Legal
Privacy Policy
How NIMUGIRE Business Ltd collects, uses, protects, and shares your personal data when you use MotoLink Rwanda — under Rwanda's Law No. 058/2021 on the Protection of Personal Data and Privacy.
Table of contents
1. Introduction
NIMUGIRE Business Ltd ("we", "us", "our") operates MotoLink Rwanda (motolinkrwanda.com and the MotoLink mobile apps). This policy explains what personal data we collect, why, how we protect it, and your rights under Rwanda's Law No. 058/2021 on the Protection of Personal Data and Privacy.
2. Who We Are (Data Controller)
- Company: NIMUGIRE Business Ltd
- Product: MotoLink Rwanda
- Website: motolinkrwanda.com
- Contact: privacy@motolinkrwanda.com
- Registered in Rwanda under the Rwanda Development Board (RDB)
3. Data We Collect
Riders
- Name and phone number (account creation)
- Pickup and drop-off locations (GPS coordinates and place names)
- Ride history (routes, fares, dates)
- Payment method and transaction references (we do not store full card numbers)
- Device push notification token
Drivers
- Name, phone number
- National ID number (encrypted at rest)
- Driver's license number (encrypted at rest)
- Vehicle plate number, make and model
- Real-time GPS location while online
- Earnings, payout history, wallet balance
- Documents uploaded during onboarding (ID photo, license photo)
- Device push notification token
All users
- App usage data (screens visited, errors) for debugging
- IP address and device type
4. Why We Process Your Data (Legal Basis)
- Ride booking and matching: contractual necessity
- Driver identity verification: legal obligation + contractual necessity
- Payment processing: contractual necessity
- Real-time GPS for dispatch and safety: contractual necessity + legitimate interest
- Push notifications: consent (you can withdraw at any time in device settings)
- Fraud prevention and platform safety: legitimate interest
5. Who We Share Your Data With
- Matched driver/rider: first name and vehicle plate only, for the duration of the ride
- PayPack (Kigali, Rwanda): payment processing
- Supabase Inc. (USA): database hosting and authentication — covered by a Data Processing Agreement
- Vercel Inc. (USA): application hosting — covered by a Data Processing Agreement
- RURA, RNP, BNR, or other Rwandan regulators: when legally required
We never sell your data to third parties.
6. Cross-Border Data Transfers
Your data is stored on servers in the United States operated by Supabase and Vercel. Both processors have signed Data Processing Agreements including standard contractual clauses. We have applied for cross-border transfer authorization from Rwanda's National Cyber Security Authority (NCSA) as required by Law No. 058/2021.
7. How Long We Keep Your Data
- Ride records and payment history: 5 years (tax and regulatory compliance)
- Driver identity documents: duration of driver relationship + 2 years
- GPS location data per ride: retained as part of the ride record (5 years)
- Push notification tokens: deleted when you uninstall the app or revoke permission
- Account data: deleted within 30 days of account deletion request
8. Your Rights
Under Law No. 058/2021 you have the right to:
- Access your personal data
- Correct inaccurate data
- Delete your data (subject to legal retention requirements)
- Withdraw consent (for consent-based processing)
- Object to processing based on legitimate interest
- Lodge a complaint with the NCSA Data Protection & Privacy Office (dpo.gov.rw)
To exercise any right, email privacy@motolinkrwanda.com. We respond within 30 days.
9. Data Security
- All data transmitted over HTTPS/TLS
- National ID and license numbers encrypted at rest
- Role-based access control — staff see only what they need
- Supabase Row-Level Security ensures users can only access their own data
- Admin actions logged in an audit trail
10. Children
MotoLink is not intended for users under 18. We do not knowingly collect data from minors.
11. Changes to This Policy
We will post updates on this page with a revised "Last Updated" date. Continued use of MotoLink after changes constitutes acceptance.