Privacy Policy

1. Definitions

In this Privacy Policy, the following terms shall have the meanings set out below:

"Personal Data" means any information relating to an identified or identifiable natural person as defined under Law N° 058/2021.
"Processing" means any operation performed on Personal Data, whether or not by automated means.
"Data Controller" means Ubwiru Investments LTD, which determines the purposes and means of processing Personal Data.
"Data Subject" means you, the individual user of our Platform.
"Platform" means the UbwiruHomes website (ubwiruhomes.com) and all associated applications and services.
"Third Party" means any natural or legal person other than you and Ubwiru Investments LTD.

2. Data Controller Information

Ubwiru Investments LTD

Registered Address: [Insert your registered business address in Rwanda]

Email: admin@ubwiruhomes.com

Phone: [Insert your phone number]

Ubwiru Investments LTD is registered with the Rwanda Development Board (RDB) and complies with all applicable data protection laws. Our registration number is [Insert RDB registration number].

If you have any questions about this Privacy Policy or our data practices, please contact our Data Protection Officer at: admin@ubwiruhomes.com

3. Personal Data We Collect

We collect the following categories of Personal Data:

3.1 Account Information

When you register for an account, we collect your full name, email address, phone number, and account type (buyer or seller).

3.2 Professional Information (for Sellers)

If you register as a seller, we may collect your profession, company name, years of experience, biography, website, and professional license number.

3.3 Property Information

When you list a property, we collect property details including address, price, description, amenities, images (stored externally), and location coordinates.

3.4 Transaction Information

We collect information about your interactions with our Platform, including inquiries sent to sellers, saved properties, and reviews submitted.

3.5 Technical Data

We automatically collect your IP address, browser type, device information, and browsing activity on our Platform.

3.6 Google Photos Integration

If you choose to connect your Google account to select photos, we request read-only access to your Google Photos library. We do not upload, modify, or delete any of your photos. We only store the URLs of photos you select. You may revoke this access at any time through your Google Account settings.

4. How We Collect Your Data

Directly from you: When you register, list a property, send an inquiry, upload documents, or submit a review.
Automatically: When you browse our Platform, we collect technical data through cookies and similar technologies.
From Third Parties: When you log in using Google OAuth, we receive your name and email address from Google.
From Google Photos: When you authorize read-only access to select property photos.

5. Legal Basis for Processing

Under Law N° 058/2021, we process your Personal Data on the following legal bases:

Contractual Necessity: Processing is necessary for the performance of our agreement with you (e.g., to facilitate property listings and inquiries).
Legitimate Interests: Processing is necessary for our legitimate business interests, such as improving our Platform, preventing fraud, and ensuring security.
Legal Obligation: Processing is necessary to comply with applicable laws, including tax and anti-fraud regulations.
Consent: For certain processing activities (e.g., Google Photos access, marketing communications), we rely on your explicit consent.

6. How We Use Your Data

Account Management

Create and manage your user account, verify your identity, and provide customer support.

Property Listings

Enable you to list properties and for buyers to view and inquire about properties.

Communication

Send you notifications about property inquiries, approvals, document verifications, and platform updates.

Platform Improvement

Analyze usage patterns to improve our Platform's functionality and user experience.

Security and Fraud Prevention

Detect and prevent fraudulent activities, unauthorized access, and other security issues.

Legal Compliance

Comply with our legal obligations under Rwandan law, including tax and anti-money laundering regulations.

7. Data Sharing and Disclosure

We do not sell your Personal Data. We may share your data in the following circumstances:

7.1 Between Users

When you list a property, your name, phone number, and email address are visible to potential buyers. When you inquire about a property, your name, email, and phone number are shared with the seller.

7.2 Service Providers

We share data with third-party service providers who assist us with hosting, email delivery, analytics, and security. All service providers are contractually obligated to protect your data.

7.3 Google

If you choose to use Google OAuth or Google Photos integration, we share limited data with Google as described in their privacy policy.

7.4 Legal Requirements

We may disclose your data if required by law, regulation, legal process, or governmental request, including to comply with Rwandan authorities such as RIB, RRA, or DGIE.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity.

8. International Data Transfers

Your Personal Data may be transferred to and processed in countries outside Rwanda, including the United States (for our hosting provider and email services). When we transfer your data internationally, we ensure appropriate safeguards are in place to protect your data in accordance with Rwandan data protection law.

9. Data Security

We implement appropriate technical and organizational measures to protect your Personal Data, including:

Secure socket layer (SSL) encryption for all data transmitted between your browser and our servers.
Database credentials stored outside the public web directory.
Password hashing using bcrypt.
CSRF protection on all forms.
Rate limiting on login attempts to prevent brute force attacks.
Regular security updates and monitoring.

Despite these measures, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security. You use the Platform at your own risk.

10. Data Retention

We retain your Personal Data only as long as necessary to fulfill the purposes outlined in this Privacy Policy, or as required by law.

Account Information: Retained until you delete your account, plus 30 days for backup purposes.
Property Listings: Retained for 7 years after the listing is removed to comply with tax and legal obligations under Rwandan law.
Transaction Records: Retained for 7 years as required by Rwandan tax law (Law N° 16/2005 on Taxes).
Inquiries and Messages: Retained for 3 years.
Technical Data: Retained for 12 months.

11. Your Rights Under Rwandan Law

Under Law N° 058/2021, you have the following rights regarding your Personal Data:

Right to Access

You have the right to request a copy of the Personal Data we hold about you.

Right to Rectification

You have the right to correct inaccurate or incomplete Personal Data.

Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your Personal Data, subject to certain legal exceptions.

Right to Restrict Processing

You have the right to restrict how we process your Personal Data in certain circumstances.

Right to Data Portability

You have the right to receive your Personal Data in a structured, commonly used format.

Right to Object

You have the right to object to processing based on legitimate interests or direct marketing.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw consent at any time.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Rwandan Data Protection Authority if you believe your rights have been violated.

To exercise any of these rights, please contact us at admin@ubwiruhomes.com. We will respond within 30 days as required by law.

12. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our Platform. Cookies are small text files stored on your device.

Types of Cookies We Use:

Essential Cookies: Required for the Platform to function (e.g., session management, CSRF protection).
Preference Cookies: Remember your preferences and settings.
Analytics Cookies: Help us understand how users interact with our Platform.

You can control cookies through your browser settings. However, disabling essential cookies may affect the functionality of our Platform.

13. Third-Party Links

Our Platform may contain links to third-party websites, including Google Photos, Irembo, RDB, DGIE, RRA, and others. We are not responsible for the privacy practices of these third-party sites. We encourage you to read their privacy policies.

14. Children's Privacy

Our Platform is not intended for children under 18 years of age. We do not knowingly collect Personal Data from children under 18. If you become aware that a child has provided us with Personal Data, please contact us immediately.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any material changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy.

16. Contact Information