Privacy Policy — ELM-DIGITAL LIBRARY

Who we are

ELM-Digital Library operates the ELM-Digital Library Platform and is responsible for the personal data described in this policy. We process personal data in line with the Personal Data Protection Act, 2022 of Tanzania and its regulations.

Questions or requests about your data: support@elm-digitallibrary.com.

Information we collect

We collect only what we need to run the Platform:

Account details: username, email address, password (stored only in encrypted, hashed form), and optionally your name, photo, bio, affiliation and other profile details you add.
Consent records: when you accepted these Terms and Privacy Policy, and which version.
Purchase and payment records: what you bought or subscribed to, amounts, dates, status, transaction references, and the mobile number used for payment. We never receive your mobile money PIN or full card details.
Reading activity: the titles you open, reading progress, bookmarks, ratings, reviews and comments.
Technical and security data: IP address, approximate location derived from it, browser and device type, sign-in times, and records of security events such as failed sign-ins.
Messages you send us, such as support requests.

How we use it

To create and secure your account, including confirming your email address and notifying you of new sign-ins.
To process payments, grant access to titles and subscriptions, and send receipts.
To provide the reader, remember your progress and show your library.
To show prices in the right currency for your region (based on approximate location from your IP address).
To calculate and report royalties to authors and publishers - using aggregated reading and sales figures, not your profile.
To protect the Platform and its content against fraud, bots, account sharing and unauthorised copying.
To answer your messages, and to send service emails you cannot opt out of (such as confirmations, receipts and security alerts).

Why we are allowed to use it

We use your data to perform our agreement with you (providing the service you signed up for), to meet legal obligations (for example tax and accounting records), for our legitimate interests in keeping the Platform secure and improving it, and - where we ask for it - with your consent, which you can withdraw at any time.

Who we share it with

We do not sell your personal data. We share it only with:

Our payment provider (currently Selcom), to process payments.
Our email delivery provider, to send account and service emails.
Cloudflare, which provides the security check on sign-up and sign-in forms and processes device and network data to detect bots.
Our hosting and infrastructure providers, who store data on our behalf.
Institutions you access titles through, limited to confirming your membership and access.
Authors and publishers, but only aggregated statistics (such as how often a title is read), not information that identifies you.
Authorities, where the law requires it.

Data outside Tanzania

Some of the providers above (for example the email and security services) may process data outside Tanzania. Where that happens we rely on their contractual and security commitments, and transfer data only as permitted by the Personal Data Protection Act.

How long we keep it

We keep account and reading data while your account is open. When you close your account we delete or anonymise it within a reasonable time, except purchase and payment records, which we keep for the period required by Tanzanian tax and accounting law, and records we need to resolve disputes or prevent fraud.

Your rights

Under the Personal Data Protection Act you can ask us to:

give you a copy of the personal data we hold about you;
correct data that is wrong or incomplete (much of it you can edit yourself in your profile);
delete your data, or close your account;
stop or restrict certain uses of your data, or withdraw consent you gave.

Write to support@elm-digitallibrary.com; we may need to confirm your identity first. If you are not satisfied with our answer, you can complain to the Personal Data Protection Commission of Tanzania.

Children

Users under 18 should use the Platform only with a parent's or guardian's permission. If you believe a child has given us personal data without that permission, contact us and we will take appropriate steps.

Cookies and similar technologies

We use essential cookies to keep you signed in, protect forms against forgery and remember settings such as light or dark mode. The Cloudflare security check may set its own essential cookies. We do not use advertising cookies.

Security

We protect data with encrypted connections (HTTPS), hashed passwords, access controls and monitoring. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

Changes to this policy

We may update this policy. Significant changes will be announced on the Platform or by email. The version and date are shown at the top of this page.