TURIKUMWE PRIVACY POLICY

Effective Date: 17 June 2026 Last Updated: 17 June 2026

1. Who we are

Turikumwe is an online crowdfunding and fundraising platform operated by Astoria LTD, a private company incorporated in the Republic of Rwanda under Law N° 007/2021 of 05/02/2021 governing companies (RDB Company Code / TIN: 156457878), with its registered office at Runyonza Village, Nyagahinga Cell, Rusororo Sector, Gasabo District, Kigali City, Rwanda.

Astoria LTD is the data controller responsible for your personal data on the Turikumwe platform within the meaning of Rwanda's Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy (the "DPPL").

Astoria LTD is registered with the National Cyber Security Authority (NCSA) — Data Protection & Privacy Office as a data controller under the DPPL (Registration No.: [to be inserted upon issuance by NCSA]).

For the meaning of capitalised terms used here, see our Terms of Service.

2. What information we collect

We collect personal information you give us directly and information generated by your use of the Platform, including:

Account information — name, e-mail address, mobile telephone number, password, and profile photo.
Campaign-creator information — date of birth, gender (optional self-identification), province and district of residence, occupation, beneficiary details, and your acceptance of our Terms.
Identity verification (KYC) — government-issued ID details, a recent photograph, mobile-money account verification, and other documents required to comply with Rwandan anti-money-laundering and counter-terrorist-financing (AML/CFT) law.
Campaign content — the story, photographs, captions, fundraising goal, and any documents you upload.
Payment and donation records — donation amounts, donor name (unless you give anonymously), payment-provider references, and withdrawal destination details.
Technical information — IP address, device identifiers, browser type, language, pages viewed, and cookies as described in Section 9.

We practise data minimisation — we collect only what we need. Donors may give without creating an account, and identity documents are requested only from campaign creators who must be verified.

3. Why we use your information

We use your information to:

operate the Platform and your account;
display your campaign to donors and the public (only the parts you choose to publish);
process donations and withdrawals through our mobile-money and payment partners;
verify your identity and prevent fraud, money laundering, and the financing of terrorism;
comply with Applicable Law, including Rwandan AML/CFT law, the DPPL, and sanctions screening;
respond to lawful requests from regulators, courts, and law enforcement;
send you transactional notifications about your campaign and account;
secure and improve the Platform.

We rely on lawful bases including your consent, the performance of our contract with you, our legal obligations, and our legitimate interests in operating a safe Platform. Where we process the special category of health data (which may appear when a creator voluntarily describes a medical condition to substantiate a health-related campaign), we rely on your consent.

4. Who we share information with

We share information with:

Our payment partners — MTN Mobile Money, Airtel Money, and other licensed payment service providers and banks used to handle donations and withdrawals.
Our service providers — hosting, database, e-mail, fraud-prevention, and customer-support vendors acting under our instructions and bound by written data-processing agreements (see Section 5).
Our regulators and law enforcement — including the National Bank of Rwanda (BNR), the Financial Intelligence Centre (FIC), the National Cyber Security Authority (NCSA), the Rwanda Revenue Authority (RRA), the Rwanda Investigation Bureau (RIB), and the Rwanda Utilities Regulatory Authority (RURA), where required by law or where we reasonably believe disclosure is necessary to prevent fraud or other harm.
Donors and the public — the parts of your campaign you choose to publish (story, photos, captions, organiser name, and progress).

We do not sell your personal data.

5. International transfers

The Turikumwe application and its database are hosted by Netlify, Inc., and our transactional e-mail is delivered through Resend, both located in the United States of America. Your personal data is therefore stored and processed outside Rwanda.

We make these transfers under an authorization to store personal data outside Rwanda issued by the NCSA, and each provider is engaged under a written agreement incorporating a GDPR-aligned Data Processing Addendum, under which the provider processes data only on our documented instructions, maintains confidentiality, applies appropriate security, and assists with data-subject requests and breach notification. Our providers are independently certified (SOC 2 Type II and ISO 27001).

6. How long we keep it

We keep your information for as long as your account is active and for a reasonable period afterwards, in line with Rwandan AML/CFT record-keeping requirements (typically five (5) years), tax and accounting rules, and any pending investigations or legal claims. Verification documents and payout details are retained for the period required by applicable financial regulation and then securely deleted.

7. Your rights

Under the DPPL, you have rights to:

access the personal data we hold about you;
correct inaccurate data;
request deletion (subject to our legal retention obligations);
restrict or object to certain processing;
request a copy of your data in a portable format;
withdraw consent where we rely on it.

Because we retain full administrative control of the Platform and database, we can fulfil these requests regardless of where your data is physically stored. To exercise your rights, contact our Data Protection Officer at vbutera@turikumwerw.com. You may also lodge a complaint with the National Cyber Security Authority (NCSA) in Rwanda.

8. Security and breaches

We use technical and organisational measures to protect your information, including:

encryption of data in transit (TLS 1.2+) and AES-256-GCM encryption of sensitive fields such as payout details;
Argon2id hashing of passwords (we never store passwords in plaintext);
role-based access control and comprehensive audit logging;
a multi-approver workflow for high-value withdrawals;
rate limiting on sensitive endpoints, and encrypted backups.

If a personal-data breach occurs that meets the DPPL threshold, we will notify the NCSA within forty-eight (48) hours of becoming aware, and notify affected users where required.

9. Cookies

The Platform uses essential cookies to keep you signed in and to remember your preferences (such as language), and limited analytics cookies to understand how the Platform is used. A separate Cookie Policy will describe these in more detail.

10. Children

The Platform is not intended for users under eighteen (18). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact vbutera@turikumwerw.com and we will delete it.

11. Changes to this Policy

We will update this policy when our practices change. The "Effective Date" at the top of this page will reflect the most recent version. Material changes will be notified to you by e-mail or in-app message.

12. Contact us

Data Controller: Astoria LTD (RDB Company Code / TIN: 156457878)
Data Protection Officer: vbutera@turikumwerw.com
Telephone: +1 918 413 9217
Registered office: Runyonza Village, Nyagahinga Cell, Rusororo Sector, Gasabo District, Kigali City, Rwanda

Turikumwe — We Are Together.

Privacy Policy