1. Controller
UMUGINA (Kigali, Rwanda) is the data controller for the marketplace. Privacy contact: privacy@umugina.com.
2. Data we collect
Depending on your role, we may process: name, email, phone, account credentials, business profile and verification documents, product listings and media, order and payment metadata (including product name snapshots on order lines), attribution / referral codes, content reports, device and usage logs, and support messages. Payment card or mobile-money credentials for online providers are handled by the payment provider, not stored as full secrets by UMUGINA.
3. Why we process data
We process data to create accounts, run checkout and fulfilment, calculate commissions and platform fees, prevent fraud and abuse, review verification and reports, meet legal obligations, and improve the product. Legal bases include contract performance, legitimate interests in a secure marketplace, and consent where required (for example optional marketing).
4. Sharing
We share data with businesses and agents as needed to fulfil attributed orders; with payment, hosting, email, and analytics processors under contract; and with authorities when required by Rwandan law. Verification documents are accessible to platform admins for trust review and are not published on public shop pages. We do not sell personal data.
5. Retention and security
We retain account and transaction records for as long as needed for operations, dispute handling, and statutory retention. We use access controls, encryption in transit, rate limiting, and monitoring. No method of transmission is perfectly secure; report incidents to privacy@umugina.com.
Product listings: after a seller requests removal, a listing may remain publicly visible for 3 days with new orders disabled, then is hidden. We may keep listing data, media, and related audit records for up to 30 days (or longer if needed for orders, reports, disputes, or legal holds) before deletion or anonymisation. Order line snapshots (such as product name at purchase) may be kept with the order even after a listing is purged.
Accounts and businesses: self-serve closure uses an approximately 30-day cooling-off window before the account or shop is closed and public profile details may be removed. Limited finance, order, commission, and audit records may be retained afterward as required for legitimate interests and legal compliance.
6. Your rights
Subject to Law Nº 058/2021, you may request access, correction, deletion, restriction, or objection, and you may lodge a complaint with the competent authority in Rwanda. Use privacy@umugina.com to exercise these rights. Deletion requests may be limited where we must keep data for active orders, disputes, fraud prevention, or legal obligations.
See also our Terms of Service and FAQ.