[DRAFT — pending legal review] This page has not been reviewed by a qualified lawyer. It is working copy for the Kivu Listing team and is not yet binding on anyone.
What we collect, why we collect it, how long we keep it, and the rights you have over it under Rwandan law.
The data controller is Kivu Listing, a subsidiary of Kivu MS LLC.
[REGISTERED ADDRESS — TO BE CONFIRMED]
Data protection officer: [DPO NAME — TO BE APPOINTED], [DPO EMAIL — TO BE CONFIRMED].
This notice is written to meet Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy.
| Data | Why | Lawful basis |
|---|---|---|
| Account: email or phone, name, password hash, language | To create and secure your account and sign you in | Performance of a contract |
| Listing content: title, description, price, photographs | To publish your advert | Performance of a contract |
| Exact location pin and UPI (land parcel number) | To verify a property against its title before publication | Legitimate interest — preventing fraud |
| Enquiries you send a seller: name, phone or email, message | To pass your enquiry to that seller | Legitimate interest — the purpose you gave it for |
| Reports about a listing, including your IP address | To review abuse reports and prevent report spam | Legitimate interest — platform safety |
| Payment records: amount, plan, payer name from the provider | To take payment, issue receipts, and meet accounting duties | Contract, and legal obligation |
| Technical: IP address, request logs, rate-limit counters | To keep the service available and resist abuse | Legitimate interest — security |
We do not sell your personal data, and we do not use it for advertising by third parties.
A published listing is public. Your village is shown, but the exact map pin is never published — buyers see an approximate point offset by roughly 150 metres. Your UPI number is never shown to anyone but our moderators. Your phone number appears only if you chose to display it in your contact preferences.
Our application and database run on Render, and photographs and documents are stored on Cloudflare R2. Both process data on servers outside Rwanda, which means your personal data is transferred and stored cross-border.
Where Law N° 058/2021 requires authorisation or an adequate-safeguards mechanism for such transfers, we rely on [TRANSFER MECHANISM — TO BE CONFIRMED WITH COUNSEL].
Under Law N° 058/2021 you may ask us to:
To exercise any of these, contact [DPO EMAIL — TO BE CONFIRMED]. We will respond within the period the law allows. Exercising a right is free, and we will not treat you differently for it.
If you are unhappy with how we handle your data, you may complain to the supervisory authority: the National Cyber Security Authority (NCSA) of Rwanda, [NCSA CONTACT — TO BE CONFIRMED]. You may complain to them whether or not you have raised it with us first.
We set a small number of strictly necessary cookies: two to keep you signed in, and none for advertising. We do not run third-party analytics or advertising trackers. [COOKIE LIST — TO BE CONFIRMED BEFORE LAUNCH]
We will update this notice as the service changes, and announce material changes on the site. See also our terms of use.
Last updated: [DATE — ON PUBLICATION]