Privacy Policy

This Privacy Policy describes how TandPay handles your personal data in compliance with Law N° 058/2021 of 13/10/2021 on the Protection of Personal Data and Privacy of the Republic of Rwanda.

1. Who We Are (Data Controller)

tandpay LTD, trading as TandPay, is the data controller of your personal data. It is a Private Company Limited by Shares registered in Rwanda on 2 February 2026 under TIN 155683751.

• Registered office: 1 KN 78 Street, Imena Village, Kiyovu Cell, Nyarugenge Sector, Nyarugenge District, City of Kigali, Rwanda
• TIN: 155683751
• Privacy contact: support@tandpay.com · +250 787 609 066

If you have any question about how we handle your data, or wish to exercise your rights under Rwandan Law 058/2021, please email support@tandpay.com.

2. Data We Collect

We collect only the data we need to operate the TandPay service.

a. Seller data (for registered Seller accounts)

• Mobile phone number (used as login identifier)
• Personal Identification Number (PIN), stored only as a bcrypt hash — never in plaintext
• Full name
• Business name
• Business location / address
• Mobile money (MoMo) phone number for receiving payouts
• Rwandan National ID (number and, when identity verification is active, scanned image)
• Profile photo and a selfie for automated identity verification (when enabled)
• Bio or business description

b. Buyer data

• Mobile phone number (used to identify you and send payment notifications)
• MoMo phone number used to pay
• Delivery information you provide for an order (where required)

c. Transaction data

• Order details, amounts, fees, status
• Delivery codes (stored as cryptographic hashes, never readable by staff)
• Payment-provider reference IDs from pawaPay, QuidexPlus Rwanda Limited and the relevant Mobile Money network
• Dispute messages and evidence you submit

d. Device and technical data

• IP address
• Device identifier / fingerprint (used to remember trusted devices and reduce OTP prompts)
• User agent (browser or app version)
• Approximate geolocation derived from IP

e. Support data

• Emails and messages you send to support@tandpay.com
• Any attachments you include

3. Why We Collect It (Legal Bases Under Law 058/2021)

We only process your data when one of the following legal bases applies (Article 8 of Law 058/2021):

1. Performance of a contract — we need to process your data to operate the TandPay service you have requested (process a protected payment, confirm delivery and resolve support matters).
2. Legal obligation — we are required to retain transaction records and KYC data to meet BNR financial-records requirements, AML/CFT obligations, tax reporting, and any lawful regulatory order.
3. Legitimate interest — we process limited data (device fingerprints, rate-limit logs, AML flags) to prevent fraud and keep the service secure. We have assessed that this interest does not override your privacy rights.
4. Consent — account creation or a support conversation is not treated as consent to marketing. If TandPay offers marketing messages, they require a separate opt-in that can be withdrawn through the support channels below.

4. Who We Share It With (Sub-processors)

We share your data with a limited set of third-party service providers, each of whom is contractually obligated to handle your data securely and only for the purpose we specify. Our current sub-processors are:

We may also share your data:

• With regulators (BNR, NCSA, Rwanda Revenue Authority) when required by law
• With law enforcement in response to a valid legal order
• With successors in the event of a merger, acquisition, or corporate reorganisation

We will not sell your data to advertisers or data brokers.

5. Where Your Data Is Stored

Most of your data is stored on servers operated by Supabase and AWS in the European Union (AWS region eu-west-1, Ireland). This means your data is transferred from Rwanda to the European Union. By using TandPay, you acknowledge and consent to this international transfer.

We use sub-processors who provide adequate data-protection safeguards. The European Union has data-protection standards that meet or exceed those required by Rwandan Law 058/2021. Contracts with our sub-processors include standard data-protection clauses.

6. How Long We Keep Your Data

TandPay keeps personal data only as long as necessary for the purpose for which it was collected and for applicable legal obligations. Retention depends on the type of record and whether an account, transaction, dispute, fraud review, tax matter, audit, regulatory duty or legal claim remains active.

When data is no longer needed, we delete or anonymize it. If a deletion request cannot cover a record that must be retained, access to that record is restricted to the applicable legal, audit, dispute, fraud or regulatory purpose and it is removed or anonymized when that obligation ends.

WhatsApp and messaging

When you contact TandPay or receive a requested message through WhatsApp, we may process your WhatsApp or phone number, name and profile details made available by the service, message content, attachments you voluntarily submit, timestamps, and delivery, read and status events.

• Purposes: requested account or transaction notifications, customer support, security and fraud prevention, and service administration. Marketing messages are sent only where a person has separately opted in.
• Provider: Meta Platforms and WhatsApp provide the messaging channel and process data under their own terms and privacy policy. Meta and WhatsApp are not TandPay's payment processor.
• Consent and choice: starting a support conversation or creating an account is not consent to marketing. TandPay does not currently send WhatsApp marketing based solely on those actions. Any future marketing use requires a separate opt-in.

