The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection law. It gives individuals in the EU and EEA (and the UK under the UK GDPR) greater control over their personal data and imposes obligations on organizations that process their data.
PamojaMeet is committed to complying with the GDPR and supporting our users in exercising their rights. This page provides specific information about our GDPR compliance and how you can exercise your rights.
Who does this page apply to? This GDPR page applies to all users who are in the European Union, European Economic Area, or United Kingdom. If you are located in another jurisdiction, please refer to our Privacy Policy for information about the data protection laws that apply to you.
PamojaMeet acts as the Data Controller for the following processing activities:
PamojaMeet acts as a Data Processor when processing personal data on behalf of healthcare providers using our telemedicine features. In these cases:
For certain processing activities (e.g., meeting recordings shared between participants), PamojaMeet and meeting hosts may be Joint Controllers. We have agreements in place to ensure GDPR compliance for joint processing activities.
We process personal data under the following legal bases as defined in Article 6 of the GDPR:
| Legal Basis | GDPR Article | Processing Activities |
|---|---|---|
| Consent | Art. 6(1)(a) | Marketing emails, non-essential cookies, AI features, data sharing with third parties for advertising |
| Contract Performance | Art. 6(1)(b) | Providing the Service, processing payments, managing subscriptions, delivering support |
| Legal Obligation | Art. 6(1)(c) | Tax record retention, responding to lawful requests from authorities, compliance with court orders |
| Legitimate Interests | Art. 6(1)(f) | Security monitoring, fraud prevention, analytics, service improvement, internal administrative purposes |
| Vital Interests | Art. 6(1)(d) | Emergency situations in telemedicine contexts |
| Substantial Public Interest | Art. 9(2)(g) | Public health purposes (where applicable in telemedicine contexts) |
| Health Data (Explicit Consent) | Art. 9(2)(a) | Processing of health data for telemedicine services (with explicit consent of the data subject) |
Legitimate Interests Assessment: When we rely on legitimate interests, we conduct a Legitimate Interests Assessment (LIA) to balance our interests against your rights and freedoms. You can request a copy of our LIAs by contacting our DPO.
As a data subject under the GDPR, you have the following rights:
| Right | GDPR Article | Description | How to Exercise |
|---|---|---|---|
| Right of Access | Art. 15 | Obtain confirmation of whether we process your data and receive a copy of your data | Request via form below or email |
| Right to Rectification | Art. 16 | Have inaccurate personal data corrected or incomplete data completed | Account settings or request via form below |
| Right to Erasure | Art. 17 | Have your personal data deleted ("right to be forgotten") | Request via form below or email |
| Right to Restriction | Art. 18 | Restrict processing of your personal data in certain circumstances | Request via form below or email |
| Right to Data Portability | Art. 20 | Receive your data in a structured, commonly used, machine-readable format | Request via form below or email |
| Right to Object | Art. 21 | Object to processing based on legitimate interests or for direct marketing | Request via form below or email |
| Right re: Automated Decisions | Art. 22 | Not be subject to decisions based solely on automated processing, including profiling | Request via form below or email |
| Right to Withdraw Consent | Art. 7(3) | Withdraw consent at any time (without affecting prior lawful processing) | Account settings or contact us |
Exercising Your Rights: We will respond to all GDPR requests within 30 days. If we need more time (up to 60 additional days for complex requests), we will notify you within the initial 30-day period. There is no charge for most requests, but we may charge a reasonable fee for manifestly unfounded or excessive requests.
We collect personal data from the following sources:
We process the following categories of personal data:
| Category | Examples | Special Category? |
|---|---|---|
| Identity Data | Name, username, profile photo | No |
| Contact Data | Email address, phone number | No |
| Account Data | Password (hashed), account preferences | No |
| Financial Data | Payment card details (tokenized), billing address | No |
| Technical Data | IP address, device info, browser type, operating system | No |
| Usage Data | Features used, meeting history, interaction patterns | No |
| Meeting Content | Audio, video, chat messages, screen shares, recordings | May be (if health data) |
| Communication Data | Support tickets, feedback, survey responses | No |
| Health Data | Telemedicine session data, clinical notes | Yes (Art. 9) |
| Location Data | Approximate location based on IP address | No |
We process personal data for the following purposes:
| Purpose | Legal Basis | Data Categories |
|---|---|---|
| Providing the video conferencing service | Contract | All categories (as needed) |
| Account management and authentication | Contract | Identity, Contact, Account |
| Payment processing | Contract | Financial, Identity, Contact |
| Customer support | Contract / Legitimate interest | Identity, Contact, Communication |
| Service improvement and analytics | Legitimate interest | Technical, Usage |
| Security and fraud prevention | Legitimate interest | Technical, Usage, Identity |
| Marketing communications | Consent | Identity, Contact |
| AI-powered features | Consent | Meeting Content |
| Telemedicine services | Consent / Vital interests | Health Data, Meeting Content |
| Legal compliance | Legal obligation | As required by law |
| Research and development | Legitimate interest | Aggregated/anonymized data only |
We share personal data with the following categories of recipients:
All processors are bound by Data Processing Agreements (DPAs) that ensure GDPR-compliant processing.
PamojaMeet is based in Tanzania. When we transfer personal data from the EU/EEA/UK to countries outside these regions, we ensure appropriate safeguards are in place:
| Mechanism | When Applied |
|---|---|
| EU Standard Contractual Clauses (SCCs) | Transfers to processors in non-adequate countries |
| UK International Data Transfer Agreement (IDTA) | Transfers from the UK to non-adequate countries |
| Adequacy Decisions | Transfers to countries with an adequacy decision from the European Commission |
| Transfer Impact Assessments | Conducted for all international transfers to assess supplementary measures |
Your data may be processed in the following locations:
You may request information about the specific safeguards applied to transfers to any particular country by contacting our DPO.
We retain personal data only as long as necessary for the purposes for which it was collected:
| Data Type | Retention Period | Justification |
|---|---|---|
| Account Data | Duration of account + 30 days | Contract performance |
| Meeting Recordings | Per plan limits (30-90 days) | Contract / User request |
| Chat Messages | Meeting duration + 30 days | Contract performance |
| Payment Records | 7 years | Legal obligation (tax laws) |
| Usage Analytics | 26 months (anonymized after 12 months) | Legitimate interest |
| Support Tickets | 3 years after resolution | Legitimate interest |
| Consent Records | Duration of processing + 5 years | Legal obligation (accountability) |
| Server Logs | 90 days | Security / Legitimate interest |
We implement the following technical and organizational measures to protect personal data (as required by Article 32 of the GDPR):
In the event of a personal data breach:
PamojaMeet has appointed a Data Protection Officer (DPO) who oversees our compliance with GDPR and other data protection laws.
You can contact our DPO at:
The DPO is responsible for:
The Service is not intended for children under 16 years of age (or the applicable age of digital consent in your jurisdiction, which may be as low as 13 in some EU member states).
If we become aware that we have collected personal data from a child without appropriate parental consent, we will delete the data promptly.
For telemedicine services involving minors, the healthcare provider (Data Controller) is responsible for obtaining appropriate parental/guardian consent.
If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority.
You can:
Use this form to exercise any of your GDPR rights. We will respond within 30 days.
Verification: To protect your privacy, we may need to verify your identity before processing your request. We may ask you to provide additional information or confirm details about your account. We will not discriminate against you for exercising your GDPR rights.