Privacy Policy

1. Introduction

SheRooted ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our contact form.

2. Information We Collect

When you submit our contact form, we collect:

• Personal Information: Name and email address
• Communication Data: The message content you provide
• Technical Data: IP address, browser type, and device information (collected automatically by our service provider)
• Consent Records: Record of your consent to this privacy policy

When you book a place at one of our events, we collect:

• Personal Information: Name and email address
• Contact Number: The mobile number you use to pay, so we can match your payment to your booking
• Booking Details: Number of slots, amount due, and a reference code we generate for you
• Payment Reference: The Selcom confirmation code from your payment SMS, if you choose to provide it
• Attendance Record: Whether and when your ticket was scanned at the event
• Consent Records: Record of your consent to this privacy policy

We never collect or store your mobile money PIN, and we have no access to your mobile money account. Payment itself happens entirely within your mobile money provider's app, not on this website.

3. How We Use Your Information

We use the information we collect to:

• Respond to your inquiries and messages
• Communicate with you about our programs and initiatives
• Process event bookings, match payments, and issue your ticket
• Verify tickets at the event entrance
• Improve our website and services
• Prevent spam and abuse
• Comply with legal obligations

4. Third-Party Service Providers

We use the following third-party services to process your data:

Formspree

Our contact form is powered by Formspree, which processes and delivers your messages to our email. Formspree's privacy policy can be found at: https://formspree.io/legal/privacy-policy/

hCaptcha

We use hCaptcha to prevent spam and bot submissions. hCaptcha's privacy policy can be found at: https://www.hcaptcha.com/privacy

Google (Sheets & Apps Script)

Event bookings are stored in a private Google Sheet and processed by Google Apps Script. Access is restricted to two SheRooted organisers. Google's privacy policy can be found at: https://policies.google.com/privacy

Resend

Booking confirmations and event tickets are delivered by Resend, which processes your name and email address in order to send them. Resend's privacy policy can be found at: https://resend.com/legal/privacy-policy

QuickChart

Ticket QR images are generated by QuickChart. The QR contains only your reference code, your name, and the number of slots booked, plus a security signature. It never contains your email address, phone number, or payment details.

5. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy. Contact form submissions are typically retained for:

• Active correspondence: Until the inquiry is resolved
• Historical records: Up to 2 years for reference purposes
• Event bookings: Deleted within 90 days after the event takes place
• Legal requirements: As required by applicable laws

6. Your Rights (GDPR Compliance)

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we use your data
• Portability: Receive your data in a structured format
• Objection: Object to our processing of your data
• Withdraw Consent: Withdraw consent at any time

To exercise these rights, please contact us at info@sherooted.org

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• HTTPS encryption for data transmission
• Input sanitization to prevent XSS attacks
• Rate limiting to prevent abuse
• Honeypot spam protection
• hCaptcha bot verification

8. International Data Transfers

Your information may be transferred to and processed in countries other than Tanzania. We ensure appropriate safeguards are in place when transferring data internationally.

9. Children's Privacy

While our programs are open to students in Grade 9-13, we do not knowingly collect personal information from anyone under 13 years old without parental consent. If you believe we have inadvertently collected such information, please contact us immediately.

10. Cookies and Tracking

Our website uses minimal cookies and local storage only for:

• Language preference (EN/SW toggle)
• Rate limiting for contact form submissions

These are essential for website functionality and do not track you across other websites.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Email: info@sherooted.org
Instagram: @sherooted.tz