Privacy policy

Last updated: 15 November 2026

Who we are

Zanzipalms Real Estate Limited, Office No. 1, The Garten, Paje, Zanzibar, 72110, Tanzania ("we") is the controller of the personal data collected through zanzipalms.com. You can contact us about your personal data at sales@zanzipalms.com or +255 774 401 261.

What we collect

When you send us an enquiry

When you use the enquiry form (the Ask us button or Enquire on a listing), we receive and store: your name; your WhatsApp number and/or email address; your message, if you write one; your answers to the form's questions (for example what you are looking for, the type of property, your budget range, the area and your timeline); the page you sent the enquiry from and, for a listing, its reference; the campaign tags in the link that brought you to the site, if any (such as utm_source); your consent and the exact wording you agreed to; and the date and time. We use these details only to handle your enquiry and directly related follow-up. We do not use them to send you newsletters or other marketing. ### Spam protection

When you submit a form, your IP address is used briefly by Cloudflare Turnstile and by our server for spam prevention and rate-limiting. It is not stored with your enquiry. ### When you browse

Our public website does not set cookies. Your saved favourites and the last unit type you viewed are stored only in your browser (local storage) and are not sent to us; you can clear them at any time. For the current visit only, your browser also keeps the campaign tags of the link you arrived with; they reach us only if you send an enquiry. Our own server does not keep logs of website visits. Cloudflare, which delivers our website, keeps technical security logs (such as IP address, time, requested page and browser type) under its own policy. We do not currently use analytics tracking. If we introduce it, we will update this notice and, where required, ask for your consent first.

Why we use your data (legal basis)

We process your enquiry details to respond to your request and to take steps before any agreement you may wish to enter into (GDPR Art. 6(1)(b); PDPA s.22(2)). We use technical data for security, spam prevention and rate-limiting based on our legitimate interests (GDPR Art. 6(1)(f)). We keep client and transaction records to comply with anti-money-laundering law (GDPR Art. 6(1)(c)). Where we rely on your consent, you may withdraw it at any time, without charge, by replying "STOP" or emailing us.

Who receives your data

We do not sell your personal data. It is seen by our team and processed for us, under contract, by these providers: Hostinger (website hosting, Germany); Cloudflare (content delivery, security, spam checks, encrypted backups); Google Workspace (email); Meta Platforms / WhatsApp (messaging, if you contact us there). ## Transfers outside Tanzania

Our providers store or process data in Germany, the European Union, the United States and other countries. Where we transfer personal data outside Tanzania, we do so in accordance with sections 31–32 of the Personal Data Protection Act and its Regulations. The transfer is necessary to respond to your request, and we rely on contractual safeguards with each provider. For people in the EU/UK, onward transfers rely on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework (and UK equivalents). You may request details of these safeguards.

How long we keep it

Enquiries that do not lead to a transaction: deleted or anonymised 24 months after our last contact. Client and transaction records, including identity and due-diligence documents: 10 years after the transaction or the end of our relationship, as required by anti-money-laundering law. Encrypted backups: rolling, up to 12 months (one a day for a week, one a week for five weeks, one a month for a year), after which deleted data no longer exists in backups.

How we protect it

The website is served only over encrypted connections (HTTPS). Our server accepts connections only through Cloudflare. Our content system can be reached only by our team, behind two separate logins. Backups are encrypted and kept in two places. Access to enquiries is limited to the people who handle them.

Your rights

You may ask us to confirm whether we process your data and give you access; to correct it; to erase it; to stop or suspend processing that is likely to cause you damage; and to object to decisions based solely on automated processing. If you are in the EU/UK you also have rights to restriction, data portability and objection under the GDPR/UK GDPR. We acknowledge suspension requests within 72 hours and respond to correction or erasure requests within 14 days (and in any case within one month). We may keep data where the law requires it. To exercise your rights, write to sales@zanzipalms.com.

Complaints

Please contact us first. You may complain to the Personal Data Protection Commission (PDPC), P.O. Box 1105, 1 Moshi Street, Viwandani, 41102 Dodoma, Tanzania; dg@pdpc.go.tz / helpdesk@pdpc.go.tz; +255 718 462 536; https://pdpc.go.tz. If you are in the EU or UK, you may also complain to your local data protection authority (in the UK, the Information Commissioner's Office). ## Changes to this policy

We will publish any change on this page with a new date.