To stop marketing messages, email support@tandpay.com or send an opt-out request on WhatsApp. The current automated STOP command cancels an active bot flow; it does not yet create a persistent marketing preference. A support request is therefore the implemented opt-out method. Transactional and service messages are separate from marketing and may still be sent when requested or needed for an active transaction, account security or support case.

You can request a person through WhatsApp or contact support@tandpay.com / +250 787 609 066. See the public Data Deletion page to request removal of TandPay or WhatsApp-related data.

Do not send full PINs, passwords, complete payment credentials or full identity-document numbers through WhatsApp.

7. Your Rights Under Rwandan Law 058/2021

Articles 13 to 23 of Law 058/2021 give you rights over your personal data. You can exercise them by emailing support@tandpay.com or using the Data Deletion page.

1. Right of access (Art. 13) — You can ask for a copy of the personal data we hold about you.
2. Right to rectification (Art. 16) — You can ask us to correct inaccurate or incomplete data.
3. Right to erasure (Art. 17) — You can ask us to delete your data. Where a record must be retained for an applicable legal obligation or legal claim, we restrict processing to that purpose and delete or anonymize it when the obligation ends.
4. Right to restriction of processing (Art. 18) — You can ask us to pause processing in specific circumstances (e.g., while a correction is being investigated).
5. Right to data portability (Art. 19) — You can ask for your data in a structured, machine-readable format.
6. Right to object (Art. 20) — You can object to processing based on our legitimate interest.
7. Right not to be subject to automated decision-making (Art. 21) — We do not take decisions affecting you based solely on automated processing. All dispute resolutions are reviewed by a human administrator, not only by an algorithm.
8. Right to withdraw consent — Where processing is based on your consent (e.g., marketing), you can withdraw it at any time.
9. Right to lodge a complaint — You have the right to complain to the National Cyber Security Authority (NCSA) as Rwanda's data-protection supervisory authority if you believe we have breached your rights.

8. How We Protect Your Data (Security)

We take the following measures to keep your data secure:

• Encryption in transit — All communication with TandPay uses TLS (HTTPS).
• Encryption at rest — Database and backups are encrypted at rest at the infrastructure level.
• Hashed credentials — PINs are stored as bcrypt hashes, never in plaintext. Delivery codes are stored as SHA-256 hashes.
• Signed webhooks — Payment provider callbacks are verified using HMAC signatures.
• Row-level access control — Database policies restrict users to reading only their own data.
• Rate limiting — Atomic, persistent rate limits protect against brute-force and enumeration attacks.
• Audit logging — Every payment state change and administrative action is recorded in an append-only audit log.
• Monitoring — Automated AML rules (velocity, volume, repeated-pair, failed-attempt) flag suspicious activity.
• Backups — Encrypted backups support service recovery and are retained only as long as necessary for recovery and applicable legal obligations.

No system is 100% secure. If we discover a personal-data breach that is likely to affect your rights, we will notify you and the NCSA in accordance with Article 27 of Law 058/2021.

9. Cookies and Similar Technologies

TandPay's website uses essential cookies only:

• Session cookie — keeps you logged in while you use the site.
• CSRF-protection cookie — protects against cross-site request forgery attacks.

We do not use Google Analytics, Meta Pixel, TikTok Pixel, or other third-party tracking or advertising cookies. We do not sell browsing data.

10. Children

TandPay is not directed at children. You must be at least eighteen (18) years old to use the service. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account or provided personal data to us, please contact support@tandpay.com and we will delete it promptly.

11. International Data Transfers

Some service providers may process data outside Rwanda, including in the European Union or the United States. Where an international transfer occurs, TandPay uses applicable contractual, technical and organizational safeguards and limits sharing to what is needed for the stated service.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will provide reasonable notice of material changes through an appropriate channel, such as:

• In-app notice
• SMS to your registered phone number
• An updated "Last Updated" date at the top of this document

The current version and its last-updated date remain available on this public page.

13. Contact

For any privacy-related question, request, or complaint:

• Customer support and WhatsApp: support@tandpay.com · +250 787 609 066
• Business and legal: bahati@tandpay.com · +250 781 836 513
• Post: tandpay LTD, 1 KN 78 Street, Imena Village, Kiyovu Cell, Nyarugenge Sector, Nyarugenge District, City of Kigali, Rwanda

You may also contact the National Cyber Security Authority (NCSA) of Rwanda if you wish to lodge a complaint with the supervisory authority.