Privacy Policy

Version 1.0 · Last updated: 19 September 2026

OneClick WhatsApp Business Platform — Privacy Policy

This Privacy Policy explains how iMartGroup Ltd, through its OneClick WhatsApp Business Platform available at whatsapp.oneclick.co.tz ("OneClick", "we", "us" or "our"), collects, uses, stores, protects and discloses personal data in connection with the OneClick WhatsApp Business messaging service.

OneClick is committed to protecting personal data and respecting the privacy of businesses, users, customers and other individuals whose information is processed through the Platform.

This Privacy Policy is intended to operate together with applicable privacy and data protection laws of the United Republic of Tanzania, including the Personal Data Protection Act, 2022, applicable regulations and guidance issued by the Personal Data Protection Commission ("PDPC"), and other applicable electronic communications and data protection requirements.

Where OneClick processes WhatsApp-related information, the processing may also be subject to applicable Meta and WhatsApp terms, policies and data processing requirements.

1. About OneClick

OneClick is a business messaging platform operated by iMartGroup Ltd.

The Platform enables businesses and organisations to manage WhatsApp Business communications, including:

• customer communication;
• customer support;
• service notifications;
• authentication and OTP;
• transactional notifications;
• approved marketing communications;
• message management; and
• business WhatsApp account management.

OneClick may process information relating to the Client's business users, administrators and customers in order to provide these services.

2. Who this Privacy Policy applies to

This Privacy Policy applies to:

1. businesses and organisations that register for OneClick;
2. administrators and authorised users of Client accounts;
3. individuals who communicate with businesses using WhatsApp where those communications are processed through OneClick;
4. individuals whose information is provided by a Client in connection with the Service; and
5. visitors to the OneClick website and Platform.

Where a Client uses OneClick to process personal data relating to its customers, the Client may determine the purposes for which that customer data is processed.

In such circumstances, the Client may be responsible for providing its customers with appropriate privacy notices and for ensuring that the Client has a lawful basis for processing and communicating with those individuals.

3. Our role in relation to personal data

The role of OneClick depends on the nature of the processing.

For information necessary to operate OneClick accounts, manage users, provide security, administer subscriptions, provide support and maintain the Platform, iMartGroup Ltd may act as a data controller.

Where OneClick processes personal data on behalf of a Client for the Client's business messaging activities, OneClick may act as a data processor or service provider on behalf of that Client, subject to the applicable agreement and law.

The Client may remain responsible for determining:

• why customer information is collected;
• what customer information is used;
• which customers receive communications;
• the lawful basis for processing;
• the content of communications; and
• the retention period applicable to the Client's customer data.

Where required, OneClick may enter into additional data processing terms with Clients.

4. Information we may collect

Depending on how the Service is used, OneClick may collect or process the following categories of information.

4.1 Business information

This may include:

• company or organisation name;
• business registration information;
• business address;
• contact information;
• business email address;
• business telephone number;
• website;
• industry or business activity;
• account information;
• verification information; and
• information required for onboarding or compliance.

4.2 User and administrator information

This may include:

• name;
• email address;
• telephone number;
• username;
• role or access level;
• login information;
• account activity;
• authentication information; and
• records relating to access to the Platform.

4.3 WhatsApp Business Account information

Where a Client connects a WhatsApp Business Account, OneClick may process information required to operate the connected account. This may include:

• WhatsApp Business Account identifiers;
• business phone number;
• business profile information;
• account configuration;
• approved message templates;
• messaging status;
• account administration information;
• business verification information; and
• other information made available through applicable WhatsApp Business Platform services.

4.4 Customer and messaging information

Where a Client uses OneClick to communicate with its customers, the Platform may process information contained in or associated with those communications. Depending on the Client's use of the Service, this may include:

• customer name;
• telephone number;
• WhatsApp identifier;
• message content;
• media or attachments;
• message timestamps;
• delivery information;
• message status;
• customer requests;
• transaction references;
• booking information;
• account information; and
• other information included by the Client or customer in a communication.

The nature and amount of customer information processed will depend on how the Client configures and uses the Service.

4.5 Technical and security information

We may collect information necessary to operate and secure the Platform, including:

• IP address;
• device information;
• browser information;
• operating system;
• login timestamps;
• access records;
• authentication events;
• audit logs;
• API activity;
• error logs;
• security events; and
• other technical information reasonably necessary to operate and protect the Service.

