation, employer and employment identification, and information relating to your investments, unit holdings, bids, purchases and repurchase/redemption requests.

Form content data: the content of application forms, contact and enquiry messages, complaint details, and communications you send to us.

Technical and usage data: your IP address, browser type, device information, pages visited, access times and referring pages (see the section on automatic information and cookies below).

4 Information Provided Directly by Users

You provide personal data directly to us when you:

• complete an online application form (for example, to open an account, subscribe to units of the Timiza Fund, make a buying or repurchase request, participate in an auction, or open a CDS securities account);
• submit a contact, enquiry or call-back request through our website;
• subscribe to our newsletter or fund reports;
• upload documents, identification images or signature images as part of an application;
• correspond with us by email, telephone, WhatsApp or in person.

Where you provide personal data of another person (for example, a joint applicant, next of kin, authorised signatory or nominee), you confirm that you have their authority to do so and that they have been made aware of this Privacy Policy.

5 Automatically Collected Information

When you visit our website, we may automatically collect certain technical information, including your IP address, browser type and version, operating system, the pages you visit, the time and date of your visit, and the website from which you linked to us. This information helps us to keep the website secure, diagnose faults, and understand how visitors use our site so we can improve it.

We may also use third-party services (described under "Cookies and Tracking Technologies" below) that set cookies or similar technologies on your device.

6 How We Use Personal Data

We use personal data for the following purposes:

• Providing our services: processing applications to open accounts, buy, sell or repurchase units, participate in auctions, and manage your investments;
• Client onboarding and verification: verifying identity as required by anti-money laundering (AML), counter-terrorism financing (CTF) and know-your-client (KYC) obligations under Tanzanian law and DSE rules;
• Communication: responding to your enquiries, requests and complaints, and providing client support;
• Legal and regulatory compliance: complying with applicable laws and regulations and lawful requests from regulators and authorities;
• Records and administration: maintaining internal records, executing and confirming transactions;
• Improvement and security: improving our website and services, and detecting and preventing fraud or misuse;
• with your consent: sending newsletters, fund reports and marketing communications that you have asked to receive.

7 Legal Basis for Processing Personal Data

We process personal data on one or more of the following lawful bases:

• Consent: where you have given us clear, freely given, specific, informed and unambiguous consent to process your personal data for a particular purpose (for example, to use a form or to receive marketing communications);
• Performance of a contract: where processing is necessary for us to take steps at your request before entering into a contract or to perform a contract with you (for example, to process an application or investment transaction);
• Legal obligation: where processing is necessary to comply with a legal or regulatory obligation, including obligations under the securities, capital markets, anti-money laundering and tax laws of Tanzania;
• Legitimate interests: where processing is necessary for our legitimate interests (for example, to keep our systems secure, prevent fraud, or respond to enquiries), and those interests are not overridden by your rights and interests.

8 Consent

Where we rely on your consent to process personal data, we will request it in a clear and explicit manner. Our online forms include a consent statement in which you agree to us collecting and processing your personal data for the purpose of providing the requested services, in accordance with this Privacy Policy.

Consent checkboxes are never pre-ticked. You are free to choose whether to give consent. Where your consent is required to process a form or request, we cannot process it without your consent. You may withdraw your consent at any time by contacting us using the details in the "Contact Us" section below. Withdrawal of consent will not affect the lawfulness of processing carried out before your withdrawal.

9 How We Store and Protect Personal Data

We store personal data on secure servers and take appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include access controls, secure data transmission (TLS/HTTPS), restricted access on a need-to-know basis, and internal policies and training. Personal data may be stored in electronic and physical records and is accessible only to authorised personnel.

Where payment details, receipts or identification documents are submitted online, they are handled securely and used only for the purposes described in this Privacy Policy.

10 Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, and to satisfy legal, accounting, regulatory and reporting requirements (including record-keeping obligations under securities and anti-money laundering laws, which may require certain records to be kept for a number of years). When personal data is no longer required, we securely delete or anonymise it.

