Privacy Policy
Your privacy is important to us. This Privacy Policy explains how Tunga Market collects, uses, and protects your personal information when you use our platform.
Our Privacy Commitments
Data Minimization
We only collect information necessary to provide and improve our services.
User Control
You have full control over your personal data and privacy settings.
Transparency
Clear, accessible language about how we handle your information.
Table of Contents
1. Introduction & Scope
Learn how we handle your personal information in line with Rwandan privacy laws.
Purpose of This Policy
This Privacy Policy explains how Tunga Market (“we,” “our,” or “the Company”) collects, uses, discloses, and protects the personal data of individuals (“you,” “users,” or “customers”) who interact with our platform, services, and related digital products.
It is designed to comply with Law No. 058/2021 of the Republic of Rwanda relating to the protection of personal data and privacy, and other applicable international privacy standards.
Scope of Application
- Applies to all data collected through our website, and customer interactions.
- Covers both personal and non-personal information gathered from users, customers, and merchants.
- Includes any third-party integrations, payment gateways, and analytics tools used in our platform.
Acceptance of Policy
By accessing or using our platform, you acknowledge that you have read, understood, and agreed to this Privacy Policy and the Terms & Conditions. If you do not agree, please discontinue use of our services.
Policy Updates
We may update this Privacy Policy periodically to reflect changes in our practices or legal obligations. When updates occur, we will notify users via in-app notification, email, or website banner. The latest version will always be accessible on this page.
2. Information We Collect
We collect data necessary to deliver our services effectively, securely, and in compliance with Rwandan privacy laws.
Account Information
- Full name, email, phone number, and login credentials (encrypted).
- Business or seller registration data (company name, TIN, and verification documents).
- Security preferences, two-factor authentication, and password recovery settings.
Transaction & Payment Data
- Order history, invoices, and payment method details (processed securely via payment gateways).
- Delivery and shipping details, including address and contact recipient.
Behavioral & Technical Data
- Browsing activity, clicks, searches, and session duration on our platform.
- Device type, IP address, browser version, and operating system for analytics and security.
Communication & Support Data
- Messages sent to customer support or live chat, including attachments or screenshots.
- Survey responses, product feedback, and review submissions.
3. Lawful Basis for Processing
We process your personal data only when we have a lawful reason, as required by applicable data protection laws.
- Consent: You provide explicit consent to process your data for specific purposes, such as marketing communications or personalization of your shopping experience.
- Contractual Necessity: Processing is necessary to fulfill a contract with you, including order processing, payment, and delivery.
- Legal Obligation: Processing is necessary to comply with laws and regulations in Rwanda, such as tax reporting or consumer protection.
- Legitimate Interests: We may process your data for legitimate business interests, such as improving our platform, preventing fraud, or conducting analytics, provided it does not override your rights.
- Vital Interests: In rare cases, we may process data to protect your life or the life of another individual.
By using our platform, you acknowledge that we may rely on any of these lawful bases to process your information for the purposes described in this Privacy Policy.
5. Data Retention & Storage
We retain your personal data only as long as necessary for business and legal purposes, and store it securely to protect your privacy.
- Retention Period: Personal data is retained only for as long as necessary to provide services, fulfill legal obligations, resolve disputes, or enforce our agreements. Specific retention periods may vary by data type.
- Inactive Accounts: Data from inactive or closed accounts may be anonymized or deleted after a set period, usually 12-24 months, unless required for legal or regulatory reasons.
- Storage Locations: Data may be stored on secure servers located in Rwanda or in other countries that maintain adequate data protection standards.
- Data Security: We implement administrative, technical, and physical safeguards to protect your data from unauthorized access, alteration, disclosure, or destruction.
- Backup & Recovery: We maintain secure backups to prevent data loss and enable recovery in case of incidents, while ensuring compliance with privacy regulations.
By continuing to use our platform, you consent to the collection, storage, and retention of your personal data as described in this section and elsewhere in our Privacy Policy.
6. Data Sharing & Disclosure
We only share your personal data when necessary, secure, and legally justified.
Sharing with Service Providers
We may share your personal data with trusted third-party service providers who assist us in:
- Processing payments and orders through payment gateways.
- Delivering products and managing logistics.
- Providing analytics, marketing, or IT support services.
Legal and Regulatory Compliance
We may disclose your personal data if required to do so by law, regulation, or governmental request, or if we believe disclosure is necessary to:
- Comply with legal obligations or respond to lawful requests from authorities.
- Enforce our Terms & Conditions or protect our rights, property, or safety.
- Investigate fraud, security breaches, or other illegal activities.
Affiliates & Business Partners
Your data may be shared with our affiliates or business partners solely for legitimate business purposes, such as:
- Improving services or delivering joint offerings.
- Sending communications or marketing only with your consent.
- Conducting analytics and research to enhance user experience.
Principles of Data Sharing
- We share only the minimum data necessary to perform the service.
- We ensure all recipients implement adequate data protection measures.
- We never sell your personal data to third parties for commercial purposes without your consent.