4.6 Website information

When you visit our website, we may collect information relating to your interaction with the website, including information submitted through contact forms and technical information required for website security and operation.

Where cookies or similar technologies are used, applicable information will be described in our cookie or website notice where required.

5. How we use personal data

We may use personal data for legitimate and lawful purposes including:

1. creating and administering accounts;
2. verifying businesses and authorised users;
3. providing WhatsApp Business messaging services;
4. enabling message sending and receiving;
5. providing customer support;
6. managing WhatsApp Business accounts;
7. managing message templates;
8. processing authentication and OTP messages;
9. providing service and transactional messaging functionality;
10. maintaining security;
11. preventing fraud, abuse and unauthorised access;
12. monitoring and troubleshooting the Platform;
13. providing technical assistance;
14. maintaining records;
15. processing payments and billing;
16. complying with legal and regulatory obligations;
17. responding to lawful requests from competent authorities;
18. resolving disputes;
19. enforcing contractual terms; and
20. improving the reliability, security and functionality of the Platform.

We will not use personal data for purposes incompatible with the purposes for which it was collected unless permitted or required by applicable law.

6. Customer messages and Client data

OneClick provides a platform through which Clients communicate with their customers.

Where customer information is processed on behalf of a Client, the Client is responsible for determining the lawful purpose of the communication and ensuring that appropriate notices, permissions, consents or other lawful bases are in place where required.

OneClick processes such information to provide the contracted messaging service.

Clients should not send sensitive personal data through the Platform unless they have a lawful basis and appropriate safeguards for doing so and the intended use is permitted by applicable law and WhatsApp/Meta requirements.

7. Legal bases for processing

Where applicable, personal data may be processed on one or more of the following grounds:

1. performance of a contract or steps taken at the request of the individual or Client;
2. compliance with a legal or regulatory obligation;
3. consent, where consent is required;
4. legitimate and lawful business purposes where permitted by applicable law;
5. protection of rights, safety or security;
6. establishment, exercise or defence of legal claims; or
7. another lawful basis recognised under applicable law.

Where consent is relied upon, the individual may have the right to withdraw consent subject to applicable legal limitations.

Withdrawal of consent does not necessarily invalidate processing already undertaken lawfully before withdrawal.

8. Marketing communications

Clients using OneClick are responsible for ensuring that marketing communications are sent in accordance with applicable law, customer preferences and WhatsApp/Meta requirements.

OneClick does not authorise a Client to send unsolicited marketing communications merely because the Client has access to the Platform.

Clients must maintain appropriate records of customer permissions and must honour applicable opt-out or withdrawal requests.

Where a customer asks a Client to stop receiving marketing communications, the Client should promptly honour that request and maintain appropriate suppression records.

9. Authentication and OTP data

Where OneClick is used to send authentication or one-time passwords, the information may include telephone numbers, authentication codes, timestamps and related transaction or account references.

Authentication information should only be used for the security purpose for which it was generated.

Clients must not request customers to disclose OTPs unnecessarily and must implement appropriate controls around authentication credentials.

10. Transactional information

Where OneClick is used for transactional notifications, the Platform may process information such as:

• transaction references;
• order numbers;
• booking references;
• payment status;
• amounts;
• account identifiers;
• dates and times;
• customer contact details; and
• other information required to communicate the transaction.

OneClick processes such information only to the extent reasonably necessary to provide the applicable service.

11. Sharing of personal data

We may share or provide access to personal data where necessary and lawful for the purposes described in this Privacy Policy. Recipients may include:

11.1 Clients

Where OneClick processes customer communications on behalf of a Client, the Client may receive information necessary to manage its customer relationship and provide its services.

11.2 Meta and WhatsApp

Where required to provide WhatsApp Business Platform functionality, relevant information may be transmitted to or processed by Meta, WhatsApp and their applicable service infrastructure. Such processing is also subject to applicable Meta and WhatsApp terms and policies.

11.3 Service providers

We may use trusted third-party providers for services such as cloud hosting, infrastructure, security, monitoring, technical support, email, analytics, payment processing, data storage and other services required to operate the Platform.

Such providers may process personal data only to the extent reasonably necessary for the services they provide and subject to appropriate contractual or legal safeguards.

11.4 Regulators and authorities

We may disclose information where required or permitted by applicable law, including to courts, regulators, law enforcement agencies, tax authorities, the PDPC, TCRA or other competent authorities.

11.5 Professional advisers

Information may be shared where reasonably necessary with legal, accounting, audit, compliance or other professional advisers subject to applicable confidentiality requirements.

12. Cross-border data transfers

Because OneClick relies on international technology infrastructure and third-party services, personal data may be processed or stored outside Tanzania.

Where personal data is transferred outside Tanzania, OneClick will implement applicable requirements and safeguards under Tanzanian data protection law, including requirements relating to cross-border transfers.

Where a transfer requires regulatory approval, permit, contractual safeguard or another mechanism under applicable law, OneClick will take reasonable steps to satisfy the applicable requirement.

The Client acknowledges that WhatsApp/Meta and other third-party service providers may operate infrastructure in jurisdictions outside Tanzania.

Cross-border processing by such providers may also be governed by their applicable privacy and data-processing terms.

13. Where personal data may be stored

Personal data may be stored on systems operated by OneClick or authorised service providers.

Depending on the particular service architecture, information may be stored or processed in Tanzania or in other jurisdictions.

OneClick will apply appropriate safeguards consistent with applicable law and contractual requirements.

Clients requiring specific data residency arrangements should contact OneClick before onboarding.

14. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Retention periods may depend on the nature of the information, the purpose for which it was collected, the Client's contractual requirements, legal and regulatory requirements, accounting requirements, dispute resolution, security and fraud prevention, and legitimate business requirements.

When personal data is no longer required, it may be deleted, anonymised or securely disposed of in accordance with applicable requirements.

Certain technical, security, audit or transaction records may be retained for longer where necessary for legal, security or regulatory purposes.

15. Data security

OneClick maintains reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

Depending on the applicable system and service, security measures may include access controls, authentication mechanisms, role-based permissions, secure transmission, encryption where appropriate, audit logging, monitoring, system hardening, vulnerability management, backup controls, incident response procedures and staff confidentiality obligations.

No electronic system can be guaranteed to be completely secure.

Clients are also responsible for maintaining appropriate security controls over their own systems, users, devices, passwords, API credentials and integrations.

16. Personal data breaches

Where OneClick becomes aware of a personal data breach affecting information processed through the Platform, we will take reasonable steps to investigate, contain and remediate the incident.

Where required by applicable law, we will notify the relevant authority, affected Client or other persons within the applicable timeframe.

Clients must promptly notify OneClick of suspected security incidents involving their OneClick account, credentials, integrations or customer information.

17. Data subject rights

Subject to applicable law and any applicable limitations, individuals may have rights relating to their personal data, including rights to:

• request information about processing;
• request access to personal data;
• request correction of inaccurate or incomplete information;
• request deletion where legally applicable;
• object to or restrict certain processing where legally applicable;
• withdraw consent where processing is based on consent;
• request information concerning the processing of personal data; and
• exercise other rights available under applicable Tanzanian data protection law.

Where OneClick processes personal data on behalf of a Client, a request may need to be directed to the relevant Client because that Client may be responsible for determining the purpose and lawful basis of processing.

OneClick will provide reasonable assistance where required by applicable law.

18. How to exercise your rights

A privacy request may be submitted to:

Privacy / Data Protection Contact
iMartGroup Ltd
Morocco Square, TR Tower 4th Floor, Mwai Kibaki Road & Ursino Street, Dar Es Salaam
United Republic of Tanzania

Email: privacy@imartgroup.co.tz

The request should provide enough information to identify the relevant account or information and allow us to verify the identity of the requester where reasonably necessary.

We may request additional information to prevent unauthorised disclosure of personal data.

We will handle requests in accordance with applicable law.

19. Children's privacy

The OneClick Platform is intended for businesses and professional users and is not designed to knowingly collect personal data directly from children for independent use of the Platform.

Clients must not use OneClick to unlawfully collect or process children's personal data.

Where a Client's business involves services directed to children or the processing of children's information, the Client is responsible for ensuring appropriate legal safeguards, parental or guardian requirements and other applicable protections.

20. Automated decision-making and profiling

OneClick does not intend to use personal data processed through the Platform to make decisions about individuals based solely on automated processing where such decisions produce legal or similarly significant effects, except where permitted by applicable law and subject to required safeguards.

