INTRODUCTION

We are committed to protecting the privacy and security of our users' personal data. This Privacy Policy explains Our Policies and procedures on the collection, use and disclosure of Your information when You use our Platform, and tells You about Your Privacy rights and how the law protects you. This Policy is aligned with the Company’s goals and objectives, as well as ensure that regulatory, operational, and contractual requirements are fulfilled.

INTERPRETATIONS AND DEFINITIONS

INTERPRETATION

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or plural.

DEFINITIONS

For the purposes of this Privacy Policy:

Account means a unique account created for You to access our Service or parts of our Service.
Company (referred to as either "the Company", "We", "Us", or "Our" in this Policy) refers to Irembo Ltd, Irembo Campus KG 9 Ave, Nyarutarama, Kigali, Rwanda.
Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.
Country refers to Rwanda.
Device means any device that can access the Platform and Services, such as a computer, a cellphone or a digital tablet.
Law means Law No. 058/2021 of 13/10/2021 relating to the Protection of Personal Data and Privacy of natural persons in Rwanda, and any subsequent amendments or regulations thereto, as well as all applicable international laws, treaties, and conventions related to data protection, including but not limited to the General Data Protection Regulation (GDPR).
Personal Data is any information that relates to an identified or identifiable individual.
Platform refers to IremboPay.
Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service, or to assist the Company in analysing how the Service is used with a suitable agreement(s) or contract.
Usage Data refers to data collected automatically, either generated by the use of the Platform or from the Platform infrastructure itself (for example, the duration of a page visit).
You means the individual accessing or using the Platform, or the Company, or other legal entity on behalf of which such individual is accessing or using the Platform, as applicable. a. Employee or Staff is a person who is bound by the Company’s code of conduct. b. Contractor is a person or a consultant who has been authorized by the Company to facilitate the Service or parts of the Service. c. External User is a person or a consultant, an employee of the Service Provider bound by the contract/agreement. d. Auditor is a person or a consultant who has mandated by the law/regulator and the Company’s Board/Management to access the Platform for purposes of audit and/or investigation. e. Merchant is a Government institution, a business/private company that has established contractual agreements with the Company to use the Platform for payment collections.

DATA WE COLLECT

When using the Platform, we may collect the following personal data:

Merchants’ Information: Name, email address, phone number, business information, bank details.
Payment Transactions: Payment details, Bill ID, transaction amount, and associated payment method.
Technical Information: IP address, device information, and usage data for security and analytics purposes.

HOW WE COLLECT YOUR DATA?

We collect Your data when:

You create an account,
You make a payment,
Contact customer support.

HOW WE USE YOUR DATA?

We process personal data for the following purposes:

To facilitate payment transactions,
To authenticate Merchants,
To process settlements to merchant bank accounts,
To generate invoices and receipts,
To comply with legal and regulatory obligations,
To detect and prevent fraud and security breaches,
To provide customer support,
To improve and optimize our platform,
To contact you,
To enhance and improve the product.

We do not sell or rent personal data. However, we may share data with:

Payment Processors: To facilitate and confirm payments.
Regulatory Authorities: Where required by law or for compliance with financial regulations.
Service Providers: Engaged to support platform operations, under strict confidentiality agreements.

DATA RETENTION

Personal data is retained only for as long as necessary to fulfill the purposes set out in this Privacy Policy and to the extent necessary to comply with legal obligations, resolve disputes and enforce our legal and regulatory obligations.

Transaction records are retained in compliance with financial regulations.

Merchant account data is retained as long as the account is active, and for longer, based on the grounds provided for under the Law.

TRANSFER OF YOUR PERSONAL DATA

Personal data will be processed at the Company’s operating location and in any other places where the parties involved in the processing are located.

Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.

The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.

DISCLOSURE OF YOUR PERSONAL DATA

LAW ENFORCEMENT

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

OTHER LEGAL REQUIREMENTS

The Company may disclose Your Personal Data in the good faith that such action is necessary to:

Comply with a legal obligation.
Protect and defend the rights or property of the Company.
Prevent or investigate possible wrongdoing in connection with Money Laundering, Combating the Financing of Terrorism and the Financing of Proliferation of Weapons of Mass Destruction.

DATA SECURITY

We implement technical and organizational measures to protect personal data from unauthorized access, alteration, disclosure, or destruction. These include encryption, access controls, regular security assessments and audits, secure storage solutions and employee training on data protection.

USER RIGHTS

As provided in the Law, every user is entitled to the following:

Right to Personal Data: a user may request the information relating to the purposes of the processing of his/her personal data.
Right to Object: a user has the right to object to processing of personal data which causes or is likely to cause loss, sadness, or anxiety. However, this right does not apply if there is compelling legitimate grounds which override the interests, rights and freedoms of the user, or for the establishment of the legal claim.
Right to Personal Data Portability: Request a copy of personal data in a structured and machine-readable format.
Right not to be subject to a decision based on automated data processing: Opt out of decisions based solely on automated processing.
Right to Restriction of Processing of personal data: Object to or restrict certain processing activities unless it is necessary for the protection of the rights of others, or for public interest.
Right to Erasure of Personal Data: Request deletion of personal data, subject to legal constraints. This right does not apply if the processing is necessary for reasons of public interest, for historical or scientific research purposes or statistical purposes, for compliance with legal obligation, or for the establishment, exercise or defence of legal claims in the interest of the data controller.
Right to Rectification: a user may request correction of his/her personal data. This may be in regard to rectification to capture the correct details.
Right to designate an heir to personal data: The personal data are not subject to succession. However, where the data subject(user) had left a will, the data subject provides his or her heir with full or restricted rights relating to the processing of personal data kept by the data controller or the data processor, if such personal data still need to be used.
Right to representation: If the user is under sixteen years, has a physical impairment, has a medically determinable mental impairment, he or she is represented by his or her parent, adopter, guardian, or by another person authorised in writing in accordance with relevant law.

If you would like to exercise any of these rights, please reach out to Us at our email, dpo@irembo.com, and we’ll respond in not more than 30 days.

COOKIES

Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information when using Our Platform. When you visit Our Platform, we may collect information from you automatically through cookies such as Mixpanel to:

Give us an understanding of how you interact with our platform.
Give us a visibility on Which country Our Platform Users are based.
Fetch Our Platform uptime status.

CHANGES TO THIS PRIVACY POLICY

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on Our Platform, prior to the change becoming effective, and update the Last updated date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

By using our Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein.

You have the right to withdraw your consent to the processing of your personal data at any time by sending a request to the Company.

Upon receiving your withdrawal request, we will stop processing your personal data for the purposes that relied on your consent, unless we have a legal or contractual obligation to continue processing. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

Please note that withdrawing consent may affect our ability to provide certain services to you. If you have any questions about the implications of withdrawing consent or wish to exercise your right to withdraw consent, please contact us at dpo@irembo.com.

CONTACT US

If you have any questions about this Privacy Policy, You can contact us at:

Irembo Ltd. Kigali, Gasabo. Email: support@irembo.com Call Center Hotline: 9099 Monday through Friday from 06:00 a.m. to 10:00p.m, Central African Time. Saturdays and Sundays from 9:00 a.m. to 05:00 p.m, Central African Time.