Edified Generation Rwanda Data Privacy Statement
- Introduction and Compliance Commitment
Edified Generation Rwanda (referred to as “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data. This Data Privacy Statement explains how we collect, use, and protect your personal data, and outlines your rights in compliance with Law N° 058/2021 of 13/10/2021 Relating to the Protection of Personal Data and Privacy (the DPP Law) of the Republic of Rwanda.
We are a certified Data Controller under the Rwandan DPP Law, meaning we determine the purposes and means of processing your personal data.
- Data Controller Details
Detail | Information |
Data Controller Name | Edified Generation Rwanda |
Registration number | 001/147/0424 |
Registered Address | KG 17 Ave, Kigali-Rwanda |
Contact Email | |
Data Protection Officer (DPO) Contact | Pierre UWIRINGIYIMANA Tel: 0788314864 |
DPO Email |
- Principles of Personal Data Processing
As a Data Controller, we adhere strictly to the fundamental principles of the DPP Law, ensuring your personal data is:
- Lawful, Fair, and Transparent:Processed lawfully, fairly, and in a transparent manner.
- Purpose-Limited:Collected for explicit, specified, and legitimate purposes and not further processed in a manner incompatible with those purposes.
- Data Minimization:Related to and not excessive for the purposes for which it is processed.
- Accurate:Accurate and, where necessary, kept up to date.
- Storage-Limited:Kept in a form which permits identification of data subjects for no longer than is necessary.
- Confidential and Secure:Processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
- Personal Data We Collect and Process
We process different categories of personal data depending on the context of your relationship with us (e.g., beneficiary, donor, employee, website user).
Category of Data | Examples of Data Collected | Primary Purpose for Processing | Lawful Basis for Processing (DPP Law) |
Identification Data | Name, national ID number, passport number, date of birth, photo. | Verification of identity for program enrollment, contracts, or employment. | Contractual Necessity and/or Legal Obligation. |
Contact Data | Residential address, phone number, email address. | Communication regarding our services, programs, or employment. | Consent and/or Legitimate Interest. |
Sensitive Data | Health status (e.g., for beneficiary support), socioeconomic status (e.g., UBUDEHE category). | Assessing eligibility for programs, providing required support services. | Explicit Consent and/or Vital Interest of the Data Subject. |
Financial Data | Bank account details (for salaries/scholarships), donation history. | Processing payments, managing payroll, and financial compliance. | Contractual Necessity and/or Legal Obligation. |
Digital/Technical Data | IP address, browser type, usage data (website/app analytics). | Maintaining website security, service improvement. | Legitimate Interest. |
- Your Rights as a Data Subject
As data subject, you have the following rights concerning your personal data:
Your Right | Description |
Right to be Informed | The right to be informed about the collection and use of your personal data, as provided in this statement. |
Right to Access | The right to request and obtain a copy of the personal data we hold about you. |
Right to Rectification | The right to have inaccurate or incomplete personal data about you corrected or updated without undue delay. |
Right to Erasure | The right to request the deletion of your personal data in certain circumstances (e.g., where the data is no longer necessary for the original purpose). |
Right to Object to Processing | The right to object to the processing of your personal data, including for direct marketing purposes. |
Right to Restrict Processing | The right to request the limitation of our processing of your personal data under certain conditions. |
Right to Data Portability | The right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller. |
Right to Designate an Heir | The right to designate a legal heir to your personal data upon your death. |
To exercise any of these rights, please submit a written request to our Data Protection Officer using the contact details provided in Section 2.
- Data Security and Retention
Security Measures
We have implemented appropriate technical and organisational measures to protect your personal data from accidental loss, damage, unauthorised access, alteration, or disclosure. These measures include encryption, access controls, staff training, secure physical storage and regular audits.
Retention
We will retain your personal data for no longer than is necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Our data retention schedule is determined by legal obligations and organizational policy.
- Data Sharing and Transfers
We may share your personal data with trusted third-party Data Processors (e.g., IT service providers, legal advisors, and donors) only to the extent necessary to fulfill our stated purposes. Any such sharing is governed by a written contract that obligates the Processor to protect the data to the standards required by the DPP Law.
8.Updates to this Statement
We reserve the right to update this Data Privacy Statement periodically to reflect changes in our data processing practices or legal requirements. We will notify you of any material changes by posting the new statement on our website and, where appropriate, through direct communication.
9.Contact and Complaints
If you have any questions, concerns, or complaints about this Data Privacy Statement or our data processing practices, please contact our Data Protection Officer at the email address provided in Section 2.
You also have the right to lodge a complaint directly with the Supervisory Authority (the National Cyber Security Authority – NCSA) if you believe your data protection rights have been violated.