Where automated tools are used for security, fraud prevention, system monitoring or service optimisation, they may process technical or usage information for those purposes.

Where applicable law requires additional notice or safeguards regarding automated decision-making or profiling, OneClick will comply with the applicable requirements.

21. Cookies and similar technologies

The OneClick website may use cookies or similar technologies necessary for website operation, authentication, security, preferences, analytics or other legitimate website purposes.

Where required, the website will provide appropriate information and choices regarding cookies.

22. Third-party services

OneClick integrates with third-party services, including WhatsApp/Meta and other technology providers.

When a Client uses such integrations, information may be processed by the relevant third party.

Third-party services are governed by their own applicable terms and privacy policies.

For WhatsApp Business Platform services, Clients should review the applicable WhatsApp and Meta terms and privacy/data-processing documentation.

OneClick does not control the privacy practices of independent third-party providers.

23. WhatsApp and Meta

The WhatsApp Business messaging functionality provided through OneClick is dependent on services operated or provided by WhatsApp and Meta.

Relevant information may be processed by Meta or WhatsApp as necessary to provide, secure, operate, support or enforce their services.

Meta and WhatsApp maintain their own applicable legal terms, privacy documentation, messaging policies and data-processing arrangements.

The Client is responsible for ensuring that its use of WhatsApp Business messaging complies with applicable WhatsApp and Meta requirements.

Nothing in this Privacy Policy changes the applicable legal relationship between the Client and Meta/WhatsApp.

24. Client responsibilities for privacy

Clients using OneClick must:

1. comply with applicable data protection law;
2. provide appropriate privacy notices to their customers;
3. establish an appropriate lawful basis for processing;
4. obtain consent where consent is legally required;
5. respect customer privacy rights;
6. maintain accurate customer information;
7. avoid collecting unnecessary personal information;
8. maintain appropriate security controls;
9. respect customer marketing preferences;
10. implement appropriate retention and deletion practices;
11. respond to customer privacy requests where the Client is responsible for the relevant processing; and
12. ensure that its use of OneClick complies with applicable WhatsApp and Meta policies.

25. Sensitive personal data

Clients should avoid sending sensitive personal data through OneClick unless the processing is lawful, necessary, proportionate and appropriately protected.

Where applicable law imposes additional requirements for sensitive personal data, the Client is responsible for ensuring that those requirements are satisfied.

OneClick may restrict certain uses of the Platform where necessary to comply with law, security requirements or WhatsApp/Meta policies.

26. International business Clients

Where a Client operates outside Tanzania or communicates with individuals in other jurisdictions, the Client is responsible for determining whether additional privacy, data protection, electronic communications, direct marketing or consumer protection requirements apply to its activities.

OneClick may provide contractual or technical assistance where appropriate but does not provide legal advice to Clients.

27. Privacy of business account information

Business account information may include commercially sensitive information.

OneClick will treat confidential business information appropriately and will not disclose it except where necessary to provide the Service, where authorised by the Client, or where disclosure is required or permitted by law.

28. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal or regulatory requirements, third-party services, or our data processing practices.

The updated version will be published on the OneClick website with a revised "Last Updated" date.

Where required by law, we will provide additional notice of material changes.

29. Governing law

This Privacy Policy shall be interpreted in accordance with applicable laws of the United Republic of Tanzania, including applicable personal data protection legislation and regulations.

Where mandatory data protection laws in another jurisdiction apply to particular processing activities, those requirements will be considered to the extent legally applicable.

30. Complaints and regulatory rights

If an individual has a concern regarding the processing of personal data, they may first contact OneClick using the details provided in this Privacy Policy.

Individuals may also have rights to lodge complaints with the competent data protection or regulatory authority where provided by applicable law.

For Tanzania-related matters, the relevant authority may include the Personal Data Protection Commission (PDPC).

31. Contact us

For questions, requests or concerns relating to this Privacy Policy or personal data processing, contact:

iMartGroup Ltd
Morocco Square, TR Tower 4th Floor, Mwai Kibaki Road & Ursino Street, Dar Es Salaam
United Republic of Tanzania

OneClick WhatsApp Platform: https://whatsapp.oneclick.co.tz
Privacy email: privacy@imartgroup.co.tz
General support: business@imartgroup.co.tz
Telephone: +255 800 750 376

Privacy Policy version

Version: 1.0
Last updated: 19 September 2026