PDPC compliance and data protection

Scope of this statement

This page describes codeblock's data protection posture for our website, discovery conversations, software delivery work, managed services, and support operations. It is intended for clients, prospects, suppliers, job applicants, and individuals whose personal data may be processed through products we build or operate.

The statement does not replace a project-specific data processing agreement, security schedule, statement of work, or client privacy notice. Where we process personal data on behalf of a client, the client's instructions and our written contract define the operational detail for that engagement.

Tanzania data protection framework

Tanzania's Personal Data Protection Act, Cap. 44, established the Personal Data Protection Commission and sets rules for collecting, using, storing, disclosing, and transferring personal data. It applies to data controllers and data processors handling personal data in Tanzania and, in relevant cases, data connected to Tanzanian data subjects.

We treat the PDPC framework as a baseline for Tanzanian projects. Where a client is subject to additional laws such as the EU GDPR, UK GDPR, sector regulations, insurance reporting requirements, payment rules, health data obligations, or contractual security standards, we align the project controls to those higher or additional requirements.

Our role as controller or processor

• For this website, sales enquiries, supplier relationships, recruitment, and our own business administration, codeblock acts as a data controller because we decide why and how that personal data is processed.
• For most client software projects, codeblock acts as a data processor or sub-processor. In that role, we process personal data only for the documented purposes agreed with the client and only under the client's lawful instructions.
• For advisory, audit, architecture, or discovery engagements, our role may vary by scope. We document that role before personal data is shared at scale.
• Where both parties decide important processing purposes together, we agree controller responsibilities, data subject communication duties, and accountability records in writing.

Core PDPC principles we build around

• Lawfulness, fairness, and transparency: personal data must be collected and used for clear, lawful, and communicated purposes.
• Purpose limitation: systems should not reuse personal data for unrelated purposes without a valid legal basis and appropriate notice.
• Data minimisation: forms, databases, APIs, logs, and integrations should collect only the personal data needed for the product or service.
• Accuracy: systems should support correction workflows and reduce stale or conflicting records.
• Storage limitation: products should include retention rules, deletion workflows, and archival controls that match business and legal requirements.
• Security and confidentiality: personal data should be protected by technical and organisational controls proportionate to the risk.
• Accountability: decisions about personal data should be documented, reviewable, and supported by contracts, policies, and evidence.

Registration and accountability

Where registration, notification, or recordkeeping is required under the PDPC framework, we assess the relevant controller or processor role and maintain evidence of the applicable status for codeblock or the client engagement. We do not represent a client as registered or compliant unless the client has completed its own required steps.

For client work, we help identify processing activities, personal data categories, data subject groups, third-party processors, transfer routes, and system controls so that the client can maintain its own accountability records.

Privacy by design in software delivery

• Discovery workshops include questions about personal data, sensitive data, regulatory exposure, retention, and user rights.
• Product requirements distinguish necessary data from optional data and avoid collecting personal data just because it may be useful later.
• UX flows include clear notices, consent moments, preference controls, and user-support paths where the product requires them.
• Engineering designs include access control, least privilege, environment separation, secrets management, and logging boundaries.
• Database schemas and API contracts are reviewed for avoidable personal data duplication and excessive exposure.
• Release checklists consider privacy notices, cookie consent, analytics gating, third-party scripts, and data transfer implications.

Security controls

• Transport encryption for production web traffic and APIs.
• Encryption at rest where supported by the hosting, database, or storage provider.
• Role-based access for production systems, cloud dashboards, repositories, and support tools.
• Separate development, staging, and production environments wherever the project architecture allows.
• Use of test data or anonymised data for development unless the client approves another controlled approach.
• Code review, dependency review, and vulnerability remediation practices proportionate to the engagement.
• Audit logs or operational logs for security-relevant activity where the platform supports them.
• Incident escalation paths covering containment, evidence gathering, client notification, and remediation.

Data subject rights support

The PDPC framework gives individuals rights connected to their personal data, including rights to be informed, access personal data, request correction, object or withdraw consent where applicable, and seek deletion or restriction where the law permits. We design and support systems so those rights can be actioned in a practical way.

When codeblock receives a request about data we process on behalf of a client, we direct the request to that client unless the law requires us to respond directly. When the request concerns data for which codeblock is the controller, we verify the request and respond through the contact details below.

Cross-border work and transfers

codeblock serves clients across Tanzania, Africa, Europe, the Americas, and other regions. That means project data may be hosted, supported, or accessed from more than one country depending on the client's infrastructure, cloud region, support model, and contract.

Where personal data is transferred outside Tanzania, we review whether the transfer is permitted, whether the destination and recipient provide appropriate safeguards, and whether additional contractual or technical controls are required. For European clients, we also support GDPR transfer mechanisms such as data processing agreements and standard contractual clauses where applicable.

Breach and incident response

• Triage and containment: limit exposure, revoke compromised credentials, and preserve relevant evidence.
• Impact assessment: identify affected systems, data categories, data subjects, and likely harm.
• Notification path: inform the client or relevant controller promptly where codeblock is a processor, and support any regulator or data subject notification obligations.
• Remediation: patch root causes, rotate secrets, harden controls, and document lessons learned.
• Recordkeeping: maintain an incident record with facts, timeline, decisions, and corrective actions.

Sub-processors and vendors

We use reputable cloud, collaboration, development, monitoring, and communication providers to run our business and deliver software. Where those providers process personal data for a client engagement, they are assessed for their role, access level, security posture, and contractual safeguards.

Client-specific sub-processor lists can be documented in the relevant contract, data processing agreement, or project security schedule.

Client responsibilities

• Provide lawful instructions and confirm the lawful basis for processing personal data in the product.
• Approve privacy notices, consent text, data subject workflows, and retention rules that reflect the client's business and legal obligations.
• Tell codeblock before sharing sensitive data, regulated data, or production personal data for development or support.
• Maintain account owners, access approvals, and removal requests for client-controlled systems.
• Review and approve third-party services, hosting regions, payment providers, analytics tools, and marketing tags used in the product.

Contact and escalation

For PDPC, privacy, or security questions, email hello@codeblock.co.tz or write to codeblock Co. Ltd, codeblock HQ, Mbezi Beach, Dar es Salaam, Tanzania. If your question relates to a client product, include the client or product name so we can route it correctly.

This statement is reviewed periodically and when there are material changes to law, our services, our vendors, or our data handling practices.