Privacy Policy

1. Who we are

This website is operated by Hanga Technologies Ltd ("Hanga", "we", "us"), a company registered in Rwanda with its registered office at [Registered office address, Kigali, Rwanda]. Hanga is the data controller for personal data collected through this website.

You can contact us about privacy matters at [[email protected]] or by post at the address above. Where required by law, the details of our designated data protection contact are: [Name / role and contact details, if appointed].

2. Personal data we collect

We collect only the personal data needed to operate this website and respond to you.

Information you provide

• Contact form and email inquiries: your name, organisation, email address, phone number (if provided), the type of inquiry, and the content of your message.
• Business correspondence: information you share with us when discussing a project, tender, or partnership, including documents you choose to send.

Information collected automatically

• Server logs: our hosting provider may record your IP address, browser type, device information, the pages you visit, and the date and time of access, for security and operational purposes.
• Preferences: your light or dark theme choice is stored in your browser's local storage. It is not transmitted to us.
• Analytics: [This website does not currently use analytics. If analytics are introduced, describe the tool, the data collected, anonymisation measures, and the consent mechanism here.]

We ask that you do not send us special categories of personal data (such as health, biometric, or political information) or confidential personal data about third parties through the contact form.

3. How we use personal data

• To respond to your inquiry and communicate with you about it.
• To prepare proposals, scopes, or tender responses you have requested.
• To manage our relationship with you if you become a client or partner.
• To operate, secure, and improve this website, including detecting and preventing abuse.
• To comply with legal obligations, including record-keeping and responding to lawful requests from authorities.

We do not sell personal data. We do not use personal data collected through this website for automated decision-making that produces legal or similarly significant effects on you.

4. Lawful basis for processing

We process personal data in accordance with Rwanda's law relating to the protection of personal data and privacy ([Law No. 058/2021 of 13/10/2021]) and other applicable laws. Our lawful bases are:

• Consent, where you submit the contact form and agree to our use of your details to respond to you. You may withdraw consent at any time.
• Contract, where processing is necessary to take steps at your request before entering into a contract, or to perform a contract with you.
• Legitimate interests, for website security, operational logging, and managing business relationships, where these interests are not overridden by your rights.
• Legal obligation, where we are required to retain or disclose information by law.

5. Cookies and similar technologies

This website is designed to operate with essential technologies only. Your theme preference is stored in local storage on your device; no tracking cookies are set by default. If we introduce optional cookies, such as analytics, we will ask for your consent first and update our Cookie Notice, which contains full details.

6. Sharing personal data and processors

We share personal data only where necessary and with appropriate safeguards:

• Service providers who host this website, deliver email, or process form submissions on our behalf. These providers act on our instructions under written agreements. Current providers: [Hosting provider; email provider; form delivery service, if any].
• Professional advisers such as lawyers, accountants, and auditors, where necessary.
• Authorities where required by law or to protect our legal rights.
• Business partners only with your knowledge, for example where you ask us to involve a consortium partner in responding to your inquiry.

7. International transfers

Some of our service providers may store or process data outside Rwanda. Where this occurs, we take steps to ensure the data receives adequate protection, including contractual safeguards and, where required, authorisation from or notification to the National Cyber Security Authority or other competent authority in accordance with Rwandan law. Details: [Describe the countries and safeguards applicable to your providers].

8. Retention

We keep personal data only for as long as needed for the purposes described above:

• Inquiries that do not lead to further engagement: up to [12 months] after our last communication.
• Proposals, tenders, and client or partner relationships: for the duration of the relationship and for a further period required by law, contract, or legitimate business needs (typically [up to 10 years] for records with tax or legal relevance).
• Server logs: typically [30 to 90 days], unless needed for security investigation.

When data is no longer needed, we delete or anonymise it securely.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (HTTPS), access controls and least-privilege principles, secure configuration of hosting and email services, and staff awareness of data protection obligations. No method of transmission or storage is completely secure; if a breach affecting your personal data occurs, we will notify you and the relevant authority where required by law.

10. Your rights

Subject to applicable law, you have the right to:

• be informed about how your personal data is used;
• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased where there is no lawful reason for us to keep it;
• restrict or object to processing in certain circumstances;
• receive your data in a portable format where processing is based on consent or contract and carried out by automated means;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with the supervisory authority in Rwanda ([National Cyber Security Authority / Data Protection Office contact details]).

To exercise any of these rights, contact us using the details in section 13. We may need to verify your identity before responding. We aim to respond within the timeframe required by law.

11. Children

This website is intended for organisations and professionals. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this policy to reflect changes in our practices, technology, or legal requirements. The "last updated" date at the top of the page indicates the current version. Material changes will be highlighted on this page.

13. Contact

Hanga Technologies Ltd
[Registered office address]
Kigali, Rwanda
Email: [[email protected]]