Privacy Policy

2.1 Categories of Data Subjects

• Couples: Individuals planning their weddings using our platform
• Vendors: Wedding service providers registered on our platform
• Website Visitors: Anyone browsing our website
• Employees: Staff members of Andiza Co. Limited
• Prospects: Potential customers and business partners

2.2 Types of Personal Data

3.1 Service Delivery

• Creating and managing user accounts
• Processing wedding bookings and vendor services
• Facilitating communication between couples and vendors
• Managing venue tours and quote requests
• Providing wedding planning tools (checklist, budget tracker, guest list)
• Sending booking confirmations and status updates

3.2 Business Operations

• Processing payments and managing invoices
• Vendor verification and quality control
• Customer support and dispute resolution
• Platform maintenance and improvement
• Analytics and performance monitoring

3.3 Legal and Compliance

• Compliance with Rwanda data protection laws
• Know Your Customer (KYC) verification
• Fraud prevention and security
• Responding to legal requests and court orders
• Enforcing our terms and conditions

3.4 Marketing and Communication

• Sending promotional emails and newsletters (with consent)
• Personalized service recommendations
• Market research and surveys
• Platform updates and announcements

3.5 Human Resources

• Employee recruitment and onboarding
• Payroll and benefits administration
• Performance management
• Training and development

4.1 Consent (Article 6)

You have given clear, informed, and voluntary consent for us to process your personal data for specific purposes. You may withdraw your consent at any time.

Examples: Marketing communications, optional profile features, newsletter subscriptions

4.2 Contractual Necessity

Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into a contract.

Examples: Creating your account, processing bookings, delivering services, payment processing

4.3 Legal Obligation

Processing is necessary for compliance with legal obligations to which Andiza is subject.

Examples: Tax reporting, KYC verification, responding to lawful requests from authorities

4.4 Legitimate Interest

Processing is necessary for the legitimate interests pursued by Andiza or a third party, except where such interests are overridden by your fundamental rights and freedoms.

Examples: Fraud prevention, platform security, business analytics, improving user experience

5.1 Within Andiza

Your data may be accessed by authorized employees and contractors who need it to perform their duties, subject to strict confidentiality obligations.

5.2 Service Providers and Processors

We engage third-party service providers to perform functions on our behalf, including:

• Cloud hosting and data storage providers
• Payment processors (e.g., Stripe, mobile money providers)
• Email service providers
• Analytics and monitoring tools
• Customer support platforms

All processors are bound by data processing agreements in accordance with Articles 48 and 49 of Law No 058/2021.

5.3 Business Partners

We may share data with vendors on our platform to facilitate bookings and service delivery. Vendors only receive information necessary to fulfill their services.

5.4 Regulatory and Legal Authorities

We may disclose your data to:

• National Cyber Security Authority (NCSA)
• Rwanda Revenue Authority (RRA)
• Law enforcement agencies
• Courts and tribunals
• Other regulatory bodies as required by law

5.5 Professional Advisors

We may share data with lawyers, auditors, accountants, and other professional advisors who assist us in running our business.

6.1 Right of Access

You have the right to obtain confirmation as to whether your personal data is being processed, and if so, to access that data and receive information about how it is being used.

6.2 Right to Rectification

You have the right to request correction of inaccurate personal data and to have incomplete data completed.

6.3 Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, or when you withdraw consent.

6.4 Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain situations, such as when you contest the accuracy of the data or object to processing.

6.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

6.6 Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

6.7 Right to Withdraw Consent (Article 8)

Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

6.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the National Cyber Security Authority (NCSA) if you believe your data protection rights have been violated.

7.1 Technical Security Measures

• Encryption of data in transit (SSL/TLS) and at rest
• Secure authentication and password hashing (bcrypt)
• Regular security updates and patches
• Firewall and intrusion detection systems
• Secure backup and disaster recovery procedures
• Regular security audits and vulnerability assessments

7.2 Organizational Security Measures

• Access controls and role-based permissions
• Employee training on data protection
• Confidentiality agreements with staff and contractors
• Data protection impact assessments (Article 38)
• Incident response and data breach procedures (Articles 43-45)
• Regular review and update of security policies

7.3 Data Breach Response (Articles 43, 44, and 45)

In the event of a personal data breach, we will:

• Notify the NCSA within 72 hours of becoming aware of the breach (Article 43)
• Maintain a register of all data breaches (Article 44)
• Notify affected data subjects without undue delay if the breach poses a high risk to their rights and freedoms (Article 45)
• Take immediate steps to contain and remediate the breach
• Conduct a thorough investigation and implement preventive measures

8.1 Retention Periods

8.2 Secure Deletion

When personal data is no longer needed, we securely delete or anonymize it using industry-standard methods to prevent unauthorized access or recovery.

8.3 Retention Schedule Review

We regularly review our data retention schedule to ensure compliance with legal requirements and best practices. Our full Data Retention Schedule is available upon request from our DPO.

9.1 Current Status

Currently, all personal data processing and storage occurs within Rwanda using local infrastructure and service providers. We do not transfer personal data outside Rwanda.

9.2 Future Transfers

If we need to transfer personal data outside Rwanda in the future, we will:

• Ensure the receiving country has adequate data protection laws
• Implement appropriate safeguards such as Standard Contractual Clauses
• Obtain authorization from the NCSA where required
• Notify affected data subjects and obtain consent where necessary

9.3 Third-Party Services

Some of our service providers (e.g., cloud hosting, email services) may have servers located outside Rwanda. We ensure these providers comply with Rwanda data protection standards through contractual agreements and regular audits.

10.1 Data Subject Consent (Articles 6 and 7)

When you create an account or use our services, you provide consent for us to process your personal data. Your consent is:

• Freely given: You have a genuine choice and control
• Specific: Separate consent for different processing purposes
• Informed: You understand what you're consenting to
• Unambiguous: Clear affirmative action required

10.2 Consent Withdrawal (Article 8)

You have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal. To withdraw consent:

• Use the unsubscribe link in marketing emails
• Update your preferences in account settings
• Submit a Consent Withdrawal Form
• Contact our DPO at [email protected]

10.3 Parental Consent (Articles 9 and 8)

Our services are intended for individuals aged 18 and above. If you are under 18, you must have parental or guardian consent to use our platform. Parents/guardians can:

• Provide consent for minors to use our services
• Access and manage their child's data
• Request deletion of their child's data
• Withdraw consent at any time

10.4 Data Subject Rights Request Forms

Use these forms to exercise your data protection rights:

13.1 Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data protection practices:

13.2 Policy Updates

We may update this Privacy Policy periodically. Material changes will be communicated via email and website notice. We encourage regular review of this policy.