11 Sharing / Disclosure of Personal Data

We do not sell personal data. We may share personal data with the following categories of recipients, only where necessary and lawfully permitted:

• Regulators and authorities: the Dar es Salaam Stock Exchange (DSE), the Central Depository for Securities (CDS), the Capital Markets and Securities Authority (CMSA), the Bank of Tanzania (BoT), and other authorities where we are legally obliged or authorised to do so;
• Service providers: third parties who help us operate our business, such as payment processors, SMS/messaging providers, cloud and hosting providers, and IT and security services;
• Professional advisers: auditors, legal advisers and consultants bound by confidentiality;
• Business parties: counterparties and settlement institutions necessary to execute your transactions, such as the CSDR and clearing members.

12 Third-Party Service Providers

We engage third-party providers to support our website and services, including hosted libraries and tools (such as font and script libraries delivered through content delivery networks), a live-chat support service, mapping services and, with your consent, a translation service. These providers may process limited technical information in order to deliver their services. Where a service provider processes personal data on our behalf, we require it to do so in accordance with this Privacy Policy and applicable data protection law, and to implement appropriate security measures.

13 Cookies and Tracking Technologies

Our website uses cookies and similar technologies for essential and non-essential purposes. Essential cookies are required for the website to function. Non-essential technologies include our live-chat support service and an optional website translation service, which may set cookies or collect limited information to provide those features.

When you first visit our website you are shown a cookie consent notice. You may choose to accept all non-essential technologies or to continue with essential ones only. Your choice is stored in a cookie on your device and you can change it at any time by clearing your browser cookies.

• Essential cookies: required for security, form processing and basic functionality.
• Live-chat cookies: provided by our third-party chat service, used only when you accept non-essential technologies.
• Translation cookies: used by our optional translation tool, loaded only when you accept non-essential technologies.

14 Your Rights as a Data Subject

Subject to applicable law, you have the following rights in relation to your personal data:

• Right of access: to obtain confirmation that we process your personal data and a copy of the personal data we hold about you;
• Right to correction: to ask us to correct inaccurate or incomplete personal data;
• Right to deletion: to ask us to delete your personal data where permitted by law;
• Right to restrict processing: to ask us to restrict how we process your personal data in certain circumstances;
• Right to object: to object to processing based on our legitimate interests or for direct marketing;
• Right to data portability: to receive the personal data you provided to us in a structured, commonly used and machine-readable format, where the processing is based on consent or contract;
• Right to withdraw consent: to withdraw your consent at any time where processing is based on consent;
• Right to complain: to lodge a complaint with a supervisory authority, including the Personal Data Protection Commission of Tanzania.

15 How to Request Access, Correction or Deletion

To exercise any of your rights, or to ask a question about your personal data, please contact our privacy team in writing using the contact details below. To help us respond quickly, please provide your full name, the email address or account details used when you engaged with us, and a description of your request.

We will respond to legitimate requests within a reasonable time (normally within 30 days) and free of charge. We may need to verify your identity before acting on your request. We may be unable to delete certain data where we are required to retain it by law or regulation.

16 Data Security

We apply technical and organisational measures appropriate to the sensitivity of the personal data we handle, including encryption of data in transit, restricted and logged access to systems, firewalls, and internal data protection policies. While no method of transmission or storage is completely secure, we use reasonable and proportionate measures to safeguard your personal data.

17 Children's Privacy

Our investment products may be held on behalf of minors as permitted by applicable rules (for example, a guardian investing on behalf of a minor). Except where a guardian or parent provides the personal data of a minor in connection with an application made in accordance with applicable law, our website and services are not directed to children under 18, and we do not knowingly collect personal data directly from children. If you believe a child has provided us personal data without a lawful basis, please contact us and we will take appropriate steps.

18 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal obligations. When we make changes, we will update the "Last updated" date at the top of this page. Where changes are significant, we will take reasonable steps to bring them to your attention, including by updating this page. We encourage you to review this Privacy Policy regularly.

19 Contact Us & Data Protection Enquiries

If you have any questions about this Privacy Policy or about how we handle your personal data, or wish to exercise any of your data subject rights, please contact us at:

ZAN SECURITIES LIMITED
1st Floor, VIVA Towers, Ali Hassan Mwinyi Road,
P.O. Box 5366, Dar es Salaam, Tanzania.
Email: investorsupport@zansec.co.tz or info.dsm@zansec.co.tz
Phone: +255 222 103 433 / +255 750 011 250
WhatsApp: +255 756 111 888