7. Your Rights & Choices
You have full control over your personal data and privacy settings, in line with Rwandan law.
Access Your Data
Request a full copy of personal information that we hold about you, including account, transaction, and interaction data.
Correct Your Data
Update or correct any inaccurate or incomplete personal information to ensure it is accurate and up to date.
Edit ProfileDelete Your Data
Exercise your “right to be forgotten” by requesting deletion of personal data, subject to legal or contractual obligations.
Request DeletionExport Your Data
Download your personal data in a structured, machine-readable format for portability and transfer.
8. Security Measures
We prioritize safeguarding your personal information using technical and organizational security measures in line with Rwanda’s data protection standards.
Technical Safeguards
- Use of SSL/TLS encryption to secure data transmission between your device and our servers.
- Regular security audits, vulnerability assessments, and system monitoring to detect unauthorized access.
- Secure password hashing and encryption of sensitive user information in databases.
- Implementation of two-factor authentication (2FA) for sensitive operations where applicable.
Organizational Measures
Our internal policies are designed to restrict access to personal data only to authorized personnel who require it for legitimate business functions. Employees receive regular data protection and cybersecurity training.
Data Breach Response
In the unlikely event of a data breach, we will take immediate action to mitigate the risk, notify affected individuals, and inform the National Cyber Security Authority (NCSA) and the Data Protection Office as required under Law No. 058/2021.
User Responsibility
While we employ strict measures to protect your information, you are responsible for maintaining the confidentiality of your login credentials and ensuring secure use of your account.
10. International Data Transfers
Learn how we securely handle your data when it is transferred across international borders.
Overview
As part of our global operations, we may transfer and store your personal data outside Rwanda. These transfers occur only when necessary for service provision, cloud hosting, or partnerships with trusted third-party service providers located in other jurisdictions.
Legal Safeguards
When transferring data internationally, we ensure that adequate protection measures are in place consistent with Law No. 058/2021 of the Republic of Rwanda and other applicable international privacy standards. These include:
- Using countries recognized as having adequate data protection frameworks.
- Implementing contractual clauses approved by competent data protection authorities.
- Applying technical and organizational safeguards to protect data confidentiality and integrity.
- Requiring our third-party partners to comply with equivalent privacy and security standards.
Cloud & Third-Party Providers
Your data may be processed or stored on servers operated by international cloud providers (such as AWS, Google Cloud, or Microsoft Azure) that maintain data centers across multiple regions. All transfers to these providers are governed by strict data processing agreements.
Your Rights Regarding Transfers
You have the right to be informed when your data is transferred internationally and to request details on the safeguards applied to such transfers. You may also object to certain transfers where allowed by law.
11. Children’s Privacy
We take the privacy and safety of children seriously and comply with all applicable child protection laws.
Policy Overview
Tunga Market does not knowingly collect or process personal data from individuals under the age of 16. Our services are intended for users who can lawfully enter into binding contracts under the laws of the Republic of Rwanda.
Parental Consent
If we become aware that a child under 16 has provided personal information without verified parental consent, we will take immediate steps to delete such information from our records and systems.
Parents or guardians who believe their child has submitted personal data may contact us to review, correct, or request deletion of that information.
Educational & Safety Commitment
We encourage parents and guardians to educate children about responsible online behavior and the importance of safeguarding personal information. Tunga Market promotes a safe, family-friendly digital environment that aligns with Rwandan child protection guidelines.
Contact for Child Privacy Concerns
If you believe we may have collected data from a child under 16, please reach out immediately. We will act promptly to address and resolve the issue in line with our compliance obligations.
12. Changes to This Policy
Transparency is our priority — we will always inform you when updates are made to this Privacy Policy.
Policy Updates and Notifications
Tunga Market reserves the right to revise or update this Privacy Policy from time to time to reflect changes in legal requirements, technological advancements, or our operational practices.
When we make significant updates, we will notify users through prominent notices on our website, email notifications, or other appropriate means before the changes take effect.
Effective Date
The most recent version of this Privacy Policy will always be available on this page, with the date of the latest revision clearly indicated at the top. Continued use of our services after such updates constitutes acceptance of the revised terms.
User Responsibility
We encourage users to review this Privacy Policy periodically to stay informed about how Tunga Market protects personal data and ensures compliance with Rwanda’s Law No. 058/2021 of 13/10/2021 on the Protection of Personal Data and Privacy.
13. Contact Information
Have questions about your privacy or need assistance with your data rights? We’re here to help.
Privacy Officer
For privacy-related questions, access requests, or to exercise your rights under Rwanda’s Law No. 058/2021 on Data Protection and Privacy.
Email: privacy@tungamarket.com
Response Time: Within 48 hours
Office Hours: Monday – Friday, 8:00 AM – 5:00 PM Kigali (GMT+2)
Legal Department
For legal correspondence, compliance inquiries, or formal notices regarding this Privacy Policy.
Address: Tunga Market - Kigali, Rwanda
Email: legal@tungamarket.com
Attention: Legal & Compliance Team
You may also reach out to our general support channels for non-legal or technical inquiries: