Privacy Policy

1. Introduction

Smart Ikimina ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our AI-powered community savings and loans platform, including our website, mobile application, and related services (collectively, the "Platform").

By using Smart Ikimina, you consent to the data practices described in this policy. If you do not agree with any part of this policy, please do not use the Platform.

2. Information We Collect

A. Information You Provide Directly

• Registration Data: Full name, phone number, email address, date of birth, government-issued ID number (for Group Administrators and Minecofin officials), home address, and village/sector details.
• Financial Information: Mobile money account details (MTN or Airtel), transaction history, contribution records, loan applications, repayment history, penalty records, and dividend payments.
• Group Data: Meeting minutes, attendance logs, voting records, expense reports, group bylaws, and internal resolutions uploaded by Group Administrators.
• Communications: Messages sent to support, chat inquiries, dispute filings, and feedback submissions.

B. Information Collected Automatically

• Usage Data: IP address, device type and model, operating system, browser type, access times, pages viewed, features used, and navigation paths.
• Transaction Logs: Timestamps of all contributions, loan requests, repayments, penalty applications, and account changes.
• Location Data: Approximate geographic location derived from IP address (for fraud detection and regulatory compliance).
• AI Interaction Logs: Anonymized chatbot conversations and AI recommendation interactions (used to improve model accuracy).

C. Information from Third Parties

• Mobile Money Providers (MTN, Airtel): Payment verification, transaction status, and account confirmation data.
• Financial Institutions: Credit history (if you choose to link external accounts), bank account details for larger transactions.
• Government Databases: Identity verification (where required for Minecofin reporting or anti-fraud compliance).

3. How We Use Your Information

We use your information for the following legitimate purposes:

4. Legal Basis for Processing

Under Rwandan data protection law and (where applicable) GDPR, we rely on the following legal bases to process your personal data:

• Contract Performance: Processing necessary to fulfill our agreement with you, including managing contributions, loans, and dividends.
• Legal Obligation: Processing required to comply with financial regulations, anti-money laundering laws, and Minecofin reporting requirements.
• Legitimate Interests: Processing for fraud prevention, platform security, AI model training, and business analytics, where such interests are not overridden by your privacy rights.
• Consent: Processing for optional marketing communications, personalized AI recommendations (where consent is required), and non-essential cookies.

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

5. Data Sharing and Disclosure

We do not sell your personal data. We may share your information in the following circumstances:

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law.

• Active Accounts: Data retained for the duration of your membership plus 3 additional years for financial audit purposes and potential dispute resolution.
• Terminated Accounts: Personal data is anonymized or deleted within 90 days of account closure, except:
  • Transaction records required by financial regulations (retained for 7 years)
  • Loan records with outstanding balances (retained until fully repaid plus 3 years)
  • Dispute-related data (retained until resolution plus 2 years)
• AI Chatbot Logs: Anonymized after 30 days; raw logs deleted.
• Marketing Data: Retained until you unsubscribe or withdraw consent.

7. Data Security

We implement robust technical and organizational security measures to protect your data:

• Encryption: Data encrypted in transit using TLS 1.3 (or higher) and at rest using AES-256 encryption.
• Access Controls: Role-based access control (RBAC) ensures Minecofin, Group Admins, and Members see only authorized data.
• Authentication: Multi-factor authentication (MFA) available for sensitive roles (Minecofin, Group Admins).
• Monitoring: Real-time intrusion detection, fraud detection algorithms, and regular security audits.
• Backups: Daily encrypted backups stored in geographically separate, secure facilities with 30-day retention.
• Staff Training: All employees undergo mandatory data protection and security awareness training.

8. Your Rights

Under Rwandan law and (where applicable) the GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, contact our Data Protection Officer at dpo@smartikimina.rw. We will respond within 30 days (extendable by 30 days for complex requests). Verification of identity may be required.

You also have the right to lodge a complaint with the National Cyber Security Authority (NCSA) of Rwanda if you believe your data protection rights have been violated.

9. Children's Privacy

Smart Ikimina is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately. Upon verification, we will delete such information from our systems.

10. International Data Transfers

Your personal data is primarily stored on servers located in Rwanda (Rwanda Cloud infrastructure) or the European Economic Area (EEA) depending on service provider locations. When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by relevant data protection authorities
• Adequacy decisions where applicable (EEA transfers only)
• Data processing agreements requiring equivalent protection standards

For transfers to countries without adequate data protection laws, we rely on your explicit consent or the necessity of the transfer for contract performance.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience:

• Essential Cookies: Required for authentication, security, and Platform functionality. Cannot be disabled.
• Analytics Cookies: Help us understand how users interact with the Platform (e.g., Google Analytics, self-hosted analytics).
• Preference Cookies: Remember your settings and preferences.
• AI Training Cookies: Collect anonymized interaction data to improve our AI models (optional).

You can manage cookie preferences via your browser settings or our cookie consent banner. Disabling essential cookies may prevent Platform access.

12. Third-Party Links

The Platform may contain links to external websites or services (e.g., mobile money portals, bank integration pages). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. We will notify users of material changes via:

• Email to your registered email address (30 days' notice for significant changes)
• Platform notification upon login
• Updating the "Last Updated" date at the top of this document

Your continued use of the Platform after changes become effective constitutes your acknowledgment of the modified Privacy Policy. For significant changes, we may request explicit consent where required by law.

14. Contact Information

For privacy-related questions, to exercise your rights, or to report a data breach, please contact our Data Protection Officer (DPO):