Privacy Policy
How we collect, use, and protect personal data under Law N° 058/2021.
1. Who is responsible for your data
The data controller is Umutuzo Rentals Ltd, Kigali, Rwanda ("Umutuzo"). We process personal data in accordance with Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy. Questions and requests: privacy@umutuzorentals.com.
2. What we collect, and why
Renters: name, phone, email, viewing and booking history — to arrange viewings, process bookings, and prevent fraud.
Homeowners: name, phone, email, national ID, proof of ownership or authority to let, property details and photos, payout details (mobile money number or bank account) — to verify listings, comply with our anti-fraud obligations, and pay you.
Verification agents: name, phone, email, national ID, district, verification activity records — to vet applicants, assign work, and pay per verification.
All visitors: basic technical data (IP address, device type, pages viewed) via analytics — to keep the service secure and improve it.
3. Legal bases
We process data to perform our contract with you (listings, viewings, payouts), to comply with legal obligations (fraud prevention, tax, lawful requests from Rwandan authorities), and with your consent where required (e.g. marketing messages). You may withdraw consent at any time without affecting prior processing.
4. National IDs and ownership documents
ID and ownership documents are collected solely to verify identity and the right to let a property. They are stored encrypted, access is restricted to trained admin staff, they are never shown publicly or shared with renters, and they are deleted or anonymised 24 months after an account is closed unless a longer retention is required by law.
5. Who we share data with
Payment providers (Flutterwave, mobile money operators) to process payments; verification agents to complete physical inspections; hosting and analytics providers acting as processors under contract; and Rwandan authorities where lawfully required. We do not sell personal data.
6. International transfers
Some of our processors host data outside Rwanda. Where this happens we rely on contractual safeguards and the transfer conditions permitted by Law N° 058/2021.
7. Your rights
You have the right to access, rectify, and erase your personal data, to object to or restrict processing, to withdraw consent, and to lodge a complaint with the National Cyber Security Authority (NCSA) Data Protection Office. To exercise these rights, email privacy@umutuzorentals.com; we respond within the statutory timeframe.
8. Retention
Account and transaction data are retained while your account is active and for up to 24 months after closure, unless a longer period is required for tax, dispute-resolution, or fraud-prevention purposes. Marketing consents are retained until withdrawn.
9. Security
We use TLS in transit, encrypted storage for sensitive documents, role-based access controls, and audit logs. No online service is perfectly secure; we notify affected users of any breach in line with Law N° 058/2021.
10. Cookies and analytics
We use strictly necessary cookies to keep you signed in, and analytics cookies (with your consent) to understand aggregate usage. You can change your choice at any time from the cookie banner.
11. Changes
We may update this policy and will post the effective date below. Material changes are communicated by email or in-app notice.
Effective date: TODO — set on publication. Contact: privacy@umutuzorentals.com.