Privacy Policy

1. Introduction

At RwandaPay ("Company", "we", "our", "us"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, payment gateway services, APIs, and any related services (collectively, the "Services").

We are committed to protecting your personal data and complying with applicable data protection laws, including the Rwandan Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy.

By using our Services, you consent to the data practices described in this Privacy Policy. If you do not agree with any part of this policy, please do not use our Services.

2. Information We Collect

We collect several types of information from and about users of our Services:

2.1 Personal Information You Provide

• Account Information: Name, email address, phone number, company name, tax identification number (TIN), and business registration details.
• Verification Information: National ID, passport, RDB certificate, and other identification documents.
• Payment Information: Bank account details, mobile money account information, and transaction history.
• Communication Information: Information you provide when contacting our support team or responding to surveys.

2.2 Information Automatically Collected

• Device Information: IP address, browser type, operating system, device identifiers.
• Usage Information: Pages visited, time spent, click-through rates, and API call logs.
• Location Information: Approximate location based on IP address.
• Transaction Data: Payment amounts, timestamps, reference numbers, and payment status.

2.3 Information from Third Parties

• Mobile network operators (MTN Rwanda, Airtel Rwanda) for payment processing.
• Financial institutions for settlement purposes.
• Regulatory authorities for compliance verification.

3. How We Use Your Information

We use the information we collect for various purposes, including:

• Providing Services: Process payments, verify identities, manage accounts, and provide customer support.
• Improving Services: Analyze usage patterns, fix technical issues, and enhance user experience.
• Security: Detect and prevent fraud, unauthorized transactions, and security breaches.
• Compliance: Comply with legal obligations, regulatory requirements, and law enforcement requests.
• Communication: Send transaction notifications, policy updates, and marketing communications (with consent).
• Analytics: Monitor and analyze trends, usage, and activities in connection with our Services.

4. Sharing of Information

We may share your information in the following circumstances:

• Service Providers: With third-party vendors who help us operate our Services (hosting, analytics, customer support).
• Payment Processors: With mobile network operators and financial institutions to process transactions.
• Legal Requirements: When required by law, court order, or government regulation, including BNR and RDB.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.
• With Your Consent: When you explicitly authorize us to share your information.

We do not sell your personal information to third parties.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption: All sensitive data is encrypted using AES-256 encryption at rest and TLS 1.3 in transit.
• Access Controls: Strict access controls limit employee access to personal data.
• PCI DSS Compliance: Our payment infrastructure is PCI DSS Level 1 certified.
• Regular Audits: We conduct regular security audits and penetration testing.
• Incident Response: We have an incident response plan for data breaches.

While we strive to protect your information, no method of transmission over the Internet is 100% secure. You use our Services at your own risk.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

• Account Information: Retained for the duration of your account and up to 5 years after closure for regulatory compliance.
• Transaction Data: Retained for 7 years to comply with financial regulations.
• Verification Documents: Retained for 5 years after account closure.
• Log Data: Retained for 1 year for security and debugging purposes.

7. Your Rights

Under applicable data protection laws, you have the following rights:

• Access: Request a copy of your personal information.
• Rectification: Correct inaccurate or incomplete information.
• Erasure: Request deletion of your information (subject to legal obligations).
• Restriction: Limit how we use your information.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to certain processing activities.
• Withdraw Consent: Withdraw previously given consent.

To exercise these rights, contact us at privacy@rwandapay.rw. We will respond within 30 days.

8. Cookies

We use cookies and similar tracking technologies to:

• Essential Cookies: Required for basic website functionality and authentication.
• Analytics Cookies: Help us understand how users interact with our Services.
• Preference Cookies: Remember your settings and preferences.
• Security Cookies: Help protect against fraud and unauthorized access.

You can manage cookie preferences through your browser settings. However, disabling cookies may affect certain functionality of our Services.

9. Children's Privacy

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will take steps to delete such information.

10. International Transfers

Your information may be transferred to and processed in countries other than Rwanda. We ensure appropriate safeguards are in place, such as standard contractual clauses approved by competent authorities, to protect your information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.