UNITED REPUBLIC OF TANZANIA

TANZANIA LIBRARY SERVICES BOARD (TLSB)

INTEGRATED NATIONAL DIGITAL LIBRARY SYSTEM (iNDLS)

PRIVACY POLICY

Mobile Application and Web Portal

Version: 1.0

Effective Date: 20 October 2026

POLICY, DATA PROCESSING AND CONFIDENTIALITY

1. Policy Statement and Scope

The Tanzania Library Services Board (TLSB) is committed to protecting the privacy and personal data of users of the Integrated National Digital Library System (iNDLS). This Policy governs the collection, use, storage, disclosure, security and deletion of personal data through the iNDLS mobile application and web portal.

It applies to library members, students, researchers, children, authors, publishers, library professionals and participating institutions. TLSB shall process personal data in accordance with applicable Tanzanian laws, including the Personal Data Protection Act, No. 11 of 2022, the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023, and the Tanzania Library Services Act, Chapter 102, Revised Edition 2023.

TLSB acts as the data controller and shall ensure that personal data is processed lawfully, fairly, transparently, securely and only for specified legitimate purposes.

2. Collection and Use of Personal Data

TLSB shall collect only information necessary to provide library services, administer membership, process transactions, maintain security and fulfil legal obligations. Information may include identity and membership details, contact information, library activity, payment records, communications and technical security logs.

Information may be obtained directly from users, participating institutions, authorized representatives, system records and relevant service providers. Sensitive personal data and identity documents shall be collected only where lawful and necessary, subject to applicable safeguards. Payment credentials entered directly into a payment provider's platform shall be handled by that provider.

TLSB shall use personal data to manage accounts, borrowing, reservations, fines, subscriptions, electronic resources, customer support, essential notifications, system security, audits and lawful statistical reporting.

3. Reading Confidentiality and Lawful Processing

TLSB recognizes that reading interests, searches and borrowing histories may reveal private or sensitive information. Access to identifiable library activity shall be restricted to authorized personnel with legitimate service, security or legal responsibilities. Such information shall not be publicly disclosed or used for unrelated purposes without an appropriate legal basis.

Where individual identification is unnecessary, aggregated or anonymized data shall be used. Public bibliographic information shall be distinguished from private membership, contact and payment records. TLSB shall not sell or rent personal data or use it for third-party targeted advertising.

Processing shall rely on the applicable lawful basis, including statutory functions, requested services, legal obligations or consent where required. Use of iNDLS or reading this Policy does not constitute blanket consent. Where consent is required, users shall be informed of the purpose and provided with a means of withdrawal. Essential service communications shall be distinguished from optional promotional messages.

4. Application Permissions and Analytics

The application requires internet connectivity to provide digital library services. Optional permissions may include camera access for QR-code scanning, access to selected photographs for profile uploads and notifications for reminders and security alerts. Users may manage optional permissions through their device settings.

The application shall not access contacts, microphone recordings or precise location unless a supported feature requires such access and the relevant collection is properly disclosed.

The released iNDLS version 1.0 does not use third-party analytics software or advertising networks. Internal diagnostics and security logs shall support system maintenance, performance monitoring and incident detection, subject to appropriate safeguards and retention limits.

 

SECURITY, RETENTION AND USERS' RIGHTS

5. Data Sharing, Storage and Security

TLSB shall share personal data only where lawful, necessary and proportionate. Authorized recipients may include TLSB personnel, participating libraries, government hosting providers, GePG and Hazina payment services, notification providers, electronic content providers and competent public authorities where disclosure is legally authorized or required. Service providers shall be subject to appropriate confidentiality and security obligations.

Personal data shall be stored and processed within the United Republic of Tanzania, with primary infrastructure in Dar es Salaam and disaster-recovery facilities in Dodoma. International transfers shall not occur under this Policy unless applicable legal requirements, authorizations and safeguards have been satisfied.

TLSB shall implement appropriate security measures, including secure communications, access controls, authentication safeguards, security monitoring, encrypted backups, system maintenance and staff confidentiality requirements. Suspected or confirmed personal data breaches shall be assessed, contained, investigated and documented. Notifications to the Personal Data Protection Commission (PDPC) and affected individuals shall be made where required by law.

6. Data Retention and Deletion

TLSB shall retain personal data only as long as necessary for its intended purpose or as otherwise lawfully required. The approved retention periods include:

• Inactive accounts: Review after 60 months of inactivity, followed by notice, a 90-day reactivation period and secure deletion arrangements where applicable.
• Borrowing records: Retained for active transactions and the applicable dispute-resolution period; additional identifiable reading history shall be retained only where the user opts into the personal reading-list feature.
• Search logs: Anonymized after six months.
• Financial records: Retained for seven years from the end of the relevant financial year.
• Support and complaint records: Retained for three years after closure, unless a lawful extension applies.
• Security logs: Retained for 12 months.
• Backups: Overwritten according to the established 90-day backup cycle.

Expired records shall be securely deleted or irreversibly anonymized unless further retention is legally justified. Retained information shall be restricted to the purpose requiring its preservation.

7. Children and Users' Rights

TLSB shall apply appropriate privacy safeguards to children under 18 years of age. Where parental, guardian or other legally authorized consent is required, the appropriate authorization shall be obtained and verified. Children's information shall not be used for third-party targeted advertising or inappropriate profiling.

Subject to applicable law, users may request access to their personal data, correction of inaccurate information, erasure where legally permitted, restriction or objection to processing where applicable, withdrawal of consent and review of qualifying automated decisions. Users may also lodge complaints with TLSB or the PDPC.

8. Account Deletion and Complaints

Users may request account deletion through the application or TLSB website, where available, or by emailing info@tlsb.go.tz with the subject line “iNDLS Account Deletion Request.” Users should provide their registered email address or telephone number and, if available, their membership number. Passwords, PINs and verification codes must not be submitted.

TLSB shall verify requests, assess lawful retention requirements and communicate the decision and completion arrangements. Account deactivation does not constitute deletion. Information required for legal, financial, audit, security or dispute purposes may be retained for the applicable period and restricted to that purpose.

9. Policy Review and Contact

TLSB shall review this Policy periodically and whenever changes in law, technology or processing practices require revision. Material changes shall be communicated appropriately, and additional consent shall be obtained where required by law.

Data Protection Officer
Tanzania Library Services Board (TLSB)
Bibi Titi Mohamed Road, P.O. Box 9283, Dar es Salaam, Tanzania
Email: info@tlsb.go.tz
Telephone: +255 22 2150048/9 or +255 22 2151100
Website: www.tlsb.go.tz
iNDLS Portal: https://idlibtaifa.tlsb.go.tz
PDPC: https://www.pdpc.go.tz/

Document Owner: Tanzania Library Services Board
Responsible Office: Data Protection Officer
Version: 1.0
Effective Date: 20 October 2026

TLSB shall uphold responsible personal data management, reading confidentiality, secure digital library services and the protection of users' rights in accordance with applicable Tanzanian law.