Privacy Notice

STAFF PORTAL — University of Dodoma

Version 1.0

1. Introduction

University of Dodoma (UDOM) operates the STAFF PORTAL — the institution's Digital Human Resource & Academic Management system — to administer staff records, leave and travel, training, research and consultancy, academic promotion, imprest, and related HR and academic processes. This notice explains how UDOM collects, uses, discloses, and protects your personal data as a member of staff using this system, in accordance with the Personal Data Protection Act, 2023, and its regulations.

This notice covers your data as a staff member and system user. It does not cover the separate public-facing UDOM website, which has its own privacy notice.

2. Data Protection Principles

UDOM adheres to the data protection principles by:

  • Processing personal data lawfully, fairly, and transparently;
  • Collecting only what is necessary for specific, explicit, and legitimate HR and academic administration purposes;
  • Keeping data accurate and up to date, and retaining it only as long as required;
  • Protecting it with appropriate technical and organizational security measures; and
  • Respecting your rights as a data subject in accordance with the law.

3. Personal Data We Collect

Depending on your role and employment record, this may include:

  • Identity data: full name, date of birth, gender, marital status, nationality, tribe, religion, National ID (NIDA), TIN, passport number, driving licence, profile photo;
  • Employment data: check number, PF number, social security number, duty post, employment category and status, reporting organ, joining/confirmation dates, promotion and probation records;
  • Contact and family data: phone number, address, next-of-kin and dependant details;
  • Financial data: salary scale, leave allowance, imprest and travel claims;
  • Academic and research data: education history, publications, research and consultancy projects, promotion assessments;
  • Attendance data: biometric enrollment and attendance events, where the Attendance module is in use;
  • System usage data: login history, IP address, and an audit trail of actions taken in the system.

4. Why We Collect and Process Your Personal Data

  • Administering your employment, leave, travel, and training records;
  • Processing salary-related allowances, imprest, and financial claims;
  • Supporting research, consultancy, and academic promotion processes;
  • Recording attendance and monitoring workplace compliance;
  • Maintaining an accurate, auditable record of HR and academic decisions; and
  • Meeting statutory obligations to bodies such as NSSF/PSSSF, TRA, and TCU.

5. Legal Basis for Processing

Your personal data is processed based on:

  • Necessity for your employment contract — most HR, payroll, and academic administration processing;
  • Legal obligation — where required by labour, tax, pension, or higher-education law;
  • Legitimate institutional interest — for system security, audit, and administrative efficiency; and
  • Consent — for data you choose to provide that isn't otherwise required, such as optional next-of-kin details.

6. How We May Share Your Personal Data

Your data may be shared only with:

  • Authorized UDOM staff whose role requires it — access is restricted by permission, not open to every system user;
  • Statutory bodies such as NSSF/PSSSF, TRA, and TCU, where required by law;
  • Law enforcement or regulatory authorities where required by law or court order.

UDOM does not sell your personal data or use it for commercial marketing.

7. Disclosure of Personal Data

UDOM may disclose personal data in circumstances where disclosure is required by law, court order, or a regulatory authority.

8. Cross-Border Data Transfers

UDOM does not transfer your personal data to countries outside of Tanzania without your consent, except where a specific integration you use requires it (for example, syncing publication metadata with an international research index) — and even then, only non-sensitive, publication-level data is involved, never your personal HR records.

9. Where Your Personal Data Is Held

Your personal data is stored on UDOM-controlled servers, with role-based access control, an audit trail of access and changes, and password and session security measures in place to safeguard it against unauthorized access, loss, alteration, or disclosure. Regular backups are kept on institution-controlled storage only.

10. How Long We Keep Your Personal Data

UDOM retains your personal data only for as long as necessary to fulfil the purposes described in this notice. Retention periods follow the nature of the data and statutory obligations, after which data is securely deleted, anonymized, or archived in accordance with the UDOM Records and Archives Management Policy and the National Records and Archives Management Act, 2023.

11. Your Rights as a Data Subject

You have the right to:

  • Request access to the personal data UDOM holds about you;
  • Request correction of inaccurate data;
  • Request deletion of data no longer required for a lawful purpose; and
  • Lodge a complaint with the Personal Data Protection Commission.

12. Security of the Collected Personal Data

UDOM implements technical and organizational measures to protect your data, including role-based access control, an audit trail of system activity, a password policy with mandatory periodic changes, and secure session handling.

13. Access to Your Personal Data

Much of your own data is already visible to you in your profile within this system. For data not directly visible, submit a written request to the Data Protection Officer using the contact details in section 16. We may ask you to verify your identity before processing your request, and will respond within the timeframe set by applicable law.

14. Session Data

This system uses a session cookie to keep you signed in. It is strictly necessary for the system to function and is not used for tracking, advertising, or analytics.

15. How to Complain

For any complaint about how your personal data is handled, contact the Data Protection Officer at dpo@udom.ac.tz.

16. Changes to This Notice

This notice may be updated from time to time. When it changes materially, you will be asked to review and accept the current version the next time you sign in.