Policy

Data Protection & Responsible AI

This statement sets out the principles that govern how Hanga Technologies Ltd handles data and designs, builds, and deploys AI systems for clients. It is a commitment to clients, their users, and the people whose data passes through the systems we build.

1. Purpose and scope

Hanga builds systems that handle personal and institutional data, and increasingly these systems include AI components. This statement describes the principles we apply in that work. It covers both how we protect data and how we ensure AI is deployed in ways that are safe, supervised, and accountable.

It applies to all our delivery work. It complements, and does not replace, the data protection laws of Rwanda and other jurisdictions in which our clients operate, the policies of our clients, and the specific terms of each engagement. For how we handle data on this website, see the Privacy Policy.

2. Data protection principles

We align our work with Rwanda's law relating to the protection of personal data and privacy and with widely accepted international principles. In practice this means:

  • Lawfulness and purpose limitation. Personal data is processed only for defined, legitimate purposes agreed with the client, and on a lawful basis identified before processing begins.
  • Minimisation. Systems collect and retain only the data needed for the purpose. We challenge requirements that ask for more than is necessary, and we design AI pipelines so that sensitive data is excluded, masked, or pseudonymised wherever the task allows.
  • Accuracy. Data models, validation rules, and review steps are designed to keep data correct and to make correction straightforward.
  • Storage limitation. Retention periods are defined in the design and enforced by the system, not left to manual housekeeping.
  • Security. Appropriate technical and organisational measures are built in: encryption in transit and at rest, least-privilege access, audit logging, secure configuration, dependency management, and tested backup and recovery.
  • Accountability. Design decisions affecting personal data are documented. Where required, a data protection impact assessment is completed before processing starts.
  • Data residency. Where law or client policy requires data to remain in Rwanda or within client infrastructure, we design for that, including private deployment of AI models.

3. Responsible AI principles

AI components can read, classify, summarise, recommend, and draft. They can also be wrong in ways that are hard to see. These principles are how we make AI acceptable in institutional and regulated settings.

Human oversight

People remain accountable for decisions. Each AI-enabled workflow defines where a person reviews, approves, corrects, or overrides. Consequential actions — updating official records, issuing decisions, communicating outcomes, moving money — require human approval unless the client's governance explicitly and documentedly authorises otherwise. Every system can be paused or switched off without data loss.

Minimisation and proportionality

We use AI where it addresses a real problem better than simpler alternatives, and we use the least capable model and the least data that will do the job reliably. Deterministic rules are preferred over AI judgment wherever rules are sufficient.

Security

AI components are subject to the same security standards as the rest of a system, plus controls specific to AI: restrictions on which data may be sent to which model or provider, protection against prompt injection and data leakage, scoped tool permissions for agentic workflows, and monitoring of inputs and outputs.

Fairness

We test AI behaviour across the groups, languages, and document types a system will actually encounter, including Kinyarwanda, English, French, and Swahili where relevant. Differences in performance are measured, reported to the client, and addressed through design — for example, by routing lower-confidence cases to human review rather than accepting unequal outcomes.

Transparency and explainability

Staff know when they are working with AI-generated output. Outputs show their sources, confidence, and reasoning where the task allows. Each AI component is documented in a model card describing its purpose, inputs, limitations, evaluation results, and the model and version in use. Where appropriate, people affected by a process are informed that AI assists it.

Reliability and evaluation

Before deployment, each AI component is evaluated against a test set built from real, anonymised examples. Accuracy, failure modes, and edge cases are measured and shared in plain language. The same evaluation is repeated after any change to models, prompts, or data. Systems are monitored in operation for error rates, latency, and drift.

Traceability and auditability

Every automated action is logged with its inputs, sources, model version, output, and the person who acted on it. Logs are retained according to the client's audit requirements and can be used to reconstruct what happened and why.

Accountability

Each AI-enabled system has a named owner on the client side and clear escalation routes. We take responsibility for the quality of what we build and for being honest about its limitations.

4. How we apply these principles in delivery

  • Discovery: identify personal and sensitive data, legal basis, and governance requirements; assess whether AI is appropriate at all.
  • Design: data protection assessment where required; data flow diagrams; definition of oversight points, permissions, logging, and fallback behaviour; evaluation plan.
  • Build: secure development practices; versioned prompts, rules, and configuration; automated tests including AI evaluation.
  • Test: security review; accessibility audit; evaluation results reviewed with the client; controlled pilot alongside the existing process.
  • Handover: model cards, operations runbooks, monitoring, and training that enable the client to govern the system independently.
  • Support: scheduled re-evaluation as data, rules, and models change; incident procedures; reporting to client governance.

5. Working within client governance

Our clients, particularly public institutions and regulated organisations, have their own legal obligations, policies, and oversight bodies. We work within them. This includes complying with client security and data classification policies, supporting internal and external audits, providing documentation in the form oversight functions require, and deferring to the client's data protection officer or equivalent on matters of interpretation.

6. What we will not do

  • Deploy AI to make consequential decisions about individuals without meaningful human review.
  • Build systems designed for covert surveillance, manipulation, or discrimination.
  • Send client or personal data to external AI providers without the client's informed agreement and appropriate contractual safeguards.
  • Train models on client data for use outside that client's engagement.
  • Overstate the accuracy or capability of an AI system to win or retain work.

7. Review of this statement

We review this statement at least annually and when relevant law, guidance, or our practices change. Clients may request the current version and supporting documentation at any time.

8. Contact

Questions about this statement, or about data protection and AI in a specific engagement, can be sent to [[email protected]].