Privacy Policy

1. Who We Are

MetriqOS is a product of Metriq Tanzania Limited, a company registered in Tanzania. We build and operate a cloud-based platform for NGOs, development organisations, and implementing partners operating across Africa and internationally. We are the data controller for all personal data processed through the MetriqOS platform at metriqos.net.

For privacy-related enquiries: info@metriqos.net

2. Information We Collect

2.1 Account Information

• Organisation name and type
• Administrator name and email address
• Oversight contact name, email, and position
• Billing contact information (for paid accounts)

2.2 Platform Data (Your Data)

• Project information, indicators, and results data you enter
• Documents and files you upload
• Survey and field data collected via GroundTruth™
• Reports and assessments you create
• Team member profiles you add

2.3 Donor and Oversight Access

When you add an oversight contact or programme officer to your account, that individual gains authorised read-only access to the project data, IPTT results, DIP timelines, DQA scores, and reports you have shared with them. This access is granted exclusively by your account administrator. You control who holds Oversight access and may revoke it at any time through your account settings. Oversight users are covered by the same data protection obligations as your organisation.

2.4 Usage and Technical Data

• Log data (pages visited, actions taken, timestamps)
• IP address and browser/device information
• Session duration and feature usage patterns

3. How We Use Your Information

We use your information solely to:

• Provide the service — operate and maintain your MetriqOS account
• Communicate with you — send subscription reminders, security alerts, and support responses
• Improve the platform — analyse aggregated, anonymised usage patterns to improve features
• Comply with legal obligations — maintain records as required by applicable law
• Protect security — detect and prevent fraud, abuse, and unauthorised access

We do not use your data for advertising, profiling, or resale to third parties.

4. Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR) Article 6, we process your personal data on the following lawful bases:

• Contract performance (Article 6(1)(b)) — the majority of processing is necessary to deliver the MetriqOS service under your subscription agreement, including account management, platform operation, and support.
• Legitimate interests (Article 6(1)(f)) — we process technical and usage data to maintain platform security, prevent fraud and unauthorised access, and analyse aggregated and anonymised usage patterns to improve the service. These interests do not override your rights or interests.
• Legal obligation (Article 6(1)(c)) — we retain certain records where required by applicable Tanzanian or UK law.
• Consent (Article 6(1)(a)) — where we send optional communications or process any data beyond the above bases, we will obtain your explicit consent and provide clear opt-out options.

5. Data Storage, Location, and Security

4.1 Where Your Data Is Stored

MetriqOS is operated by Metriq Tanzania Limited, a company incorporated and operating under the laws of Tanzania, serving a global client base across Africa and beyond. Your data is stored on enterprise-grade servers located in the United Kingdom, within a secure, ISO-compliant data centre facility. Hosting in the UK was a deliberate choice — it reflects our commitment to world-class data security standards for our users worldwide.

This cross-border arrangement means your data benefits from the laws of both Tanzania and the United Kingdom. In Tanzania, we comply with applicable data protection principles and regulatory requirements. In the United Kingdom, data stored within our infrastructure is subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 — among the strongest data protection frameworks in the world. Regardless of where in the world you are based, you benefit from both.

We do not transfer your data to any other country or jurisdiction without your knowledge and, where required, your explicit consent.

4.2 Security Measures

• All data transmitted over HTTPS/TLS encryption
• Passwords hashed using bcrypt — never stored in plain text
• Database credentials stored with restricted access controls
• Authenticated sessions use signed tokens with expiry
• Regular automated database backups with 14-day retention
• Role-based access control limiting data access to authorised users only
• Access to production data is strictly limited to authorised personnel only

4.3 Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users within 72 hours of becoming aware of the breach, consistent with UK GDPR obligations and good practice standards applicable in Tanzania.

6. Data Sharing

We do not sell, rent, or share your data with third parties except in the following limited circumstances:

• Infrastructure providers — we use third-party infrastructure services to host and operate the platform. These providers have no independent right to access or use your data and are bound by strict confidentiality obligations.
• Legal requirements — if required by Tanzanian law, UK law, a valid court order, or to protect our legal rights, we may disclose data as required. We will notify you where legally permitted to do so.
• Your consent — only if you explicitly authorise us to share specific data with a named third party.

We currently use no third-party analytics, advertising, or tracking services within the platform.

7. Your Rights

As a MetriqOS user, you have the right to:

• Access — request a copy of all personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your personal data (subject to legal retention requirements)
• Data portability — request an export of your organisational data in a machine-readable format
• Objection — object to specific processing of your data
• Restriction — request that we restrict processing of your data in certain circumstances

To exercise any of these rights, email info@metriqos.net. We will respond within 30 days. Where your data is subject to UK GDPR, you may also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

8. Data Retention

We retain your data for as long as your account is active. After account termination:

• You have 30 days to request a full data export
• Security and authentication logs are retained for up to 365 days
• Standard activity logs are deleted after 90 days
• After the 30-day export window, all organisational data is permanently and irreversibly deleted

9. Cookies

MetriqOS uses only essential session cookies necessary for authentication and security. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

Session tokens are stored in browser localStorage and are deleted when you log out. No persistent tracking of your activity occurs outside of what is necessary to provide the service.

10. Children's Privacy

MetriqOS is a professional platform intended for use by organisations and adults aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe a minor has provided us with personal information, contact us immediately at support@metriqos.net.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify active users of material changes via email at least 14 days before changes take effect. The "Last Updated" date at the top of this page reflects when changes were last made. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

For privacy questions, data requests, or concerns:

• General: info@metriqos.net
• Support: support@metriqos.net
• Company: Metriq Tanzania Limited, Tanzania