Privacy Policy

We collect the following categories of information to operate, maintain, and improve our Service:

• Personal Information: Full name, email address, phone number, delivery address(es), and profile photo (if provided).
• Account Credentials: Encrypted password and authentication tokens.
• Payment Information: Mobile Money number (processed and stored securely by our PCI-compliant payment partners — we do not store your full mobile money PIN).
• Location Data: Real-time GPS coordinates when you use delivery tracking features (with your explicit consent).
• Device Information: Device model, operating system, unique device identifiers, app version, and push notification tokens.
• Usage Data: Pages viewed, searches performed, order history, interaction patterns, and session duration.

• Process and fulfil your delivery orders.
• Communicate order status, receipts, promotions, and service updates.
• Improve and personalise your experience on the Platform.
• Detect, prevent, and investigate fraud, abuse, or security incidents.
• Comply with legal obligations and enforce our Terms of Service.
• Train and improve our AI-powered features including product recommendations and search relevance.
• Conduct analytics and research to improve Platform performance and user satisfaction.

We do not sell your personal data. We may share information only in the following circumstances:

• With Vendors & Riders: Your name, delivery address, and phone number are shared with Vendors and Riders solely to fulfil your order.
• With Payment Processors: Transaction data is shared with our PCI-compliant payment partners (e.g. Flutterwave, Stripe) to process payments.
• With Service Providers: We use trusted third-party services for hosting, analytics, push notifications, and customer support.
• For Legal Compliance: We may disclose information if required by law, regulation, or valid legal process (e.g. court order or subpoena).
• Business Transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction.

• We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law.
• Active account data is retained for the duration of your account and for 24 months after account deletion or inactivity.
• Transaction records are retained for 5 years for tax and legal compliance purposes.
• You may request data deletion at any time by contacting support@ntwaza.com.

• We implement industry-standard security measures including: encryption of data in transit (TLS/SSL) and at rest (AES-256), role-based access controls for internal systems, regular security audits and vulnerability assessments, and secure, isolated database environments.
• While we take commercially reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal retention requirements).
• Portability: Request a machine-readable export of your data.
• Objection: Object to certain types of data processing (e.g. direct marketing).
• Withdraw Consent: Withdraw consent for data processing at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact support@ntwaza.com. We will respond within 30 days.

• We collect precise location data only when you actively use the app's delivery or tracking features, and only with your explicit permission.
• You can revoke location access at any time through your device settings.
• Location data is used solely for: providing accurate delivery estimates, enabling real-time order tracking, and optimising rider assignment and routing.

• Our website uses cookies and similar technologies to enhance your browsing experience, analyse site traffic, and personalise content.
• Essential cookies are required for the Platform to function and cannot be disabled.
• Analytics cookies help us understand usage patterns and improve our Service.
• You can manage cookie preferences through your browser settings.

Our Service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If we learn that a child under 13 has provided personal information, we will promptly delete it. If you believe a child has provided data to us, please contact support@ntwaza.com.

Your data may be processed in countries outside Rwanda where our servers and third-party service providers are located. In such cases, we ensure appropriate safeguards (e.g. Standard Contractual Clauses) are in place to protect your data.

• We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance.
• Material changes will be communicated via push notification, email, or prominent in-app notice at least 14 days before taking effect.
• Continued use of the Service after the effective date constitutes your acceptance of the updated policy.